/* DISABLE check_long_lines */

/* Copyright (c) 1996, 2026, Oracle and/or its affiliates.*/
/* All rights reserved.*/

/*
 * 
 */

/* 
 * NAME
 *    nzt.h
 * 
 * DESCRIPTION
 *    Toolkit public declarations.
 *    
 * PUBLIC FUNCTIONS
 *    nztwOpenWallet           - Open a wallet based on a WRL and pwd.
 *    nztwCloseWallet          - Close a wallet.
 *    nztwRetrievePersonaCopy  - Retieve a copy of a particular persona.
 *    nzteOpenPersona          - Open a persona.
 *    nzteClosePersona         - Close a persona.
 *    nzteDestroyPersona       - Destroy a persona.
 *    nzteRetrieveTrustedIdentCopy - Retrieves a trusted identity frompersona
 *    nztePriKey               - Get the Private Key (X509 Only)
 *    nzteMyCert               - Get the Certificate (X509 only)
 *    nztiAbortIdentity        - Discard an unstored identity.
 *    nztbbReuseBlock          - Reuse a buffer block.           
 *    nztbbPurgeBlock          - Purge the memory used within a buffer block.
 *    nztcts_CipherSpecToStr   - Converts the Cipher Spec Code To String
 *    nztiae_IsEncrEnabled     - Checks to see if Encryption is Enabled
 *                               in the current Cipher Spec.
 *    nztiae_IsHashEnabled     - Checks to see if Hashing is Enabled
 *                               in the current Cipher Spec.
 *    nztwGetCertInfo          - Get peer certificate info
 *    nzICE_Install_Cert_ext   - Installs a Cert into a wallet with Trustflag
 *                               value set for the certificate.
 *
 * NOTE: the '+' indicates that these functions are UNSUPPORTED at this time.
 * 
 * NOTES
 *    
 * MODIFIED
 *    apfwkr     02/13/26 - CI #38965522 of anna_bug-37213411 from main
 *    bwolfgan   03/26/25 - Rename OQS into PQC
 *    bwolfgan   10/11/24 - Add OQS support
 *    anna       11/22/24 - ER 37213411 - NZ API TO RETRIEVE CERTIFICATE
 *    rchahal    10/03/23 - ER 35837962: cert selection using alias, thumbprint
 *    mmiyashi   08/06/21 - Proj 89547: System default certificate store
 *    nitnagpa   05/24/21 - Removing Plateform Dependency for Date
 *    nitnagpa   04/28/21 - OSS-5987
 *    anna       10/21/20 - Code Cleanup - Crypto-962
 *    anna       06/12/20 - Code Cleanup Crypto-736
 *    bapalava   06/04/20 - NZ cleaup task - Jira-751
 *    anna       06/03/20 - Code Cleanup Crypto-733,735,737,743
 *    anna       05/29/20 - Code Cleanup Crypto-752
 *    hyunjele   05/13/20 - CRYPTO-387: Remove dead code under macro NZDEPRECATED,
 *                          MES_DELETE, MES_OBSOLETE, MES_LATER_OBSOLETE and
 *                          NZMES_OBSOLETE
 *    anna       05/11/20 - code cleanup (Crypto-229)
 *    anna       04/23/20 - Code cleanup(Crypto-282): deadcode under macro
 *                          NZ_OLD_TOOLS
 *    anna       02/20/20 - nztbbSetBlock is obsolete bug-30744217
 *    zighuang   04/02/20 - Bug #30743598: Remove method nztbbSetBlock. 
 *    anna       02/13/20 - public APIs in private header nztn.h moved here
 *                          [crypto-214]
 *    abjuneja   09/11/13 - Bug 14245960 - Wallet encryption algo upgrade
 *    nidgarg    05/07/13 - TF Support: Add functions for Trustflags
 *    shiahuan   11/28/07 - 
 *    skalyana   08/15/07 - 
 *    pkale      09/28/06 - Bug 5565668: Removed __STDC__
 *    tnallath   09/22/05 - 
 *    rchahal    07/27/04 - add keyusage 
 *    srtata     11/10/03 - fix nztSetAppDefaultLocation header 
 *    rchahal    10/15/03 - bug 2513821 
 *    rchahal    11/11/02 - pkcs11 support
 *    akoyfman   07/05/02 - adding secret store to persona
 *    supriya    10/11/01 - Fix for bug # 2015732
 *    ajacobs    04/04/01 - make NZT_REGISTRY_WRL always available
 *    ajacobs    03/06/01 - olint fix
 *    ajacobs    03/02/01 - Add GetCertInfo
 *    supriya    02/23/01 - Move nzttKPUsage from nzt0.h
 *    rchahal    01/26/01 - olint fixes
 *    supriya    12/07/00 - Change fn name
 *    supriya    12/01/00 - Certificate API's needed for iAS
 *    supriya    06/19/00 - Adding definitions for MCS and ENTR
 *    lkethana   05/31/00 - multiple cert support
 *    skanjila   06/25/99 - Remove nztcts_CipherSpecToStr() to NZOS.
 *    skanjila   06/23/99 - Change API of nztcts_CipherSpecToStr.
 *    lkethana   06/18/99 - rem nztIPrivateAlloc, etc
 *    lkethana   06/10/99 - changing size_t to ub4
 *    lkethana   06/02/99 - add api for getting auth/encry/hash capability of c
 *    arswamin   12/28/98 - add NZT_MAX_MD5.
 *    arswamin   12/21/98 - change signature of compareDN
 *    qdinh      12/21/98 - change size_t to ub4.
 *    inetwork   11/22/98 - Removing NZDEPRECATED definition
 *    amthakur   09/14/98 - deprecating and updating the c-structures.
 *    arswamin   09/24/98 - adding NZTTWRL_NULL for SSO support.
 *    amthakur   07/30/98 - changing the prototype of nztGetCertChain.
 *    qdinh      05/01/98 - add NZTTIDENTTYPE_INVALID_TYPE
 *    qdinh      04/17/98 - add NZTTWRL_ORACLE.
 *    ascott     10/08/97 - implement nztiStoreTrustedIdentity
 *    ascott     10/07/97 - add nztiGetIdentityDesc
 *    ascott     09/28/97 - clarify prototype comments and error codes
 *    ascott     09/05/97 - update identity: create, destroy, duplicate
 *    ascott     08/21/97 - add GetCert and GetPriKey
 *    ascott     08/07/97 - add other WRL settings
 *    asriniva   03/25/97 - Add ANSI prototypes
 *    rwessman   03/19/97 - Added prototypes for nztific_FreeIdentityContent()
 *    asriniva   03/11/97 - Fix olint errors
 *    sdange     02/28/97 - Removed inclusion of nz0decl.h
 *    sdange     02/18/97 - Moved nzt specific declarations from nz0decl.h
 *    asriniva   01/21/97 - Remove prototypes.
 *    asriniva   10/31/96 - Include oratypes.h
 *    asriniva   10/15/96 - Declare buffer block helper functions
 *    asriniva   10/08/96 - First pass at wallet open/close
 *    asriniva   10/04/96 - Add random number seed function
 *    asriniva   10/03/96 - Reorder parameters in nztbbSetBlock
 *    asriniva   10/03/96 - Keep editing.
 *    asriniva   10/03/96 - Continued edits.
 *    asriniva   10/02/96 - Continue editing.
 *    asriniva   09/26/96 -
 */
   
