cryptkrn.h

老外写的加密库cryptlib(版本3.1)

/****************************************************************************
*																			*
*					  cryptlib Kernel Interface Header File 				*
*						Copyright Peter Gutmann 1992-2002					*
*																			*
****************************************************************************/

#ifndef _CRYPTKRN_DEFINED

#define _CRYPTKRN_DEFINED

/* Macros to handle code correctness checking of critical sections of the 
   code such as the kernel and CSPRNG (sed quis custodiet ipsos custodes?).  
   By default these are mapped directly to C assertions, but they can be 
   remapped for use by an external verifier if USE_EXTERNAL_CHECKER is 
   defined (typically this means turning them into no-ops for ADL) */

#if !defined( USE_EXTERNAL_CHECKER ) && !defined( NDEBUG )

/* Value of a variable at the start of block scope, used for postcondition
   predicates.  The pointer is declared as char * rather than the more
   general void * in order to allow range comparisons.  Note that these
   declarations must be the last in any set of variable declarations since
   the release build expands them to nothing, leaving only the terminating
   semicolon on the line, which must follow all other declarations */

#define ORIGINAL_VALUE( x )			orig_##x
#define ORIGINAL_INT( x )			const int orig_##x = ( int ) x
#define ORIGINAL_PTR( x )			const char *orig_##x = ( const char * ) x

/* Sometimes we can't use the preprocessor tricks above because the value
   being saved isn't a primitive type or the variable value isn't available 
   at the start of the block, in which case we have to use the somewhat less 
   transaparent macros below */

#define ORIGINAL_INT_VAR( x, y )	const int orig_##x = ( y )
#define DECLARE_ORIGINAL_INT( x )	int orig_##x
#define STORE_ORIGINAL_INT( x, y )	orig_##x = ( y )

/* Sometimes we need to declare temporary intermediate variables to avoid 
   having to cram a dozen lines of expression into a single assertion, the
   following define allows this */

#define TEMP_INT( x )		int x
#define TEMP_VAR( x )		x

/* Preconditions, invariants, postconditions */

#define PRE( x )			assert( x )
#define INV( x )			assert( x )
#define POST( x )			assert( x )

/* Universal qualifiers: for_all, there_exists */

#define FORALL( iter, start, end, condition ) \
		{ \
		int iter; \
		\
		for( iter = ( start ); iter < ( end ); iter++ ) \
			assert( condition ); \
		}
#else

/* Non-debug version, no-op out the various checks */

#define ORIGINAL_VALUE( a )
#define ORIGINAL_INT( a )
#define ORIGINAL_PTR( a )
#define ORIGINAL_INT_VAR( a, b )
#define DECLARE_ORIGINAL_INT( x )
#define STORE_ORIGINAL_INT( x, y )
#define TEMP_INT( a )
#define TEMP_VAR( a )
#define PRE( x )
#define INV( x )
#define POST( x )
#define FORALL( a, b, c, d )

#endif /* USE_EXTERNAL_CHECKER || NDEBUG */

/****************************************************************************
*																			*
*							Object Message Types							*
*																			*
****************************************************************************/

/* The object types */

typedef enum {
	OBJECT_TYPE_NONE,				/* No object type */
	OBJECT_TYPE_CONTEXT,			/* Context */
	OBJECT_TYPE_KEYSET,				/* Keyset */
	OBJECT_TYPE_ENVELOPE,			/* Envelope */
	OBJECT_TYPE_CERTIFICATE,		/* Certificate */
	OBJECT_TYPE_DEVICE,				/* Crypto device */
	OBJECT_TYPE_SESSION,			/* Secure session */
	OBJECT_TYPE_USER,				/* User object */
	OBJECT_TYPE_LAST				/* Last object type */
	} OBJECT_TYPE;

/* Object subtypes.  The subtype names aren't needed by the kernel (it just 
   treats the values as an anonymous bitfield during an ACL check) but they 
   are used in the ACL definitions and by the code that calls 
   krnlCreateObject(), so they need to be defined here.

