andre@0: /* This Source Code Form is subject to the terms of the Mozilla Public
andre@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
andre@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
andre@0: /*
andre@0:  * This file defines several platform independent functions to
andre@0:  * manipulate certificates and CRLs in a portable manner.
andre@0:  *
andre@0:  */
andre@0: 
andre@0: #ifndef _PKIX_PL_PKI_H
andre@0: #define _PKIX_PL_PKI_H
andre@0: 
andre@0: #include "pkixt.h"
andre@0: #include "seccomon.h"
andre@0: #include "certt.h"
andre@0: 
andre@0: #ifdef __cplusplus
andre@0: extern "C" {
andre@0: #endif
andre@0: 
andre@0: /* General
andre@0:  *
andre@0:  * Please refer to the libpkix Programmer's Guide for detailed information
andre@0:  * about how to use the libpkix library. Certain key warnings and notices from
andre@0:  * that document are repeated here for emphasis.
andre@0:  *
andre@0:  * All identifiers in this file (and all public identifiers defined in
andre@0:  * libpkix) begin with "PKIX_". Private identifiers only intended for use
andre@0:  * within the library begin with "pkix_".
andre@0:  *
andre@0:  * A function returns NULL upon success, and a PKIX_Error pointer upon failure.
andre@0:  *
andre@0:  * Unless otherwise noted, for all accessor (gettor) functions that return a
andre@0:  * PKIX_PL_Object pointer, callers should assume that this pointer refers to a
andre@0:  * shared object. Therefore, the caller should treat this shared object as
andre@0:  * read-only and should not modify this shared object. When done using the
andre@0:  * shared object, the caller should release the reference to the object by
andre@0:  * using the PKIX_PL_Object_DecRef function.
andre@0:  *
andre@0:  * While a function is executing, if its arguments (or anything referred to by
andre@0:  * its arguments) are modified, free'd, or destroyed, the function's behavior
andre@0:  * is undefined.
andre@0:  *
andre@0:  */
andre@0: 
andre@0: /*
andre@0:  * Cert
andre@0:  *
andre@0:  * A Cert represents an X.509 certificate. It can be created using the bytes
andre@0:  * of a valid ASN.1 DER encoding. Once created, a Cert is immutable. The
andre@0:  * following functions include accessors (gettors) for the various components
andre@0:  * of an X.509 certificate. Also included are functions to perform various
andre@0:  * checks on a certificate, including name constraints, key usage, validity
andre@0:  * (expiration), and signature verification.
andre@0:  */
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_Create
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Creates a new certificate using the bytes in the ByteArray pointed to by
andre@0:  *  "byteArray" and stores it at "pCert". If the bytes are not a valid ASN.1
andre@0:  *  DER encoding of a certificate, a PKIX_Error pointer is returned. Once
andre@0:  *  created, a Cert is immutable.
andre@0:  *
andre@0:  *  Certificate  ::=  SEQUENCE  {
andre@0:  *      tbsCertificate          TBSCertificate,
andre@0:  *      signatureAlgorithm      AlgorithmIdentifier,
andre@0:  *      signatureValue          BIT STRING  }
andre@0:  *
andre@0:  *  AlgorithmIdentifier  ::=  SEQUENCE  {
andre@0:  *      algorithm               OBJECT IDENTIFIER,
andre@0:  *      parameters              ANY DEFINED BY algorithm OPTIONAL  }
andre@0:  *
andre@0:  *  TBSCertificate  ::=  SEQUENCE  {
andre@0:  *      version         [0]  EXPLICIT Version DEFAULT v1,
andre@0:  *      serialNumber    CertificateSerialNumber,
andre@0:  *      signature       AlgorithmIdentifier,
andre@0:  *      issuer          Name,
andre@0:  *      validity        Validity,
andre@0:  *      subject         Name,
andre@0:  *      subjectPublicKeyInfo SubjectPublicKeyInfo,
andre@0:  *      issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
andre@0:  *                          -- If present, version MUST be v2 or v3
andre@0:  *      subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
andre@0:  *                              -- If present, version MUST be v2 or v3
andre@0:  *      extensions      [3]  EXPLICIT Extensions OPTIONAL
andre@0:  *                              -- If present, version MUST be v3
andre@0:  *      }
andre@0:  *
andre@0:  *  Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
andre@0:  *
andre@0:  *  CertificateSerialNumber  ::=  INTEGER
andre@0:  *
andre@0:  *  Validity ::= SEQUENCE {
andre@0:  *      notBefore       Time,
andre@0:  *      notAfter        Time }
andre@0:  *
andre@0:  *  Time ::= CHOICE {
andre@0:  *      utcTime         UTCTime,
andre@0:  *      generalTime     GeneralizedTime }
andre@0:  *
andre@0:  *  UniqueIdentifier  ::=  BIT STRING
andre@0:  *
andre@0:  *  SubjectPublicKeyInfo  ::=  SEQUENCE  {
andre@0:  *      algorithm               AlgorithmIdentifier,
andre@0:  *      subjectPublicKey        BIT STRING  }
andre@0:  *
andre@0:  *  Extensions  ::=  SEQUENCE SIZE (1..MAX) OF Extension
andre@0:  *
andre@0:  *  Extension  ::=  SEQUENCE  {
andre@0:  *      extnID          OBJECT IDENTIFIER,
andre@0:  *      critical        BOOLEAN DEFAULT FALSE,
andre@0:  *      extnValue       OCTET STRING  }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "byteArray"
andre@0:  *      Address of ByteArray representing the CERT's DER encoding.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pCert"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_Create(
andre@0:         PKIX_PL_ByteArray *byteArray,
andre@0:         PKIX_PL_Cert **pCert,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_CreateFromCERTCertificate
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  * Creates a new certificate using passed in CERTCertificate object.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "nssCert"
andre@0:  *      The object that will be used to create new PKIX_PL_Cert.
andre@0:  *  "pCert"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_CreateFromCERTCertificate(
andre@0:         const CERTCertificate *nssCert,
andre@0:         PKIX_PL_Cert **pCert,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetCERTCertificate
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  * Returns underlying CERTCertificate structure. Return CERTCertificate
andre@0:  * object is duplicated and should be destroyed by caller.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of PKIX_PL_Cert. Must be non-NULL.
andre@0:  *  "pCert"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetCERTCertificate(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         CERTCertificate **pnssCert, 
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetVersion
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves the version of the Cert pointed to by "cert" and stores it at
andre@0:  *  "pVersion". The version number will either be 0, 1, or 2 (corresponding to
andre@0:  *  v1, v2, or v3, respectively).
andre@0:  *
andre@0:  *  Version  ::=  INTEGER  {  v1(0), v2(1), v3(2)  }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose version is to be stored. Must be non-NULL.
andre@0:  *  "pVersion"
andre@0:  *      Address where PKIX_UInt32 will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetVersion(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_UInt32 *pVersion,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetSerialNumber
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the BigInt that represents the serial number of the
andre@0:  *  Cert pointed to by "cert" and stores it at "pSerialNumber".
andre@0:  *
andre@0:  *  CertificateSerialNumber  ::=  INTEGER
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose serial number is to be stored. Must be non-NULL.
andre@0:  *  "pSerial"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetSerialNumber(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_BigInt **pSerial,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetIssuer
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the X500Name that represents the issuer DN of the
andre@0:  *  Cert pointed to by "cert" and stores it at "pIssuer".
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose issuer is to be stored. Must be non-NULL.
andre@0:  *  "pIssuer"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetIssuer(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_X500Name **pIssuer,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetSubject
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the X500Name that represents the subject DN of the
andre@0:  *  Cert pointed to by "cert" and stores it at "pSubject". If the Cert does not
andre@0:  *  have a subject DN, this function stores NULL at "pSubject".
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose subject is to be stored. Must be non-NULL.
andre@0:  *  "pSubject"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetSubject(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_X500Name **pSubject,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetSubjectPublicKeyAlgId
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the OID that represents the subject public key
andre@0:  *  algorithm of the Cert pointed to by "cert" and stores it at
andre@0:  *  "pSubjKeyAlgId".
andre@0:  *
andre@0:  *  SubjectPublicKeyInfo  ::=  SEQUENCE  {
andre@0:  *      algorithm               AlgorithmIdentifier,
andre@0:  *      subjectPublicKey        BIT STRING  }
andre@0:  *
andre@0:  *  AlgorithmIdentifier  ::=  SEQUENCE  {
andre@0:  *      algorithm               OBJECT IDENTIFIER,
andre@0:  *      parameters              ANY DEFINED BY algorithm OPTIONAL  }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose subject public key algorithm OID is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pSubjKeyAlgId"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetSubjectPublicKeyAlgId(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_OID **pSubjKeyAlgId,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetSubjectPublicKey
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the PublicKey that represents the subject public key
andre@0:  *  of the Cert pointed to by "cert" and stores it at "pPublicKey".
andre@0:  *
andre@0:  *  SubjectPublicKeyInfo  ::=  SEQUENCE  {
andre@0:  *      algorithm               AlgorithmIdentifier,
andre@0:  *      subjectPublicKey        BIT STRING  }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose subject public key is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pPublicKey"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetSubjectPublicKey(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_PublicKey **pPublicKey,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_PublicKey_NeedsDSAParameters
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  * Determines if the PublicKey pointed to by "pubKey" is a DSA Key with null
andre@0:  * parameters and stores the result at "pNeedsParams". 