/* ENABLE check_long_lines */

/**
 * \ingroup NZ_HEADERS
 * @{
 * @file nzt.h
 *
 */

#ifndef NZT_ORACLE
#define NZT_ORACLE

#ifndef ORATYPES
# include <oratypes.h>
#endif /* ORATYPES */

#ifndef NZERROR_ORACLE
# include <nzerror.h>         /* NZ error type */
#endif /* NZERROR_ORACLE */

#define NZT_MAX_SHA1 20
#define NZT_MAX_MD5  16

/***************************************/
/* PUBLIC CONSTANTS, MACROS, AND TYPES */
/***************************************/

/*
 * Wallet Resource Locator Type Strings
 *
 * WRL TYPE        PARMETERS      BEHAVIOR
 * ========        ==========      =====================================
 * default:          <none>        Uses directory defined by the parameter
 *                                 SNZD_DEFAULT_FILE_DIRECTORY which in 
 *                                 unix is "$HOME/oracle/oss"
 * 
 * file:            file path      Find the Oracle wallet in this directory.
 *                                 example: file:<dir-path>
 * 
 * sqlnet:           <none>        In this case, the directory path will be 
 *                                 retrieved from the sqlnet.ora file under
 *                                 the oss.source.my_wallet parameter.
 *
 * mcs:              <none>        Microsoft WRL.
 *
 * entr:             dir path      Entrust WRL. eg: ENTR:<dir-path>   
 * 
 * system:           <none>        System's default certificate
 * 
 */
/* Note that there is no NZT_NULL_WRL.  Instead look in snzd.h for DEFAULT_WRP
 * which is used in our new defaulting mechanism.  The NZT_DEFAULT_WRL
 * should be deprecated.
 */
#define NZT_DEFAULT_WRL    ((text *)"default:")
#define NZT_SQLNET_WRL     ((text *)"sqlnet:")
#define NZT_FILE_WRL       ((text *)"file:")
#define NZT_ENTR_WRL       ((text *)"entr:")
#define NZT_MCS_WRL        ((text *)"mcs:")
#define NZT_SYSTEM_WRL     ((text *)"system:")
#define NZT_ORACLE_WRL     ((text *)"oracle:")
#define NZT_REGISTRY_WRL   ((text *)"reg:")
#define NZT_MEMORY_WRL     ((text *)"memory:")

#define  NZ_TF_SERVER_AUTH  256 /* Trusted server CA certificate */
#define  NZ_TF_CLIENT_AUTH 512  /* Trusted Client CA certificate */
#define  NZ_TF_VALID_PEER 1024  /* Peer's User Certificate */
#define  NZ_TF_USER_CERT 2048   /* User certificate, only for NZ use */
#define  NZ_TF_NULL 4096        /* NULL trustflag to certificate */
#define  NZ_TF_TRUSTED 8192     /* Trusted certificate */
#define  NZ_TF_NONE 16384       /* Used by internal functions when Wallet doesn't support TF */

typedef int nzTrustFlag;

/*! Enum for WRL */
           
enum nzttwrl 
{
   NZTTWRL_DEFAULT = 1,    /*!< Default, use SNZD_DEFAULT_FILE_DIRECTORY */
   NZTTWRL_SQLNET,         /*!< Use oss.source.my_wallet in sqlnet.ora file */
   NZTTWRL_FILE,           /*!< Find the oracle wallet in this directory */
   NZTTWRL_ENTR,           /*!< Find the entrust profile in this directory */
   NZTTWRL_MCS,            /*!< WRL for Microsoft */
   NZTTWRL_ORACLE,         /*!< Get the wallet from OSS db */
   NZTTWRL_NULL,           /*!< New SSO defaulting mechanism */
   NZTTWRL_REGISTRY,       /*!< Find the wallet in Windows Registry */
   NZTTWRL_MEMORY,         /*!< Read the wallet from Memory/Buffer */
   NZTTWRL_SYSTEM          /*!< System's default certs for one-way TLS */
};
typedef enum nzttwrl nzttwrl;

#ifndef NZ0DECL_ORACLE
   /*
    * With the elimination of nz0decl.h from public, we need this
    * redundant typedef.
    */
   typedef struct nzctx nzctx;
   typedef struct nzstrc nzstrc;
   typedef struct nzosContext nzosContext;
#endif /* NZ0DECL_ORACLE */

/* Moved from nz0decl.h */

typedef struct nzttIdentity nzttIdentity;
typedef struct nzttIdentityPrivate nzttIdentityPrivate;
typedef struct nzttPersona nzttPersona;
typedef struct nzttPersonaList nzttPersonaList;
typedef struct nzttPersonaPrivate nzttPersonaPrivate;
typedef struct nzttWallet nzttWallet;
typedef struct nzttWalletPrivate nzttWalletPrivate;
typedef struct nzttWalletObj nzttWalletObj; /* For wallet object */
typedef struct nzssEntry nzssEntry; /* For secretstore */
typedef struct nzpkcs11_Info nzpkcs11_Info;
typedef struct nzpkcs12_Info nzpkcs12_Info;
typedef struct nzttTrustInfo nzttTrustInfo;
typedef struct nzdpTimeDate nzdpTimeDate;

/**
 * \brief Crypto Engine State
 *
 * Once the crypto engine (CE) has been initialized for a particular
 * cipher, it is either at the initial state, or it is continuing to
 * use the cipher.  NZTCES_END is used to change the state back to
 * initialized and flush any remaining output.  NZTTCES_RESET can be
 * used to change the state back to initialized and throw away any
 * remaining output.
 */
enum nzttces 
{
   NZTTCES_CONTINUE = 1,    /*!< Continue processing input */
   NZTTCES_END,             /*!< End processing input */
   NZTTCES_RESET            /*!< Reset processing and skip generating output */
};
typedef enum nzttces nzttces;

/**
 * \brief Crypto Engine Functions
 *
 * List of crypto engine categories; used to index into protection
 * vector.
 */
enum nzttcef
{
   NZTTCEF_DETACHEDSIGNATURE = 1,   /*!< Signature, detached from content */
   NZTTCEF_SIGNATURE,               /*!< Signature combined with content */
   NZTTCEF_ENVELOPING,              /*!< Signature and encryption with content */
   NZTTCEF_PKENCRYPTION,            /*!< Encryption for one or more recipients */
   NZTTCEF_ENCRYPTION,              /*!< Symmetric encryption */
   NZTTCEF_KEYEDHASH,               /*!< Keyed hash/checkusm */
   NZTTCEF_HASH,                    /*!< Hash/checsum */
   NZTTCEF_RANDOM,                  /*!< Random byte generation */

   NZTTCEF_LAST                     /*!< Used for array size */
};
typedef enum nzttcef nzttcef;

/**
 * \brief State of the persona.
 */
enum nzttState
{
   NZTTSTATE_EMPTY = 0,     /*!< is not in any state(senseless???) */
   NZTTSTATE_REQUESTED,     /*!< cert-request */
   NZTTSTATE_READY,         /*!< certificate */
   NZTTSTATE_INVALID,       /*!< certificate */
   NZTTSTATE_RENEWAL        /*!< renewal-requested */
};
typedef enum nzttState nzttState;

/**
 * \brief Cert-version types
 * 
 * This is used to quickly look-up the cert-type
 */
enum nzttVersion
{
   NZTTVERSION_X509v1 = 1,        /*!< X.509v1 */
   NZTTVERSION_X509v3,            /*!< X.509v3 */
   NZTTVERSION_INVALID_TYPE       /*!< For Initialization */
};
typedef enum nzttVersion nzttVersion;

