Apache Portable Runtime
apr_jose.h
Go to the documentation of this file.
1 /* Licensed to the Apache Software Foundation (ASF) under one or more
2  * contributor license agreements. See the NOTICE file distributed with
3  * this work for additional information regarding copyright ownership.
4  * The ASF licenses this file to You under the Apache License, Version 2.0
5  * (the "License"); you may not use this file except in compliance with
6  * the License. You may obtain a copy of the License at
7  *
8  * http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 /**
17  * @file apr_jose.h
18  * @brief APR-UTIL JSON Object Signing and Encryption Library
19  */
20 #ifndef APR_JOSE_H
21 #define APR_JOSE_H
22 
23 /**
24  * @defgroup APR_Util_JOSE JSON Object Signing and Encryption
25  * @ingroup APR_Util
26  * @{
27  *
28  * The JOSE (JSON Object Signing and Encryption) library allows the encoding
29  * and decoding of JWS (JSON Web Signature), JWE (JSON Web Encryption), JWK
30  * (JSON Web Key) and JWT (JSON Web Token) objects, encoded using compact
31  * encoding, JSON encoding, or flattened JSON encoding.
32  *
33  * The following RFCs are supported:
34  *
35  * - https://tools.ietf.org/html/rfc7515 - JSON Web Signature (JWS)
36  * - https://tools.ietf.org/html/rfc7516 - JSON Web Encryption (JWE)
37  * - https://tools.ietf.org/html/rfc7517 - JSON Web Key (JWK)
38  * - https://tools.ietf.org/html/rfc7519 - JSON Web Token (JWT)
39  *
40  * Encryption, decryption, signing and verification are implemented as
41  * callbacks to the caller's specification, and are not included.
42  *
43  * When decrypting or verifying, the caller MUST verify that the 'alg'
44  * algorithm parameter in the JOSE message matches the algorithm expected
45  * by the implementation.
46  *
47  * It is recommended that the apr_crypto library be used to implement the
48  * callbacks, however an alternatively crypto library of the caller's choice
49  * may be used instead.
50  */
51 #include "apr.h"
52 #include "apr_pools.h"
53 #include "apu_errno.h"
54 #include "apr_strings.h"
55 #include "apr_buckets.h"
56 #include "apr_json.h"
57 
58 #ifdef __cplusplus
59 extern "C" {
60 #endif
61 
62 /**
63  * @package Apache JOSE library
64  *
65  */
66 
67 /**
68  * HMAC using SHA-256
69  *
70  * https://tools.ietf.org/html/rfc7518#section-3.1
71  */
72 #define APR_JOSE_JWA_HS256 "HS256"
73 
74 /**
75  * HMAC using SHA-384
76  *
77  * https://tools.ietf.org/html/rfc7518#section-3.1
78  */
79 #define APR_JOSE_JWA_HS384 "HS384"
80 
81 /**
82  * HMAC using SHA-512
83  *
84  * https://tools.ietf.org/html/rfc7518#section-3.1
85  */
86 #define APR_JOSE_JWA_HS512 "HS512"
87 
88 /**
89  * RSASSA-PKCS1-v1_5 using SHA-256
90  *
91  * https://tools.ietf.org/html/rfc7518#section-3.1
92  */
93 #define APR_JOSE_JWA_RS256 "RS256"
94 
95 /**
96  * RSASSA-PKCS1-v1_5 using SHA-384
97  *
98  * https://tools.ietf.org/html/rfc7518#section-3.1
99  */
100 #define APR_JOSE_JWA_RS384 "RS384"
101 
102 /**
103  * RSASSA-PKCS1-v1_5 using SHA-512
104  *
105  * https://tools.ietf.org/html/rfc7518#section-3.1
106  */
107 #define APR_JOSE_JWA_RS512 "RS512"
108 
109 /**
110  * ECDSA using P-256 and SHA-256
111  *
112  * https://tools.ietf.org/html/rfc7518#section-3.1
113  */
114 #define APR_JOSE_JWA_ES256 "ES256"
115 
116 /**
117  * ECDSA using P-384 and SHA-384
118  *
119  * https://tools.ietf.org/html/rfc7518#section-3.1
120  */
121 #define APR_JOSE_JWA_ES384 "ES384"
122 
123 /**
124  * ECDSA using P-512 and SHA-512
125  *
126  * https://tools.ietf.org/html/rfc7518#section-3.1
127  */
128 #define APR_JOSE_JWA_ES512 "ES512"
129 
130 /**
131  * RSASSA-PSS using SHA-256 and MGF1 with SHA-256
132  *
133  * https://tools.ietf.org/html/rfc7518#section-3.1
134  */
135 #define APR_JOSE_JWA_PS256 "PS256"
136 
137 /**
138  * RSASSA-PSS using SHA-384 and MGF1 with SHA-384
139  *
140  * https://tools.ietf.org/html/rfc7518#section-3.1
141  */
142 #define APR_JOSE_JWA_PS384 "PS384"
143 
144 /**
145  * RSASSA-PSS using SHA-512 and MGF1 with SHA-512
146  *
147  * https://tools.ietf.org/html/rfc7518#section-3.1
148  */
149 #define APR_JOSE_JWA_PS512 "PS512"
150 
151 /**
152  * No digital signature or MAC performed
153  *
154  * https://tools.ietf.org/html/rfc7518#section-3.1
155  */
156 #define APR_JOSE_JWA_NONE "none"
157 
158 /**
159  * "kty" (Key Type) Parameter
160  *
161  * https://tools.ietf.org/html/rfc7517#section-4.1
162  */
163 #define APR_JOSE_JWK_KEY_TYPE "kty"
164 
165 /**
166  * "use" (Public Key Use) Parameter
167  *
168  * https://tools.ietf.org/html/rfc7517#section-4.2
169  */
170 #define APR_JOSE_JWK_PUBLIC_KEY_USE "use"
171 
172 /**
173  * "key_ops" (Key Operations) Parameter
174  *
175  * https://tools.ietf.org/html/rfc7517#section-4.3
176  */
177 #define APR_JOSE_JWK_KEY_OPERATIONS "key_ops"
178 
179 /**
180  * "keys" Parameter
181  *
182  * https://tools.ietf.org/html/rfc7517#section-5.1
183  */
184 #define APR_JOSE_JWK_KEYS "keys"
185 
186 /**
187  * "alg" (Algorithm) Parameter
188  *
189  * https://tools.ietf.org/html/rfc7515#section-4.1.1
190  * https://tools.ietf.org/html/rfc7516#section-4.1.1
191  * https://tools.ietf.org/html/rfc7517#section-4.4