   Because there are so many object subtypes we have to split them across 
   two 32-bit bitfields in order to permit a simple bitwise and check, if we 
   ordered them by the more obvious major and minor type (that is, object 
   type and subtype) this wouldn't be necessary but it would increase the 
   size of the compiled ACL table (from 2 * 32 bits to NO_OBJECT_TYPES * 
   32 bits) and would make automated consistency checking difficult since 
   it's no longer possible to spot a case where a subtype bit for object A 
   has been set for object B.  
   
   To resolve this, we divide the subtype bit field into two smaller bit
   fields (classes) with the high two bits designating which class the 
   subtype is in (actually we use the bits one below the high bit since 
   this may be interpreted as a sign bit by some preprocessors even if it's
   declared as a xxxxUL, so in the following discussion we're talking about
   logical rather than physical high bits).  Class A is always 01xxx..., 
   class B is always 10xxx...  If we get an entry that has 11xxx... we know 
   that that ACL entry is inconsistent.  This isn't pretty, but it's the 
   least ugly way to do it which still allows the ACL table to be built 
   using the preprocessor.
   
   Note that the device and keyset values must be in the same class, since
   they're interchangeable for many message types and this simplifies some
   of the MKACL() macros that only need to initialise one class type */

#define SUBTYPE_CLASS_MASK			0x60000000L
#define SUBTYPE_CLASS_A				0x20000000L
#define SUBTYPE_CLASS_B				0x40000000L

#define SUBTYPE_CTX_CONV			0x20000001L
#define SUBTYPE_CTX_PKC				0x20000002L
#define SUBTYPE_CTX_HASH			0x20000004L
#define SUBTYPE_CTX_MAC				0x20000008L

#define SUBTYPE_CERT_CERT			0x20000010L
#define SUBTYPE_CERT_CERTREQ		0x20000020L
#define SUBTYPE_CERT_REQ_CERT		0x20000040L
#define SUBTYPE_CERT_REQ_REV		0x20000080L
#define SUBTYPE_CERT_CERTCHAIN		0x20000100L
#define SUBTYPE_CERT_ATTRCERT		0x20000200L
#define SUBTYPE_CERT_CRL			0x20000400L
#define SUBTYPE_CERT_CMSATTR		0x20000800L
#define SUBTYPE_CERT_RTCS_REQ		0x20001000L
#define SUBTYPE_CERT_RTCS_RESP		0x20002000L
#define SUBTYPE_CERT_OCSP_REQ		0x20004000L
#define SUBTYPE_CERT_OCSP_RESP		0x20008000L
#define SUBTYPE_CERT_PKIUSER		0x20010000L

#define SUBTYPE_KEYSET_FILE			0x20020000L
#define SUBTYPE_KEYSET_FILE_PARTIAL	0x20040000L
#define SUBTYPE_KEYSET_DBMS			0x20080000L
#define SUBTYPE_KEYSET_DBMS_STORE	0x20100000L
#define SUBTYPE_KEYSET_HTTP			0x20200000L
#define SUBTYPE_KEYSET_LDAP			0x20400000L

#define SUBTYPE_DEV_SYSTEM			0x20800000L
#define SUBTYPE_DEV_FORTEZZA		0x21000000L
#define SUBTYPE_DEV_PKCS11			0x22000000L
#define SUBTYPE_DEV_CRYPTOAPI		0x24000000L

#define SUBTYPE_ENV_ENV				0x40000001L
#define SUBTYPE_ENV_ENV_PGP			0x40000002L
#define SUBTYPE_ENV_DEENV			0x40000004L

