zig-software-foundation/zig
2
0
Fork 0
mirror of https://codeberg.org/ziglang/zig.git synced 2026-09-01 21:33:54 -06:00
Code Issues Packages Projects Releases Wiki Activity

windows: trigger automatic fetching of root certificates

Browse Source
This commit is contained in:
Jacob Young 2026-03-19 10:07:35 -04:00
parent 3c8b96df6d
commit 26a14cba3f
9 changed files with 881 additions and 449 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
lib/std/Io/Threaded.zig
View File

@ -13587,7 +13587,7 @@ fn netLookupFallible(
//&cancel_token,
null)) {
// We must wait for the APC routine.
.SUCCESS, .REQUEST_PENDING => |status| if (current_thread) |_| {
.SUCCESS, .DNS_REQUEST_PENDING => |status| if (current_thread) |_| {
while (!@atomicLoad(bool, &lookup_dns.done, .acquire)) {
// Once we get here we must not return from the function until the
// operation completes, thereby releasing references to `host_name_w`,
@ -13604,16 +13604,16 @@ fn netLookupFallible(
}
} else switch (status) {
.SUCCESS => try lookup_dns.completedFallible(),
.REQUEST_PENDING => unreachable, // `pQueryCompletionCallback` was `null`
.DNS_REQUEST_PENDING => unreachable, // `pQueryCompletionCallback` was `null`
else => unreachable,
},
else => |status| lookup_dns.results.QueryStatus = status,
}
switch (lookup_dns.results.QueryStatus) {
.SUCCESS => return,
.REQUEST_PENDING => unreachable, // already handled
.INVALID_NAME, .NO_RECORDS => return error.UnknownHostName,
else => |status| return windows.unexpectedError(@enumFromInt(@intFromEnum(status))),
.DNS_REQUEST_PENDING => unreachable, // already handled
.INVALID_NAME, .DNS_INFO_NO_RECORDS => return error.UnknownHostName,
else => |err| return windows.unexpectedError(err),
}
}

5
lib/std/crypto/Certificate.zig
View File

@ -2,6 +2,10 @@ buffer: []const u8,
index: u32,
pub const Bundle = @import("Certificate/Bundle.zig");
pub const Chain = switch (builtin.os.tag) {
else => void, // not a shim to also avoid expensive caller logic
.windows => @import("Certificate/Chain.zig"),
};
pub const Version = enum { v1, v2, v3 };
@ -844,6 +848,7 @@ fn verifyEd25519(
};
}
const builtin = @import("builtin");
const std = @import("../std.zig");
const crypto = std.crypto;
const mem = std.mem;

12
lib/std/crypto/Certificate/Bundle.zig
View File

@ -20,8 +20,10 @@ const der = Certificate.der;
const base64 = std.base64.standard.decoderWithIgnore(" \t\r\n");
/// The key is the contents slice of the subject.
map: std.HashMapUnmanaged(der.Element.Slice, u32, MapContext, std.hash_map.default_max_load_percentage) = .empty,
bytes: std.ArrayList(u8) = .empty,
map: std.HashMapUnmanaged(der.Element.Slice, u32, MapContext, std.hash_map.default_max_load_percentage),
bytes: std.ArrayList(u8),
pub const empty: Bundle = .{ .map = .empty, .bytes = .empty };
pub const VerifyError = Certificate.Parsed.VerifyError || error{
CertificateIssuerNotFound,
@ -153,11 +155,11 @@ fn rescanWindows(cb: *Bundle, gpa: Allocator, io: Io, now: Io.Timestamp) RescanW
const w = std.os.windows;
const GetLastError = w.GetLastError;
const root = [4:0]u16{ 'R', 'O', 'O', 'T' };
const store = w.crypt32.CertOpenSystemStoreW(null, &root) orelse switch (GetLastError()) {
const store = w.crypt32.CertOpenSystemStoreW(.NULL, &root) orelse switch (GetLastError()) {
.FILE_NOT_FOUND => return error.FileNotFound,
else => |err| return w.unexpectedError(err),
};
defer _ = w.crypt32.CertCloseStore(store, 0);
defer assert(w.crypt32.CertCloseStore(store, .{ .CHECK = std.debug.runtime_safety }).toBool());
const now_sec = now.toSeconds();
@ -335,7 +337,7 @@ test "scan for OS-provided certificates" {
const io = std.testing.io;
const gpa = std.testing.allocator;
var bundle: Bundle = .{};
var bundle: Bundle = .empty;
defer bundle.deinit(gpa);
const now = Io.Clock.real.now(io);

95
lib/std/crypto/Certificate/Chain.zig Normal file
View File

@ -0,0 +1,95 @@
//! A sequence of certificates, where each certificate is authenticated by the next certificate.
const Chain = @This();
store: ?crypt32.HCERTSTORE,
primary: ?*const crypt32.CERT_CONTEXT,
pub const empty: Chain = .{ .store = null, .primary = null };
pub fn deinit(chain: *Chain) void {
if (chain.primary) |primary| assert(crypt32.CertFreeCertificateContext(primary).toBool());
if (chain.store) |store| if (!crypt32.CertCloseStore(store, .{
.CHECK = std.debug.runtime_safety,
}).toBool()) std.os.windows.unexpectedError(std.os.windows.GetLastError()) catch unreachable;
chain.* = .empty;
}
pub fn addCert(chain: *Chain, cert: []const u8) std.Io.UnexpectedError!void {
const store = chain.store orelse store: {
const store = crypt32.CertOpenStore(
.MEMORY,
.{},
.NULL,
.{},
null,
) orelse return std.os.windows.unexpectedError(std.os.windows.GetLastError());
chain.store = store;
break :store store;
};
if (!crypt32.CertAddEncodedCertificateToStore(
store,
.{ .CERT = .ASN },
cert.ptr,
@intCast(cert.len),
.ALWAYS,
if (chain.primary) |_| null else &chain.primary,
).toBool()) return std.os.windows.unexpectedError(std.os.windows.GetLastError());
}
pub const VerifyError = error{
TlsCertificateNotVerified,
} || std.Io.UnexpectedError;
pub fn verify(chain: *const Chain, now: std.Io.Timestamp) VerifyError!void {
const now_win = @divFloor(now.nanoseconds - std.time.epoch.windows * std.time.ns_per_s, 100);
var cert_chain: *const crypt32.CERT_CHAIN.CONTEXT = undefined;
if (!crypt32.CertGetCertificateChain(
.CURRENT_USER,
chain.primary orelse return error.TlsCertificateNotVerified,
&.{
.dwLowDateTime = @bitCast(@as(i32, @truncate(now_win >> 0))),
.dwHighDateTime = @bitCast(@as(i32, @intCast(now_win >> 32))),
},
null,
&.{ .RequestedUsage = .{ .dwType = .AND, .Usage = .{
.cUsageIdentifier = ALLOWED_EKUS.len,
.rgpszUsageIdentifier = &ALLOWED_EKUS,
} } },
.{ .REVOCATION_CHECK_END_CERT = true, .REVOCATION_ACCUMULATIVE_TIMEOUT = true },
null,
&cert_chain,
).toBool()) return std.os.windows.unexpectedError(std.os.windows.GetLastError());
defer crypt32.CertFreeCertificateChain(cert_chain);
var status: crypt32.CERT_CHAIN.POLICY.STATUS = .{
.dwError = undefined,
.lChainIndex = undefined,
.lElementIndex = undefined,
.pvExtraPolicyStatus = undefined,
};
if (!crypt32.CertVerifyCertificateChainPolicy(
.SSL,
cert_chain,
&.{
.dwFlags = .{
.IGNORE_END_REV_UNKNOWN = true,
.IGNORE_CTL_SIGNER_REV_UNKNOWN = true,
.IGNORE_CA_REV_UNKNOWN = true,
.IGNORE_ROOT_REV_UNKNOWN = true,
},
.pvExtraPolicyPara = @constCast(&crypt32.HTTPSPolicyCallbackData{ .dwAuthType = .SERVER }),
},
&status,
).toBool()) return std.os.windows.unexpectedError(std.os.windows.GetLastError());
switch (status.dwError) {
.SUCCESS => return,
.CERT_E_UNTRUSTEDROOT => return error.TlsCertificateNotVerified,
else => |err| return std.os.windows.unexpectedError(err),
}
}
const ALLOWED_EKUS = [_][*:0]const u8{"1.3.6.1.5.5.7.3.1"};
const assert = std.debug.assert;
const builtin = @import("builtin");
const std = @import("std");
const crypt32 = std.os.windows.crypt32;