192  */
193 #define APR_JOSE_JWKSE_ALGORITHM "alg"
194 
195 /**
196  * "enc" (Encryption Algorithm) Header Parameter
197  *
198  * https://tools.ietf.org/html/rfc7516#section-4.1.2
199  */
200 #define APR_JOSE_JWE_ENCRYPTION "enc"
201 
202 /**
203  * "zip" (Compression Algorithm) Header Parameter
204  *
205  * https://tools.ietf.org/html/rfc7516#section-4.1.3
206  */
207 #define APR_JOSE_JWE_COMPRESSION "zip"
208 
209 /**
210  * "jku" (JWK Set URL) Header Parameter
211  *
212  * https://tools.ietf.org/html/rfc7515#section-4.1.2
213  * https://tools.ietf.org/html/rfc7516#section-4.1.4
214  */
215 #define APR_JOSE_JWSE_JWK_SET_URL "jku"
216 
217 /**
218  * "jwk" (JSON Web Key) Header Parameter
219  *
220  * https://tools.ietf.org/html/rfc7515#section-4.1.3
221  * https://tools.ietf.org/html/rfc7516#section-4.1.5
222  */
223 #define APR_JOSE_JWSE_JWK "jwk"
224 
225 /**
226  * "kid" (Key ID) Header Parameter
227  *
228  * https://tools.ietf.org/html/rfc7515#section-4.1.4
229  * https://tools.ietf.org/html/rfc7516#section-4.1.6
230  */
231 #define APR_JOSE_JWKSE_KEYID "kid"
232 
233 /**
234  * "x5u" (X.509 URL) Header Parameter
235  *
236  * https://tools.ietf.org/html/rfc7515#section-4.1.5
237  * https://tools.ietf.org/html/rfc7516#section-4.1.7
238  */
239 #define APR_JOSE_JWKSE_X509_URL "x5u"
240 
241 /**
242  * "x5c" (X.509 Certificate Chain) Header Parameter
243  *
244  * https://tools.ietf.org/html/rfc7515#section-4.1.6
245  * https://tools.ietf.org/html/rfc7516#section-4.1.8
246  */
247 #define APR_JOSE_JWKSE_X509_CHAIN "x5c"
248 
249 /**
250  * "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter
251  *
252  * https://tools.ietf.org/html/rfc7515#section-4.1.7
253  * https://tools.ietf.org/html/rfc7516#section-4.1.9
254  */
255 #define APR_JOSE_JWKSE_X509_SHA1_THUMBPRINT "x5t"
256 
257 /**
258  *"x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Header
259  * Parameter
260  *
261  * https://tools.ietf.org/html/rfc7515#section-4.1.8
262  * https://tools.ietf.org/html/rfc7516#section-4.1.10
263  */
264 #define APR_JOSE_JWKSE_X509_SHA256_THUMBPRINT "x5t#S256"
265 
266 /**
267  * "typ" (Type) Header Parameter
268  *
269  * https://tools.ietf.org/html/rfc7515#section-4.1.9
270  * https://tools.ietf.org/html/rfc7516#section-4.1.11
271  */
272 #define APR_JOSE_JWSE_TYPE "typ"
273 
274 /**
275  * "cty" (Content Type) Header Parameter
276  *
277  * https://tools.ietf.org/html/rfc7515#section-4.1.10
278  * https://tools.ietf.org/html/rfc7516#section-4.1.12
279  */
280 #define APR_JOSE_JWSE_CONTENT_TYPE "cty"
281 
282 /**
283  * "crit" (Critical) Header Parameter
284  *
285  * https://tools.ietf.org/html/rfc7515#section-4.1.11
286  * https://tools.ietf.org/html/rfc7516#section-4.1.13
287  */
288 #define APR_JOSE_JWSE_CRITICAL "crit"
289 
290 /**
291  * "payload" Parameter
292  *
293  * https://tools.ietf.org/html/rfc7515#section-7.2.1
294  */
295 #define APR_JOSE_JWS_PAYLOAD "payload"
296 
297 /**
298  * "signatures" Parameter
299  *
300  * https://tools.ietf.org/html/rfc7515#section-7.2.1
301  */
302 #define APR_JOSE_JWS_SIGNATURES "signatures"
303 
304 /**
305  * "protected" Parameter
306  *
307  * https://tools.ietf.org/html/rfc7515#section-7.2.1
308  * https://tools.ietf.org/html/rfc7516#section-7.2.1
309  */
310 #define APR_JOSE_JWSE_PROTECTED "protected"
311 
312 /**
313  * "header" Parameter
314  *
315  * https://tools.ietf.org/html/rfc7515#section-7.2.1
316  * https://tools.ietf.org/html/rfc7516#section-7.2.1
317  */
318 #define APR_JOSE_JWSE_HEADER "header"
319 
320 /**
321  * "signature" Parameter
322  *
323  * https://tools.ietf.org/html/rfc7515#section-7.2.1
324  */
325 #define APR_JOSE_JWS_SIGNATURE "signature"
326 
327 /**
328  * "unprotected" Parameter
329  *
330  * https://tools.ietf.org/html/rfc7516#section-7.2.1
331  */
332 #define APR_JOSE_JWE_UNPROTECTED "unprotected"
333 
334 /**
335  * "ciphertext" Parameter
336  *
337  * https://tools.ietf.org/html/rfc7516#section-7.2.1
338  */
339 #define APR_JOSE_JWE_CIPHERTEXT "ciphertext"
340 
341 /**
342  * "recipients" Parameter
343  *
344  * https://tools.ietf.org/html/rfc7516#section-7.2.1
345  */
346 #define APR_JOSE_JWE_RECIPIENTS "recipients"
347 
348 /**
349  * "encrypted_key" Parameter
350  *
351  * https://tools.ietf.org/html/rfc7516#section-7.2.1
352  */
353 #define APR_JOSE_JWE_EKEY "encrypted_key"
354 
355 /**
356  * "iv" Parameter
357  *
358  * https://tools.ietf.org/html/rfc7516#section-7.2.1
359  */
360 #define APR_JOSE_JWE_IV "iv"
361 
362 /**
363  * "tag" Parameter
364  *
365  * https://tools.ietf.org/html/rfc7516#section-7.2.1
366  */
367 #define APR_JOSE_JWE_TAG "tag"
368 
369 /**
370  * "aad" Parameter
371  *
372  * https://tools.ietf.org/html/rfc7516#section-7.2.1
373  */
374 #define APR_JOSE_JWE_AAD "aad"
375 
376 /**
377  * "iss" (Issuer) Claim
378  *
379  * https://tools.ietf.org/html/rfc7519#section-4.1.1
380  */
381 #define APR_JOSE_JWT_ISSUER "iss"
382 
383 /**
384  * "sub" (Subject) Claim
385  *
386  * https://tools.ietf.org/html/rfc7519#section-4.1.2
387  */
388 #define APR_JOSE_JWT_SUBJECT "sub"
389 
390 /**
391  * "aud" (Audience) Claim
392  *
393  * https://tools.ietf.org/html/rfc7519#section-4.1.3