#define SUBTYPE_SESSION_SSH			0x40000008L
#define SUBTYPE_SESSION_SSH_SVR		0x40000010L
#define SUBTYPE_SESSION_SSL			0x40000020L
#define SUBTYPE_SESSION_SSL_SVR		0x40000040L
#define SUBTYPE_SESSION_RTCS		0x40000080L
#define SUBTYPE_SESSION_RTCS_SVR	0x40000100L
#define SUBTYPE_SESSION_OCSP		0x40000200L
#define SUBTYPE_SESSION_OCSP_SVR	0x40000400L
#define SUBTYPE_SESSION_TSP			0x40000800L
#define SUBTYPE_SESSION_TSP_SVR		0x40001000L
#define SUBTYPE_SESSION_CMP			0x40002000L
#define SUBTYPE_SESSION_CMP_SVR		0x40004000L
#define SUBTYPE_SESSION_SCEP		0x40008000L
#define SUBTYPE_SESSION_SCEP_SVR	0x40010000L

#define SUBTYPE_USER_SO				0x40020000L
#define SUBTYPE_USER_NORMAL			0x40040000L
#define SUBTYPE_USER_CA				0x40080000L

/* Message flags.  Normally messages can only be sent to external objects, 
   however we can also explicitly send them to internal objects which means 
   that the external access ACL isn't checked.  This can only be done from 
   inside cryptlib, for example when an object sends a message to a 
   subordinate object */

#define MESSAGE_FLAG_INTERNAL		0x100
#define MKINTERNAL( message )		( message | MESSAGE_FLAG_INTERNAL )

/* A mask to extract the basic message type */

#define MESSAGE_MASK				0xFF

/* The message types that can be sent to an object via krnlSendMessage().  
   By default messages can only be sent to externally visible objects, there 
   are also internal versions that can be sent to all objects.  The object 
   messages have the following arguments:

	Type								DataPtr			Value
	---------------------------			-------			-----
	MESSAGE_DESTROY						NULL			0
	MESSAGE_INC/DECREFCOUNT				NULL			0
	MESSAGE_GETDEPENDENT				&objectHandle	objectType
	MESSAGE_SETDEPENDENT				&objectHandle	incRefCount
	MESSAGE_CLONE						NULL			cloneContext
	MESSAGE_GET/SETATTRIBUTE			&value			attributeType
	MESSAGE_DELETEATTRIBUTE				NULL			attributeType
	MESSAGE_COMPARE						&value			compareType
	MESSAGE_CHECK						NULL			requestedUse

	MESSAGE_CHANGENOTIFY				&value			attributeType
										Data from message that triggered the
										changeNotify

	MESSAGE_CTX_ENC/DEC/SIG/SIGCHK/HASH	&value			valueLength
	MESSAGE_CTX_GENKEY					NULL			isAsync
	MESSAGE_CTX_GENIV					NULL			0

	MESSAGE_CRT_SIGN,					NULL			sigKey
	MESSAGE_CRT_SIGCHECK,				NULL			verifyObject
	MESSAGE_CRT_EXPORT,					&value			formatType

	MESSAGE_DEV_QUERYCAPABILITY			&queryInfo		algorithm
	MESSAGE_DEV_EXP/IMP/SIG/SIGCHK/DER	&mechanismInfo	mechanismType
	MESSAGE_DEV_CREATEOBJECT			&createInfo		objectType
	MESSAGE_DEV_CREATEOBJECT_INDIRECT	&createInfo		objectType

	MESSAGE_ENV_PUSH/POPDATA			&value			0

	MESSAGE_KEY_GET/SET/DELETEKEY		&keymgmtInfo	itemType
	MESSAGE_KEY_GETFIRST/NEXTCERT		&keymgmtInfo	itemType
	MESSAGE_KEY_CERTMGMT				&certMgmtInfo	action */