76
lib/std/crypto/tls/Client.zig
View File

@ -103,15 +103,20 @@ pub const Options = struct {
/// self-signed certificate.
self_signed,
/// Verify that the server certificate is authorized by a given ca bundle.
bundle: Certificate.Bundle,
bundle: struct {
gpa: std.mem.Allocator,
io: std.Io,
lock: *std.Io.RwLock,
bundle: *Certificate.Bundle,
},
},
write_buffer: []u8,
read_buffer: []u8,
/// Cryptographically secure random bytes. The pointer is not captured; data is only
/// read during `init`.
entropy: *const [entropy_len]u8,
/// Current time according to the wall clock / calendar, in seconds.
realtime_now_seconds: i64,
/// Current time according to the wall clock / calendar.
realtime_now: std.Io.Timestamp,
/// If non-null, ssl secrets are logged to this stream. Creating such a log file allows
/// other programs with access to that file to decrypt all traffic over this connection.
@ -135,8 +140,6 @@ pub const Options = struct {
};
const InitError = error{
WriteFailed,
ReadFailed,
InsufficientEntropy,
DiskQuota,
LockViolation,
@ -182,7 +185,7 @@ const InitError = error{
NotSquare,
NonCanonical,
WeakPublicKey,
};
} || std.Io.Writer.Error || std.Io.Reader.ShortError || std.Io.Cancelable;
/// Initiates a TLS handshake and establishes a TLSv1.2 or TLSv1.3 session.
///
@ -286,6 +289,8 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
}
var tls_version: tls.ProtocolVersion = undefined;
var chain: Certificate.Chain = if (Certificate.Chain != void) .empty;
defer if (Certificate.Chain != void) chain.deinit();
// These are used for two purposes:
// * Detect whether a certificate is the first one presented, in which case
// we need to verify the host name.
@ -327,7 +332,7 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
var handshake_cipher: tls.HandshakeCipher = undefined;
var main_cert_pub_key: CertificatePublicKey = undefined;
var tls12_negotiated_group: ?tls.NamedGroup = null;
const now_sec = options.realtime_now_seconds;
const now_sec = options.realtime_now.toSeconds();
var cleartext_fragment_start: usize = 0;
var cleartext_fragment_end: usize = 0;
@ -615,7 +620,9 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
else => unreachable,
}
const certs_size = hsd.decode(u24);
var certs_decoder = try hsd.sub(certs_size);
const certs = try hsd.sub(certs_size);
var certs_decoder = certs;
while (!certs_decoder.eof()) {
try certs_decoder.ensure(3);
const cert_size = certs_decoder.decode(u24);
@ -657,7 +664,11 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
handshake_state = .trust_chain_established;
break :cert;
},
.bundle => |ca_bundle| if (ca_bundle.verify(subject, now_sec)) |_| {
.bundle => |ca| if (verify: {
try ca.lock.lockShared(ca.io);
defer ca.lock.unlockShared(ca.io);
break :verify ca.bundle.verify(subject, now_sec);
}) {
handshake_state = .trust_chain_established;
break :cert;
} else |err| switch (err) {
@ -669,6 +680,25 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
prev_cert = subject;
cert_index += 1;
}
if (Certificate.Chain != void) {
certs_decoder = certs;
while (!certs_decoder.eof()) {
try certs_decoder.ensure(3);
const cert_size = certs_decoder.decode(u24);
const certd = try certs_decoder.sub(cert_size);
chain.addCert(certd.rest()) catch |err| switch (err) {
error.Unexpected => return error.TlsCertificateNotVerified,
};
if (tls_version == .tls_1_3) {
try certs_decoder.ensure(2);
const total_ext_size = certs_decoder.decode(u16);
const all_extd = try certs_decoder.sub(total_ext_size);
_ = all_extd;
}
}
}
cert_buf_index += 1;
},
.server_key_exchange => {
@ -676,7 +706,7 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
if (cipher_state != .cleartext) return error.TlsUnexpectedMessage;
switch (handshake_state) {
.trust_chain_established => {},
.certificate => return error.TlsCertificateNotVerified,
.certificate => try tryDownloadRootCert(&chain, &options),
else => return error.TlsUnexpectedMessage,
}
@ -795,7 +825,7 @@ pub fn init(input: *Reader, output: *Writer, options: Options) InitError!Client
if (cipher_state != .handshake) return error.TlsUnexpectedMessage;
switch (handshake_state) {
.trust_chain_established => {},
.certificate => return error.TlsCertificateNotVerified,
.certificate => try tryDownloadRootCert(&chain, &options),
else => return error.TlsUnexpectedMessage,
}
switch (handshake_cipher) {
@ -1571,6 +1601,30 @@ const CertificatePublicKey = struct {
}
};
fn tryDownloadRootCert(chain: *Certificate.Chain, options: *const Options) !void {
if (Certificate.Chain != void) switch (options.ca) {
else => {},
.bundle => |ca| {
chain.verify(options.realtime_now) catch |err| switch (err) {
error.Unexpected => return error.TlsCertificateNotVerified,
else => |e| return e,
};
var bundle: Certificate.Bundle = .empty;
defer bundle.deinit(ca.gpa);
if (bundle.rescan(ca.gpa, ca.io, options.realtime_now)) {
try ca.lock.lock(ca.io);
defer ca.lock.unlock(ca.io);
std.mem.swap(Certificate.Bundle, ca.bundle, &bundle);
} else |err| switch (err) {
error.Canceled => |e| return e,
else => {},
}
return; // the os has verified the certificate for us
},
};
return error.TlsCertificateNotVerified;
}
/// The priority order here is chosen based on what crypto algorithms Zig has
/// available in the standard library as well as what is faster. Following are
/// a few data points on the relative performance of these algorithms.

38
lib/std/http/Client.zig
View File

@ -29,8 +29,8 @@ allocator: Allocator,
/// Used for opening TCP connections.
io: Io,
ca_bundle: if (disable_tls) void else std.crypto.Certificate.Bundle = if (disable_tls) {} else .{},
ca_bundle_mutex: Io.Mutex = .init,
ca_bundle_lock: if (disable_tls) void else Io.RwLock = if (disable_tls) {} else .init,
ca_bundle: if (disable_tls) void else std.crypto.Certificate.Bundle = if (disable_tls) {} else .empty,
/// Used both for the reader and writer buffers.
tls_buffer_size: if (disable_tls) u0 else usize = if (disable_tls) 0 else std.crypto.tls.Client.min_buffer_len,
/// If non-null, ssl secrets are logged to a stream. Creating such a stream
@ -344,12 +344,17 @@ pub const Connection = struct {
&tls.connection.stream_writer.interface,
.{
.host = .{ .explicit = remote_host.bytes },
.ca = .{ .bundle = client.ca_bundle },
.ca = .{ .bundle = .{
.gpa = client.allocator,
.io = client.io,
.lock = &client.ca_bundle_lock,
.bundle = &client.ca_bundle,
} },
.ssl_key_log = client.ssl_key_log,
.read_buffer = tls_read_buffer,
.write_buffer = socket_write_buffer,
.entropy = &random_buffer,
.realtime_now_seconds = client.now.?.toSeconds(),
.realtime_now = client.now.?,
// This is appropriate for HTTPS because the HTTP headers contain
// the content length which is used to detect truncation attacks.
.allow_truncation_attacks = true,
@ -1693,19 +1698,24 @@ pub fn request(
const protocol = Protocol.fromUri(uri) orelse return error.UnsupportedUriScheme;
if (protocol == .tls) {
if (protocol == .tls) tls: {
if (disable_tls) unreachable;
{
client.ca_bundle_mutex.lockUncancelable(io);
defer client.ca_bundle_mutex.unlock(io);
if (client.now == null) {
const now = Io.Clock.real.now(io);
client.now = now;
client.ca_bundle.rescan(client.allocator, io, now) catch
return error.CertificateBundleLoadFailure;
}
try client.ca_bundle_lock.lockShared(io);
defer client.ca_bundle_lock.unlockShared(io);
if (client.now != null) break :tls;
}
var bundle: std.crypto.Certificate.Bundle = .empty;
defer bundle.deinit(client.allocator);
const now = Io.Clock.real.now(io);
bundle.rescan(client.allocator, io, now) catch |err| switch (err) {
error.Canceled => |e| return e,
else => return error.CertificateBundleLoadFailure,
};
try client.ca_bundle_lock.lock(io);
defer client.ca_bundle_lock.unlock(io);
client.now = now;
std.mem.swap(std.crypto.Certificate.Bundle, &client.ca_bundle, &bundle);
}
const connection = options.connection orelse c: {