394  */
395 #define APR_JOSE_JWT_AUDIENCE "aud"
396 
397 /**
398  * "exp" (Expiration Time) Claim
399  *
400  * https://tools.ietf.org/html/rfc7519#section-4.1.4
401  */
402 #define APR_JOSE_JWT_EXPIRATION_TIME "exp"
403 
404 /**
405  * "nbf" (Not Before) Claim
406  *
407  * https://tools.ietf.org/html/rfc7519#section-4.1.5
408  */
409 #define APR_JOSE_JWT_NOT_BEFORE "nbf"
410 
411 /**
412  * "iat" (Issued At) Claim
413  *
414  * https://tools.ietf.org/html/rfc7519#section-4.1.6
415  */
416 #define APR_JOSE_JWT_ISSUED_AT "iat"
417 
418 /**
419  * "jti" (JWT ID) Claim
420  *
421  * https://tools.ietf.org/html/rfc7519#section-4.1.7
422  */
423 #define APR_JOSE_JWT_ID "jti"
424 
425 /**
426  * "typ" (Type) Header Parameter representing a JWT
427  *
428  * https://tools.ietf.org/html/rfc7519#section-5.1
429  */
430 #define APR_JOSE_JWSE_TYPE_JWT "JWT"
431 
432 /**
433  * Default options.
434  */
435 #define APR_JOSE_FLAG_NONE 0
436 
437 /**
438  * Return the full JOSE structure, instead of innermost nested structure.
439  */
440 #define APR_JOSE_FLAG_DECODE_ALL 1
441 
442 /**
443  * When verifying or decrypting, break out of processing.
444  *
445  * If the verification or decryption failed, processing will be aborted
446  * with the given error.
447  *
448  * If the verification or decryption succeeded, processing will be considered
449  * successful and will move on to the nested structure.
450  */
451 #define APR_JOSE_FLAG_BREAK 2
452 
453 /**
454  * Forward declaration of the apr_jose_t structure.
455  */
456 typedef struct apr_jose_t apr_jose_t;
457 
458 /**
459  * Enum that represents the type of JOSE object.
460  */
461 typedef enum apr_jose_type_e {
462  /** No specific type. */
464  /** JSON Web Key (JWK) */
466  /** JSON Web Key Set (JWKS) */
468  /** JSON Web Signature (JWS) - compact encoding */
470  /** JSON Web Signature (JWS) - JSON encoding */
472  /** JSON Web Encryption (JWE) - compact encoding */
474  /** JSON Web Encryption (JWE) - JSON encoding */
476  /** JSON Web Token (JWT) */
478  /** Generic binary data */
480  /** Generic text data */
482  /** Generic JSON structure */
485 
486 /**
487  * Unsigned char data of a given length
488  */
489 typedef struct apr_jose_data_t {
490  /** Pointer to the data */
491  const unsigned char *data;
492  /** Length of the data */
493  apr_size_t len;
495 
496 /**
497  * Signed char data of a given length
498  */
499 typedef struct apr_jose_text_t {
500  /** Pointer to the text */
501  const char *text;
502  /** Length of the text */
503  apr_size_t len;
505 
506 /**
507  * JSON object
508  */
509 typedef struct apr_jose_json_t {
510  /** Parsed JSON structure. */
513 
514 /**
515  * A JSON web key
516  */
517 typedef struct apr_jose_jwk_t {
518  /** Parsed JWK JSON structure */
521 
522 /**
523  * A JSON web key set
524  */
525 typedef struct apr_jose_jwks_t {
526  /** Parsed JWK set JSON structure containing a JSON array */
529 
530 /**
531  * A single signature within a a JSON web signature.
532  */
533 typedef struct apr_jose_signature_t {
534  /** JWS Header */
536  /** JWS Protected Header */
538  /** JWS Signature */
540  /** Caller specified context */
541  void *ctx;
542  /** Result of verification for this signature */
545 
546 /**
547  * A JSON web signature
548  */
549 typedef struct apr_jose_jws_t {
550  /** JWS Compact / Flattened Signature */
552  /** JWS General Signatures */
554  /** JWS Payload */
557 
558 /**
559  * An encrypted payload within a a JSON web encryption.
560  */
561 typedef struct apr_jose_encryption_t {
562  /** JWE Shared Header */
564  /** JWE Protected Header */
565  apr_json_value_t *protected;
566  /** JWE Protected Header (basde64url) */
568  /** JWE Initialization Vector */
570  /** JWE AAD */
572  /** JWE AAD (base64url)*/
574  /** JWE Ciphertext */
576  /** JWE Authentication Tag */
579 
580 /**
581  * A single recipient within a a JSON web encryption.
582  */
583 typedef struct apr_jose_recipient_t {
584  /** JWE Header */
586  /** JWE Encrypted Key */
588  /** Caller specified context */
589  void *ctx;
590  /** Result of decryption for this recipient */
593 
594 /**
595  * A JSON web encryption
596  */
597 typedef struct apr_jose_jwe_t {
598  /** JWE Compact / Flattened Recipient */
600  /** JWE General Recipients */
602  /** JWE Encryption Parameters */
604  /** JWE Payload */
607 
608 /**
609  * A JSON web token
610  */
611 typedef struct apr_jose_jwt_t {
612  /** Claims associated with the JWT. */
615 
616 /**
617  * One JOSE structure to rule them all.
618  */
619 struct apr_jose_t {
620  /** pool used for allocation */
622  /** content type of this structure */
623  const char *typ;
624  /** content type of the payload */
625  const char *cty;
626  /** result of the operation */
628  /** type of the value */
630  /** actual value, depending on the type */
631  union {
632  apr_jose_jwk_t *jwk;
633  apr_jose_jwks_t *jwks;
634  apr_jose_jws_t *jws;
635  apr_jose_jwe_t *jwe;
636  apr_jose_jwt_t *jwt;
637  apr_jose_data_t *data;
638  apr_jose_text_t *text;
639  apr_jose_json_t *json;
640  } jose;
641 };
642 
643 /**
644  * Callbacks for encryption, decryption, signing and verifying.