/**
 * \brief Cipher Types
 *
 * List of all cryptographic algorithms, some of which may not be
 * available.
 */
enum nzttCipherType 
{
   NZTTCIPHERTYPE_INVALID = 0,
   NZTTCIPHERTYPE_RSA = 1,          /*!< RSA public key */
   NZTTCIPHERTYPE_DES,              /*!< DES */
   NZTTCIPHERTYPE_RC4,              /*!< RC4 */
   NZTTCIPHERTYPE_MD5DES,           /*!< DES encrypted MD5 with salt (PBE) */
   NZTTCIPHERTYPE_MD5RC2,           /*!< RC2 encrypted MD5 with salt (PBE) */
   NZTTCIPHERTYPE_MD5,              /*!< MD5 */
   NZTTCIPHERTYPE_SHA,              /*!< SHA */
   NZTTCIPHERTYPE_ECC,              /*!< ECC */
   /* PQC cipher needs to be equal or bigger than 0x100 */
   NZTTCIPHERTYPE_ML_DSA   = 0x100,  /*!< ML_DSA */
   NZTTCIPHERTYPE_SLH_DSA  = 0x101   /*!< SLH_DSA */
};
typedef enum nzttCipherType nzttCipherType;

#define NZTTCIPHERTYPE_isPQC(c) (c >= 0x100)

/**
 * \brief TDU Formats
 *
 * List of possible toolkit data unit (TDU) formats.  Depending on the
 * function and cipher used some may be not be available.
 */
enum nztttdufmt
{
   NZTTTDUFMT_PKCS7 = 1,            /*!< PKCS7 format */
   NZTTTDUFMT_RSAPAD,               /*!< RSA padded format */
   NZTTTDUFMT_ORACLEv1,             /*!< Oracle v1 format */
   NZTTTDUFMT_LAST                  /*!< Used for array size */
};
typedef enum nztttdufmt nztttdufmt;

/**
 * \brief Validate State
 *
 * Possible validation states an identity can be in.
 */
enum nzttValState
{
   NZTTVALSTATE_NONE = 1,        /*!< Needs to be validated */
   NZTTVALSTATE_GOOD,            /*!< Validated */
   NZTTVALSTATE_REVOKED          /*!< Failed to validate */
};
typedef enum nzttValState nzttValState;

/**
 * \brief Policy Fields <----NEW (09/14/98)
 *
 * Policies enforced
 */
enum nzttPolicy
{
   NZTTPOLICY_NONE = 0,/*!< null policy */
   NZTTPOLICY_RETRY_1, /*!< number of retries for decryption = 1 */
   NZTTPOLICY_RETRY_2, /*!< number of retries for decryption = 2 */
   NZTTPOLICY_RETRY_3  /*!< number of retries for decryption = 3 */
};
typedef enum nzttPolicy nzttPolicy;

/**
 * Personas and identities have unique id's that are represented with
 * 128 bits.
 */
typedef ub1 nzttID[16];

/**
 * \brief Identity Types
 *
 * List of all Identity types..
 */
enum nzttIdentType 
{
   NZTTIDENTITYTYPE_INVALID_TYPE = 0,  
   NZTTIDENTITYTYPE_CERTIFICTAE,      
   NZTTIDENTITYTYPE_CERT_REQ,      
   NZTTIDENTITYTYPE_RENEW_CERT_REQ,      
   NZTTIDENTITYTYPE_CLEAR_ETP,      
   NZTTIDENTITYTYPE_CLEAR_UTP,      
   NZTTIDENTITYTYPE_CLEAR_PTP       
};
typedef enum nzttIdentType nzttIdentType;

typedef enum nztyat
{
   NZTYAT_UNKNOWN = 0,
   NZTYAT_RSAUV,             /* RSA public/private crypto & dig. sig. */
   NZTYAT_PBE_MD5DES,        /* Password based encryption with MD5 DESCBC */
   NZTYAT_PBE_3DESIV8,       /* Password based encryption with DES-EDE3 IV8 */
   NZTYAT_GENRAND,           /* Generate random bytes */
   NZTYAT_RC4,               /* RC4 symmetric encryption */
   NZTYAT_AES128,            /* AES 128-bit symmetric encryption */
   NZTYAT_AES256,            /* AES 256-bit symmetric encryption */
   NZTYAT_DES,               /* DES symmetric encryption */
   NZTYAT_3DES,              /* 3DES symmetric encryption */
   NZTYAT_MD5,               /* MD5 digest */
   NZTYAT_SHA1,
   NZTYAT_SHA256,
   NZTYAT_SHA384,
   NZTYAT_SHA512

} nztyat;

typedef ub4 nzttKPUsage;
/* IF new types are added nztiMUS should be changed */
#define NZTTKPUSAGE_NONE 0
#define NZTTKPUSAGE_SSL 1             /* SSL Server */
#define NZTTKPUSAGE_SMIME_ENCR 2
#define NZTTKPUSAGE_SMIME_SIGN 4
#define NZTTKPUSAGE_CODE_SIGN 8
#define NZTTKPUSAGE_CERT_SIGN 16
#define NZTTKPUSAGE_SSL_CLIENT 32     /* SSL Client */
#define NZTTKPUSAGE_INVALID_USE 0xffff


/**
 * Timestamp as 32 bit quantity in UTC.
 */
typedef ub1 nzttTStamp[4];

/**
 * \brief Buffer Block
 *
 * A function that needs to fill (and possibly grow) an output buffer
 * uses an output parameter block to describe each buffer.
 *
 * The flags_nzttBufferBlock member tells the function whether the
 * buffer can be grown or not.  If flags_nzttBufferBlock is 0, then
 * the buffer will be realloc'ed automatically.  
 *
 * The buflen_nzttBufferBLock member is set to the length of the
 * buffer before the function is called and will be the length of the
 * buffer when the function is finished.  If buflen_nzttBufferBlock is
 * 0, then the initial pointer stored in pobj_nzttBufferBlock is
 * ignored.
 *
 * The objlen_nzttBufferBlock member is set to the length of the
 * object stored in the buffer when the function is finished.  If the
 * initial buffer had a non-0 length, then it is possible that the
 * object length is shorter than the buffer length.
 *
 * The pobj_nzttBufferBlock member is a pointer to the output object.
 */
struct nzttBufferBlock
{
# define NZT_NO_AUTO_REALLOC     0x1

   uword flags_nzttBufferBlock;     /*!< Flags */
   ub4 buflen_nzttBufferBlock;   /*!< Total length of buffer */
   ub4 usedlen_nzttBufferBlock;  /*!< Length of used buffer part */
   ub1 *buffer_nzttBufferBlock;     /*!< Pointer to buffer */
};
typedef struct nzttBufferBlock nzttBufferBlock;

/**
 * \brief Wallet.
 *
 */
struct nzttWallet
{
   ub1 *ldapName_nzttWallet;              /*!< user's LDAP Name */
   ub4  ldapNamelen_nzttWallet;           /*!< len of user's LDAP Name */
   nzttPolicy securePolicy_nzttWallet;    /*!< secured-policy of the wallet */
   nzttPolicy openPolicy_nzttWallet;      /*!< open-policy of the wallet */
   nzttPersona *persona_nzttWallet;       /*!< List of personas in wallet */
   nzttWalletPrivate *private_nzttWallet; /*!< Private wallet information */
};