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "pubKey"
andre@0:  *      Address of the Public Key of interest. Must be non-NULL.
andre@0:  *  "pNeedsParams"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a PublicKey Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_PublicKey_NeedsDSAParameters(
andre@0:         PKIX_PL_PublicKey *pubKey,
andre@0:         PKIX_Boolean *pNeedsParams,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_PublicKey_MakeInheritedDSAPublicKey
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  * This function is used for DSA key parameter inheritance, which allows a
andre@0:  * first DSA key with omitted parameters (pointed to by "firstKey") to inherit
andre@0:  * the PQG parameters of a second DSA key that does have parameters. (pointed
andre@0:  * to by "secondKey"). Once created, a PublicKey is immutable.
andre@0:  *
andre@0:  * Specifically, the algorithm used by the function is:
andre@0:  *
andre@0:  * If the first PublicKey is not a DSA public key with omitted parameters,
andre@0:  *      the function stores NULL at "pResultKey". (No Error is returned)
andre@0:  * Else if the second PublicKey is not a DSA public key with non-NULL,
andre@0:  *      parameters, the function returns an Error.
andre@0:  * Else
andre@0:  *      the function creates a third PublicKey with a "Y" value from the
andre@0:  *      first PublicKey and the DSA parameters from the second PublicKey,
andre@0:  *      and stores it at "pResultKey".
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "firstKey"
andre@0:  *      Address of a Public Key that needs to inherit DSA parameters.
andre@0:  *      Must be non-NULL.
andre@0:  *  "secondKey"
andre@0:  *      Address of a Public Key that has DSA parameters that will be inherited
andre@0:  *      by "firstKey". Must be non-NULL.
andre@0:  *  "pResultKey"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a PublicKey Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_PublicKey_MakeInheritedDSAPublicKey(
andre@0:         PKIX_PL_PublicKey *firstKey,
andre@0:         PKIX_PL_PublicKey *secondKey,
andre@0:         PKIX_PL_PublicKey **pResultKey,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetCriticalExtensionOIDs
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the List of OIDs (each OID corresponding to a
andre@0:  *  critical extension of the Cert pointed to by "cert") and stores it at
andre@0:  *  "pExtensions". If "cert" does not have any critical extensions, this
andre@0:  *  function stores an empty List at "pExtensions".
andre@0:  *
andre@0:  *  Note that the List returned by this function is immutable.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose critical extension OIDs are to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pExtensions"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetCriticalExtensionOIDs(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_List **pExtensions,  /* list of PKIX_PL_OID */
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetAuthorityKeyIdentifier
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to a ByteArray representing the authority key
andre@0:  *  identifier extension of the Cert pointed to by "cert" and stores it at
andre@0:  *  "pAuthKeyId".
andre@0:  *
andre@0:  *  Note that this function only retrieves the keyIdentifier component
andre@0:  *  (OCTET STRING) of the AuthorityKeyIdentifier extension, when present.
andre@0:  *
andre@0:  *  If "cert" does not have an AuthorityKeyIdentifier extension or if the
andre@0:  *  keyIdentifier component of the AuthorityKeyIdentifier extension is not
andre@0:  *  present, this function stores NULL at "pAuthKeyId".
andre@0:  *
andre@0:  *  AuthorityKeyIdentifier ::= SEQUENCE {
andre@0:  *      keyIdentifier                   [0] KeyIdentifier           OPTIONAL,
andre@0:  *      authorityCertIssuer             [1] GeneralNames            OPTIONAL,
andre@0:  *      authorityCertSerialNumber       [2] CertificateSerialNumber OPTIONAL  }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose authority key identifier is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pAuthKeyId"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetAuthorityKeyIdentifier(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_ByteArray **pAuthKeyId,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetSubjectKeyIdentifier
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to a ByteArray representing the subject key identifier
andre@0:  *  extension of the Cert pointed to by "cert" and stores it at "pSubjKeyId".
andre@0:  *  If "cert" does not have a SubjectKeyIdentifier extension, this function
andre@0:  *  stores NULL at "pSubjKeyId".
andre@0:  *
andre@0:  *  SubjectKeyIdentifier ::= KeyIdentifier
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose subject key identifier is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pSubjKeyId"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetSubjectKeyIdentifier(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_ByteArray **pSubjKeyId,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetSubjectAltNames
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the List of GeneralNames (each GeneralName
andre@0:  *  representing a subject alternative name found in the subject alternative
andre@0:  *  names extension of the Cert pointed to by "cert") and stores it at
andre@0:  *  "pSubjectAltNames". If "cert" does not have a SubjectAlternativeNames
andre@0:  *  extension, this function stores NULL at "pSubjectAltNames".
andre@0:  *
andre@0:  *  Note that the List returned by this function is immutable.
andre@0:  *
andre@0:  *  SubjectAltName ::= GeneralNames
andre@0:  *
andre@0:  *  GeneralNames ::= SEQUENCE SIZE (1..MAX) OF GeneralName
andre@0:  *
andre@0:  *  GeneralName ::= CHOICE {
andre@0:  *      otherName                       [0]     OtherName,
andre@0:  *      rfc822Name                      [1]     IA5String,
andre@0:  *      dNSName                         [2]     IA5String,
andre@0:  *      x400Address                     [3]     ORAddress,
andre@0:  *      directoryName                   [4]     Name,
andre@0:  *      ediPartyName                    [5]     EDIPartyName,
andre@0:  *      uniformResourceIdentifier       [6]     IA5String,
andre@0:  *      iPAddress                       [7]     OCTET STRING,
andre@0:  *      registeredID                    [8]     OBJECT IDENTIFIER }
andre@0:  *
andre@0:  *  OtherName ::= SEQUENCE {
andre@0:  *      type-id                         OBJECT IDENTIFIER,
andre@0:  *      value                           [0] EXPLICIT ANY DEFINED BY type-id }
andre@0:  *
andre@0:  *  EDIPartyName ::= SEQUENCE {
andre@0:  *      nameAssigner                    [0]     DirectoryString OPTIONAL,
andre@0:  *      partyName                       [1]     DirectoryString }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose subjectAltNames are to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pSubjectAltNames"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetSubjectAltNames(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_List **pSubjectAltNames,  /* list of PKIX_PL_GeneralName */
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetAllSubjectNames
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the List of GeneralNames (each GeneralName
andre@0:  *  representing a subject DN or a subject alternative name found in the
andre@0:  *  subject alternative names extension of the Cert pointed to by "cert") and
andre@0:  *  stores it at "pAllSubjectNames".If the Subject DN of "cert" is empty and
andre@0:  *  it does not have a SubjectAlternativeNames extension, this function stores
andre@0:  *  NULL at "pAllSubjectNames".
andre@0:  *
andre@0:  *  Note that the List returned by this function is immutable.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose subject DN and subjectAltNames are to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pAllSubjectNames"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetAllSubjectNames(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_List **pAllSubjectNames,  /* list of PKIX_PL_GeneralName */
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetExtendedKeyUsage
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to a List of OIDs (each OID corresponding to an
andre@0:  *  extended key usage of the Cert pointed to by "cert") and stores it at
andre@0:  *  "pKeyUsage". If "cert" does not have an extended key usage extension, this
andre@0:  *  function stores a NULL at "pKeyUsage".
andre@0:  *
andre@0:  *  Note that the List returned by this function is immutable.
andre@0:  *
andre@0:  *  ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
andre@0:  *
andre@0:  *  KeyPurposeId ::= OBJECT IDENTIFIER
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose extended key usage OIDs are to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pKeyUsage"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetExtendedKeyUsage(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_List **pKeyUsage,  /* list of PKIX_PL_OID */
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetNameConstraints
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to a CertNameConstraints object representing the name
andre@0:  *  constraints extension of the Cert pointed to by "cert" and stores it at
andre@0:  *  "pNameConstraints".
andre@0:  *
andre@0:  *  If "cert" does not have a name constraints extension, this function stores
andre@0:  *  NULL at "pNameConstraints".
andre@0:  *
andre@0:  *  NameConstraints ::= SEQUENCE {
andre@0:  *      permittedSubtrees       [0]     GeneralSubtrees OPTIONAL,
andre@0:  *      excludedSubtrees        [1]     GeneralSubtrees OPTIONAL }
andre@0:  *
andre@0:  *  GeneralSubtrees ::= SEQUENCE SIZE (1..MAX) OF GeneralSubtree
andre@0:  *
andre@0:  *  GeneralSubtree ::= SEQUENCE {
andre@0:  *      base                    GeneralName,
andre@0:  *      minimum         [0]     BaseDistance DEFAULT 0,
andre@0:  *      maximum         [1]     BaseDistance OPTIONAL }
andre@0:  *
andre@0:  *  BaseDistance ::= INTEGER (0..MAX)
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose name constraints extension is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pNameConstraints"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetNameConstraints(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_CertNameConstraints **pNameConstraints,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetBasicConstraints
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to a CertBasicConstraints object representing the basic
andre@0:  *  constraints extension of the Cert pointed to by "cert" and stores it at
andre@0:  *  "pBasicConstraints".