645  */
646 typedef struct apr_jose_cb_t {
647  /**
648  * Callback that encrypts the content of the bucket brigade bb based
649  * on the parameters provided by the jwe->protected_header, and writes
650  * the resulting encrypted key to recipient->ekey, the initialisation vector
651  * to encryption->iv, the additional authentication data to encryption->aad, the
652  * cipher text to encryption->cipher, and the tag to encryption->tag.
653  *
654  * The encrypt function is expected to perform some or all of the
655  * following steps:
656  *
657  * 1. Determine the Key Management Mode employed by the algorithm used
658  * to determine the Content Encryption Key value. (This is the
659  * algorithm recorded in the "alg" (algorithm) Header Parameter of
660  * the resulting JWE.)
661  *
662  * 2. When Key Wrapping, Key Encryption, or Key Agreement with Key
663  * Wrapping are employed, generate a random CEK value. See RFC
664  * 4086 [RFC4086] for considerations on generating random values.
665  * The CEK MUST have a length equal to that required for the
666  * content encryption algorithm.
667  *
668  * 3. When Direct Key Agreement or Key Agreement with Key Wrapping are
669  * employed, use the key agreement algorithm to compute the value
670  * of the agreed upon key. When Direct Key Agreement is employed,
671  * let the CEK be the agreed upon key. When Key Agreement with Key
672  * Wrapping is employed, the agreed upon key will be used to wrap
673  * the CEK.
674  *
675  * 4. When Key Wrapping, Key Encryption, or Key Agreement with Key
676  * Wrapping are employed, encrypt the CEK to the recipient and let
677  * the result be the JWE Encrypted Key.
678  *
679  * 5. When Direct Key Agreement or Direct Encryption are employed, let
680  * the JWE Encrypted Key be the empty octet sequence.
681  *
682  * 6. When Direct Encryption is employed, let the CEK be the shared
683  * symmetric key.
684  *
685  * 8. If the JWE JSON Serialization is being used, repeat this process
686  * (steps 1-7) for each recipient.
687  *
688  * 9. Generate a random JWE Initialization Vector of the correct size
689  * for the content encryption algorithm (if required for the
690  * algorithm); otherwise, let the JWE Initialization Vector be the
691  * empty octet sequence.
692  *
693  * 11. If a "zip" parameter was included, compress the plaintext using
694  * the specified compression algorithm and let M be the octet
695  * sequence representing the compressed plaintext; otherwise, let M
696  * be the octet sequence representing the plaintext.
697  *
698  * 12. Create the JSON object(s) containing the desired set of Header
699  * Parameters, which together comprise the JOSE Header: one or more
700  * of the JWE Protected Header, the JWE Shared Unprotected Header,
701  * and the JWE Per-Recipient Unprotected Header.
702  *
703  * 13. Compute the Encoded Protected Header value BASE64URL(UTF8(JWE
704  * Protected Header)). If the JWE Protected Header is not present
705  * (which can only happen when using the JWE JSON Serialization and
706  * no "protected" member is present), let this value be the empty
707  * string.
708  *
709  * 14. Let the Additional Authenticated Data encryption parameter be
710  * ASCII(Encoded Protected Header). However, if a JWE AAD value is
711  * present (which can only be the case when using the JWE JSON
712  * Serialization), instead let the Additional Authenticated Data
713  * encryption parameter be ASCII(Encoded Protected Header || '.' ||
714  * BASE64URL(JWE AAD)).
715  *
716  * 15. Encrypt M using the CEK, the JWE Initialization Vector, and the
717  * Additional Authenticated Data value using the specified content
718  * encryption algorithm to create the JWE Ciphertext value and the
719  * JWE Authentication Tag (which is the Authentication Tag output
720  * from the encryption operation).
721  *
722  * @param bb Brigade containing data to be encrypted.
723  * @param jose The JOSE structure.
724  * @param recipient Structure containing details of the recipient of
725  * this message.
726  * @param encryption Structure to be filled out by the callback
727  * containing the encrypted message.
728  * @param ctx A context.
729  * @param pool The pool to use.
730  * @return APR_SUCCESS if encrypted successfully, APR_ENOTIMPL if
731  * encryption is not supported, or any other suitable error. The
732  * jose->result structure may be filled out with further details of
733  * any error.
734  */
736  apr_jose_recipient_t *recipient, apr_jose_encryption_t *encryption,
737  void *ctx, apr_pool_t *pool);
738  /**
739  * Callback that decrypts the ciphertext based
740  * on the parameters provided by the recipient and encryption parameters, and writes
741  * the resulting decrypted value to the bucket brigade. Base64url versions of the
742  * protected header and the aad are provided as part of the JWE decryption
743  * mechanism.
744  *
745  * For security reasons, this callback MUST verify that the algorithm
746  * present in the JWE matches the algorithm expected by the decoder.
747  *
748  * The decrypt function is expected to perform some or all of the
749  * following steps:
750  *
751  * 6. Determine the Key Management Mode employed by the algorithm
752  * specified by the "alg" (algorithm) Header Parameter.
753  *
754  * 7. Verify that the JWE uses a key known to the recipient.
755  *
756  * 8. When Direct Key Agreement or Key Agreement with Key Wrapping are
757  * employed, use the key agreement algorithm to compute the value
758  * of the agreed upon key. When Direct Key Agreement is employed,
759  * let the CEK be the agreed upon key. When Key Agreement with Key
760  * Wrapping is employed, the agreed upon key will be used to
761  * decrypt the JWE Encrypted Key.
762  *
763  * 9. When Key Wrapping, Key Encryption, or Key Agreement with Key
764  * Wrapping are employed, decrypt the JWE Encrypted Key to produce
765  * the CEK. The CEK MUST have a length equal to that required for
766  * the content encryption algorithm. Note that when there are
767  * multiple recipients, each recipient will only be able to decrypt
768  * JWE Encrypted Key values that were encrypted to a key in that
769  * recipient's possession. It is therefore normal to only be able
770  * to decrypt one of the per-recipient JWE Encrypted Key values to
771  * obtain the CEK value. Also, see Section 11.5 for security
772  * considerations on mitigating timing attacks.