/**
 * \brief Structure with information about number of trusted 
 *        certificates of each type
 */
struct nzttTrustInfo
{
   ub4 serverAuthTFcount_nzttTrustInfo;    /*!< Number of certificates with
                                                 * SERVER_AUTH trust flag
                                                 */

   ub4 clientAuthTFcount_nzttTrustInfo;    /*!< Number of certificates with
                                                 * CLIENT_AUTH trust flag
                                                 */

   ub4 peerAuthTFcount_nzttTrustInfo;      /*!< Number of certificates with
                                                 * PEER_AUTH trust flag
                                                 */
};
/**
 * \brief Structure containing information about a persona.
 * @note
 * The wallet contains, one or more personas.  A persona always
 * contains its private key and its identity.  It may also contain
 * other 3rd party identites.  All identities qualified with trust
 * where the qualifier can indicate anything from untrusted to trusted
 * for specific operations.
 */
struct nzttPersona
{
   ub1 *genericName_nzttPersona;              /*!< user-friendly persona name  */
   ub4  genericNamelen_nzttPersona;           /*!< persona-name length */
   nzttPersonaPrivate *private_nzttPersona;   /*!< Opaque part of persona */
   nzttIdentity *mycertreqs_nzttPersona;      /*!< My cert-requests */
   nzttIdentity *mycerts_nzttPersona;         /*!< My certificates */
   nzttIdentity *mytps_nzttPersona;           /*!< List of trusted identities */
   nzssEntry *mystore_nzttPersona;            /*!< List of secrets */
   nzpkcs11_Info *mypkcs11Info_nzttPersona;   /*!< PKCS11 token info */
   struct nzttPersona *next_nzttPersona;      /*!< Next persona */
   boolean bTrustFlagEnabled_nzttPersona;     /*!< Persona supports Cert with trustflags */
   nzttTrustInfo trustinfo;                   /*!< Number of certs with C,T,P trustflag
                                               * in Persona 
                                               */
   nzpkcs12_Info *p12Info_nzttPersona;        /*!< PKCS12 Info */
};

/** Persona List */
struct nzttPersonaList
{
struct nzttPersonaList *next_nzttPersonaList;
nzttPersona * mynzttPersona;
};

/**
 * \brief Identity
 *
 * Structure containing information about an identity.
 *
 * @note
 *  -- the next_trustpoint field only applies to trusted identities and
 *     has no meaning (i.e. is NULL) for self identities.
 */
struct nzttIdentity
{
   text *dn_nzttIdentity;                      /*!< Alias */
   ub4 dnlen_nzttIdentity;                  /*!< Length of alias */
   text *frname_nzttIdentity;                   /*!< friendlyName */
   ub4 frnamelen_nzttIdentity;                  /*!< Length of friendlyName */
   text *comment_nzttIdentity;                 /*!< Comment  */
   ub4 commentlen_nzttIdentity;             /*!< Length of comment */
   nzttIdentityPrivate *private_nzttIdentity;  /*!< Opaque part of identity */
   nzttIdentity *next_nzttIdentity;            /*!< next identity in list */
};

/**
 * \brief B64 certificate
 */
struct nzttB64Cert
{
   ub1 *b64Cert_nzttB64Cert;
   ub4  b64Certlen_nzttB64Cert;
   struct nzttB64Cert *next_nzttB64Cert;
};
typedef struct nzttB64Cert nzttB64Cert;

/**
 * \brief PKCS7 protocol information
 */
struct nzttPKCS7ProtInfo
{
   nzttCipherType mictype_nzttPKCS7ProtInfo;    /*!< Hash cipher */
   nzttCipherType symmtype_nzttPKCS7ProtInfo;   /*!< Symmetric cipher */
   ub4 keylen_nzttPKCS7ProtInfo;             /*!< Length of key to use */
};
typedef struct nzttPKCS7ProtInfo nzttPKCS7ProtInfo;

/**
 * \brief Protection Information.
 *
 * Information specific to a type of protection.
 */
union nzttProtInfo
{
   nzttPKCS7ProtInfo pkcs7_nzttProtInfo;
};
typedef union nzttProtInfo nzttProtInfo;

/**
 * \brief Persona description
 *
 * A description of a persona so that the toolkit can create one.  A
 * persona can be symmetric or asymmetric and both contain an
 * identity.  The identity for an asymmetric persona will be the
 * certificate and the identity for the symmetric persona will be
 * descriptive information about the persona.  In either case, an
 * identity will have been created before the persona is created.
 *
 * A persona can be stored separately from the wallet that references
 * it.  By default, a persona is stored with the wallet (it inherits
 * with WRL used to open the wallet).  If a WRL is specified, then it
 * is used to store the actuall persona and the wallet will have a
 * reference to it.
 */
struct nzttPersonaDesc
{
   ub4 privlen_nzttPersonaDesc;        /*!< Length of private info (key)*/
   ub1 *priv_nzttPersonaDesc;             /*!< Private information */
   ub4 prllen_nzttPersonaDesc;         /*!< Length of PRL */
   text *prl_nzttPersonaDesc;             /*!< PRL for storage */
   ub4 aliaslen_nzttPersonaDesc;       /*!< Length of alias */
   text *alias_nzttPersonaDesc;           /*!< Alias */
   ub4 longlen_nzttPersonaDesc;        /*!< Length of longer description*/
   text *long_nzttPersonaDesc;            /*!< Longer persona description */
};
typedef struct nzttPersonaDesc nzttPersonaDesc;

/**
 * \brief Identity description
 * 
 * A description of an identity so that the toolkit can create one.
 * Since an identity can be symmetric or asymmetric, the asymmetric
 * identity information will not be used when a symmetric identity is
 * created.  This means the publen_nzttIdentityDesc and
 * pub_nzttIdentityDesc members will not be used when creating a
 * symmetric identity.
 */
struct nzttIdentityDesc
{
   ub4 publen_nzttIdentityDesc;        /*!< Length of identity */
   ub1 *pub_nzttIdentityDesc;             /*!< Type specific identity */
   ub4 dnlen_nzttIdentityDesc;         /*!< Length of alias */
   text *dn_nzttIdentityDesc;             /*!< Alias */
   ub4 longlen_nzttIdentityDesc;       /*!< Length of longer description */
   text *long_nzttIdentityDesc;           /*!< Longer description */
   ub4 quallen_nzttIdentityDesc;       /*!< Length of trust qualifier */
   text *trustqual_nzttIdentityDesc;      /*!< Trust qualifier */
};
typedef struct nzttIdentityDesc nzttIdentityDesc;