andre@0:  *
andre@0:  *  If "cert" does not have a basic constraints extension, this function stores
andre@0:  *  NULL at "pBasicConstraints". Once created, a CertBasicConstraints object
andre@0:  *  is immutable.
andre@0:  *
andre@0:  *  BasicConstraints ::= SEQUENCE {
andre@0:  *      cA                      BOOLEAN DEFAULT FALSE,
andre@0:  *      pathLenConstraint       INTEGER (0..MAX) OPTIONAL }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose basic constraints extension is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pBasicConstraints"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetBasicConstraints(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_CertBasicConstraints **pBasicConstraints,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_BasicConstraints_GetCAFlag
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to a Boolean value representing the cA Flag component
andre@0:  *  of the CertBasicConstraints object pointed to by "basicConstraints" and
andre@0:  *  stores it at "pResult".
andre@0:  *
andre@0:  *  BasicConstraints ::= SEQUENCE {
andre@0:  *      cA                      BOOLEAN DEFAULT FALSE,
andre@0:  *      pathLenConstraint       INTEGER (0..MAX) OPTIONAL }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "basicConstraints"
andre@0:  *      Address of CertBasicConstraints whose cA Flag is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pResult"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_BasicConstraints_GetCAFlag(
andre@0:         PKIX_PL_CertBasicConstraints *basicConstraints,
andre@0:         PKIX_Boolean *pResult,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_BasicConstraints_GetPathLenConstraint
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to an integer value representing the pathLenConstraint
andre@0:  *  component of the CertBasicConstraints object pointed to by
andre@0:  *  "basicConstraints" and stores it at "pPathLenConstraint". If the
andre@0:  *  pathLenConstraint component is not present, this function stores -1 at
andre@0:  *  "pPathLenConstraint".
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "basicConstraints"
andre@0:  *      Address of CertBasicConstraints whose pathLen is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pPathLenConstraint"
andre@0:  *      Address where PKIX_Int32 will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_BasicConstraints_GetPathLenConstraint(
andre@0:         PKIX_PL_CertBasicConstraints *basicConstraints,
andre@0:         PKIX_Int32 *pPathLenConstraint,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetPolicyInformation
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to a List of CertPolicyInfos found in the certificate
andre@0:  *  policies extension of the Cert pointed to by "cert" and stores it at
andre@0:  *  "pPolicyInfo". If "cert" does not have a certificate policies extension,
andre@0:  *  this function stores NULL at "pPolicyInfo". Once created, a CertPolicyInfo
andre@0:  *  object is immutable.
andre@0:  *
andre@0:  *  Note that the List returned by this function is immutable.
andre@0:  *
andre@0:  *  certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
andre@0:  *
andre@0:  *  PolicyInformation ::= SEQUENCE {
andre@0:  *      policyIdentifier   CertPolicyId,
andre@0:  *      policyQualifiers   SEQUENCE SIZE (1..MAX) OF
andre@0:  *                              PolicyQualifierInfo OPTIONAL }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose CertPolicyInfos are to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pPolicyInfo"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetPolicyInformation(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_List **pPolicyInfo, /* list of PKIX_PL_CertPolicyInfo */
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CertPolicyInfo_GetPolicyId
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to an OID representing the policyIdentifier of the
andre@0:  *  CertPolicyInfo pointed to by "policyInfo" and stores it at "pCertPolicyId".
andre@0:  *
andre@0:  *  certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
andre@0:  *
andre@0:  *  PolicyInformation ::= SEQUENCE {
andre@0:  *      policyIdentifier   CertPolicyId,
andre@0:  *      policyQualifiers   SEQUENCE SIZE (1..MAX) OF
andre@0:  *                              PolicyQualifierInfo OPTIONAL }
andre@0:  *
andre@0:  *  CertPolicyId ::= OBJECT IDENTIFIER
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "policyInfo"
andre@0:  *      Address of CertPolicyInfo whose policy identifier is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pCertPolicyId"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CertPolicyInfo_GetPolicyId(
andre@0:         PKIX_PL_CertPolicyInfo *policyInfo,
andre@0:         PKIX_PL_OID **pCertPolicyId,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CertPolicyInfo_GetPolQualifiers
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to a List of the CertPolicyQualifiers representing
andre@0:  *  the policyQualifiers of the CertPolicyInfo pointed to by "policyInfo" and
andre@0:  *  stores it at "pPolicyQualifiers". If "policyInfo" does not have any
andre@0:  *  policyQualifiers, this function stores NULL at "pPolicyQualifiers". Once
andre@0:  *  created, a CertPolicyQualifier is immutable.
andre@0:  *
andre@0:  *  Note that the List returned by this function is immutable.
andre@0:  *
andre@0:  *  certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
andre@0:  *
andre@0:  *  PolicyInformation ::= SEQUENCE {
andre@0:  *      policyIdentifier   CertPolicyId,
andre@0:  *      policyQualifiers   SEQUENCE SIZE (1..MAX) OF
andre@0:  *                              PolicyQualifierInfo OPTIONAL }
andre@0:  *
andre@0:  *  PolicyQualifierInfo ::= SEQUENCE {
andre@0:  *      policyQualifierId  PolicyQualifierId,
andre@0:  *      qualifier       ANY DEFINED BY policyQualifierId }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "policyInfo"
andre@0:  *      Address of CertPolicyInfo whose policy qualifiers List is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pPolicyQualifiers"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CertPolicyInfo_GetPolQualifiers(
andre@0:         PKIX_PL_CertPolicyInfo *policyInfo,
andre@0:         PKIX_List **pPolicyQualifiers, /* list of PKIX_PL_CertPolicyQualifier */
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_PolicyQualifier_GetPolicyQualifierId
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to an OID representing the policyQualifierId of the
andre@0:  *  CertPolicyQualifier pointed to by "policyQualifier" and stores it at
andre@0:  *  "pPolicyQualifierId".
andre@0:  *
andre@0:  *  PolicyQualifierInfo ::= SEQUENCE {
andre@0:  *      policyQualifierId       PolicyQualifierId,
andre@0:  *      qualifier               ANY DEFINED BY policyQualifierId }
andre@0:  *
andre@0:  *  PolicyQualifierId ::=
andre@0:  *      OBJECT IDENTIFIER ( id-qt-cps | id-qt-unotice )
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "policyQualifier"
andre@0:  *      Address of CertPolQualifier whose policyQualifierId is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pPolicyQualifierId"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_PolicyQualifier_GetPolicyQualifierId(
andre@0:         PKIX_PL_CertPolicyQualifier *policyQualifier,
andre@0:         PKIX_PL_OID **pPolicyQualifierId,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_PolicyQualifier_GetQualifier
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to a ByteArray representing the qualifier of the
andre@0:  *  CertPolicyQualifier pointed to by "policyQualifier" and stores it at
andre@0:  *  "pQualifier".
andre@0:  *
andre@0:  *  PolicyQualifierInfo ::= SEQUENCE {
andre@0:  *      policyQualifierId       PolicyQualifierId,
andre@0:  *      qualifier               ANY DEFINED BY policyQualifierId }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "policyQualifier"
andre@0:  *      Address of CertPolicyQualifier whose qualifier is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pQualifier"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_PolicyQualifier_GetQualifier(
andre@0:         PKIX_PL_CertPolicyQualifier *policyQualifier,
andre@0:         PKIX_PL_ByteArray **pQualifier,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetPolicyMappings
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to a List of CertPolicyMaps found in the policy
andre@0:  *  mappings extension of the Cert pointed to by "cert" and stores it at
andre@0:  *  "pPolicyMappings". If "cert" does not have a policy mappings extension,
andre@0:  *  this function stores NULL at "pPolicyMappings". Once created, a
andre@0:  *  CertPolicyMap is immutable.
andre@0:  *
andre@0:  *  Note that the List returned by this function is immutable.
andre@0:  *
andre@0:  *  PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
andre@0:  *      issuerDomainPolicy      CertPolicyId,
andre@0:  *      subjectDomainPolicy     CertPolicyId }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose CertPolicyMaps are to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pPolicyMappings"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetPolicyMappings(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_List **pPolicyMappings, /* list of PKIX_PL_CertPolicyMap */
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CertPolicyMap_GetIssuerDomainPolicy
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to an OID representing the issuerDomainPolicy of the
andre@0:  *  CertPolicyMap pointed to by "policyMapping" and stores it at
andre@0:  *  "pIssuerDomainPolicy".
andre@0:  *
andre@0:  *  PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
andre@0:  *      issuerDomainPolicy      CertPolicyId,
andre@0:  *      subjectDomainPolicy     CertPolicyId }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "policyMapping"
andre@0:  *      Address of CertPolicyMap whose issuerDomainPolicy is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pIssuerDomainPolicy"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CertPolicyMap_GetIssuerDomainPolicy(
andre@0:         PKIX_PL_CertPolicyMap *policyMapping,
andre@0:         PKIX_PL_OID **pIssuerDomainPolicy,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CertPolicyMap_GetSubjectDomainPolicy
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to an OID representing the subjectDomainPolicy of the
andre@0:  *  CertPolicyMap pointed to by "policyMapping" and stores it at
andre@0:  *  "pSubjectDomainPolicy".