773  *
774  * 10. When Direct Key Agreement or Direct Encryption are employed,
775  * verify that the JWE Encrypted Key value is an empty octet
776  * sequence.
777  *
778  * 11. When Direct Encryption is employed, let the CEK be the shared
779  * symmetric key.
780  *
781  * 12. Record whether the CEK could be successfully determined for this
782  * recipient or not.
783  *
784  * 13. If the JWE JSON Serialization is being used, repeat this process
785  * (steps 4-12) for each recipient contained in the representation.
786  *
787  * 14. Compute the Encoded Protected Header value BASE64URL(UTF8(JWE
788  * Protected Header)). If the JWE Protected Header is not present
789  * (which can only happen when using the JWE JSON Serialization and
790  * no "protected" member is present), let this value be the empty
791  * string.
792  *
793  * 15. Let the Additional Authenticated Data encryption parameter be
794  * ASCII(Encoded Protected Header). However, if a JWE AAD value is
795  * present (which can only be the case when using the JWE JSON
796  * Serialization), instead let the Additional Authenticated Data
797  * encryption parameter be ASCII(Encoded Protected Header || '.' ||
798  * BASE64URL(JWE AAD)).
799  *
800  * 16. Decrypt the JWE Ciphertext using the CEK, the JWE Initialization
801  * Vector, the Additional Authenticated Data value, and the JWE
802  * Authentication Tag (which is the Authentication Tag input to the
803  * calculation) using the specified content encryption algorithm,
804  * returning the decrypted plaintext and validating the JWE
805  * Authentication Tag in the manner specified for the algorithm,
806  * rejecting the input without emitting any decrypted output if the
807  * JWE Authentication Tag is incorrect.
808  *
809  * 17. If a "zip" parameter was included, uncompress the decrypted
810  * plaintext using the specified compression algorithm.
811  *
812  * @param bb Brigade where decrypted data is to be written.
813  * @param jose The JOSE structure.
814  * @param recipient Structure containing details of the recipient of
815  * this message, to be used to decrypt the message.
816  * @param encryption Structure containing the encrypted message.
817  * @param header The JOSE protected header.
818  * @param p64 The JOSE protected header in original BASE64URL format,
819  * for use during decryption.
820  * @param aad64 The JOSE additional authenticated data in original
821  * BASE64URL format, for use during decryption.
822  * @param ctx A context.
823  * @param dflags A pointer to a flag. Set to APR_JOSE_FLAG_NONE for
824  * decryption to continue to the next recipient in the JWE, or
825  * APR_JOSE_FLAG_BREAK to stop decrypting further recipients.
826  * @param pool The pool to use.
827  * @return APR_SUCCESS if decrypted successfully, APR_ENOTIMPL if
828  * decryption is not supported, or any other suitable error. The
829  * jose->result structure may be filled out with further details of
830  * any error.
831  */
833  apr_jose_recipient_t *recipient, apr_jose_encryption_t *encryption,
834  apr_json_value_t *header, apr_jose_text_t *ph64,
835  apr_jose_text_t *aad64, void *ctx, int *dflags, apr_pool_t *pool);
836  /**
837  * Callback that signs the content of the bucket brigade bb based
838  * on the parameters provided by the signature protected header, and writes
839  * the resulting binary signature to signature->sig.
840  *
841  * The sign function is expected to perform some or all of the
842  * following steps:
843  *
844  * 5. Compute the JWS Signature in the manner defined for the
845  * particular algorithm being used over the JWS Signing Input
846  * ASCII(BASE64URL(UTF8(JWS Protected Header)) || '.' ||
847  * BASE64URL(JWS Payload)). The "alg" (algorithm) Header Parameter
848  * MUST be present in the JOSE Header, with the algorithm value
849  * accurately representing the algorithm used to construct the JWS
850  * Signature.
851  *
852  * @param bb Brigade containing data to be signed.
853  * @param jose The JOSE structure.
854  * @param signature Structure to be filled out by the callback
855  * containing the signature of the message.
856  * @param ctx A context.
857  * @param pool The pool to use.
858  * @return APR_SUCCESS if signed successfully, APR_ENOTIMPL if
859  * signing is not supported, or any other suitable error. The
860  * jose->result structure may be filled out with further details of
861  * any error.
862  */
864  apr_jose_signature_t *signature, void *ctx, apr_pool_t *pool);
865  /**
866  * Callback that verifies the content of the bucket brigade bb based
867  * on the parameters provided by the signature protected header and
868  * signature->sig.
869  *
870  * For security reasons, this callback MUST verify that the algorithm
871  * present in the JWS matches the algorithm expected by the decoder.
872  *
873  * The verify function is expected to perform some or all of the
874  * following steps:
875  *
876  * 8. Validate the JWS Signature against the JWS Signing Input
877  * ASCII(BASE64URL(UTF8(JWS Protected Header)) || '.' ||
878  * BASE64URL(JWS Payload)) in the manner defined for the algorithm
879  * being used, which MUST be accurately represented by the value of
880  * the "alg" (algorithm) Header Parameter, which MUST be present.
881  * See Section 10.6 for security considerations on algorithm
882  * validation. Record whether the validation succeeded or not.
883  *
884  * 9. If the JWS JSON Serialization is being used, repeat this process
885  * (steps 4-8) for each digital signature or MAC value contained in
886  * the representation.
887  *
888  * 10. If none of the validations in step 9 succeeded, then the JWS MUST
889  * be considered invalid. Otherwise, in the JWS JSON Serialization
890  * case, return a result to the application indicating which of the
891  * validations succeeded and failed. In the JWS Compact
892  * Serialization case, the result can simply indicate whether or not
893  * the JWS was successfully validated.
894  *
895  * @param bb Brigade containing data to be verified.
896  * @param jose The JOSE structure.
897  * @param signature Structure containing the signature to be verified.
898  * @param ctx A context.
899  * @param dflags A pointer to a flag. Set to APR_JOSE_FLAG_NONE for
900  * verification to continue to the next recipient in the JWE, or
901  * APR_JOSE_FLAG_BREAK to stop verifying further recipients.
902  * @param pool The pool to use.
903  * @return APR_SUCCESS if verified successfully, APR_ENOTIMPL if
904  * verification is not supported, or any other suitable error. The
905  * jose->result structure may be filled out with further details of
906  * any error.
907  */
909  apr_jose_signature_t *signature, void *ctx, int *vflags,
910  apr_pool_t *pool);
911  /** Context to be passed to the callback. */
912  void *ctx;
914 
915 /**
916  * @brief Get the result of the last operation on the jose. If the result
917  * is NULL, the operation was successful.