/********************************/
/* PUBLIC FUNCTION DECLARATIONS */
/********************************/

/*---------------------- nztwOpenWallet ----------------------*/
/**
 * @ingroup WALLET
 *  \brief  nztwOpenWallet - Open a wallet based on a wallet Resource Locator (WRL).
 * 
 *  @param [IN]      osscntxt  OSS context. 
 *  @param [IN]      wrllen    Length of WRL.
 *  @param [IN]      wrl       WRL.
 *  @param [IN]      pwdlen    Length of password.
 *  @param [IN]      pwd       Password.
 *  @param [IN/OUT]  wallet    Initialized wallet structure.   
 * 
 * 
 *  @note  The syntax for a WRL is <Wallet Type>:<Wallet Type Parameters>.
 *
 *    Wallet Type       Wallet Type Parameters.
 *    -----------       ----------------------
 *    File              Pathname (e.g. "file:/home/asriniva")
 *    Oracle            Connect string (e.g. "oracle:scott/tiger@oss")
 *
 *    There are also defaults.  If the WRL is NZT_DEFAULT_WRL, then
 *    the platform specific WRL default is used.  If only the wallet
 *    type is specified, then the WRL type specific default is used
 *    (e.g. "oracle:")
 *
 *    There is an implication with Oracle that should be stated: An
 *    Oracle based wallet can be implemented in a user's private space
 *    or in world readable space.
 *
 *    When the wallet is opened, the password is verified by hashing
 *    it and comparing against the password hash stored with the
 *    wallet.  The list of personas (and their associated identities)
 *    is built and stored into the wallet structure.
 *    
 *   @returns   NZERROR_OK           Success.<br>
 *              NZERROR_RIO_OPEN     RIO could not open wallet (see network trace file).<br>
 *              NZERROR_TK_PASSWORD  Password verification failed.<br>
 *              NZERROR_TK_WRLTYPE   WRL type is not known.<br>
 *              NZERROR_TK_WRLPARM   WRL parm does not match type.
 */
nzerror nztwOpenWallet( nzctx *, ub4, text *, ub4, text *, 
                           nzttWallet * );


/*---------------------- nztwCloseWallet ----------------------*/

/**
 * @ingroup WALLET 
 * \brief   nztwCloseWallet - Close a wallet
 * 
 * @param [IN]       osscntxt      OSS context.
 * @param [IN/OUT]   wallet        Wallet.
 * 
 * @note   Closing a wallet also closes all personas associated with that
 *         wallet.  It does not cause a persona to automatically be saved
 *         if it has changed.  The implication is that a persona can be
 *         modified by an application but if it is not explicitly saved it
 *         reverts back to what was in the wallet.
 *
 * @returns   NZERROR_OK           Success.<br>
 *            NZERROR_RIO_CLOSE    RIO could not close wallet (see network trace file).
 */
nzerror nztwCloseWallet( nzctx *, nzttWallet * );

/*--------------------nztwGetCertInfo----------------------------*/
/****NOTE: This function is a temporary hack.****/
/****DO NOT CALL.  It will soon disappear.****/
nzerror nztwGetCertInfo( nzctx *nz_context,
                            nzosContext *nzosCtx,
                            nzttWallet *walletRef,
                            void *peerCert );


/*------------------------ nztwConstructWallet -----------------------*/
/*
 * 
 * nzerror nztwConstructWallet( nzctx *oss_context,    
 *              nzttPolicy openPolicy,
 *              nzttPolicy securePolicy,
 *              ub1 *ldapName,
 *              ub4 ldapNamelen,
 *              nzstrc *wrl,
 *              nzttPersona *personas,
 *              nzttWallet **wallet );
 */

/*---------------------- nztwRetrievePersonaCopy ----------------------*/

/**
 * @ingroup WALLET
 * \brief    nztwRetrievePersonaCopy - Retrieves a persona based from wallet
 * 
 * @param [IN]   osscntxt      OSS context. 
 * @param [IN]   wallet        Wallet.
 * @param [IN]   index         Which wallet index to remove (first persona is zero).
 * @param [OUT]  persona       Persona found.
 * 
 * @note   Retrieves a persona from the wallet based on the index number passed
 *         in.  This persona is a COPY of the one stored in the wallet, therefore
 *         it is perfectly fine for the wallet to be closed after this call is 
 *         made.
 *         The caller is responsible for disposing of the persona when completed.
 *
 * @returns   NZERROR_OK           Success.
 */
nzerror nztwRetrievePersonaCopy( nzctx *, nzttWallet *, ub4, 
                           nzttPersona ** );

/**
 * \ingroup PERSONA
 * @{
 */


/*---------------------- nztwRetrievePersonaCopyByName ----------------------*/

/**
 * \brief   nztwRetrievePersonaCopyByName - Retrieves a persona based on its name.
 *
 * @param [IN]    osscntxt      OSS context.
 * @param [IN]    wallet        Wallet.
 * @param [IN]    name          Name of the persona 
 * @param [OUT]   persona       Persona found.
 *
 * @note   Retrieves a persona from the wallet based on the name of the persona. 
 *         This persona is a COPY of the one stored in the wallet, therefore
 *         it is perfectly fine for the wallet to be closed after this call is
 *         made.
 *         The caller is responsible for disposing of the persona when completed.
 *
 * @returns   NZERROR_OK           Success.
 */
nzerror nztwRetrievePersonaCopyByName( nzctx *, nzttWallet *, char *,
                           nzttPersona ** );

/*---------------------- nzteOpenPersona ----------------------*/

/**
 * \brief   nzteOpenPersona - Open a persona.
 * 
 * @param [IN]       osscntxt   OSS context. 
 * @param [IN/OUT]   persona    Persona.
 * 
 * @note
 *    
 * @returns    NZERROR_OK           Success.<br>
 *             NZERROR_TK_PASSWORD  Password failed to decrypt persona.<br>
 *             NZERROR_TK_BADPRL    Persona resource locator did not work.<br>
 *             NZERROR_RIO_OPEN     Could not open persona (see network trace file).
 */
nzerror nzteOpenPersona( nzctx *, nzttPersona * );

/*--------------------- nzteClosePersona ---------------------*/

/**
 * \brief   nzteClosePersona - Close a persona.
 * 
 * @param [IN]       osscntxt  OSS context.
 * @param [IN/OUT]   persona   Persona.
 * 
 * @note    Closing a persona does not store the persona, it simply releases
 *          the memory associated with the crypto engine.
 *    
 * @returns   NZERROR_OK        Success.
 */
nzerror nzteClosePersona( nzctx *, nzttPersona * );

/*--------------------- nzteDestroyPersona ---------------------*/

/**
 * \brief   nzteDestroyPersona - Destroy a persona.
 * 
 * @param [IN]       osscntxt     OSS context.
 * @param [IN/OUT]   persona      Persona.
 * 
 * @note   The persona is destroyd in the open state, but it will
 *         not be associated with a wallet.<br>
 *         The persona parameter is doubly indirect so that at the
 *         conclusion of the function, the pointer can be set to NULL.
 *
 *
 * @returns   NZERROR_OK        Success.<br>
 *            NZERROR_TK_TYPE   Unsupported itype/ctype combination.<br>
 *            NZERROR_TK_PARMS  Error in persona description.
 */
nzerror nzteDestroyPersona( nzctx *, nzttPersona ** );

/*---------------------- nzteRetrieveTrustedIdentCopy ----------------------*/

/**
 *  \brief  nzteRetrieveTrustedIdentCopy - Retrieves a trusted identity from persona
 * 
 *  @param  osscntxt [IN]     OSS context. 
 *  @param  persona  [IN]     Persona.
 *  @param  index    [IN]     Which wallet index to remove (first element is zero).
 *  @param  identity [OUT]    Trusted Identity from this persona.
 * 
 * @note
 *    Retrieves a trusted identity from the persona based on the index 
 *    number passed in.  This identity is a COPY of the one stored in 
 *    the persona, therefore it is perfectly fine to close the persona
 *    after this call is made.
 *
 *    The caller is responsible for freeing the memory of this object 
 *    by calling nztiAbortIdentity it is no longer needed
 *
 * @return
 *    NZERROR_OK           Success.
 */
nzerror nzteRetrieveTrustedIdentCopy( nzctx *, nzttPersona *, ub4, 
                           nzttIdentity ** );