281
lib/std/os/windows.zig
View File

@ -1545,281 +1545,7 @@ pub const DNS = struct {
// ref: um/WinDNS.h
pub const STATUS = enum(LONG) {
/// The operation completed successfully.
SUCCESS = 0,
/// The parameter is incorrect.
INVALID_PARAMETER = 87,
/// The filename, directory name, or volume label syntax is incorrect.
INVALID_NAME = 123,
/// DNS server unable to interpret format.
FORMAT_ERROR = 9001,
/// DNS server failure.
SERVER_FAILURE = 9002,
/// DNS name does not exist.
NAME_ERROR = 9003,
/// DNS request not supported by name server.
NOT_IMPLEMENTED = 9004,
/// DNS operation refused.
REFUSED = 9005,
/// DNS name that ought not exist, does exist.
YXDOMAIN = 9006,
/// DNS RR set that ought not exist, does exist.
YXRRSET = 9007,
/// DNS RR set that ought to exist, does not exist.
NXRRSET = 9008,
/// DNS server not authoritative for zone.
NOTAUTH = 9009,
/// DNS name in update or prereq is not in zone.
NOTZONE = 9010,
/// DNS signature failed to verify.
BADSIG = 9016,
/// DNS bad key.
BADKEY = 9017,
/// DNS signature validity expired.
BADTIME = 9018,
/// Only the DNS server acting as the key master for the zone may perform this operation.
KEYMASTER_REQUIRED = 9101,
/// This operation is not allowed on a zone that is signed or has signing keys.
NOT_ALLOWED_ON_SIGNED_ZONE = 9102,
/// NSEC3 is not compatible with the RSA-SHA-1 algorithm. Choose a different algorithm or use NSEC.
///
/// This value was also named DNS_INVALID_NSEC3_PARAMETERS
NSEC3_INCOMPATIBLE_WITH_RSA_SHA1 = 9103,
/// The zone does not have enough signing keys. There must be at least one key signing key (KSK) and at least one zone signing key (ZSK).
NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS = 9104,
/// The specified algorithm is not supported.
UNSUPPORTED_ALGORITHM = 9105,
/// The specified key size is not supported.
INVALID_KEY_SIZE = 9106,
/// One or more of the signing keys for a zone are not accessible to the DNS server. Zone signing will not be operational until this error is resolved.
SIGNING_KEY_NOT_ACCESSIBLE = 9107,
/// The specified key storage provider does not support DPAPI++ data protection. Zone signing will not be operational until this error is resolved.
KSP_DOES_NOT_SUPPORT_PROTECTION = 9108,
/// An unexpected DPAPI++ error was encountered. Zone signing will not be operational until this error is resolved.
UNEXPECTED_DATA_PROTECTION_ERROR = 9109,
/// An unexpected crypto error was encountered. Zone signing may not be operational until this error is resolved.
UNEXPECTED_CNG_ERROR = 9110,
/// The DNS server encountered a signing key with an unknown version. Zone signing will not be operational until this error is resolved.
UNKNOWN_SIGNING_PARAMETER_VERSION = 9111,
/// The specified key service provider cannot be opened by the DNS server.
KSP_NOT_ACCESSIBLE = 9112,
/// The DNS server cannot accept any more signing keys with the specified algorithm and KSK flag value for this zone.
TOO_MANY_SKDS = 9113,
/// The specified rollover period is invalid.
INVALID_ROLLOVER_PERIOD = 9114,
/// The specified initial rollover offset is invalid.
INVALID_INITIAL_ROLLOVER_OFFSET = 9115,
/// The specified signing key is already in process of rolling over keys.
ROLLOVER_IN_PROGRESS = 9116,
/// The specified signing key does not have a standby key to revoke.
STANDBY_KEY_NOT_PRESENT = 9117,
/// This operation is not allowed on a zone signing key (ZSK).
NOT_ALLOWED_ON_ZSK = 9118,
/// This operation is not allowed on an active signing key.
NOT_ALLOWED_ON_ACTIVE_SKD = 9119,
/// The specified signing key is already queued for rollover.
ROLLOVER_ALREADY_QUEUED = 9120,
/// This operation is not allowed on an unsigned zone.
NOT_ALLOWED_ON_UNSIGNED_ZONE = 9121,
/// This operation could not be completed because the DNS server listed as the current key master for this zone is down or misconfigured. Resolve the problem on the current key master for this zone or use another DNS server to seize the key master role.
BAD_KEYMASTER = 9122,
/// The specified signature validity period is invalid.
INVALID_SIGNATURE_VALIDITY_PERIOD = 9123,
/// The specified NSEC3 iteration count is higher than allowed by the minimum key length used in the zone.
INVALID_NSEC3_ITERATION_COUNT = 9124,
/// This operation could not be completed because the DNS server has been configured with DNSSEC features disabled. Enable DNSSEC on the DNS server.
DNSSEC_IS_DISABLED = 9125,
/// This operation could not be completed because the XML stream received is empty or syntactically invalid.
INVALID_XML = 9126,
/// This operation completed, but no trust anchors were added because all of the trust anchors received were either invalid, unsupported, expired, or would not become valid in less than 30 days.
NO_VALID_TRUST_ANCHORS = 9127,
/// The specified signing key is not waiting for parental DS update.
ROLLOVER_NOT_POKEABLE = 9128,
/// Hash collision detected during NSEC3 signing. Specify a different user-provided salt, or use a randomly generated salt, and attempt to sign the zone again.
NSEC3_NAME_COLLISION = 9129,
/// NSEC is not compatible with the NSEC3-RSA-SHA-1 algorithm. Choose a different algorithm or use NSEC3.
NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1 = 9130,
/// No records found for given DNS query.
NO_RECORDS = 9501,
/// Bad DNS packet.
BAD_PACKET = 9502,
/// No DNS packet.
NO_PACKET = 9503,
/// DNS error, check rcode.
RCODE = 9504,
/// Unsecured DNS packet.
UNSECURE_PACKET = 9505,
/// DNS query request is pending.
REQUEST_PENDING = 9506,
/// Invalid DNS type.
INVALID_TYPE = 9551,
/// Invalid IP address.
INVALID_IP_ADDRESS = 9552,
/// Invalid property.
INVALID_PROPERTY = 9553,
/// Try DNS operation again later.
TRY_AGAIN_LATER = 9554,
/// Record for given name and type is not unique.
NOT_UNIQUE = 9555,
/// DNS name does not comply with RFC specifications.
NON_RFC_NAME = 9556,
/// DNS name is a fully-qualified DNS name.
FQDN = 9557,
/// DNS name is dotted (multi-label).
DOTTED_NAME = 9558,
/// DNS name is a single-part name.
SINGLE_PART_NAME = 9559,
/// DNS name contains an invalid character.
INVALID_NAME_CHAR = 9560,
/// DNS name is entirely numeric.
NUMERIC_NAME = 9561,
/// The operation requested is not permitted on a DNS root server.
NOT_ALLOWED_ON_ROOT_SERVER = 9562,
/// The record could not be created because this part of the DNS namespace has been delegated to another server.
NOT_ALLOWED_UNDER_DELEGATION = 9563,
/// The DNS server could not find a set of root hints.
CANNOT_FIND_ROOT_HINTS = 9564,
/// The DNS server found root hints but they were not consistent across all adapters.
INCONSISTENT_ROOT_HINTS = 9565,
/// The specified value is too small for this parameter.
DWORD_VALUE_TOO_SMALL = 9566,
/// The specified value is too large for this parameter.
DWORD_VALUE_TOO_LARGE = 9567,
/// This operation is not allowed while the DNS server is loading zones in the background. Please try again later.
BACKGROUND_LOADING = 9568,
/// The operation requested is not permitted on against a DNS server running on a read-only DC.
NOT_ALLOWED_ON_RODC = 9569,
/// No data is allowed to exist underneath a DNAME record.
NOT_ALLOWED_UNDER_DNAME = 9570,
/// This operation requires credentials delegation.
DELEGATION_REQUIRED = 9571,
/// Name resolution policy table has been corrupted. DNS resolution will fail until it is fixed. Contact your network administrator.
INVALID_POLICY_TABLE = 9572,
/// DNS zone does not exist.
ZONE_DOES_NOT_EXIST = 9601,
/// DNS zone information not available.
NO_ZONE_INFO = 9602,
/// Invalid operation for DNS zone.
INVALID_ZONE_OPERATION = 9603,
/// Invalid DNS zone configuration.
ZONE_CONFIGURATION_ERROR = 9604,
/// DNS zone has no start of authority (SOA) record.
ZONE_HAS_NO_SOA_RECORD = 9605,
/// DNS zone has no Name Server (NS) record.
ZONE_HAS_NO_NS_RECORDS = 9606,
/// DNS zone is locked.
ZONE_LOCKED = 9607,
/// DNS zone creation failed.
ZONE_CREATION_FAILED = 9608,
/// DNS zone already exists.
ZONE_ALREADY_EXISTS = 9609,
/// DNS automatic zone already exists.
AUTOZONE_ALREADY_EXISTS = 9610,
/// Invalid DNS zone type.
INVALID_ZONE_TYPE = 9611,
/// Secondary DNS zone requires master IP address.
SECONDARY_REQUIRES_MASTER_IP = 9612,
/// DNS zone not secondary.
ZONE_NOT_SECONDARY = 9613,
/// Need secondary IP address.
NEED_SECONDARY_ADDRESSES = 9614,
/// WINS initialization failed.
WINS_INIT_FAILED = 9615,
/// Need WINS servers.
NEED_WINS_SERVERS = 9616,
/// NBTSTAT initialization call failed.
NBSTAT_INIT_FAILED = 9617,
/// Invalid delete of start of authority (SOA).
SOA_DELETE_INVALID = 9618,
/// A conditional forwarding zone already exists for that name.
FORWARDER_ALREADY_EXISTS = 9619,
/// This zone must be configured with one or more master DNS server IP addresses.
ZONE_REQUIRES_MASTER_IP = 9620,
/// The operation cannot be performed because this zone is shut down.
ZONE_IS_SHUTDOWN = 9621,
/// This operation cannot be performed because the zone is currently being signed. Please try again later.
ZONE_LOCKED_FOR_SIGNING = 9622,
/// Primary DNS zone requires datafile.
PRIMARY_REQUIRES_DATAFILE = 9651,
/// Invalid datafile name for DNS zone.
INVALID_DATAFILE_NAME = 9652,
/// Failed to open datafile for DNS zone.
DATAFILE_OPEN_FAILURE = 9653,
/// Failed to write datafile for DNS zone.
FILE_WRITEBACK_FAILED = 9654,
/// Failure while reading datafile for DNS zone.
DATAFILE_PARSING = 9655,
/// DNS record does not exist.
RECORD_DOES_NOT_EXIST = 9701,
/// DNS record format error.
RECORD_FORMAT = 9702,
/// Node creation failure in DNS.
NODE_CREATION_FAILED = 9703,
/// Unknown DNS record type.
UNKNOWN_RECORD_TYPE = 9704,
/// DNS record timed out.
RECORD_TIMED_OUT = 9705,
/// Name not in DNS zone.
NAME_NOT_IN_ZONE = 9706,
/// CNAME loop detected.
CNAME_LOOP = 9707,
/// Node is a CNAME DNS record.
NODE_IS_CNAME = 9708,
/// A CNAME record already exists for given name.
CNAME_COLLISION = 9709,
/// Record only at DNS zone root.
RECORD_ONLY_AT_ZONE_ROOT = 9710,
/// DNS record already exists.
RECORD_ALREADY_EXISTS = 9711,
/// Secondary DNS zone data error.
SECONDARY_DATA = 9712,
/// Could not create DNS cache data.
NO_CREATE_CACHE_DATA = 9713,
/// DNS name does not exist.
NAME_DOES_NOT_EXIST = 9714,
/// Could not create pointer (PTR) record.
PTR_CREATE_FAILED = 9715,
/// DNS domain was undeleted.
DOMAIN_UNDELETED = 9716,
/// The directory service is unavailable.
DS_UNAVAILABLE = 9717,
/// DNS zone already exists in the directory service.
DS_ZONE_ALREADY_EXISTS = 9718,
/// DNS server not creating or reading the boot file for the directory service integrated DNS zone.
NO_BOOTFILE_IF_DS_ZONE = 9719,
/// Node is a DNAME DNS record.
NODE_IS_DNAME = 9720,
/// A DNAME record already exists for given name.
DNAME_COLLISION = 9721,
/// An alias loop has been detected with either CNAME or DNAME records.
ALIAS_LOOP = 9722,
/// DNS AXFR (zone transfer) complete.
AXFR_COMPLETE = 9751,
/// DNS zone transfer failed.
AXFR = 9752,
/// Added local WINS server.
ADDED_LOCAL_WINS = 9753,
/// Secure update call needs to continue update request.
CONTINUE_NEEDED = 9801,
/// TCP/IP network protocol not installed.
NO_TCPIP = 9851,
/// No DNS servers configured for local system.
NO_DNS_SERVERS = 9852,
/// The specified directory partition does not exist.
DP_DOES_NOT_EXIST = 9901,
/// The specified directory partition already exists.
DP_ALREADY_EXISTS = 9902,
/// This DNS server is not enlisted in the specified directory partition.
DP_NOT_ENLISTED = 9903,
/// This DNS server is already enlisted in the specified directory partition.
DP_ALREADY_ENLISTED = 9904,
/// The directory partition is not available at this time. Please wait a few minutes and try again.
DP_NOT_AVAILABLE = 9905,
/// The operation failed because the domain naming master FSMO role could not be reached. The domain controller holding the domain naming master FSMO role is down or unable to service the request or is not running Windows Server 2003 or later.
DP_FSMO_ERROR = 9906,
_,
};
pub const STATUS = Win32Error;
pub const TYPE = enum(WORD) {
A = 0x0001,
@ -4458,6 +4184,11 @@ pub const STARTF_USESTDHANDLES = 0x00000100;
pub const THREAD_START_ROUTINE = fn (LPVOID) callconv(.winapi) DWORD;
pub const USER_THREAD_START_ROUTINE = fn (LPVOID) callconv(.winapi) NTSTATUS;
pub const FILETIME = extern struct {
dwLowDateTime: DWORD,
dwHighDateTime: DWORD,
};
pub const GUID = extern struct {
Data1: u32,
Data2: u16,