andre@0:  *
andre@0:  *  PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
andre@0:  *      issuerDomainPolicy      CertPolicyId,
andre@0:  *      subjectDomainPolicy     CertPolicyId }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "policyMapping"
andre@0:  *      Address of CertPolicyMap whose subjectDomainPolicy is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pSubjectDomainPolicy"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CertPolicyMap_GetSubjectDomainPolicy(
andre@0:         PKIX_PL_CertPolicyMap *policyMapping,
andre@0:         PKIX_PL_OID **pSubjectDomainPolicy,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetRequireExplicitPolicy
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves the requireExplicitPolicy value of the policy constraints
andre@0:  *  extension of the Cert pointed to by "cert" and stores it at "pSkipCerts".
andre@0:  *  If "cert" does not have a policy constraints extension or the
andre@0:  *  requireExplicitPolicy component is not populated, this function stores -1
andre@0:  *  at "pSkipCerts".
andre@0:  *
andre@0:  *  PolicyConstraints ::= SEQUENCE {
andre@0:  *      requireExplicitPolicy   [0] SkipCerts OPTIONAL,
andre@0:  *      inhibitPolicyMapping    [1] SkipCerts OPTIONAL }
andre@0:  *
andre@0:  *  SkipCerts ::= INTEGER (0..MAX)
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose requireExplicitPolicy value is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pSkipCerts"
andre@0:  *      Address where PKIX_Int32 will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetRequireExplicitPolicy(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_Int32 *pSkipCerts,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetPolicyMappingInhibited
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves the inhibitPolicyMapping value of the policy constraints
andre@0:  *  extension of the Cert pointed to by "cert" and stores it at "pSkipCerts".
andre@0:  *  If "cert" does not have a policy constraints extension or the
andre@0:  *  inhibitPolicyMapping component is not populated, this function stores -1
andre@0:  *  at "pSkipCerts".
andre@0:  *
andre@0:  *  PolicyConstraints ::= SEQUENCE {
andre@0:  *      requireExplicitPolicy   [0] SkipCerts OPTIONAL,
andre@0:  *      inhibitPolicyMapping    [1] SkipCerts OPTIONAL }
andre@0:  *
andre@0:  *  SkipCerts ::= INTEGER (0..MAX)
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose requireExplicitPolicy value is to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pSkipCerts"
andre@0:  *      Address where PKIX_Int32 will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetPolicyMappingInhibited(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_Int32 *pSkipCerts,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetInhibitAnyPolicy
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves the value of the inhibit any-policy extension of the Cert
andre@0:  *  pointed to by "cert" and stores it at "pSkipCerts". If "cert" does not have
andre@0:  *  an inhibit any-policy extension, this function stores -1 at "pSkipCerts".
andre@0:  *
andre@0:  *  InhibitAnyPolicy ::= SkipCerts
andre@0:  *
andre@0:  *  SkipCerts ::= INTEGER (0..MAX)
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose inhibit any-policy extensions value is to be
andre@0:  *      stored. Must be non-NULL.
andre@0:  *  "pSkipCerts"
andre@0:  *      Address where PKIX_Int32 will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetInhibitAnyPolicy(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_Int32 *pSkipCerts,
andre@0:         void *plContext);
andre@0: 
andre@0: /* policy processing functions */
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_AreCertPoliciesCritical
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Checks whether the certificate policies extension of the Cert pointed to
andre@0:  *  by "cert" is critical and stores the Boolean result at "pCritical". If
andre@0:  *  "cert" does not have a certificate policies extension, this function
andre@0:  *  stores NULL at "pCritical".
andre@0:  *
andre@0:  *  XXX what distinguishes NULL from PKIX_FALSE?
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose certificate policies extension's criticality is
andre@0:  *      to be determined. Must be non-NULL.
andre@0:  *  "pCritical"
andre@0:  *      Address where PKIX_Boolean will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_AreCertPoliciesCritical(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_Boolean *pCritical,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_CheckNameConstraints
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Checks whether the subject distinguished name and subject alternative names
andre@0:  *  of the Cert pointed to by "cert" satisfy the CertNameConstraints pointed
andre@0:  *  to by "nameConstraints". If the CertNameConstraints are not satisfied, a
andre@0:  *  PKIX_Error pointer is returned. If "nameConstraints" is NULL, the function
andre@0:  *  does nothing.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose subject names are to be checked.
andre@0:  *      Must be non-NULL.
andre@0:  *  "nameConstraints"
andre@0:  *      Address of CertNameConstraints that need to be satisfied.
andre@0:  *  "treatCommonNameAsDNSName"
andre@0:  *      PKIX_TRUE if the subject common name should be considered a dNSName
andre@0:  *      when evaluating name constraints.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_CheckNameConstraints(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_CertNameConstraints *nameConstraints,
andre@0:         PKIX_Boolean treatCommonNameAsDNSName,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_MergeNameConstraints
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Merges the CertNameConstraints pointed to by "firstNC" and the
andre@0:  *  CertNameConstraints pointed to by "secondNC" and stores the merged
andre@0:  *  CertNameConstraints at "pResultNC". If "secondNC" is NULL, the
andre@0:  *  CertNameConstraints pointed to by "firstNC" is stored at "pResultNC".
andre@0:  *
andre@0:  *  Once created, a CertNameConstraints object is immutable.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "firstNC"
andre@0:  *      Address of first CertNameConstraints to be merged. Must be non-NULL.
andre@0:  *  "secondNC"
andre@0:  *      Address of second CertNameConstraints to be merged
andre@0:  *  "pResultNC"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_MergeNameConstraints(
andre@0:         PKIX_PL_CertNameConstraints *firstNC,
andre@0:         PKIX_PL_CertNameConstraints *secondNC,
andre@0:         PKIX_PL_CertNameConstraints **pResultNC,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_VerifyKeyUsage
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Verifies that the keyUsage bit(s) specified by "keyUsage" appear in the
andre@0:  *  keyUsage extension of the Cert pointed to by "cert". The keyUsage bit
andre@0:  *  values specified in pkixt.h are supported, and can be bitwise or'ed if
andre@0:  *  multiple bit values are to be verified. If the keyUsages do not all appear
andre@0:  *  in the keyUsage extension of "cert", a PKIX_Error pointer is returned.
andre@0:  *
andre@0:  *  KeyUsage ::= BIT STRING {
andre@0:  *      digitalSignature        (0),
andre@0:  *      nonRepudiation          (1),
andre@0:  *      keyEncipherment         (2),
andre@0:  *      dataEncipherment        (3),
andre@0:  *      keyAgreement            (4),
andre@0:  *      keyCertSign             (5),
andre@0:  *      cRLSign                 (6),
andre@0:  *      encipherOnly            (7),
andre@0:  *      decipherOnly            (8) }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose keyUsage bits are to be verified.
andre@0:  *      Must be non-NULL.
andre@0:  *  "keyUsage"
andre@0:  *      Constant representing keyUsage bit(s) that all must appear in keyUsage
andre@0:  *      extension of "cert".
andre@0:  *  "plContext" - Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_VerifyKeyUsage(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_UInt32 keyUsage,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_VerifyCertAndKeyType
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  * Verifies cert and key types against certificate usage that is
andre@0:  * a part of plContext(pkix_pl_nsscontext) structure. Throws an error
andre@0:  * if cert or key types does not match.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose keyUsage bits are to be verified.
andre@0:  *      Must be non-NULL.
andre@0:  *  "isLeafCert"
andre@0:  *      What type of a cert has been verified.
andre@0:  *  "plContext" - Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_VerifyCertAndKeyType(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_Boolean isChainCert,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_CheckValidity
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Checks whether the Cert pointed to by "cert" would be valid at the time
andre@0:  *  represented by the Date pointed to by "date". If "date" is NULL, then this
andre@0:  *  function checks whether the Cert would be valid at the current time. If the
andre@0:  *  Cert would not be valid at the specified Date, a PKIX_Error pointer is
andre@0:  *  returned.
andre@0:  *
andre@0:  *  Validity ::= SEQUENCE {
andre@0:  *      notBefore       Time,
andre@0:  *      notAfter        Time }
andre@0:  *
andre@0:  *  Time ::= CHOICE {
andre@0:  *      utcTime         UTCTime,
andre@0:  *      generalTime     GeneralizedTime }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose validity is to be checked. Must be non-NULL.
andre@0:  *  "date"
andre@0:  *      Address of Date at which the Cert is being checked for validity.
andre@0:  *      If NULL, the current time is used for the Date.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_CheckValidity(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_Date *date,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetValidityNotAfter
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the Date that represents the notAfter time of the
andre@0:  *  Certificate pointed to by "cert" and stores it at "pDate".
andre@0:  *
andre@0:  *  Validity ::= SEQUENCE {
andre@0:  *      notBefore       Time,
andre@0:  *      notAfter        Time }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose validity time is to be retrieved. Must be
andre@0:  *      non-NULL.