/*--------------------- nztePriKey ---------------------*/

/**
 * \brief   nztePriKey - Get the decrypted Private Key for the Persona
 * 
 * @param  osscntxt [IN]     OSS context.
 * @param  persona  [IN]     Persona.
 * @param  vkey     [OUT]    Private Key [B_KEY_OBJ]
 * @param  vkey_len [OUT]    Private Key Length
 * 
 * @note
 *    This funiction will only work for X.509 based persona which contain
 *    a private key.  
 *    A copy of the private key is returned to the caller so that they do not 
 *    have to worry about the key changeing "underneath them".
 *    Memory will be allocated for the vkey and therefore, the CALLER
 *    will be responsible for freeing this memory.
 *
 * @returns
 *    NZERROR_OK           Success.
 *    NZERROR_NO_MEMORY    ossctx is null.
 *    NZERROR_TK_BADPRL    Persona resource locator did not work.
 */
nzerror nztePriKey( nzctx *, nzttPersona *, ub1 **, ub4 * );

/*--------------------- nzteMyCert ---------------------*/

/**
 * \brief   nzteMyCert - Get the X.509 Certificate for a persona
 * 
 * @param   osscntxt [IN]     OSS context.
 * @param   persona  [IN]     Persona.
 * @param   cert     [OUT]    X.509 Certificate [BER encoded]
 * @param   cert_len [OUT]    Certificate length
 * 
 * @note
 *    This funiction will only work for X.509 based persona which contain
 *    a certificate for the self identity. 
 *    A copy of the certificate is returned to the caller so that they do not 
 *    have to worry about the certificate changeing "underneath them".
 *    Memory will be allocated for the cert and therefore, the CALLER
 *    will be responsible for freeing this memory.
 *
 * @returns
 *    NZERROR_OK           Success.
 *    NZERROR_NO_MEMORY    ossctx is null.
 */
nzerror nzteMyCert( nzctx *, nzttPersona *, ub1 **, ub4 * );


/**
 * @}
 */

/**
 * \ingroup IDENTITY
 * @{
 */

/*--------------------- nztiAbortIdentity ---------------------*/

/**
 * \brief    nztiAbortIdentity - Abort an unassociated identity.
 * 
 * @param   osscntxt [IN]     OSS context.
 * @param   identity [IN/OUT] Identity.
 * 
 * @note
 *    It is an error to try to abort an identity that can be
 *    referenced through a persona.
 *    
 *    The identity pointer is set to NULL at the conclusion.
 * 
 * @returns
 *    NZERROR_OK           Success.
 *    NZERROR_CANTABORT    Identity is associated with persona.
 */
nzerror nztiAbortIdentity( nzctx *, nzttIdentity ** );

/*--------------------- nztiGetSecInfo ---------------------*/

/**
 * @ingroup PERSONA
 * \brief   nztiGetSecInfo - Get some security information for SSL
 * 
 * @param      osscntxt [IN]        OSS context.
 * @param      persona  [IN]        persona
 * @param      dname    [OUT]       distinguished name of the certificate
 * @param      dnamelen [OUT]       length of the distinguished name 
 * @param      issuername [OUT]     issuer name of the certificate
 * @param      certhash [OUT]       SHA1 hash of the certificate
 * @param      certhashlen[OUT]     length of the hash
 *
 * @note
 *    This function allocate memories for issuername, certhash, and dname.
 *   To deallocate memory for those params, you should call nztdbuf_DestroyBuf.
 * @returns
 *    
 */
nzerror nztiGetSecInfo( nzctx *, nzttPersona *, text **, ub4 *,
            text **, ub4 *, ub1 **, ub4 * );

/*--------------------- nztiGetSecInfo ---------------------*/

/**
 * @ingroup PERSONA
 * \brief   nztiGetCertThumbprint - Retrieve thumbprint
 *
 * @param      osscntxt     [IN]        OSS context
 * @param      nzttIdentity [IN]        Identity
 * @param      digestType   [IN]        digest type
 * @param      retHex       [IN]        thumbprint to be hex encoded or not
 * @param      certhash     [OUT]       hash of the certificate
 * @param      certhashlen  [OUT]       length of the hash
 *
 * @note
 *    This function allocate memories for certhash
 *   To deallocate memory for those params, you should call nzumfree.
 * @returns
 *
 */
nzerror nztiGetCertThumbprint( nzctx *, nzttIdentity *, nztyat , boolean ,
                        ub1 **, ub4 * );

/*-------------------- nztgch_GetCertHash --------------------*/

/*
 * nztgch_GetCertHash -  Get SHA1 hash for the certificate of the identity 
 * 
 *  osscntxt [IN]        OSS context.
 *  identity [IN]        identity need to get issuername from
 *  certHash [OUT]       certHash buffer 
 *  hashLen  [OUT]       length of the certHash 
 * 
 * NOTE
 *    Need to call nztdbuf_DestroyBuf to deallocate memory for certHash.   
 * RETURNS
 *    
 */
nzerror nztgch_GetCertHash( nzctx *, const nzttIdentity *,
              ub1 **, ub4 * );

/*----------------------- nztCompareDN -----------------------*/

/**
 * \brief   nztCompareDN
 * 
 * @param   osscntxt   [IN]      OSS context.
 * @param   dn1        [IN]      distinguished name 1
 * @param   dn2        [IN]      distinguished name 2
 * 
 * @note
 *    
 * @returns
 *    NZERROR_OK       succeeded
 *   others         failed
 *    
 */
nzerror nztCompareDN( nzctx *, ub1 *,ub4 ,  ub1 *, ub4, boolean * );

/*---------------- nztiee_IsEncrEnabled ----------------*/
/**
 *
 * \brief
 *  nztiee_IsEncrEnabled -  Checks to see if Encryption is Enabled
 *                               in the current Cipher Spec.
 * 
 *   @param ctx   [IN]   Oracle SSL Context
 *   @param ncipher [IN]    CipherSuite
 *   @param EncrEnabled [OUT] Boolean for is Auth Enabled?
 * 
 * @note
 *    
 * @returns
 *      NZERROR_OK on success.
 *      NZERROR_TK_INV_CIPHR_TYPE if Cipher Spec is not Recognized.
 */

nzerror nztiee_IsEncrEnabled( nzctx *ctx, 
                                  ub2 ncipher, 
                                  boolean *EncrEnabled );