262
lib/std/os/windows/crypt32.zig
View File

@ -1,31 +1,283 @@
const std = @import("../../std.zig");
const windows = std.os.windows;
const BOOL = windows.BOOL;
const DWORD = windows.DWORD;
const BYTE = windows.BYTE;
const LONG = windows.LONG;
const LPCSTR = windows.LPCSTR;
const LPCWSTR = windows.LPCWSTR;
const FILETIME = windows.FILETIME;
const HANDLE = windows.HANDLE;
// ref: um/wincrypt.h
pub const HCRYPTPROV_LEGACY = enum(usize) { NULL = 0 };
pub const CERT_INFO = *opaque {};
pub const CTL_USAGE = extern struct {
cUsageIdentifier: DWORD,
rgpszUsageIdentifier: [*]const LPCSTR,
};
pub const CERT_ENHKEY_USAGE = CTL_USAGE;
pub const ENCODING = enum(u16) {
UNSPECIFIED = 0x0000,
ASN = 0x0001,
NDR = 0x0002,
_,
pub const TYPE = packed struct(DWORD) {
CERT: ENCODING = .UNSPECIFIED,
CMSG: ENCODING = .UNSPECIFIED,
};
};
pub const HCERTSTORE = *opaque {};
pub const CERT_CONTEXT = extern struct {
dwCertEncodingType: DWORD,
dwCertEncodingType: ENCODING.TYPE,
pbCertEncoded: [*]BYTE,
cbCertEncoded: DWORD,
pCertInfo: CERT_INFO,
hCertStore: HCERTSTORE,
};
pub extern "crypt32" fn CertOpenSystemStoreW(
_: ?*const anyopaque,
szSubsystemProtocol: LPCWSTR,
pub const CERT_STORE = struct {
pub const PROV = enum(usize) {
MSG = 1,
MEMORY = 2,
FILE = 3,
REG = 4,
PKCS7 = 5,
SERIALIZED = 6,
FILENAME_A = 7,
FILENAME_W = 8,
SYSTEM_A = 9,
SYSTEM_W = 10,
COLLECTION = 11,
SYSTEM_REGISTRY_A = 12,
SYSTEM_REGISTRY_W = 13,
PHYSICAL_W = 14,
SMART_CARD_W = 15,
LDAP_W = 16,
PKCS12 = 17,
/// LPCSTR
_,
pub fn fromString(str: LPCSTR) PROV {
return @enumFromInt(@intFromPtr(str));
}
};
pub const FLAG = packed struct(DWORD) {
NO_CRYPT_RELEASE: bool = false,
SET_LOCALIZED_NAME: bool = false,
DEFER_CLOSE_UNTIL_LAST_FREE: bool = false,
Reserved3: u1 = 0,
DELETE: bool = false,
UNSAFE_PHYSICAL: bool = false,
SHARE_STORE: bool = false,
SHARE_CONTEXT: bool = false,
MANIFOLD: bool = false,
ENUM_ARCHIVED: bool = false,
UPDATE_KEYID: bool = false,
BACKUP_RESTORE: bool = false,
MAXIMUM_ALLOWED: bool = false,
CREATE_NEW: bool = false,
OPEN_EXISTING: bool = false,
READONLY: bool = false,
Reserved16: u16 = 0,
};
pub const ADD = enum(DWORD) {
NEW = 1,
USE_EXISTING = 2,
REPLACE_EXISTING = 3,
ALWAYS = 4,
REPLACE_EXISTING_INHERIT_PROPERTIES = 5,
REWER = 6,
NEWER_INHERIT_PROPERTIES = 7,
_,
};
};
pub extern "crypt32" fn CertOpenStore(
lpszStoreProvider: CERT_STORE.PROV,
dwEncodingType: ENCODING.TYPE,
hCryptProv: HCRYPTPROV_LEGACY,
dwFlags: CERT_STORE.FLAG,
pvPara: ?*const anyopaque,
) callconv(.winapi) ?HCERTSTORE;
pub const CERT_CLOSE_STORE_FLAG = packed struct(DWORD) {
FORCE: bool = false,
CHECK: bool = false,
Reserved2: u30 = 0,
};
pub extern "crypt32" fn CertCloseStore(
hCertStore: HCERTSTORE,
dwFlags: DWORD,
dwFlags: CERT_CLOSE_STORE_FLAG,
) callconv(.winapi) BOOL;
pub extern "crypt32" fn CertEnumCertificatesInStore(
hCertStore: HCERTSTORE,
pPrevCertContext: ?*CERT_CONTEXT,
) callconv(.winapi) ?*CERT_CONTEXT;
pub extern "crypt32" fn CertFreeCertificateContext(
pCertContext: ?*const CERT_CONTEXT,
) callconv(.winapi) BOOL;
pub extern "crypt32" fn CertAddEncodedCertificateToStore(
hCertStore: ?HCERTSTORE,
dwCertEncodingType: ENCODING.TYPE,
pbCertEncoded: [*]const BYTE,
cbCertEncoded: DWORD,
dwAddDisposition: CERT_STORE.ADD,
ppCertContext: ?*?*const CERT_CONTEXT,
) callconv(.winapi) BOOL;
pub extern "crypt32" fn CertOpenSystemStoreW(
hProv: HCRYPTPROV_LEGACY,
szSubsystemProtocol: LPCWSTR,
) callconv(.winapi) ?HCERTSTORE;
pub const HCERTCHAINENGINE = enum(usize) {
CURRENT_USER = 0x0,
LOCAL_MACHINE = 0x1,
SERIAL_LOCAL_MACHINE = 0x2,
/// HANDLE
_,
pub fn fromHandle(handle: HANDLE) HCERTCHAINENGINE {
return @enumFromInt(@intFromPtr(handle));
}
};
pub const CERT_CHAIN = packed struct(DWORD) {
CACHE_END_CERT: bool = false,
THREAD_STORE_SYNC: bool = false,
CACHE_ONLY_URL_RETRIEVAL: bool = false,
USE_LOCAL_MACHINE_STORE: bool = false,
ENABLE_CACHE_AUTO_UPDATE: bool = false,
ENABLE_SHARE_STORE: bool = false,
Reserved6: u20 = 0,
REVOCATION_CHECK_OCSP_CERT: bool = false,
REVOCATION_ACCUMULATIVE_TIMEOUT: bool = false,
REVOCATION_CHECK_END_CERT: bool = false,
REVOCATION_CHECK_CHAIN: bool = false,
REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT: bool = false,
REVOCATION_CHECK_CACHE_ONLY: bool = false,
pub const CONTEXT = opaque {};
pub const USAGE_MATCH = extern struct {
dwType: TYPE,
Usage: CERT_ENHKEY_USAGE,
pub const TYPE = enum(DWORD) { AND = 0x00000000, OR = 0x00000001, _ };
};
pub const PARA = extern struct {
cbSize: DWORD = @sizeOf(PARA),
RequestedUsage: USAGE_MATCH,
};
pub const POLICY = enum(usize) {
BASE = 1,
AUTHENTICODE = 2,
AUTHENTICODE_TS = 3,
SSL = 4,
BASIC_CONSTRAINTS = 5,
NT_AUTH = 6,
MICROSOFT_ROOT = 7,
EV = 8,
SSL_F12 = 9,
SSL_HPKP_HEADER = 10,
THIRD_PARTY_ROOT = 11,
SSL_KEY_PIN = 12,
CT = 13,
/// LPCSTR
_,
pub fn fromString(str: LPCSTR) POLICY {
return @enumFromInt(@intFromPtr(str));
}
pub const PARA = extern struct {
cbSize: DWORD = @sizeOf(POLICY.PARA),
dwFlags: FLAG,
pvExtraPolicyPara: ?*anyopaque,
};
pub const STATUS = extern struct {
cbSize: DWORD = @sizeOf(STATUS),
dwError: windows.Win32Error,
lChainIndex: LONG,
lElementIndex: LONG,
pvExtraPolicyStatus: ?*anyopaque,
};
pub const FLAG = packed struct(DWORD) {
IGNORE_NOT_TIME_VALID: bool = false,
IGNORE_CTL_NOT_TIME_VALID: bool = false,
IGNORE_NOT_TIME_NESTED: bool = false,
IGNORE_INVALID_BASIC_CONSTRAINTS: bool = false,
ALLOW_UNKNOWN_CA: bool = false,
IGNORE_WRONG_USAGE: bool = false,
IGNORE_INVALID_NAME: bool = false,
IGNORE_INVALID_POLICY: bool = false,
IGNORE_END_REV_UNKNOWN: bool = false,
IGNORE_CTL_SIGNER_REV_UNKNOWN: bool = false,
IGNORE_CA_REV_UNKNOWN: bool = false,
IGNORE_ROOT_REV_UNKNOWN: bool = false,
IGNORE_PEER_TRUST: bool = false,
IGNORE_NOT_SUPPORTED_CRITICAL_EXT: bool = false,
TRUST_TESTROOT: bool = false,
ALLOW_TESTROOT: bool = false,
Reserved16: u11 = 0,
IGNORE_WEAK_SIGNATURE: bool = false,
Reserved28: u4 = 0,
};
};
};
pub const HTTPSPolicyCallbackData = extern struct {
cbSize: DWORD = @sizeOf(HTTPSPolicyCallbackData),
dwAuthType: AUTHTYPE,
fdwChecks: DWORD = 0,
pwszServerName: ?LPCWSTR = null,
pub const AUTHTYPE = enum(DWORD) { CLIENT = 1, SERVER = 2, _ };
};
pub extern "crypt32" fn CertGetCertificateChain(
hChainEngine: HCERTCHAINENGINE,
pCertContext: *const CERT_CONTEXT,
pTime: ?*const FILETIME,
hAdditionalStore: ?HCERTSTORE,
pChainPara: *const CERT_CHAIN.PARA,
dwFlags: CERT_CHAIN,
pvReserved: ?*const anyopaque,
ppChainContext: **const CERT_CHAIN.CONTEXT,
) callconv(.winapi) BOOL;
pub extern "crypt32" fn CertFreeCertificateChain(
pChainContext: *const CERT_CHAIN.CONTEXT,
) callconv(.winapi) void;
pub extern "crypt32" fn CertVerifyCertificateChainPolicy(
pszPolicyOID: CERT_CHAIN.POLICY,
pChainContext: *const CERT_CHAIN.CONTEXT,
pPolicyPara: *const CERT_CHAIN.POLICY.PARA,
pPolicyStatus: *CERT_CHAIN.POLICY.STATUS,
) callconv(.winapi) BOOL;