typedef enum {
	MESSAGE_NONE,				/* No message */

	/* Control messages to externally visible objects (the internal versions
	   are defined further down).  These messages are handled directly by 
	   the kernel and don't affect the object itself except for 
	   MESSAGE_DESTROY which is generated by the kernel in response to the
	   final MESSAGE_DECREFCOUNT sent to an object.  These are forwarded out
	   to the object to get it to clean up its state before the kernel
	   destroys it */
	MESSAGE_DESTROY,			/* Destroy the object */
	MESSAGE_INCREFCOUNT,		/* Increment object ref.count */
	MESSAGE_DECREFCOUNT,		/* Decrement object ref.count */
	MESSAGE_GETDEPENDENT,		/* Get dependent object */
	MESSAGE_SETDEPENDENT,		/* Set dependent object (e.g.ctx->dev) */
	MESSAGE_CLONE,				/* Clone the object */

	/* Attribute messages.  The reason for the numeric vs.non-numeric 
	   attribute messages is that the data types these work with are 
	   explicitly specified by the user based on which function they call 
	   to get/set them rather than being implicitly specified by the 
	   attribute ID.  Because of the explicit typing, the handlers have to 
	   be able to check to make sure the actual type matches what the user 
	   specified, so we need one message type for numeric attributes and one 
	   for string attributes */
	MESSAGE_GETATTRIBUTE,		/* Get numeric object attribute */
	MESSAGE_GETATTRIBUTE_S,		/* Get string object attribute */
	MESSAGE_SETATTRIBUTE,		/* Set numeric object attribute */
	MESSAGE_SETATTRIBUTE_S,		/* Set string object attribute */
	MESSAGE_DELETEATTRIBUTE,	/* Delete object attribute */

	/* General messages.  The check message is used for informational 
	   purposes only so that problems (e.g. attempt to use a public key 
	   where a private key is required) can be reported to the user 
	   immediately as a function parameter error rather than appearing much 
	   later as an object use permission error when the kernel blocks the 
	   access.  Final access checking is always still done at the kernel 
	   level to avoid the confused deputy problem */
	MESSAGE_COMPARE,			/* Compare objs. or obj.properties */
	MESSAGE_CHECK,				/* Check object info */

	/* Messages sent from the kernel to object message handlers.  These never
	   originate from outside the kernel but are generated in response to
	   other messages to notify an object of a change in its state */
	MESSAGE_CHANGENOTIFY,		/* Notification of obj.status chge.*/

	/* Object-type-specific messages */
	MESSAGE_CTX_ENCRYPT,		/* Context: Action = encrypt */
	MESSAGE_CTX_DECRYPT,		/* Context: Action = decrypt */
	MESSAGE_CTX_SIGN,			/* Context: Action = sign */
	MESSAGE_CTX_SIGCHECK,		/* Context: Action = sigcheck */
	MESSAGE_CTX_HASH,			/* Context: Action = hash */
	MESSAGE_CTX_GENKEY,			/* Context: Generate a key */
	MESSAGE_CTX_GENIV,			/* Context: Generate an IV */
	MESSAGE_CRT_SIGN,			/* Cert: Action = sign cert */
	MESSAGE_CRT_SIGCHECK,		/* Cert: Action = check/verify cert */
	MESSAGE_CRT_EXPORT,			/* Cert: Export encoded cert data */
	MESSAGE_DEV_QUERYCAPABILITY,/* Device: Query capability */
	MESSAGE_DEV_EXPORT,			/* Device: Action = export key */
	MESSAGE_DEV_IMPORT,			/* Device: Action = import key */
	MESSAGE_DEV_SIGN,			/* Device: Action = sign */
	MESSAGE_DEV_SIGCHECK,		/* Device: Action = sig.check */
	MESSAGE_DEV_DERIVE,			/* Device: Action = derive key */
	MESSAGE_DEV_CREATEOBJECT,	/* Device: Create object */
	MESSAGE_DEV_CREATEOBJECT_INDIRECT,	/* Device: Create obj.from data */
	MESSAGE_ENV_PUSHDATA,		/* Envelope: Push data */