/*---------------- nztGetIssuerName ----------------*/
/**
 * @ingroup IDENTITY
 * \brief
 *  nztGetIssuerName - Get Issuer Name from an Identity
 *     
 *   @param ctx          [IN]   Oracle SSL Context
 *   @param identity     [IN]   Identity
 *   @param issuername   [OUT]  Issuername
 *   @param issernamelen [OUT]  Issuername lenght 
 *
 *   @note
 * 
 *   @returns
 *     NZERROR_OK on success.
 *
 */
nzerror nztGetIssuerName( nzctx *ctx,
                             nzttIdentity *identity,
                             ub1  **issuername,
                             ub4   *issuernamelen );
/**
 * @ingroup IDENTITY
 * \brief
 *  nztGetSubjectName - Get Subject Name from an Identity
 *  
 *   @param ctx            [IN]   Oracle SSL Context
 *   @param identity       [IN]   Identity
 *   @param subjectname    [OUT]  subjectname
 *   @param subjectnamelen [OUT]  subjectname
 *         
 *  @note
 *
 *   @returns
 *    NZERROR_OK on success.
 *
 */

nzerror nztGetSubjectName( nzctx *ctx,
                              nzttIdentity *identity,
                              ub1  **subjectname,
                              ub4   *subjectnamelen );
/**
 * @ingroup IDENTITY
 * \brief
 *  nztGetBase64Cert - Get BASE64 encoded certificate from an identity
 *    
 *  @param ctx            [IN]   Oracle SSL Context
 *  @param identity       [IN]   Identity
 *  @param b64cert        [OUT]  b64cert
 *  @param b64certlen     [OUT]  b64certlen
 *
 *  @note
 *
 *  @returns
 *   NZERROR_OK on success.
 *
 **/

nzerror nztGetBase64Cert( nzctx *ctx,
                              nzttIdentity *identity,
                              ub1  **b64cert,
                              ub4   *b64certlen );
/**
 * @ingroup IDENTITY
 * \brief
 *  nztGetBase64Cert - Get Serial Number from an identity
 *  
 *  @param ctx            [IN]   Oracle SSL Context
 *  @param identity       [IN]   Identity
 *  @param serialnum      [OUT]  serialnum
 *  @param serialnumlen   [OUT]  serialnumlen
 *  
 *  @note
 *        
 *  @returns
 *    NZERROR_OK on success.
 *   
 */

nzerror nztGetSerialNumber( nzctx *ctx,
                              nzttIdentity *identity,
                              ub1   **serialnum,
                              ub4    *serialnumlen );
/**
 * \brief
 *  nztSS_Serialnum_to_String - Convert Serial Number to String
 *
 *  @param ctx            [IN]   Oracle SSL Context
 *  @param pserialnum     [IN]   SerialnumIdentity
 *  @param pCertserial    [OUT]  Serial num string
 *  @param certseriallen  [OUT]  certseriallen
 *
 *  @note
 *
 * @returns
 *    NZERROR_OK on success.
 *
 */

nzerror nztSS_Serialnum_to_String( nzctx* ctx,
                                    nzstrc *pSerialNum,
                                    ub1 *pCertserial,
                                    ub4 certseriallen);
/**
 * @ingroup IDENTITY
 * \brief
 *  nztGetValidDate - Convert Serial Number to String
 *
 *  @param ctx            [IN]   Oracle SSL Context
 *  @param identity       [IN]   Identity
 *  @param startdate      [OUT]  Start Date
 *  @param enddate        [OUT]  End Date
 *
 *  @note
 *
 * @returns
 *    NZERROR_OK on success.
 *
 */

nzerror nztGetValidDate( nzctx *ctx,
                            nzttIdentity *identity,
                            ub4  *startdate, 
                            ub4  *enddate  );

nzerror nztGetValidDate_ext( nzctx *ctx,
                            nzttIdentity *identity,
                            ub8  *startdate,
                            ub8  *enddate  );

nzerror nztGetDateTime(
        nzctx *nz_context,
        nzttIdentity *p_identity,
        nzdpTimeDate *startdate,
        nzdpTimeDate *enddate);

/**
 * @ingroup IDENTITY
 * \brief
 *   nztGetVersion - Get Version for Identity 
 *
 *   @param ctx       [IN] Oracle SSL Context
 *   @param identity  [IN] identity
 *   @param pVerStr   [IN] Identity Version
 *
 *   @note
 *
 *   @returns
 *     NZERROR_OK on success
 *
 */ 

nzerror nztGetVersion( nzctx *ctx,
                          nzttIdentity *identity,
                          nzstrc *pVerStr  );

/**
 * @ingroup IDENTITY
 * \brief
 *  nztGetBase64Cert - Get Serial Number from an identity
 *
 *  @param ctx            [IN]   Oracle SSL Context
 *  @param identity       [IN]   Identity
 *  @param pubKey         [OUT]  public key
 *  @param pubKeylen      [OUT]  public key len
 *
 *  @note
 *
 *  @returns
 *    NZERROR_OK on success.
 *
 */

nzerror nztGetPublicKey( nzctx *ctx,
                            nzttIdentity *identity,
                            ub1  **pubKey,
                            ub4   *pubKeylen );

nzerror nztGetPublicKeyNew(
        nzctx *nz_context,
        nzttIdentity *p_identity,
        ub1 **pubkey,
        ub4  *pubkeylen,
        text *mode);

nzerror nztGenericDestroy( nzctx *ctx,
                              ub1  **var );

nzerror nztSetAppDefaultLocation( nzctx *ctx,
                                     text *,
                                     size_t );

nzerror nztSearchNZDefault( nzctx *ctx,
                            boolean *search );

nzerror nztSetLightWeight(nzctx *ctx,
                          boolean flag);

/* ****************** nzICE_Install_Cert_ext ****************** */
/**
 * @ingroup WALLET_CERTIFICATE
 * \brief
 *   nzICE_Install_Cert_ext - Installs a Cert into a wallet if it meets certain conditions.
 * 
 *  @param oss_context     [IN]
 *  @param pWallet         [IN]
 *  @param pPersona        [IN]
 *  @param pCertbuf        [IN]
 *  @param certbuflen      [IN]
 *  @param certtype        [IN]
 *  @param pIdtypestr      [IN]
 *  @param trustflag       [IN]
 *
 * @note
 *
 * It calls the function  nztnAC_Add_Certificate().
 * Finally, it returns a ptr to where the actual object has been added into the
 * wallet. This is used in support of OWM
 * This is an extention of nztnIC_Install_Cert to support Trust flag.
 *
 */
nzerror nzICE_Install_Cert_ext( nzctx *oss_context,
                                    nzttWallet *pWallet,
                                    nzttPersona *pPersona,
                                    ub1* pCertbuf,
                                    ub4 certbuflen,
                                    boolean certtype,
                                    nzstrc *pIdtypestr,
                                    nzTrustFlag trustflag,
                                    nzttIdentity **ppCertOrTP );

/******************** nzMF_Modify_TrustFlags **************************/
/**
 * @ingroup WALLET_TRUSTFLAG
 *\brief 
 *   nzMF_Modify_TrustFlags -  Modifies trust flags assigned to a certificate
 *
 *   @param oss_context [IN]
 *   @param pWallet     [IN]
 *   @param pPersona    [IN]
 *   @param pCert       [IN]
 *   @param trustflag   [IN] 
 * 
 * @note
 *
 * This function would be used to modify trust flags assigned
 * to a certificate. The already assigned trust flag would get replaced
 * by new trust flag value
*/

nzerror nzMF_Modify_TrustFlags(nzctx *oss_context,
                                  nzttWallet *pWallet,
                                  nzttPersona *pPersona,
                                  nzttIdentity *pCert,
                                  int trustflag);

/**
 * @ingroup IDENTITY
 * \brief nztiFBL_Free_B64Cert_List
 * Destroy the contents of nzttB64Cert.
 *
 *
 * @param   nzctx               [IN]   nz_context
 * @param   nzttB64Cert         [OUT]  pp_b64Certlist
 *
 * @note
 *
 * @return
 *      NZERROR_OK
 *      NZERROR_INVALID_INPUT
 *      NZERROR_NOT_INITIALIZED
 */

nzerror nztiFBL_Free_B64Cert_List( nzctx *nz_context,
                                      nzttB64Cert **pp_b64Certlist );