andre@0:  *  "date"
andre@0:  *      Address of Date at which the Cert's notAfter time is being retrieved.
andre@0:  *      Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetValidityNotAfter(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_Date **pDate,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_VerifySignature
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Verifies the signature on the Cert pointed to by "cert" using the
andre@0:  *  PublicKey pointed to by "pubKey". If the signature doesn't verify, an
andre@0:  *  Error pointer is returned.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose signature is to be verified. Must be non-NULL.
andre@0:  *  "pubKey"
andre@0:  *      Address of a Public Key used to verify the signature. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_VerifySignature(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_PublicKey *pubKey,
andre@0:         void *plContext);
andre@0: 
andre@0: /* A set of flags to indicate how explicitly configured trust anchors should be
andre@0:  * handled by PKIX_PL_Cert_IsCertTrusted
andre@0:  */
andre@0: typedef enum PKIX_PL_TrustAnchorModeEnum {
andre@0:         /* Indicates trust anchors should be ignored; only the underlying
andre@0:          * platform's trust settings should be used.
andre@0:          */
andre@0:         PKIX_PL_TrustAnchorMode_Ignore,
andre@0: 
andre@0:         /* Indicates that explicitly configured trust anchors may be considered
andre@0:          * trustworthy, if present.
andre@0:          * Note: If the underlying platform supports marking a certificate as
andre@0:          *       explicitly untrustworthy, explicitly configured trust anchors
andre@0:          *       MAY be ignored/rejected.
andre@0:          */
andre@0:         PKIX_PL_TrustAnchorMode_Additive,
andre@0: 
andre@0:         /* Indicates that ONLY trust anchors should be considered as
andre@0:          * trustworthy.
andre@0:          * Note: If the underlying platform supports marking a certificate as
andre@0:          *       explicitly untrustworthy, explicitly configured trust anchors
andre@0:          *       MAY be ignored/rejected.
andre@0:          */
andre@0:         PKIX_PL_TrustAnchorMode_Exclusive
andre@0: } PKIX_PL_TrustAnchorMode;
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_IsCertTrusted
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Checks the Cert specified by "cert" to determine, in a manner that depends
andre@0:  *  on the underlying platform, whether it is trusted, and stores the result in
andre@0:  *  "pTrusted". If a certificate is trusted it means that a chain built to that
andre@0:  *  certificate, and satisfying all the usage, policy, validity, and other
andre@0:  *  tests, is a valid chain and the End Entity certificate from which it was
andre@0:  *  built can be trusted.
andre@0:  *
andre@0:  *  If the Certificate is not intrinsically trustworthy, it still might end up a
andre@0:  *  component in a successful chain.
andre@0:  *
andre@0:  *  If the Certificate is intrinsically untrustworthy, this function will return
andre@0:  *  an error. 
andre@0:  *
andre@0:  * PARAMETERS
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose trustworthiness is to be determined. Must be
andre@0:  *      non-NULL.
andre@0:  *  "trustAnchorMode"
andre@0:  *      A PKIX_PL_TrustAnchorMode that indicates how explicitly defined user
andre@0:  *      trust anchors should be handled.
andre@0:  *  "pTrusted"
andre@0:  *      Address where the Boolean value will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CERT Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_IsCertTrusted(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_PL_TrustAnchorMode trustAnchorMode,
andre@0:         PKIX_Boolean *pTrusted,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_IsLeafCertTrusted
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Checks the Leaf Cert specified by "cert" to determine, in a manner that 
andre@0:  *  depends on the underlying platform, whether it is trusted, and stores the 
andre@0:  *  result in "pTrusted". If a certificate is trusted it means that this
andre@0:  *  End Entify certificate has been marked as trusted for the requested usage,
andre@0:  *  policy, validity, and other tests.
andre@0:  *
andre@0:  *  If the Certificate is not intrinsically trustworthy, we can still try to 
andre@0:  *  build a successful chain.
andre@0:  *
andre@0:  *  If the Certificate is intrinsically untrustworthy, this function will return
andre@0:  *  an error. 
andre@0:  *
andre@0:  * PARAMETERS
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose trustworthiness is to be determined. Must be
andre@0:  *      non-NULL.
andre@0:  *  "pTrusted"
andre@0:  *      Address where the Boolean value will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CERT Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_IsLeafCertTrusted(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_Boolean *pTrusted,
andre@0:         void *plContext);
andre@0: 
andre@0: /* FUNCTION: PKIX_PL_Cert_SetAsTrustAnchor */
andre@0: PKIX_Error*
andre@0: PKIX_PL_Cert_SetAsTrustAnchor(PKIX_PL_Cert *cert, 
andre@0:                               void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetCacheFlag
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves the value of the cache flag in "cert" and return it at address
andre@0:  *  pointed by "pCacheFlag". The initila cache flag is determined by the
andre@0:  *  CertStore this "cert" is fetched from. When CertStore is created, user
andre@0:  *  need to specify if the data should be cached.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose cache flag is fetched. Must be non-NULL.
andre@0:  *  "pCacheFlag"
andre@0:  *      Address where PKIX_Boolean will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetCacheFlag(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_Boolean *pCacheFlag,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_SetCacheFlag
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Set the value of the cache flag in "cert" base on the boolean value stored
andre@0:  *  at "cacheFlag". This function is meant to be used by CertStore after a
andre@0:  *  Cert is created.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert where "cacheFlag" is stored. Must be non-NULL.
andre@0:  *  "cacheFlag"
andre@0:  *      PKIX_Boolean flag for cache flag.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_SetCacheFlag(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_Boolean cacheFlag,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetTrustCertStore
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves the value of the CertStore in "cert" and return it at address
andre@0:  *  pointed by "pCertStore".
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose CertStore is fetched. Must be non-NULL.
andre@0:  *  "pTrustCertStore"
andre@0:  *      Address where CertStore will be stored and returned. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetTrustCertStore(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_CertStore **pTrustCertStore,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_SetTrustCertStore
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Set the value of the CertStore "certStore" in "cert".
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert where "certStore" will be stored. Must be non-NULL.
andre@0:  *  "trustCertStore"
andre@0:  *      Address where the CertStore is. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_SetTrustCertStore(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_CertStore *trustCertStore,
andre@0:         void *plContext);
andre@0: 
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetAuthorityInfoAccess
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves the value(s) of the Authority Information Access in "cert" and
andre@0:  *  returns it in a list at address pointed by "pAuthorityInfoAccess".
andre@0:  *
andre@0:  *  SubjectInfoAccess ::=
andre@0:  *    SEQUENCE SIZE (1..MAX) of AccessDescription
andre@0:  *    AccessDescription ::= SEQUENCE {
andre@0:  *        accessMethod     OBJECT IDENTIFIER,
andre@0:  *        accessLocation   GeneralName
andre@0:  *    }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose Authority Information Access is fetched.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pAuthorityInfoAccess"
andre@0:  *      Address where Authority InfoAccess will be stored and returned.
andre@0:  *      Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetAuthorityInfoAccess(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_List **pAiaList, /* of PKIX_PL_InfoAccess */
andre@0:         void *plContext);
andre@0: 
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetSubjectInfoAccess
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves the value(s) of the Subject Information Access in "cert" and
andre@0:  *  returns it in a list at address pointed by "pSubjectInfoAccess".
andre@0:  *
andre@0:  *  SubjectInfoAccess ::=
andre@0:  *    SEQUENCE SIZE (1..MAX) of AccessDescription
andre@0:  *    AccessDescription ::= SEQUENCE {
andre@0:  *        accessMethod     OBJECT IDENTIFIER,
andre@0:  *        accessLocation   GeneralName
andre@0:  *    }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose Subject Information Access is fetched.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pSubjectInfoAccess"
andre@0:  *      Address where Subject InfoAccess will be stored and returned.
andre@0:  *      Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetSubjectInfoAccess(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_List **pSiaList, /* of PKIX_PL_InfoAccess */
andre@0:         void *plContext);
andre@0: 
andre@0: 
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Cert_GetCrlDp
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves the value(s) of the CRL Distribution Point Extension and
andre@0:  *  returns it in a list at address pointed by "pDpList".