551
lib/std/os/windows/win32error.zig
View File

@ -2503,271 +2503,554 @@ pub const Win32Error = enum(u32) {
REQUEST_PAUSED = 3050,
/// Reissue the given operation as a cached IO operation.
IO_REISSUE_AS_CACHED = 3950,
/// DNS server unable to interpret format.
DNS_FORMAT_ERROR = 9001,
DNS_ERROR_RCODE_FORMAT_ERROR = 9001,
/// DNS server failure.
DNS_SERVER_FAILURE = 9002,
DNS_ERROR_RCODE_SERVER_FAILURE = 9002,
/// DNS name does not exist.
DNS_NAME_ERROR = 9003,
DNS_ERROR_RCODE_NAME_ERROR = 9003,
/// DNS request not supported by name server.
DNS_NOT_IMPLEMENTED = 9004,
DNS_ERROR_RCODE_NOT_IMPLEMENTED = 9004,
/// DNS operation refused.
DNS_REFUSED = 9005,
DNS_ERROR_RCODE_REFUSED = 9005,
/// DNS name that ought not exist, does exist.
DNS_YXDOMAIN = 9006,
DNS_ERROR_RCODE_YXDOMAIN = 9006,
/// DNS RR set that ought not exist, does exist.
DNS_YXRRSET = 9007,
DNS_ERROR_RCODE_YXRRSET = 9007,
/// DNS RR set that ought to exist, does not exist.
DNS_NXRRSET = 9008,
DNS_ERROR_RCODE_NXRRSET = 9008,
/// DNS server not authoritative for zone.
DNS_NOTAUTH = 9009,
DNS_ERROR_RCODE_NOTAUTH = 9009,
/// DNS name in update or prereq is not in zone.
DNS_NOTZONE = 9010,
DNS_ERROR_RCODE_NOTZONE = 9010,
/// DNS signature failed to verify.
DNS_BADSIG = 9016,
DNS_ERROR_RCODE_BADSIG = 9016,
/// DNS bad key.
DNS_BADKEY = 9017,
DNS_ERROR_RCODE_BADKEY = 9017,
/// DNS signature validity expired.
DNS_BADTIME = 9018,
DNS_ERROR_RCODE_BADTIME = 9018,
/// DNSSEC errors
DNS_ERROR_DNSSEC_BASE = 9100,
/// Only the DNS server acting as the key master for the zone may perform this operation.
DNS_KEYMASTER_REQUIRED = 9101,
DNS_ERROR_KEYMASTER_REQUIRED = 9101,
/// This operation is not allowed on a zone that is signed or has signing keys.
DNS_NOT_ALLOWED_ON_SIGNED_ZONE = 9102,
DNS_ERROR_NOT_ALLOWED_ON_SIGNED_ZONE = 9102,
/// NSEC3 is not compatible with the RSA-SHA-1 algorithm. Choose a different algorithm or use NSEC.
///
/// This value was also named DNS_INVALID_NSEC3_PARAMETERS
DNS_NSEC3_INCOMPATIBLE_WITH_RSA_SHA1 = 9103,
DNS_ERROR_NSEC3_INCOMPATIBLE_WITH_RSA_SHA1 = 9103,
/// The zone does not have enough signing keys. There must be at least one key signing key (KSK) and at least one zone signing key (ZSK).
DNS_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS = 9104,
DNS_ERROR_NOT_ENOUGH_SIGNING_KEY_DESCRIPTORS = 9104,
/// The specified algorithm is not supported.
DNS_UNSUPPORTED_ALGORITHM = 9105,
DNS_ERROR_UNSUPPORTED_ALGORITHM = 9105,
/// The specified key size is not supported.
DNS_INVALID_KEY_SIZE = 9106,
DNS_ERROR_INVALID_KEY_SIZE = 9106,
/// One or more of the signing keys for a zone are not accessible to the DNS server. Zone signing will not be operational until this error is resolved.
DNS_SIGNING_KEY_NOT_ACCESSIBLE = 9107,
DNS_ERROR_SIGNING_KEY_NOT_ACCESSIBLE = 9107,
/// The specified key storage provider does not support DPAPI++ data protection. Zone signing will not be operational until this error is resolved.
DNS_KSP_DOES_NOT_SUPPORT_PROTECTION = 9108,
DNS_ERROR_KSP_DOES_NOT_SUPPORT_PROTECTION = 9108,
/// An unexpected DPAPI++ error was encountered. Zone signing will not be operational until this error is resolved.
DNS_UNEXPECTED_DATA_PROTECTION_ERROR = 9109,
DNS_ERROR_UNEXPECTED_DATA_PROTECTION_ERROR = 9109,
/// An unexpected crypto error was encountered. Zone signing may not be operational until this error is resolved.
DNS_UNEXPECTED_CNG_ERROR = 9110,
DNS_ERROR_UNEXPECTED_CNG_ERROR = 9110,
/// The DNS server encountered a signing key with an unknown version. Zone signing will not be operational until this error is resolved.
DNS_UNKNOWN_SIGNING_PARAMETER_VERSION = 9111,
DNS_ERROR_UNKNOWN_SIGNING_PARAMETER_VERSION = 9111,
/// The specified key service provider cannot be opened by the DNS server.
DNS_KSP_NOT_ACCESSIBLE = 9112,
DNS_ERROR_KSP_NOT_ACCESSIBLE = 9112,
/// The DNS server cannot accept any more signing keys with the specified algorithm and KSK flag value for this zone.
DNS_TOO_MANY_SKDS = 9113,
DNS_ERROR_TOO_MANY_SKDS = 9113,
/// The specified rollover period is invalid.
DNS_INVALID_ROLLOVER_PERIOD = 9114,
DNS_ERROR_INVALID_ROLLOVER_PERIOD = 9114,
/// The specified initial rollover offset is invalid.
DNS_INVALID_INITIAL_ROLLOVER_OFFSET = 9115,
DNS_ERROR_INVALID_INITIAL_ROLLOVER_OFFSET = 9115,
/// The specified signing key is already in process of rolling over keys.
DNS_ROLLOVER_IN_PROGRESS = 9116,
DNS_ERROR_ROLLOVER_IN_PROGRESS = 9116,
/// The specified signing key does not have a standby key to revoke.
DNS_STANDBY_KEY_NOT_PRESENT = 9117,
DNS_ERROR_STANDBY_KEY_NOT_PRESENT = 9117,
/// This operation is not allowed on a zone signing key (ZSK).
DNS_NOT_ALLOWED_ON_ZSK = 9118,
DNS_ERROR_NOT_ALLOWED_ON_ZSK = 9118,
/// This operation is not allowed on an active signing key.
DNS_NOT_ALLOWED_ON_ACTIVE_SKD = 9119,
DNS_ERROR_NOT_ALLOWED_ON_ACTIVE_SKD = 9119,
/// The specified signing key is already queued for rollover.
DNS_ROLLOVER_ALREADY_QUEUED = 9120,
DNS_ERROR_ROLLOVER_ALREADY_QUEUED = 9120,
/// This operation is not allowed on an unsigned zone.
DNS_NOT_ALLOWED_ON_UNSIGNED_ZONE = 9121,
DNS_ERROR_NOT_ALLOWED_ON_UNSIGNED_ZONE = 9121,
/// This operation could not be completed because the DNS server listed as the current key master for this zone is down or misconfigured. Resolve the problem on the current key master for this zone or use another DNS server to seize the key master role.
DNS_BAD_KEYMASTER = 9122,
DNS_ERROR_BAD_KEYMASTER = 9122,
/// The specified signature validity period is invalid.
DNS_INVALID_SIGNATURE_VALIDITY_PERIOD = 9123,
DNS_ERROR_INVALID_SIGNATURE_VALIDITY_PERIOD = 9123,
/// The specified NSEC3 iteration count is higher than allowed by the minimum key length used in the zone.
DNS_INVALID_NSEC3_ITERATION_COUNT = 9124,
DNS_ERROR_INVALID_NSEC3_ITERATION_COUNT = 9124,
/// This operation could not be completed because the DNS server has been configured with DNSSEC features disabled. Enable DNSSEC on the DNS server.
DNS_DNSSEC_IS_DISABLED = 9125,
DNS_ERROR_DNSSEC_IS_DISABLED = 9125,
/// This operation could not be completed because the XML stream received is empty or syntactically invalid.
DNS_INVALID_XML = 9126,
DNS_ERROR_INVALID_XML = 9126,
/// This operation completed, but no trust anchors were added because all of the trust anchors received were either invalid, unsupported, expired, or would not become valid in less than 30 days.
DNS_NO_VALID_TRUST_ANCHORS = 9127,
DNS_ERROR_NO_VALID_TRUST_ANCHORS = 9127,
/// The specified signing key is not waiting for parental DS update.
DNS_ROLLOVER_NOT_POKEABLE = 9128,
DNS_ERROR_ROLLOVER_NOT_POKEABLE = 9128,
/// Hash collision detected during NSEC3 signing. Specify a different user-provided salt, or use a randomly generated salt, and attempt to sign the zone again.
DNS_NSEC3_NAME_COLLISION = 9129,
DNS_ERROR_NSEC3_NAME_COLLISION = 9129,
/// NSEC is not compatible with the NSEC3-RSA-SHA-1 algorithm. Choose a different algorithm or use NSEC3.
DNS_NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1 = 9130,
DNS_ERROR_NSEC_INCOMPATIBLE_WITH_NSEC3_RSA_SHA1 = 9130,
/// Packet format
DNS_ERROR_PACKET_FMT_BASE = 9500,
/// No records found for given DNS query.
DNS_NO_RECORDS = 9501,
DNS_INFO_NO_RECORDS = 9501,
/// Bad DNS packet.
DNS_BAD_PACKET = 9502,
DNS_ERROR_BAD_PACKET = 9502,
/// No DNS packet.
DNS_NO_PACKET = 9503,
DNS_ERROR_NO_PACKET = 9503,
/// DNS error, check rcode.
DNS_RCODE = 9504,
DNS_ERROR_RCODE = 9504,
/// Unsecured DNS packet.
DNS_UNSECURE_PACKET = 9505,
DNS_ERROR_UNSECURE_PACKET = 9505,