/**
 * @} 
 *
 * */

/*------------------- nztwAW_Allocate_Wallet -------------------*/
/**
 *
 * \brief nztwAW_Allocate_Wallet
 * Allocate memory to wallet
 *
 *
 * @param   nzctx               [IN]     nz context.
 * @param   nzttWallet          [OUT]     wallet
 *
 * @note
 *
 * @return
 *    NZERROR_OK        Success.
 */
nzerror nztwAW_Allocate_Wallet( nzctx *nz_context,
                                   nzttWallet **Wallet );

/*----------------- nztwDWC_Duplicate_Wallet_Contents ------------------*/
/**
 *
 * \brief nztwDWC_Duplicate_Wallet_Contents
 * Duplicate nzttWallet source to nzttWallet target, copy ldapdn, policies, persona, nzttWalletPrivate
 *
 *
 * @param   nzctx               [IN]     nz context.
 * @param   nzttWallet          [IN]     p_sourceWallet
 * @param   nzttWallet          [OUT]    pp_targetWallet
 *
 * @note
 *
 * @return
 *    NZERROR_OK        Success.
 */
nzerror nztwDWC_Duplicate_Wallet_Contents( nzctx *nz_context,
                                              nzttWallet *p_sourceWallet,
                                              nzttWallet *pp_targetWallet );

/*---------------------- nztwGPP_Get_Personalist_Ptr ----------------------*/
/**
 *
 * \brief nztwGPP_Get_Personalist_Ptr
 * get pointer of list of nzttPersona from wallet
 *
 *
 * @param   nzctx               [IN]     nz context.
 * @param   nzttWallet          [IN]     Wallet
 * @param   nzttPersona         [OUT]    personalist
 *
 * @note
 *
 * @return
 *    NZERROR_OK        Success.
 */
nzerror nztwGPP_Get_Personalist_Ptr( nzctx *nz_context,
                                        nzttWallet *p_wallet,
                                        nzttPersona **pp_persona );

/* ****************** nztwLCW_Load_or_Create_Wallet ****************** */
/**
 *
 * \brief nztwLCW_Load_or_Create_Wallet
 * Load the wallet from the encrypted file and if failed to load then create a new  one
 *
 *
 * @param   nzctx               [IN]     oss_context
 * @param   nzstrc              [IN]     pUserpath
 * @param   nzstrc              [IN]     pPassword
 * @param   nzttWallet  [OUT]    ppWallet
 *
 * @note
 *
 * @return
 *    NZERROR_OK        Success.
 */
nzerror nztwLCW_Load_or_Create_Wallet(  nzctx *oss_context,
                                         nzstrc *pUserpath,
                                         nzstrc *pPassword,
                                         nzttWallet **ppWallet );

/******************** nztwLW_Load_Wallet  ******************/
/**
 *
 * \brief nztwLW_Load_Wallet
 * Load a wallet struct from the encrypted file
 *
 *
 * @param   nzctx                       [IN]     oss_context
 * @param   nzstrc                      [IN]     pWrl
 * @param   nzstrc                      [IN]     pPwd
 * @param   nzttWallet                  [OUT]    ppWallet
 *
 * @note
 * Load a wallet struct from the encrypted file.
 * NOTE: this is  similar to nztOpenWallet except:
 * (1) outarg is **ppWallet instead of *pWallet
 * (2) It doesn't bother trying to open clrwallet. No point doing
 *     that when you are in an interactive tool where you can get pwd.
 * (3) It doesn't call nztGetCertChain() <<==== THIS COULD CAUSE SSL failures.
 *     So see if we can modify the SSL code to call nztGetCertChain as needed
 *     or worst case just call it here too.
 *
 *
 * @return
 *    NZERROR_OK        Success.
 */
nzerror nztwLW_Load_Wallet(  nzctx *oss_context,
                              nzstrc *pWrl,
                              nzstrc *pPwd,
                              nzttWallet **ppWallet );

/* ------------------------ nztwSCW_Store_Clear_Wallet --------------- */
/**
 *
 * \brief nztwSCW_Store_Clear_Wallet
 * Stores a Clear Wallet Blob
 *
 *
 * @param   nzctx               [IN]     oss_context
 * @param   nzttWallet          [IN]     pWallet
 * @param   nzstrc              [IN]     pWrl
 * @param   nzstrc              [IN]     pPwd
 *
 * @note
 *
 * @return
 *    NZERROR_OK        Success.
 */
nzerror nztwSCW_Store_Clear_Wallet( nzctx *oss_context, nzttWallet *pWallet,
                                     nzstrc *pWrl,
                                     nzstrc *pPwd );

/**
 *
 * \brief nztwSCW_Store_Local_Wallet
 * Stores a Clear Wallet Blob
 *
 *
 * @param   nzctx               [IN]     oss_context
 * @param   nzttWallet          [IN]     pWallet
 * @param   nzstrc              [OUT]    pWrl
 * @param   nzstrc              [OUT]    pPwd
 *
 * @note
 *
 * @return
 *    NZERROR_OK        Success.
 */
nzerror nztwSCW_Store_Local_Wallet( nzctx *oss_context, nzttWallet *pWallet,
                                     nzstrc *pWrl,
                                     nzstrc *pPwd );

/*------------------- nztiGDN_Get_DName -------------------------*/

/**
 * @ingroup IDENTITY
 * \brief nztiGDN_Get_DName Get dn and dnlen from nzcontext and identity
 *
 *
 *
 * @param   nzctx               [IN]     nz context.
 * @param   nzttIdentity        [IN]     p_identity
 * @param   ub1                 [OUT]    dn
 * @param   ub4`                [OUT]    dn length
 *
 * @note
 *
 * @return
 *    NZERROR_OK        Success.
 */
nzerror nztiGDN_Get_DName( nzctx *nz_context,
                              const nzttIdentity *p_identity,
                              ub1 **dn,
                              ub4 *dnlen );

/*---------------- nztwFWC_Free_Wallet_Contents ----------------*/
/**
 *
 * \brief nztwFWC_Free_Wallet_Contents
 * Free and destroy the contents of nzttWallet like ldapdn, policies, persona, nzttWalletPrivate
 *
 *
 * @param   nzctx               [IN]     nz context.
 * @param   nzttWallet          [IN]     wallet
 *
 * @note
 *
 * @return
 *    NZERROR_OK        Success.
 */
nzerror nztwFWC_Free_Wallet_Contents( nzctx *nz_context,
                                         nzttWallet *Wallet );

/* ****************** nztnIC_Install_Cert ****************** */
/**
 *
 * \brief nztnIC_Install_Cert - Installs a Cert into a wallet if it meets certain conditions.
 *
 * It calls the function  nztnAC_Add_Certificate().
 * Finally, it returns a ptr to where the actual object has been added into the
 * wallet. This is used in support of OWM.
 *
 * @param oss_context  [IN]
 * @param pWallet      [IN]
 * @param pPersona     [IN]
 * @param pCertbuf     [IN]
 * @param certbuflen   [IN]
 * @param pIdtypestr   [IN]
 * @param ppCertOrTP   [OUT]
 *
 * @note
 *
 * @returns
 *
 */
nzerror nztnIC_Install_Cert(  nzctx *oss_context,
                                    nzttWallet *pWallet,
                                    nzttPersona *pPersona,
                                    ub1* pCertbuf,
                                    ub4 certbuflen,
                                    nzstrc *pIdtypestr );

#endif /* NZT_ORACLE */