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert whose Subject Information Access is fetched.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pDpList"
andre@0:  *      Address where CRL DP will be stored and returned.
andre@0:  *      Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Cert_GetCrlDp(PKIX_PL_Cert *cert,
andre@0:                       PKIX_List **pDpList,
andre@0:                       void *plContext);
andre@0: 
andre@0: 
andre@0: /*
andre@0:  * InfoAccess 
andre@0:  *
andre@0:  * To hold Authority Information Access or Subject Information Access
andre@0:  * retrieved from a Certificate.
andre@0:  */
andre@0: 
andre@0: #define PKIX_INFOACCESS_OCSP          1
andre@0: #define PKIX_INFOACCESS_CA_ISSUERS    2
andre@0: #define PKIX_INFOACCESS_TIMESTAMPING  3
andre@0: #define PKIX_INFOACCESS_CA_REPOSITORY 5
andre@0: 
andre@0: #define PKIX_INFOACCESS_LOCATION_UNKNOWN 0
andre@0: #define PKIX_INFOACCESS_LOCATION_HTTP    1
andre@0: #ifndef NSS_PKIX_NO_LDAP
andre@0: #define PKIX_INFOACCESS_LOCATION_LDAP    2
andre@0: #endif
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_InfoAccess_GetMethod
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Stores the method of the Information Access from "infoAccess" and
andre@0:  *  returns in "pMethod".
andre@0:  *
andre@0:  *  SubjectInfoAccess ::=
andre@0:  *    AccessDescription ::= SEQUENCE {
andre@0:  *        accessMethod     OBJECT IDENTIFIER,
andre@0:  *        accessLocation   GeneralName
andre@0:  *    }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "infoAccess"
andre@0:  *      Address of PKIX_PL_InfoAccess that has the access data.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pMethod"
andre@0:  *      Address where access method will be stored and returned.
andre@0:  *      Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_InfoAccess_GetMethod(
andre@0:         PKIX_PL_InfoAccess *infoAccess,
andre@0:         PKIX_UInt32 *pMethod,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_InfoAccess_GetLocation
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Stores the location of the Information Access from "infoAccess" and
andre@0:  *  returns in "pLocation".
andre@0:  *
andre@0:  *  SubjectInfoAccess ::=
andre@0:  *    AccessDescription ::= SEQUENCE {
andre@0:  *        accessMethod     OBJECT IDENTIFIER,
andre@0:  *        accessLocation   GeneralName
andre@0:  *    }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "infoAccess"
andre@0:  *      Address of PKIX_PL_InfoAccess that has the access data.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pLocation"
andre@0:  *      Address where access location will be stored and returned.
andre@0:  *      Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_InfoAccess_GetLocation(
andre@0:         PKIX_PL_InfoAccess *infoAccess,
andre@0:         PKIX_PL_GeneralName **pLocation,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_InfoAccess_GetLocationType
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Stores the type of location of the Information Access from "infoAccess" and
andre@0:  *  returns in "pType".
andre@0:  *
andre@0:  *  SubjectInfoAccess ::=
andre@0:  *    AccessDescription ::= SEQUENCE {
andre@0:  *        accessMethod     OBJECT IDENTIFIER,
andre@0:  *        accessLocation   GeneralName
andre@0:  *    }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "infoAccess"
andre@0:  *      Address of PKIX_PL_InfoAccess that has the access data.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pType"
andre@0:  *      Address where access location type will be stored and returned.
andre@0:  *      Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_InfoAccess_GetLocationType(
andre@0:         PKIX_PL_InfoAccess *infoAccess,
andre@0:         PKIX_UInt32 *pType,
andre@0:         void *plContext);
andre@0: 
andre@0: PKIX_Error *
andre@0: pkix_pl_InfoAccess_GetAIACerts(
andre@0:         PKIX_PL_InfoAccess *ia,
andre@0:         void **pNBIOContext,
andre@0:         void **pHandle,
andre@0:         PKIX_List **pCerts,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * CRL
andre@0:  *
andre@0:  * A CRL represents an X.509 certificate revocation list. It can be created
andre@0:  * using the bytes of a valid ASN.1 DER encoding. Once created, a CRL is
andre@0:  * immutable. The following functions include accessors (gettors) for the
andre@0:  * various components of an X.509 CRL, as well as a function for signature
andre@0:  * verification.
andre@0:  */
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CRL_Create
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Creates a new CRL using the bytes in the ByteArray pointed to by
andre@0:  *  "byteArray" and stores it at "pCRL". If the bytes are not a valid ASN.1
andre@0:  *  DER encoding of a CRL, a PKIX_Error pointer is returned. Once created, a
andre@0:  *  CRL is immutable.
andre@0:  *
andre@0:  *  CertificateList  ::=  SEQUENCE  {
andre@0:  *      tbsCertList             TBSCertList,
andre@0:  *      signatureAlgorithm      AlgorithmIdentifier,
andre@0:  *      signatureValue          BIT STRING  }
andre@0:  *
andre@0:  *  TBSCertList  ::=  SEQUENCE  {
andre@0:  *      version                 Version OPTIONAL,
andre@0:  *                              -- if present, MUST be v2
andre@0:  *      signature               AlgorithmIdentifier,
andre@0:  *      issuer                  Name,
andre@0:  *      thisUpdate              Time,
andre@0:  *      nextUpdate              Time OPTIONAL,
andre@0:  *      revokedCertificates     SEQUENCE OF SEQUENCE  {
andre@0:  *              userCertificate         CertificateSerialNumber,
andre@0:  *              revocationDate          Time,
andre@0:  *              crlEntryExtensions      Extensions OPTIONAL
andre@0:  *                                      -- if present, MUST be v2
andre@0:  *                              }  OPTIONAL,
andre@0:  *      crlExtensions           [0]  EXPLICIT Extensions OPTIONAL
andre@0:  *                                      -- if present, MUST be v2
andre@0:  *      }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "byteArray"
andre@0:  *      Address of ByteArray representing the CRL's DER encoding.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pCRL"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CRL Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CRL_Create(
andre@0:         PKIX_PL_ByteArray *byteArray,
andre@0:         PKIX_PL_CRL **pCRL,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CRL_GetIssuer
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the X500Name that represents the issuer of the CRL
andre@0:  *  pointed to by "crl" and stores it at "pCRLIssuer".
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "crl"
andre@0:  *      Address of CRL whose issuer is to be stored. Must be non-NULL.
andre@0:  *  "pCRLIssuer"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CRL Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CRL_GetIssuer(
andre@0:         PKIX_PL_CRL *crl,
andre@0:         PKIX_PL_X500Name **pCRLIssuer,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CRL_GetCriticalExtensionOIDs
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the List of OIDs (each OID corresponding to a
andre@0:  *  critical extension of the CRL pointed to by "crl") and stores it at
andre@0:  *  "pExtensions". If "crl" does not have any critical extensions, this
andre@0:  *  function stores an empty List at "pExtensions".
andre@0:  *
andre@0:  *  Note that the List returned by this function is immutable.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "crl"
andre@0:  *      Address of CRL whose critical extension OIDs are to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pExtensions"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CRL Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CRL_GetCriticalExtensionOIDs(
andre@0:         PKIX_PL_CRL *crl,
andre@0:         PKIX_List **pExtensions,   /* list of PKIX_PL_OID */
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CRL_GetCRLEntryForSerialNumber
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the CRLEntry (found in the CRL pointed to by "crl")
andre@0:  *  corresponding to the BigInt pointed to by "serialNumber" and stores it at
andre@0:  *  "pCRLEntry". If there is no such CRLEntry, this functions stores NULL at
andre@0:  *  "pCRLEntry". Once created, a CRLEntry is immutable.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "crl"
andre@0:  *      Address of CRL whose CRL Entries are to be searched. Must be non-NULL.
andre@0:  *  "serialNumber"
andre@0:  *      Address of BigInt representing serial number of certificate whose
andre@0:  *      CRLEntry is to be found. Must be non-NULL.
andre@0:  *  "pCRLEntry"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CRL Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CRL_GetCRLEntryForSerialNumber(
andre@0:         PKIX_PL_CRL *crl,
andre@0:         PKIX_PL_BigInt *serialNumber,
andre@0:         PKIX_PL_CRLEntry **pCRLEntry,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CRL_GetCRLNumber
andre@0:  * DESCRIPTION:
andre@0:  *  Retrieves the CRL Number from extension. This is non-critical extension.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "crl"
andre@0:  *      Address of CRL whose version is to be stored. Must be non-NULL.
andre@0:  *  "pCrlNumber"
andre@0:  *      Address where a CRL Number will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CRL Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CRL_GetCRLNumber(
andre@0:         PKIX_PL_CRL *crl,
andre@0:         PKIX_PL_BigInt **pCrlNumber,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CRL_VerifyUpdateTime
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Checks whether the CRL pointed to by "crl" would be valid at the time
andre@0:  *  represented by the Date pointed to by "date" and stores the Boolean result
andre@0:  *  at "pResult". This check is done only when NIST policy is enforced.
andre@0:  *
andre@0:  *  Time ::= CHOICE {
andre@0:  *      utcTime         UTCTime,
andre@0:  *      generalTime     GeneralizedTime }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "crl"
andre@0:  *      Address of CRL whose validity is to be checked. Must be non-NULL.
andre@0:  *  "date"
andre@0:  *      Address of Date at which the CRL is being checked for validity.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pResult"
andre@0:  *      Address of Boolean result. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CRL Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CRL_VerifyUpdateTime(
andre@0:         PKIX_PL_CRL *crl,
andre@0:         PKIX_PL_Date *date,
andre@0:         PKIX_Boolean *pResult,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CRL_VerifySignature
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Verifies the signature on the CRL pointed to by "crl" using the PublicKey
andre@0:  *  pointed to by "pubKey". If the signature doesn't verify, a PKIX_Error
andre@0:  *  pointer is returned.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "crl"
andre@0:  *      Address of CRL whose signature is to be verified. Must be non-NULL.