918  * @param jose - context pointer
919  * @return The apu_err_t is returned.
920  */
922  __attribute__((nonnull(1)));
923 
924 /**
925  * Make a generic JOSE structure.
926  * @param jose If jose points at NULL, a JOSE structure will be
927  * created. If the jose pointer is not NULL, the structure will
928  * be reused.
929  * @param type the type of structure to create.
930  * @param pool pool used to allocate the result from.
931  * @return The apr_jose_t is returned.
932  */
934  apr_pool_t *pool)
935  __attribute__((nonnull(3)));
936 
937 /**
938  * Make a JSON Web Key for encoding or decoding.
939  * @param jose If jose points at NULL, a JOSE structure will be
940  * created. If the jose pointer is not NULL, the structure will
941  * be reused.
942  * @param key the json representing the key. May be NULL.
943  * @param pool pool used to allocate the result from.
944  * @return The apr_jose_t is returned.
945  */
947  apr_json_value_t *key, apr_pool_t *pool)
948  __attribute__((nonnull(3)));
949 
950 /**
951  * Make a JSON Web Key Set.
952  * @param jose If jose points at NULL, a JOSE structure will be
953  * created. If the jose pointer is not NULL, the structure will
954  * be reused.
955  * @param keys the array of keys in JSON format. May be NULL.
956  * @param pool pool used to allocate the result from.
957  * @return The apr_jose_t is returned.
958  */
960  apr_json_value_t *keys, apr_pool_t *pool)
961  __attribute__((nonnull(3)));
962 
963 /**
964  * Make a signature structure for JWS.
965  *
966  * @param signature the result.
967  * @param header the unprotected header.
968  * @param protected the protected header.
969  * @param ctx user supplied context
970  * @param pool the pool to use.
971  * @return The apr_jose_signature_t is returned.
972  */
974  apr_jose_signature_t *signature, apr_json_value_t *header,
975  apr_json_value_t *protected, void *ctx, apr_pool_t *pool)
976  __attribute__((nonnull(5)));
977 
978 /**
979  * Make a recipient structure for JWE.
980  *
981  * @param recipient the result.
982  * @param unprotected the unprotected header.
983  * @param ctx user supplied context
984  * @param pool the pool to use.
985  * @return The apr_jose_recipient_t is returned.
986  */
988  apr_json_value_t *unprotected, void *ctx, apr_pool_t *pool)
989  __attribute__((nonnull(4)));
990 
991 /**
992  * Make an encryption structure for JWE.
993  *
994  * @param encryption the result.
995  * @param unprotected the unprotected shared header.
996  * @param protected the protected header.
997  * @param pool the pool to use.
998  * @return The apr_jose_encryption_t is returned.
999  */
1001  apr_json_value_t *unprotected, apr_json_value_t *protected,
1002  apr_pool_t *pool)
1003  __attribute__((nonnull(4)));
1004 
1005 /**
1006  * Make a compact encoded JWE.
1007  * @param jose If jose points at NULL, a JOSE structure will be
1008  * created. If the jose pointer is not NULL, the structure will
1009  * be reused.
1010  * @param recipient the recipient for compact / flattened JWE.
1011  * @param recipients the recipients array for general JWE.
1012  * @param encryption the encryption structure.
1013  * @param payload the JOSE payload to encrypt.
1014  * @param pool pool used to allocate the result from.
1015  * @return The apr_jose_t is returned.
1016  */
1018  apr_jose_recipient_t *recipient, apr_array_header_t *recipients,
1019  apr_jose_encryption_t *encryption, apr_jose_t *payload,
1020  apr_pool_t *pool)
1021  __attribute__((nonnull(6)));
1022 
1023 /**
1024  * Make a JSON encoded JWE.
1025  * @param jose If jose points at NULL, a JOSE structure will be
1026  * created. If the jose pointer is not NULL, the structure will
1027  * be reused.
1028  * @param recipient the recipient for compact / flattened JWE.
1029  * @param recipients the recipients array for general JWE.
1030  * @param encryption the encryption structure.
1031  * @param payload the JOSE payload to encrypt.
1032  * @param pool pool used to allocate the result from.
1033  * @return The apr_jose_t is returned.
1034  */
1036  apr_jose_recipient_t *recipient,
1037  apr_array_header_t *recipients, apr_jose_encryption_t *encryption,
1038  apr_jose_t *payload, apr_pool_t *pool)
1039  __attribute__((nonnull(6)));
1040 
1041 /**
1042  * Make a compact encoded JWS.
1043  * @param jose If jose points at NULL, a JOSE structure will be
1044  * created. If the jose pointer is not NULL, the structure will
1045  * be reused.
1046  * @param signature the header / protected header / signature used with compact or flattened syntax. May be NULL.
1047  * @param signatures array of header / protected header / signature used with general JSON syntax.
1048  * @param payload the payload to be wrapped by this JWS.
1049  * @param pool pool used to allocate the result from.
1050  * @return The apr_jose_t is returned.
1051  */
1053  apr_jose_signature_t *signature, apr_array_header_t *signatures,
1054  apr_jose_t *payload, apr_pool_t *pool)
1055  __attribute__((nonnull(5)));
1056 
1057 /**
1058  * Make a JSON encoded JWS.
1059  * @param jose If jose points at NULL, a JOSE structure will be
1060  * created. If the jose pointer is not NULL, the structure will
1061  * be reused.
1062  * @param signature the header / protected header / signature used with compact or flattened syntax. May be NULL.
1063  * @param signatures array of header / protected header / signature used with general JSON syntax.
1064  * @param payload the payload to be wrapped by this JWS.
1065  * @param pool pool used to allocate the result from.
1066  * @return The apr_jose_t is returned.
1067  */
1069  apr_jose_signature_t *signature, apr_array_header_t *signatures,
1070  apr_jose_t *payload, apr_pool_t *pool)
1071  __attribute__((nonnull(5)));
1072 
1073 /**
1074  * Make a JWT claims payload.
1075  *
1076  * To create a useful JWT, this payload needs to be wrapped in a JWS
1077  * or JWE (or both), as required by the caller.
1078  * @param jose If jose points at NULL, a JOSE structure will be
1079  * created. If the jose pointer is not NULL, the structure will
1080  * be reused.
1081  * @param claims the claims to sign.
1082  * @param pool pool used to allocate the result from.
1083  * @return The apr_jose_t is returned.