/// DNS query request is pending.
DNS_REQUEST_PENDING = 9506,
/// Invalid DNS type.
DNS_INVALID_TYPE = 9551,
DNS_ERROR_INVALID_TYPE = 9551,
/// Invalid IP address.
DNS_INVALID_IP_ADDRESS = 9552,
DNS_ERROR_INVALID_IP_ADDRESS = 9552,
/// Invalid property.
DNS_INVALID_PROPERTY = 9553,
DNS_ERROR_INVALID_PROPERTY = 9553,
/// Try DNS operation again later.
DNS_TRY_AGAIN_LATER = 9554,
DNS_ERROR_TRY_AGAIN_LATER = 9554,
/// Record for given name and type is not unique.
DNS_NOT_UNIQUE = 9555,
DNS_ERROR_NOT_UNIQUE = 9555,
/// DNS name does not comply with RFC specifications.
DNS_NON_RFC_NAME = 9556,
DNS_ERROR_NON_RFC_NAME = 9556,
/// DNS name is a fully-qualified DNS name.
DNS_FQDN = 9557,
DNS_STATUS_FQDN = 9557,
/// DNS name is dotted (multi-label).
DNS_DOTTED_NAME = 9558,
DNS_STATUS_DOTTED_NAME = 9558,
/// DNS name is a single-part name.
DNS_SINGLE_PART_NAME = 9559,
DNS_STATUS_SINGLE_PART_NAME = 9559,
/// DNS name contains an invalid character.
DNS_INVALID_NAME_CHAR = 9560,
DNS_ERROR_INVALID_NAME_CHAR = 9560,
/// DNS name is entirely numeric.
DNS_NUMERIC_NAME = 9561,
DNS_ERROR_NUMERIC_NAME = 9561,
/// The operation requested is not permitted on a DNS root server.
DNS_NOT_ALLOWED_ON_ROOT_SERVER = 9562,
DNS_ERROR_NOT_ALLOWED_ON_ROOT_SERVER = 9562,
/// The record could not be created because this part of the DNS namespace has been delegated to another server.
DNS_NOT_ALLOWED_UNDER_DELEGATION = 9563,
DNS_ERROR_NOT_ALLOWED_UNDER_DELEGATION = 9563,
/// The DNS server could not find a set of root hints.
DNS_CANNOT_FIND_ROOT_HINTS = 9564,
DNS_ERROR_CANNOT_FIND_ROOT_HINTS = 9564,
/// The DNS server found root hints but they were not consistent across all adapters.
DNS_INCONSISTENT_ROOT_HINTS = 9565,
DNS_ERROR_INCONSISTENT_ROOT_HINTS = 9565,
/// The specified value is too small for this parameter.
DNS_DWORD_VALUE_TOO_SMALL = 9566,
DNS_ERROR_DWORD_VALUE_TOO_SMALL = 9566,
/// The specified value is too large for this parameter.
DNS_DWORD_VALUE_TOO_LARGE = 9567,
DNS_ERROR_DWORD_VALUE_TOO_LARGE = 9567,
/// This operation is not allowed while the DNS server is loading zones in the background. Please try again later.
DNS_BACKGROUND_LOADING = 9568,
DNS_ERROR_BACKGROUND_LOADING = 9568,
/// The operation requested is not permitted on against a DNS server running on a read-only DC.
DNS_NOT_ALLOWED_ON_RODC = 9569,
DNS_ERROR_NOT_ALLOWED_ON_RODC = 9569,
/// No data is allowed to exist underneath a DNAME record.
DNS_NOT_ALLOWED_UNDER_DNAME = 9570,
DNS_ERROR_NOT_ALLOWED_UNDER_DNAME = 9570,
/// This operation requires credentials delegation.
DNS_DELEGATION_REQUIRED = 9571,
DNS_ERROR_DELEGATION_REQUIRED = 9571,
/// Name resolution policy table has been corrupted. DNS resolution will fail until it is fixed. Contact your network administrator.
DNS_INVALID_POLICY_TABLE = 9572,
DNS_ERROR_INVALID_POLICY_TABLE = 9572,
/// Not allowed to remove all addresses.
DNS_ERROR_ADDRESS_REQUIRED = 9573,
/// Zone errors
DNS_ERROR_ZONE_BASE = 9600,
/// DNS zone does not exist.
DNS_ZONE_DOES_NOT_EXIST = 9601,
DNS_ERROR_ZONE_DOES_NOT_EXIST = 9601,
/// DNS zone information not available.
DNS_NO_ZONE_INFO = 9602,
DNS_ERROR_NO_ZONE_INFO = 9602,
/// Invalid operation for DNS zone.
DNS_INVALID_ZONE_OPERATION = 9603,
DNS_ERROR_INVALID_ZONE_OPERATION = 9603,
/// Invalid DNS zone configuration.
DNS_ZONE_CONFIGURATION_ERROR = 9604,
DNS_ERROR_ZONE_CONFIGURATION_ERROR = 9604,
/// DNS zone has no start of authority (SOA) record.
DNS_ZONE_HAS_NO_SOA_RECORD = 9605,
DNS_ERROR_ZONE_HAS_NO_SOA_RECORD = 9605,
/// DNS zone has no Name Server (NS) record.
DNS_ZONE_HAS_NO_NS_RECORDS = 9606,
DNS_ERROR_ZONE_HAS_NO_NS_RECORDS = 9606,
/// DNS zone is locked.
DNS_ZONE_LOCKED = 9607,
DNS_ERROR_ZONE_LOCKED = 9607,
/// DNS zone creation failed.
DNS_ZONE_CREATION_FAILED = 9608,
DNS_ERROR_ZONE_CREATION_FAILED = 9608,
/// DNS zone already exists.
DNS_ZONE_ALREADY_EXISTS = 9609,
DNS_ERROR_ZONE_ALREADY_EXISTS = 9609,
/// DNS automatic zone already exists.
DNS_AUTOZONE_ALREADY_EXISTS = 9610,
DNS_ERROR_AUTOZONE_ALREADY_EXISTS = 9610,
/// Invalid DNS zone type.
DNS_INVALID_ZONE_TYPE = 9611,
DNS_ERROR_INVALID_ZONE_TYPE = 9611,
/// Secondary DNS zone requires master IP address.
DNS_SECONDARY_REQUIRES_MASTER_IP = 9612,
DNS_ERROR_SECONDARY_REQUIRES_MASTER_IP = 9612,
/// DNS zone not secondary.
DNS_ZONE_NOT_SECONDARY = 9613,
DNS_ERROR_ZONE_NOT_SECONDARY = 9613,
/// Need secondary IP address.
DNS_NEED_SECONDARY_ADDRESSES = 9614,
DNS_ERROR_NEED_SECONDARY_ADDRESSES = 9614,
/// WINS initialization failed.
DNS_WINS_INIT_FAILED = 9615,
DNS_ERROR_WINS_INIT_FAILED = 9615,
/// Need WINS servers.
DNS_NEED_WINS_SERVERS = 9616,
DNS_ERROR_NEED_WINS_SERVERS = 9616,
/// NBTSTAT initialization call failed.
DNS_NBSTAT_INIT_FAILED = 9617,
/// Invalid delete of start of authority (SOA).
DNS_SOA_DELETE_INVALID = 9618,
DNS_ERROR_NBSTAT_INIT_FAILED = 9617,
/// Invalid delete of start of authority (SOA)
DNS_ERROR_SOA_DELETE_INVALID = 9618,
/// A conditional forwarding zone already exists for that name.
DNS_FORWARDER_ALREADY_EXISTS = 9619,
DNS_ERROR_FORWARDER_ALREADY_EXISTS = 9619,
/// This zone must be configured with one or more master DNS server IP addresses.
DNS_ZONE_REQUIRES_MASTER_IP = 9620,
DNS_ERROR_ZONE_REQUIRES_MASTER_IP = 9620,
/// The operation cannot be performed because this zone is shut down.
DNS_ZONE_IS_SHUTDOWN = 9621,
DNS_ERROR_ZONE_IS_SHUTDOWN = 9621,
/// This operation cannot be performed because the zone is currently being signed. Please try again later.
DNS_ZONE_LOCKED_FOR_SIGNING = 9622,
DNS_ERROR_ZONE_LOCKED_FOR_SIGNING = 9622,
/// Datafile errors
DNS_ERROR_DATAFILE_BASE = 9650,
/// DNS 0x000025b3
/// Primary DNS zone requires datafile.
DNS_PRIMARY_REQUIRES_DATAFILE = 9651,
DNS_ERROR_PRIMARY_REQUIRES_DATAFILE = 9651,
/// DNS 0x000025b4
/// Invalid datafile name for DNS zone.
DNS_INVALID_DATAFILE_NAME = 9652,
DNS_ERROR_INVALID_DATAFILE_NAME = 9652,
/// DNS 0x000025b5
/// Failed to open datafile for DNS zone.
DNS_DATAFILE_OPEN_FAILURE = 9653,
DNS_ERROR_DATAFILE_OPEN_FAILURE = 9653,
/// DNS 0x000025b6
/// Failed to write datafile for DNS zone.
DNS_FILE_WRITEBACK_FAILED = 9654,
DNS_ERROR_FILE_WRITEBACK_FAILED = 9654,
/// DNS 0x000025b7
/// Failure while reading datafile for DNS zone.
DNS_DATAFILE_PARSING = 9655,
DNS_ERROR_DATAFILE_PARSING = 9655,
/// Database errors
DNS_ERROR_DATABASE_BASE = 9700,
/// DNS record does not exist.
DNS_RECORD_DOES_NOT_EXIST = 9701,
DNS_ERROR_RECORD_DOES_NOT_EXIST = 9701,
/// DNS record format error.
DNS_RECORD_FORMAT = 9702,
DNS_ERROR_RECORD_FORMAT = 9702,
/// Node creation failure in DNS.
DNS_NODE_CREATION_FAILED = 9703,
DNS_ERROR_NODE_CREATION_FAILED = 9703,
/// Unknown DNS record type.
DNS_UNKNOWN_RECORD_TYPE = 9704,
DNS_ERROR_UNKNOWN_RECORD_TYPE = 9704,
/// DNS record timed out.
DNS_RECORD_TIMED_OUT = 9705,
DNS_ERROR_RECORD_TIMED_OUT = 9705,
/// Name not in DNS zone.
DNS_NAME_NOT_IN_ZONE = 9706,
DNS_ERROR_NAME_NOT_IN_ZONE = 9706,
/// CNAME loop detected.
DNS_CNAME_LOOP = 9707,
DNS_ERROR_CNAME_LOOP = 9707,
/// Node is a CNAME DNS record.
DNS_NODE_IS_CNAME = 9708,
DNS_ERROR_NODE_IS_CNAME = 9708,
/// A CNAME record already exists for given name.
DNS_CNAME_COLLISION = 9709,
DNS_ERROR_CNAME_COLLISION = 9709,
/// Record only at DNS zone root.
DNS_RECORD_ONLY_AT_ZONE_ROOT = 9710,
DNS_ERROR_RECORD_ONLY_AT_ZONE_ROOT = 9710,
/// DNS record already exists.
DNS_RECORD_ALREADY_EXISTS = 9711,
DNS_ERROR_RECORD_ALREADY_EXISTS = 9711,
/// Secondary DNS zone data error.
DNS_SECONDARY_DATA = 9712,