andre@0:  *  "pubKey"
andre@0:  *      Address of a Public Key used to verify the signature. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CRL Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CRL_VerifySignature(
andre@0:         PKIX_PL_CRL *crl,
andre@0:         PKIX_PL_PublicKey *pubKey,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CRL_ReleaseDerCrl
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  * Relinguish the ownership for the crl der. The operation will succeed if
andre@0:  * a crl owns the der. If the crl was created from existing crl and does not
andre@0:  * own the der, then the function will return null.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "crl"
andre@0:  *      Address of CRL whose signature is to be verified. Must be non-NULL.
andre@0:  *  "derCrl"
andre@0:  *      Pointer to a SECItem that has der crl.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CRL Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CRL_ReleaseDerCrl(PKIX_PL_CRL *crl,
andre@0:                          SECItem **derCrl,
andre@0:                          void *plContext);
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CRL_AdoptDerCrl
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  * Adopt memory of the der. The secItem that contains der will be
andre@0:  * freed with destruction of parent pkix crl structure.
andre@0:  *
andre@0:  * * PARAMETERS:
andre@0:  *  "crl"
andre@0:  *      Address of CRL whose signature is to be verified. Must be non-NULL.
andre@0:  *  "derCrl"
andre@0:  *      Pointer to a SECItem that has der crl.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CRL Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CRL_AdoptDerCrl(PKIX_PL_CRL *crl,
andre@0:                         SECItem *derCrl,
andre@0:                         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CRLEntry_GetCRLEntryReasonCode
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves the value of the reason code extension of the CRLEntry pointed
andre@0:  *  to by "crlEntry" and stores it at "pReason". If the "crlEntry" has no
andre@0:  *  reason code extension, this function stores -1 at "pReason".
andre@0:  *
andre@0:  *  CRLReason ::= ENUMERATED {
andre@0:  *      unspecified             (0),
andre@0:  *      keyCompromise           (1),
andre@0:  *      cACompromise            (2),
andre@0:  *      affiliationChanged      (3),
andre@0:  *      superseded              (4),
andre@0:  *      cessationOfOperation    (5),
andre@0:  *      certificateHold         (6),
andre@0:  *      removeFromCRL           (8),
andre@0:  *      privilegeWithdrawn      (9),
andre@0:  *      aACompromise            (10) }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "crlEntry"
andre@0:  *      Address of CRLEntry whose reason code bit values are to be returned
andre@0:  *      at "pReason". Must be non-NULL.
andre@0:  *  "pReason"
andre@0:  *      Address of PKIX_Int32 where reason code is stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CRL Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CRLEntry_GetCRLEntryReasonCode(
andre@0:         PKIX_PL_CRLEntry *crlEntry,
andre@0:         PKIX_Int32 *pReason,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CRLEntry_GetCriticalExtensionOIDs
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Retrieves a pointer to the List of OIDs (each OID corresponding to a
andre@0:  *  critical extension of the CRLEntry pointed to by "crlEntry") and stores it
andre@0:  *  at "pExtensions". If "crlEntry" does not have any critical extensions, this
andre@0:  *  function stores an empty List at "pExtensions".
andre@0:  *
andre@0:  *  Note that the List returned by this function is immutable.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "crlEntry"
andre@0:  *      Address of CRLEntry whose critical extension OIDs are to be stored.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pExtensions"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a CRL Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CRLEntry_GetCriticalExtensionOIDs(
andre@0:         PKIX_PL_CRLEntry *crlEntry,
andre@0:         PKIX_List **pExtensions,  /* list of PKIX_PL_OID */
andre@0:         void *plContext);
andre@0: 
andre@0: #ifdef BUILD_LIBPKIX_TESTS
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_X500Name_Create
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Creates a new X500Name using the UTF8 string representation pointed to by
andre@0:  *  "stringRep" and stores it at "pName". Once created, an X500Name is
andre@0:  *  immutable.
andre@0:  *
andre@0:  *  Name ::= CHOICE {
andre@0:  *    RDNSequence }
andre@0:  *
andre@0:  *  RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
andre@0:  *
andre@0:  *  RelativeDistinguishedName ::=
andre@0:  *    SET OF AttributeTypeAndValue
andre@0:  *
andre@0:  *  AttributeTypeAndValue ::= SEQUENCE {
andre@0:  *      type    AttributeType,
andre@0:  *      value   AttributeValue }
andre@0:  *
andre@0:  *  AttributeType ::= OBJECT IDENTIFIER
andre@0:  *
andre@0:  *  AttributeValue ::= ANY DEFINED BY AttributeType
andre@0:  *
andre@0:  *  DirectoryString ::= CHOICE {
andre@0:  *      teletexString           TeletexString (SIZE (1..MAX)),
andre@0:  *      printableString         PrintableString (SIZE (1..MAX)),
andre@0:  *      universalString         UniversalString (SIZE (1..MAX)),
andre@0:  *      utf8String              UTF8String (SIZE (1..MAX)),
andre@0:  *      bmpString               BMPString (SIZE (1..MAX)) }
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "stringRep"
andre@0:  *      Address of UTF8 String representation of X500Name. Must be non-NULL.
andre@0:  *  "pName"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an X500Name Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_X500Name_Create (
andre@0:         PKIX_PL_String *stringRep,
andre@0:         PKIX_PL_X500Name **pName,
andre@0:         void *plContext);
andre@0: 
andre@0: #endif /* BUILD_LIBPKIX_TESTS */
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_X500Name_CreateFromCERTName
andre@0:  * DESCRIPTION:
andre@0:  * 
andre@0:  * The function creates x500Name using der encoded DN and/or pointer to
andre@0:  * CERTName. If arument "name" is NULL, but derName is supplied when
andre@0:  * the function generates nssDN(CERTName type) from der data. If derName
andre@0:  * is not supplied, CERTName *name will not be used to generate DN DER
andre@0:  * encoding.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "derName"
andre@0:  *      Address of DER representation of X500Name. Can be NULL
andre@0:  *  "name"
andre@0:  *      Address of CERTName representation of X500Name. Can be NULL
andre@0:  *  "pName"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an X500Name Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_X500Name_CreateFromCERTName(
andre@0:         SECItem *derName,
andre@0:         CERTName *name,
andre@0:         PKIX_PL_X500Name **pName,
andre@0:         void *plContext);
andre@0: 
andre@0: 
andre@0: /*
andre@0:  * TYPE: PKIX_PL_X500Name_Match
andre@0:  * DESCRIPTION:
andre@0:  *  Checks whether the X500Name pointed to by "firstX500Name" MATCHES the
andre@0:  *  X500Name pointed to by "secondX500Name" and stores the boolean result at
andre@0:  *  "pResult". Two X500Names MATCH if they meet the conditions specified by
andre@0:  *  RFC 3280 (section 4.1.2.4). Namely:
andre@0:  *
andre@0:  *      "This specification requires only a subset of the name comparison
andre@0:  *      functionality specified in the X.500 series of specifications.
andre@0:  *      Conforming implementations are REQUIRED to implement the following
andre@0:  *      name comparison rules:
andre@0:  *
andre@0:  *      (a)  attribute values encoded in different types (e.g., PrintableString
andre@0:  *      and BMPString) MAY be assumed to represent different strings;
andre@0:  *
andre@0:  *      (b) attribute values in types other than PrintableString are case
andre@0:  *      sensitive (this permits matching of attribute values as binary objects)
andre@0:  *
andre@0:  *      (c)  attribute values in PrintableString are not case sensitive
andre@0:  *      (e.g., "Marianne Swanson" is the same as "MARIANNE SWANSON"); and
andre@0:  *
andre@0:  *      (d)  attribute values in PrintableString are compared after removing
andre@0:  *      leading and trailing white space and converting internal substrings of
andre@0:  *      one or more consecutive white space characters to a single space."
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "firstX500Name"
andre@0:  *      Address of first X500Name to compare. Must be non-NULL.
andre@0:  *  "secondX500Name"
andre@0:  *      Address of second X500Name to compare. Must be non-NULL.
andre@0:  *  "pResult"
andre@0:  *      Address of Boolean result. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an X500Name Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_X500Name_Match(
andre@0:         PKIX_PL_X500Name *firstX500Name,
andre@0:         PKIX_PL_X500Name *secondX500Name,
andre@0:         PKIX_Boolean *pResult,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Date_Create_UTCTime
andre@0:  * DESCRIPTION:
andre@0:  *  Creates a new Date of type UTCTime using the string representation pointed
andre@0:  *  to by "stringRep" and stores it at "pDate". The UTCTime restriction means
andre@0:  *  that the year can only be specified by the least significant two digits
andre@0:  *  (YY). As such, Only the years 1950-2049 can be represented. If "stringRep"
andre@0:  *  is NULL, this function creates a new Date representing the current time
andre@0:  *  and stores it at "pDate". Once created, a Date is immutable.
andre@0:  *
andre@0:  *  If YY is greater than or equal to 50, the year is interpreted as 19YY.
andre@0:  *  If YY is less than 50, the year is interpreted as 20YY.
andre@0:  *
andre@0:  *  The string representation of the date must be in the following form:
andre@0:  *      "YYMMDDhhmmssZ" where:
andre@0:  *
andre@0:  *  YY is the least significant two digits of the year
andre@0:  *  MM is the month (01 to 12)
andre@0:  *  DD is the day (01 to 31)
andre@0:  *  hh is the hour (00 to 23)
andre@0:  *  mm are the minutes (00 to 59)
andre@0:  *  ss are the seconds (00 to 59)
andre@0:  *  Z indicates that local time is GMT
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "stringRep"
andre@0:  *      Address of String representation of Date.
andre@0:  *      If NULL, current time is used.
andre@0:  *  "pDate"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Date Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Date_Create_UTCTime (
andre@0:         PKIX_PL_String *stringRep,
andre@0:         PKIX_PL_Date **pDate,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Date_Create_UTCTime
andre@0:  * DESCRIPTION:
andre@0:  *  Creates a new Date from PRTime data.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "time"
andre@0:  *      Represented time in PRTime type.
andre@0:  *  "pDate"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Date Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Date_CreateFromPRTime(
andre@0:         PRTime time,
andre@0:         PKIX_PL_Date **pDate,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_Date_Create_CurrentOffBySeconds
andre@0:  * DESCRIPTION:
andre@0:  *  Creates a new Date of type UTCTime for current time with seconds off by
andre@0:  *  "secondsOffset" and returns it at "pDate".