1084  */
1086  apr_json_value_t *claims, apr_pool_t *pool)
1087  __attribute__((nonnull(3)));
1088 
1089 /**
1090  * Make a data buffer for encoding from the given data and length.
1091  * @param jose If jose points at NULL, a JOSE structure will be
1092  * created. If the jose pointer is not NULL, the structure will
1093  * be reused.
1094  * @param typ the content type of this data.
1095  * @param in the plaintext to sign.
1096  * @param inlen length of the plaintext.
1097  * @param pool pool used to allocate the result from.
1098  * @return The apr_jose_t is returned.
1099  */
1101  const unsigned char *in, apr_size_t inlen, apr_pool_t *pool)
1102  __attribute__((nonnull(5)));
1103 
1104 /**
1105  * Make a UTF-8 text buffer for encoding from the given string
1106  * and length.
1107  * @param jose If jose points at NULL, a JOSE structure will be
1108  * created. If the jose pointer is not NULL, the structure will
1109  * be reused.
1110  * @param cty the content type.
1111  * @param in the UTF-8 encoded text string.
1112  * @param inlen length of the UTF-8 encoded text string.
1113  * @param pool pool used to allocate the result from.
1114  * @return The apr_jose_t is returned.
1115  */
1117  const char *in, apr_size_t inlen, apr_pool_t *pool)
1118  __attribute__((nonnull(5)));
1119 
1120 /**
1121  * Make a json structure for encoding.
1122  * @param jose If jose points at NULL, a JOSE structure will be
1123  * created. If the jose pointer is not NULL, the structure will
1124  * be reused.
1125  * @param cty the content type.
1126  * @param json the json object to add.
1127  * @param pool pool used to allocate the result from.
1128  * @return The apr_jose_t is returned.
1129  */
1131  apr_json_value_t *json, apr_pool_t *pool)
1132  __attribute__((nonnull(4)));
1133 
1134 /**
1135  * Sign or encrypt the apr_jose_t, and write it to the brigade.
1136  * @param brigade brigade the result will be appended to.
1137  * @param flush The flush function to use if the brigade is full
1138  * @param ctx The structure to pass to the flush function
1139  * @param jose the JOSE to encode.
1140  * @param cb callbacks for sign and encrypt.
1141  * @param pool pool to be used.
1142  * @return APR_SUCCESS is returned if encoding was successful, otherwise
1143  * an APR status code, along with an apu_err_t with an explanation
1144  * allocated from jose->pool.
1145  */
1147  apr_brigade_flush flush, void *ctx, apr_jose_t *jose,
1148  apr_jose_cb_t *cb, apr_pool_t *pool)
1149  __attribute__((nonnull(1, 4, 6)));
1150 
1151 /**
1152  * Decode, decrypt and verify the utf8-encoded JOSE string into apr_jose_t.
1153  *
1154  * The JOSE structure may be nested to the given limit.
1155  * @param jose If jose points at NULL, a JOSE structure will be
1156  * created. If the jose pointer is not NULL, the structure will
1157  * be reused.
1158  * @param typ content type of this object.
1159  * @param brigade the JOSE structure to decode.
1160  * @param cb callbacks for verify and decrypt.
1161  * @param level depth limit of JOSE and JSON nesting.
1162  * @param flags APR_JOSE_FLAG_NONE to return payload only. APR_JOSE_FLAG_DECODE_ALL
1163  * to return the full JWS/JWE structure.
1164  * @param pool pool used to allocate the result from.
1165  */
1167  apr_bucket_brigade *brigade, apr_jose_cb_t *cb, int level, int flags,
1168  apr_pool_t *pool)
1169  __attribute__((nonnull(1, 3, 7)));
1170 
1171 
1172 #ifdef __cplusplus
1173 }
1174 #endif
1175 /** @} */
1176 #endif /* APR_JOSE_H */
APR Platform Definitions.
APR-UTIL Buckets/Bucket Brigades.
APR-UTIL JSON Library.
APR memory allocation.
APR Strings library.
APR-Util Error Codes.
apr_status_t(* apr_brigade_flush)(apr_bucket_brigade *bb, void *ctx)
Definition: apr_buckets.h:287
apr_jose_t * apr_jose_jws_make(apr_jose_t *jose, apr_jose_signature_t *signature, apr_array_header_t *signatures, apr_jose_t *payload, apr_pool_t *pool)
apr_jose_signature_t * apr_jose_signature_make(apr_jose_signature_t *signature, apr_json_value_t *header, apr_json_value_t *protected, void *ctx, apr_pool_t *pool)
struct apr_jose_jwe_t apr_jose_jwe_t
apr_jose_t * apr_jose_jwt_make(apr_jose_t *jose, apr_json_value_t *claims, apr_pool_t *pool)
apr_jose_t * apr_jose_text_make(apr_jose_t *jose, const char *cty, const char *in, apr_size_t inlen, apr_pool_t *pool)
struct apr_jose_jwt_t apr_jose_jwt_t
struct apr_jose_encryption_t apr_jose_encryption_t
apr_jose_t * apr_jose_jwe_json_make(apr_jose_t *jose, apr_jose_recipient_t *recipient, apr_array_header_t *recipients, apr_jose_encryption_t *encryption, apr_jose_t *payload, apr_pool_t *pool)
apr_jose_t * apr_jose_data_make(apr_jose_t *jose, const char *typ, const unsigned char *in, apr_size_t inlen, apr_pool_t *pool)
apr_jose_t * apr_jose_jwk_make(apr_jose_t *jose, apr_json_value_t *key, apr_pool_t *pool)
struct apr_jose_cb_t apr_jose_cb_t
apr_jose_encryption_t * apr_jose_encryption_make(apr_jose_encryption_t *encryption, apr_json_value_t *unprotected, apr_json_value_t *protected, apr_pool_t *pool)
apr_jose_t * apr_jose_make(apr_jose_t *jose, apr_jose_type_e type, apr_pool_t *pool)
struct apr_jose_recipient_t apr_jose_recipient_t
apr_jose_recipient_t * apr_jose_recipient_make(apr_jose_recipient_t *recipient, apr_json_value_t *unprotected, void *ctx, apr_pool_t *pool)
struct apr_jose_text_t apr_jose_text_t
apr_jose_type_e
Definition: apr_jose.h:461
apr_jose_t * apr_jose_jws_json_make(apr_jose_t *jose, apr_jose_signature_t *signature, apr_array_header_t *signatures, apr_jose_t *payload, apr_pool_t *pool)
apr_jose_t * apr_jose_jwks_make(apr_jose_t *jose, apr_json_value_t *keys, apr_pool_t *pool)
struct apr_jose_data_t apr_jose_data_t
apr_status_t apr_jose_encode(apr_bucket_brigade *brigade, apr_brigade_flush flush, void *ctx, apr_jose_t *jose, apr_jose_cb_t *cb, apr_pool_t *pool)
struct apr_jose_json_t apr_jose_json_t
struct apr_jose_jws_t apr_jose_jws_t
apu_err_t * apr_jose_error(apr_jose_t *jose)
Get the result of the last operation on the jose. If the result is NULL, the operation was successful...