DNS_ERROR_SECONDARY_DATA = 9712,
/// Could not create DNS cache data.
DNS_NO_CREATE_CACHE_DATA = 9713,
DNS_ERROR_NO_CREATE_CACHE_DATA = 9713,
/// DNS name does not exist.
DNS_NAME_DOES_NOT_EXIST = 9714,
DNS_ERROR_NAME_DOES_NOT_EXIST = 9714,
/// Could not create pointer (PTR) record.
DNS_PTR_CREATE_FAILED = 9715,
DNS_WARNING_PTR_CREATE_FAILED = 9715,
/// DNS domain was undeleted.
DNS_DOMAIN_UNDELETED = 9716,
DNS_WARNING_DOMAIN_UNDELETED = 9716,
/// The directory service is unavailable.
DNS_DS_UNAVAILABLE = 9717,
DNS_ERROR_DS_UNAVAILABLE = 9717,
/// DNS zone already exists in the directory service.
DNS_DS_ZONE_ALREADY_EXISTS = 9718,
DNS_ERROR_DS_ZONE_ALREADY_EXISTS = 9718,
/// DNS server not creating or reading the boot file for the directory service integrated DNS zone.
DNS_NO_BOOTFILE_IF_DS_ZONE = 9719,
DNS_ERROR_NO_BOOTFILE_IF_DS_ZONE = 9719,
/// Node is a DNAME DNS record.
DNS_NODE_IS_DNAME = 9720,
DNS_ERROR_NODE_IS_DNAME = 9720,
/// A DNAME record already exists for given name.
DNS_DNAME_COLLISION = 9721,
DNS_ERROR_DNAME_COLLISION = 9721,
/// An alias loop has been detected with either CNAME or DNAME records.
DNS_ALIAS_LOOP = 9722,
DNS_ERROR_ALIAS_LOOP = 9722,
/// Operation errors
DNS_ERROR_OPERATION_BASE = 9750,
/// DNS AXFR (zone transfer) complete.
DNS_AXFR_COMPLETE = 9751,
DNS_INFO_AXFR_COMPLETE = 9751,
/// DNS zone transfer failed.
DNS_AXFR = 9752,
DNS_ERROR_AXFR = 9752,
/// Added local WINS server.
DNS_ADDED_LOCAL_WINS = 9753,
DNS_INFO_ADDED_LOCAL_WINS = 9753,
/// Secure update
DNS_ERROR_SECURE_BASE = 9800,
/// Secure update call needs to continue update request.
DNS_CONTINUE_NEEDED = 9801,
DNS_STATUS_CONTINUE_NEEDED = 9801,
/// Setup errors
DNS_ERROR_SETUP_BASE = 9850,
/// TCP/IP network protocol not installed.
DNS_NO_TCPIP = 9851,
DNS_ERROR_NO_TCPIP = 9851,
/// No DNS servers configured for local system.
DNS_NO_DNS_SERVERS = 9852,
DNS_ERROR_NO_DNS_SERVERS = 9852,
/// Directory partition (DP) errors
DNS_ERROR_DP_BASE = 9900,
/// The specified directory partition does not exist.
DNS_DP_DOES_NOT_EXIST = 9901,
DNS_ERROR_DP_DOES_NOT_EXIST = 9901,
/// The specified directory partition already exists.
DNS_DP_ALREADY_EXISTS = 9902,
DNS_ERROR_DP_ALREADY_EXISTS = 9902,
/// This DNS server is not enlisted in the specified directory partition.
DNS_DP_NOT_ENLISTED = 9903,
DNS_ERROR_DP_NOT_ENLISTED = 9903,
/// This DNS server is already enlisted in the specified directory partition.
DNS_DP_ALREADY_ENLISTED = 9904,
DNS_ERROR_DP_ALREADY_ENLISTED = 9904,
/// The directory partition is not available at this time. Please wait a few minutes and try again.
DNS_DP_NOT_AVAILABLE = 9905,
DNS_ERROR_DP_NOT_AVAILABLE = 9905,
/// The operation failed because the domain naming master FSMO role could not be reached. The domain controller holding the domain naming master FSMO role is down or unable to service the request or is not running Windows Server 2003 or later.
DNS_DP_FSMO_ERROR = 9906,
DNS_ERROR_DP_FSMO_ERROR = 9906,
/// DNS RRL errors from 9911 to 9920
/// The RRL is not enabled.
DNS_ERROR_RRL_NOT_ENABLED = 9911,
/// The window size parameter is invalid. It should be greater than or equal to 1.
DNS_ERROR_RRL_INVALID_WINDOW_SIZE = 9912,
/// The IPv4 prefix length parameter is invalid. It should be less than or equal to 32.
DNS_ERROR_RRL_INVALID_IPV4_PREFIX = 9913,
/// The IPv6 prefix length parameter is invalid. It should be less than or equal to 128.
DNS_ERROR_RRL_INVALID_IPV6_PREFIX = 9914,
/// The TC Rate parameter is invalid. It should be less than 10.
DNS_ERROR_RRL_INVALID_TC_RATE = 9915,
/// The Leak Rate parameter is invalid. It should be either 0, or between 2 and 10.
DNS_ERROR_RRL_INVALID_LEAK_RATE = 9916,
/// The Leak Rate or TC Rate parameter is invalid. Leak Rate should be greater than TC Rate.
DNS_ERROR_RRL_LEAK_RATE_LESSTHAN_TC_RATE = 9917,
/// DNS Virtualization errors from 9921 to 9950
/// The virtualization instance already exists.
DNS_ERROR_VIRTUALIZATION_INSTANCE_ALREADY_EXISTS = 9921,
/// The virtualization instance does not exist.
DNS_ERROR_VIRTUALIZATION_INSTANCE_DOES_NOT_EXIST = 9922,
/// The virtualization tree is locked.
DNS_ERROR_VIRTUALIZATION_TREE_LOCKED = 9923,
/// Invalid virtualization instance name.
DNS_ERROR_INVAILD_VIRTUALIZATION_INSTANCE_NAME = 9924,
/// The default virtualization instance cannot be added, removed or modified.
DNS_ERROR_DEFAULT_VIRTUALIZATION_INSTANCE = 9925,
/// DNS ZoneScope errors from 9951 to 9970
/// The scope already exists for the zone.
DNS_ERROR_ZONESCOPE_ALREADY_EXISTS = 9951,
/// The scope does not exist for the zone.
DNS_ERROR_ZONESCOPE_DOES_NOT_EXIST = 9952,
/// The scope is the same as the default zone scope.
DNS_ERROR_DEFAULT_ZONESCOPE = 9953,
/// The scope name contains invalid characters.
DNS_ERROR_INVALID_ZONESCOPE_NAME = 9954,
/// Operation not allowed when the zone has scopes.
DNS_ERROR_NOT_ALLOWED_WITH_ZONESCOPES = 9955,
/// Failed to load zone scope.
DNS_ERROR_LOAD_ZONESCOPE_FAILED = 9956,
/// Failed to write data file for DNS zone scope. Please verify the file exists and is writable.
DNS_ERROR_ZONESCOPE_FILE_WRITEBACK_FAILED = 9957,
/// The scope name contains invalid characters.
DNS_ERROR_INVALID_SCOPE_NAME = 9958,
/// The scope does not exist.
DNS_ERROR_SCOPE_DOES_NOT_EXIST = 9959,
/// The scope is the same as the default scope.
DNS_ERROR_DEFAULT_SCOPE = 9960,
/// The operation is invalid on the scope.
DNS_ERROR_INVALID_SCOPE_OPERATION = 9961,
/// The scope is locked.
DNS_ERROR_SCOPE_LOCKED = 9962,
/// The scope already exists.
DNS_ERROR_SCOPE_ALREADY_EXISTS = 9963,
/// DNS Policy errors from 9971 to 9999
/// A policy with the same name already exists on this level (server level or zone level) on the DNS server.
DNS_ERROR_POLICY_ALREADY_EXISTS = 9971,
/// No policy with this name exists on this level (server level or zone level) on the DNS server.
DNS_ERROR_POLICY_DOES_NOT_EXIST = 9972,
/// The criteria provided in the policy are invalid.
DNS_ERROR_POLICY_INVALID_CRITERIA = 9973,
/// At least one of the settings of this policy is invalid.
DNS_ERROR_POLICY_INVALID_SETTINGS = 9974,
/// The client subnet cannot be deleted while it is being accessed by a policy.
DNS_ERROR_CLIENT_SUBNET_IS_ACCESSED = 9975,
/// The client subnet does not exist on the DNS server.
DNS_ERROR_CLIENT_SUBNET_DOES_NOT_EXIST = 9976,
/// A client subnet with this name already exists on the DNS server.
DNS_ERROR_CLIENT_SUBNET_ALREADY_EXISTS = 9977,
/// The IP subnet specified does not exist in the client subnet.
DNS_ERROR_SUBNET_DOES_NOT_EXIST = 9978,
/// The IP subnet that is being added, already exists in the client subnet.
DNS_ERROR_SUBNET_ALREADY_EXISTS = 9979,
/// The policy is locked.
DNS_ERROR_POLICY_LOCKED = 9980,
/// The weight of the scope in the policy is invalid.
DNS_ERROR_POLICY_INVALID_WEIGHT = 9981,
/// The DNS policy name is invalid.
DNS_ERROR_POLICY_INVALID_NAME = 9982,
/// The policy is missing criteria.
DNS_ERROR_POLICY_MISSING_CRITERIA = 9983,
/// The name of the the client subnet record is invalid.
DNS_ERROR_INVALID_CLIENT_SUBNET_NAME = 9984,
/// Invalid policy processing order.
DNS_ERROR_POLICY_PROCESSING_ORDER_INVALID = 9985,
/// The scope information has not been provided for a policy that requires it.
DNS_ERROR_POLICY_SCOPE_MISSING = 9986,
/// The scope information has been provided for a policy that does not require it.
DNS_ERROR_POLICY_SCOPE_NOT_ALLOWED = 9987,
/// The server scope cannot be deleted because it is referenced by a DNS Policy.
DNS_ERROR_SERVERSCOPE_IS_REFERENCED = 9988,