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "secondsOffset"
andre@0:  *      A PKIX_Int32 indicates the time offset from current. If "secondsOffset"
andre@0:  *      is negative, the time is in past.
andre@0:  *  "pDate"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Date Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_Date_Create_CurrentOffBySeconds(
andre@0:         PKIX_Int32 secondsOffset,
andre@0:         PKIX_PL_Date **pDate,
andre@0:         void *plContext);
andre@0: 
andre@0: #ifdef BUILD_LIBPKIX_TESTS
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_GeneralName_Create
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Creates a new GeneralName of type "nameType" using the string
andre@0:  *  representation pointed to by "stringRep" and stores it at "pGName".
andre@0:  *  All of the GeneralName type format values specified in pkixt.h are
andre@0:  *  supported, with the exception of PKIX_OTHER_NAME, PKIX_EDIPARTY_NAME,
andre@0:  *  PKIX_IP_NAME, and PKIX_X400_ADDRESS. A PKIX_ESCASCII string representation
andre@0:  *  should be used for all supported nameTypes, with the exception of
andre@0:  *  registeredID and directoryName. For registeredID, the string representation
andre@0:  *  should be the same as that used by PKIX_PL_OID_Create. For directoryName,
andre@0:  *  the string representation should be the same as that used by
andre@0:  *  PKIX_PL_X500Name_Create. If an unsupported name type is used, an Error is
andre@0:  *  returned. Once created, a GeneralName is immutable.
andre@0:  *
andre@0:  *  GeneralName ::= CHOICE {
andre@0:  *      otherName                       [0]     OtherName,
andre@0:  *      rfc822Name                      [1]     IA5String,
andre@0:  *      dNSName                         [2]     IA5String,
andre@0:  *      x400Address                     [3]     ORAddress,
andre@0:  *      directoryName                   [4]     Name,
andre@0:  *      ediPartyName                    [5]     EDIPartyName,
andre@0:  *      uniformResourceIdentifier       [6]     IA5String,
andre@0:  *      iPAddress                       [7]     OCTET STRING,
andre@0:  *      registeredID                    [8]     OBJECT IDENTIFIER }
andre@0:  *
andre@0:  *
andre@0:  * NOTE: This function is allowed to be called only by pkix tests programs.
andre@0:  * 
andre@0:  * PARAMETERS:
andre@0:  *  "nameType"
andre@0:  *      Type of GeneralName to be created. This must be one of the GeneralName
andre@0:  *      type format values specified in pkixt.h
andre@0:  *  "stringRep"
andre@0:  *      Address of String representation of GeneralName. Must be non-NULL.
andre@0:  *  "pGName"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a GeneralName Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_GeneralName_Create (
andre@0:         PKIX_UInt32 nameType,
andre@0:         PKIX_PL_String *stringRep,
andre@0:         PKIX_PL_GeneralName **pGName,
andre@0:         void *plContext);
andre@0: #endif /* BUILD_LIBPKIX_TESTS */
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_CertNameConstraints_CheckNamesInNameSpace
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  This function checks whether names in "nameList" comply with
andre@0:  *  "nameConstraints". It stores PKIX_TRUE at "pCheckPass" if the names meet the
andre@0:  *  requirement of the NameConstraints, PKIX_FALSE otherwise.
andre@0:  *
andre@0:  * PARAMETERS
andre@0:  *  "nameList"
andre@0:  *      List of GeneralNames that are checked for compliance. May be empty
andre@0:  *      or NULL.
andre@0:  *  "nameConstraints"
andre@0:  *      Address of CertNameConstraints that provides lists of permitted
andre@0:  *      and excluded names. Must be non-NULL.
andre@0:  *  "pCheckPass"
andre@0:  *      Address where PKIX_TRUE is returned if the all names in "nameList" are
andre@0:  *      valid. Must be non-NULL.
andre@0:  *  "plContext" - Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a NameConstraints Error if the function fails in a
andre@0:  *  non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_CertNameConstraints_CheckNamesInNameSpace(
andre@0:         PKIX_List *nameList, /* List of PKIX_PL_GeneralName */
andre@0:         PKIX_PL_CertNameConstraints *nameConstraints,
andre@0:         PKIX_Boolean *pCheckPass,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_AIAMgr_Create
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  This function creates an AIAMgr to handle retrieval of Certs and CRLs
andre@0:  *  from servers given by AIA Certificate extensions. It manages connections
andre@0:  *  and caches. The manager created is stored at "pAIAMgr".
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "pAIAMgr"
andre@0:  *      The address at which the result is stored. Must be non-NULL.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an AIAMgr Error if the function fails in a non-fatal way
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_AIAMgr_Create(
andre@0:         PKIX_PL_AIAMgr **pAIAMgr,
andre@0:         void *plContext);
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: PKIX_PL_AIAMgr_GetAIACerts
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  This function uses the AIAMgr pointed to by "aiaMgr" to retrieve the Certs
andre@0:  *  specified by an AIA certificate extension, if any, in the Cert pointed to by
andre@0:  *  "prevCert", storing the results at "pCerts". If the certificate has no such
andre@0:  *  extension, this function stores NULL at "pCerts".
andre@0:  *
andre@0:  *  If the request is suspended for non-blocking I/O, a platform-dependent
andre@0:  *  context is stored at "pNBIOContext" and NULL is stored at "pCerts". This
andre@0:  *  return is referred to as the WOULDBLOCK state. Note that the caller must
andre@0:  *  check for a non-NULL value at "pNBIOContext", to distinguish this state from
andre@0:  *  the "no such extension" return described in the first paragraph. (The
andre@0:  *  alternative would be to return an empty List, but it seemed wrong to incur
andre@0:  *  the overhead of creating and destroying an empty List for the most common
andre@0:  *  situation.)
andre@0:  *
andre@0:  *  After a WOULDBLOCK return, the user may continue the operation by calling
andre@0:  *  pkix_AIAMgr_GetAIACerts (possibly more than once, if the function again
andre@0:  *  returns in the WOULDBLOCK state) with the previously-returned non-NULL
andre@0:  *  value of "pNBIOContext". When results are complete, NULL is stored at
andre@0:  *  "pNBIOContext", and the results (which may be NULL) are stored at "pCerts".
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "aiaMgr"
andre@0:  *      The AIAMgr which controls the retrieval of certificates. Must be
andre@0:  *      non-NULL.
andre@0:  *  "prevCert"
andre@0:  *      Address of PKIX_PL_Cert which may provide an AIA or SIA extension. Must
andre@0:  *      be non-NULL.
andre@0:  *  "pNBIOContext"
andre@0:  *      Address at which platform-dependent information is returned if request
andre@0:  *      is suspended for non-blocking I/O. Must be non-NULL.
andre@0:  *  "pCerts"
andre@0:  *      Address at which the returned List is stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an AIAMgr Error if the function fails in a non-fatal way
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: PKIX_PL_AIAMgr_GetAIACerts(
andre@0:         PKIX_PL_AIAMgr *aiaMgr,
andre@0:         PKIX_PL_Cert *prevCert,
andre@0:         void **pNBIOContext,
andre@0:         PKIX_List **pCerts,
andre@0:         void *plContext);
andre@0: 
andre@0: typedef PKIX_Error *
andre@0: (*PKIX_PL_VerifyCallback)(
andre@0:         PKIX_PL_Object *signedObject,
andre@0:         PKIX_PL_Cert *signerCert, /* can be unknown */
andre@0:         PKIX_PL_Date *producedAt,
andre@0:         PKIX_ProcessingParams *procParams,
andre@0:         void **pNBIOContext,
andre@0:         void **pState,
andre@0:         PKIX_BuildResult **pBuildResult,
andre@0:         PKIX_VerifyNode **pVerifyTree,
andre@0:         void *plContext);
andre@0: 
andre@0: #ifdef __cplusplus
andre@0: }
andre@0: #endif
andre@0: 
andre@0: #endif /* _PKIX_PL_PKI_H */