struct apr_jose_signature_t apr_jose_signature_t
apr_jose_t * apr_jose_jwe_make(apr_jose_t *jose, apr_jose_recipient_t *recipient, apr_array_header_t *recipients, apr_jose_encryption_t *encryption, apr_jose_t *payload, apr_pool_t *pool)
apr_jose_t * apr_jose_json_make(apr_jose_t *jose, const char *cty, apr_json_value_t *json, apr_pool_t *pool)
struct apr_jose_jwks_t apr_jose_jwks_t
apr_status_t apr_jose_decode(apr_jose_t **jose, const char *typ, apr_bucket_brigade *brigade, apr_jose_cb_t *cb, int level, int flags, apr_pool_t *pool)
struct apr_jose_jwk_t apr_jose_jwk_t
@ APR_JOSE_TYPE_JSON
Definition: apr_jose.h:483
@ APR_JOSE_TYPE_JWS_JSON
Definition: apr_jose.h:471
@ APR_JOSE_TYPE_JWKS
Definition: apr_jose.h:467
@ APR_JOSE_TYPE_DATA
Definition: apr_jose.h:479
@ APR_JOSE_TYPE_JWE
Definition: apr_jose.h:473
@ APR_JOSE_TYPE_JWE_JSON
Definition: apr_jose.h:475
@ APR_JOSE_TYPE_JWT
Definition: apr_jose.h:477
@ APR_JOSE_TYPE_TEXT
Definition: apr_jose.h:481
@ APR_JOSE_TYPE_JWK
Definition: apr_jose.h:465
@ APR_JOSE_TYPE_NONE
Definition: apr_jose.h:463
@ APR_JOSE_TYPE_JWS
Definition: apr_jose.h:469
int apr_status_t
Definition: apr_errno.h:44
#define APR_DECLARE(type)
Definition: apr.h:516
struct apr_pool_t apr_pool_t
Definition: apr_pools.h:60
Definition: apr_tables.h:62
Definition: apr_buckets.h:263
Definition: apr_jose.h:646
void * ctx
Definition: apr_jose.h:912
apr_status_t(* encrypt)(apr_bucket_brigade *bb, apr_jose_t *jose, apr_jose_recipient_t *recipient, apr_jose_encryption_t *encryption, void *ctx, apr_pool_t *pool)
Definition: apr_jose.h:735
apr_status_t(* sign)(apr_bucket_brigade *bb, apr_jose_t *jose, apr_jose_signature_t *signature, void *ctx, apr_pool_t *pool)
Definition: apr_jose.h:863
apr_status_t(* verify)(apr_bucket_brigade *bb, apr_jose_t *jose, apr_jose_signature_t *signature, void *ctx, int *vflags, apr_pool_t *pool)
Definition: apr_jose.h:908
apr_status_t(* decrypt)(apr_bucket_brigade *bb, apr_jose_t *jose, apr_jose_recipient_t *recipient, apr_jose_encryption_t *encryption, apr_json_value_t *header, apr_jose_text_t *ph64, apr_jose_text_t *aad64, void *ctx, int *dflags, apr_pool_t *pool)
Definition: apr_jose.h:832
Definition: apr_jose.h:489
const unsigned char * data
Definition: apr_jose.h:491
apr_size_t len
Definition: apr_jose.h:493
Definition: apr_jose.h:561
apr_jose_data_t iv
Definition: apr_jose.h:569
apr_jose_data_t cipher
Definition: apr_jose.h:575
apr_json_value_t * unprotected
Definition: apr_jose.h:563
apr_jose_data_t aad
Definition: apr_jose.h:571
apr_jose_text_t aad64
Definition: apr_jose.h:573
apr_jose_text_t protected64
Definition: apr_jose.h:567
apr_jose_data_t tag
Definition: apr_jose.h:577
Definition: apr_jose.h:509
apr_json_value_t * json
Definition: apr_jose.h:511
Definition: apr_jose.h:597
apr_jose_t * payload
Definition: apr_jose.h:605
apr_jose_encryption_t * encryption
Definition: apr_jose.h:603
apr_jose_recipient_t * recipient
Definition: apr_jose.h:599
apr_array_header_t * recipients
Definition: apr_jose.h:601
Definition: apr_jose.h:517
apr_json_value_t * key
Definition: apr_jose.h:519
Definition: apr_jose.h:525
apr_json_value_t * keys
Definition: apr_jose.h:527
Definition: apr_jose.h:549
apr_array_header_t * signatures
Definition: apr_jose.h:553
apr_jose_t * payload
Definition: apr_jose.h:555
apr_jose_signature_t * signature
Definition: apr_jose.h:551
Definition: apr_jose.h:611
apr_json_value_t * claims
Definition: apr_jose.h:613
Definition: apr_jose.h:583
apr_json_value_t * header
Definition: apr_jose.h:585
apr_jose_data_t ekey
Definition: apr_jose.h:587
apr_status_t status
Definition: apr_jose.h:591
void * ctx
Definition: apr_jose.h:589
Definition: apr_jose.h:533
void * ctx
Definition: apr_jose.h:541
apr_json_value_t * header
Definition: apr_jose.h:535
apr_json_value_t * protected_header
Definition: apr_jose.h:537
apr_status_t status
Definition: apr_jose.h:543
apr_jose_data_t sig
Definition: apr_jose.h:539
Definition: apr_jose.h:619
apr_pool_t * pool
Definition: apr_jose.h:621
const char * cty
Definition: apr_jose.h:625
const char * typ
Definition: apr_jose.h:623
union apr_jose_t::@4 jose
apr_jose_type_e type
Definition: apr_jose.h:629
apu_err_t result
Definition: apr_jose.h:627
Definition: apr_jose.h:499
const char * text
Definition: apr_jose.h:501
apr_size_t len
Definition: apr_jose.h:503
Definition: apr_json.h:123
Definition: apu_errno.h:289