/// The zone scope cannot be deleted because it is referenced by a DNS Policy.
DNS_ERROR_ZONESCOPE_IS_REFERENCED = 9989,
/// The criterion client subnet provided in the policy is invalid.
DNS_ERROR_POLICY_INVALID_CRITERIA_CLIENT_SUBNET = 9990,
/// The criterion transport protocol provided in the policy is invalid.
DNS_ERROR_POLICY_INVALID_CRITERIA_TRANSPORT_PROTOCOL = 9991,
/// The criterion network protocol provided in the policy is invalid.
DNS_ERROR_POLICY_INVALID_CRITERIA_NETWORK_PROTOCOL = 9992,
/// The criterion interface provided in the policy is invalid.
DNS_ERROR_POLICY_INVALID_CRITERIA_INTERFACE = 9993,
/// The criterion FQDN provided in the policy is invalid.
DNS_ERROR_POLICY_INVALID_CRITERIA_FQDN = 9994,
/// The criterion query type provided in the policy is invalid.
DNS_ERROR_POLICY_INVALID_CRITERIA_QUERY_TYPE = 9995,
/// The criterion time of day provided in the policy is invalid.
DNS_ERROR_POLICY_INVALID_CRITERIA_TIME_OF_DAY = 9996,
/// An error occurred while performing an operation on a cryptographic message.
CRYPT_E_MSG_ERROR = 0x80091001,
/// Unknown cryptographic algorithm.
CRYPT_E_UNKNOWN_ALGO = 0x80091002,
/// The object identifier is poorly formatted.
CRYPT_E_OID_FORMAT = 0x80091003,
/// Invalid cryptographic message type.
CRYPT_E_INVALID_MSG_TYPE = 0x80091004,
/// Unexpected cryptographic message encoding.
CRYPT_E_UNEXPECTED_ENCODING = 0x80091005,
/// The cryptographic message does not contain an expected authenticated attribute.
CRYPT_E_AUTH_ATTR_MISSING = 0x80091006,
/// The hash value is not correct.
CRYPT_E_HASH_VALUE = 0x80091007,
/// The index value is not valid.
CRYPT_E_INVALID_INDEX = 0x80091008,
/// The content of the cryptographic message has already been decrypted.
CRYPT_E_ALREADY_DECRYPTED = 0x80091009,
/// The content of the cryptographic message has not been decrypted yet.
CRYPT_E_NOT_DECRYPTED = 0x8009100A,
/// The enveloped-data message does not contain the specified recipient.
CRYPT_E_RECIPIENT_NOT_FOUND = 0x8009100B,
/// Invalid control type.
CRYPT_E_CONTROL_TYPE = 0x8009100C,
/// Invalid issuer and/or serial number.
CRYPT_E_ISSUER_SERIALNUMBER = 0x8009100D,
/// Cannot find the original signer.
CRYPT_E_SIGNER_NOT_FOUND = 0x8009100E,
/// The cryptographic message does not contain all of the requested attributes.
CRYPT_E_ATTRIBUTES_MISSING = 0x8009100F,
/// The streamed cryptographic message is not ready to return data.
CRYPT_E_STREAM_MSG_NOT_READY = 0x80091010,
/// The streamed cryptographic message requires more data to complete the decode operation.
CRYPT_E_STREAM_INSUFFICIENT_DATA = 0x80091011,
/// The protected data needs to be re-protected.
CRYPT_I_NEW_PROTECTION_REQUIRED = 0x00091012,
/// The length specified for the output data was insufficient.
CRYPT_E_BAD_LEN = 0x80092001,
/// An error occurred during encode or decode operation.
CRYPT_E_BAD_ENCODE = 0x80092002,
/// An error occurred while reading or writing to a file.
CRYPT_E_FILE_ERROR = 0x80092003,
/// Cannot find object or property.
CRYPT_E_NOT_FOUND = 0x80092004,
/// The object or property already exists.
CRYPT_E_EXISTS = 0x80092005,
/// No provider was specified for the store or object.
CRYPT_E_NO_PROVIDER = 0x80092006,
/// The specified certificate is self signed.
CRYPT_E_SELF_SIGNED = 0x80092007,
/// The previous certificate or CRL context was deleted.
CRYPT_E_DELETED_PREV = 0x80092008,
/// Cannot find the requested object.
CRYPT_E_NO_MATCH = 0x80092009,
/// The certificate does not have a property that references a private key.
CRYPT_E_UNEXPECTED_MSG_TYPE = 0x8009200A,
/// Cannot find the certificate and private key for decryption.
CRYPT_E_NO_KEY_PROPERTY = 0x8009200B,
/// Cannot find the certificate and private key to use for decryption.
CRYPT_E_NO_DECRYPT_CERT = 0x8009200C,
/// Not a cryptographic message or the cryptographic message is not formatted correctly.
CRYPT_E_BAD_MSG = 0x8009200D,
/// The signed cryptographic message does not have a signer for the specified signer index.
CRYPT_E_NO_SIGNER = 0x8009200E,
/// Final closure is pending until additional frees or closes.
CRYPT_E_PENDING_CLOSE = 0x8009200F,
/// The certificate is revoked.
CRYPT_E_REVOKED = 0x80092010,
/// No Dll or exported function was found to verify revocation.
CRYPT_E_NO_REVOCATION_DLL = 0x80092011,
/// The revocation function was unable to check revocation for the certificate.
CRYPT_E_NO_REVOCATION_CHECK = 0x80092012,
/// The revocation function was unable to check revocation because the revocation server was offline.
CRYPT_E_REVOCATION_OFFLINE = 0x80092013,
/// The certificate is not in the revocation server's database.
CRYPT_E_NOT_IN_REVOCATION_DATABASE = 0x80092014,
/// The string contains a non-numeric character.
CRYPT_E_INVALID_NUMERIC_STRING = 0x80092020,
/// The string contains a non-printable character.
CRYPT_E_INVALID_PRINTABLE_STRING = 0x80092021,
/// The string contains a character not in the 7 bit ASCII character set.
CRYPT_E_INVALID_IA5_STRING = 0x80092022,
/// The string contains an invalid X500 name attribute key, oid, value or delimiter.
CRYPT_E_INVALID_X500_STRING = 0x80092023,
/// The dwValueType for the CERT_NAME_VALUE is not one of the character strings. Most likely it is either a CERT_RDN_ENCODED_BLOB or CERT_RDN_OCTET_STRING.
CRYPT_E_NOT_CHAR_STRING = 0x80092024,
/// The Put operation cannot continue. The file needs to be resized. However, there is already a signature present. A complete signing operation must be done.
CRYPT_E_FILERESIZED = 0x80092025,
/// The cryptographic operation failed due to a local security option setting.
CRYPT_E_SECURITY_SETTINGS = 0x80092026,
/// No DLL or exported function was found to verify subject usage.
CRYPT_E_NO_VERIFY_USAGE_DLL = 0x80092027,
/// The called function was unable to do a usage check on the subject.
CRYPT_E_NO_VERIFY_USAGE_CHECK = 0x80092028,
/// Since the server was offline, the called function was unable to complete the usage check.
CRYPT_E_VERIFY_USAGE_OFFLINE = 0x80092029,
/// The subject was not found in a Certificate Trust List (CT,.
CRYPT_E_NOT_IN_CTL = 0x8009202A,
/// None of the signers of the cryptographic message or certificate trust list is trusted.
CRYPT_E_NO_TRUSTED_SIGNER = 0x8009202B,
/// The public key's algorithm parameters are missing.
CRYPT_E_MISSING_PUBKEY_PARA = 0x8009202C,
/// An object could not be located using the object locator infrastructure with the given name.
CRYPT_E_OBJECT_LOCATOR_OBJECT_NOT_FOUND = 0x8009202D,
/// MessageText:
/// OSS Certificate encode/decode error code base
/// See asn1code.h for a definition of the OSS runtime errors. The OSS error values are offset by CRYPT_E_OSS_ERROR.
CRYPT_E_OSS_ERROR = 0x80093000,
/// No signature was present in the subject.
TRUST_E_NOSIGNATURE = 0x800B0100,
/// A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
CERT_E_EXPIRED = 0x800B0101,
/// The validity periods of the certification chain do not nest correctly.
CERT_E_VALIDITYPERIODNESTING = 0x800B0102,
/// A certificate that can only be used as an end-entity is being used as a CA or vice versa.
CERT_E_ROLE = 0x800B0103,
/// A path length constraint in the certification chain has been violated.
CERT_E_PATHLENCONST = 0x800B0104,
/// A certificate contains an unknown extension that is marked 'critical'.
CERT_E_CRITICAL = 0x800B0105,
/// A certificate being used for a purpose other than the ones specified by its CA.
CERT_E_PURPOSE = 0x800B0106,
/// A parent of a given certificate in fact did not issue that child certificate.
CERT_E_ISSUERCHAINING = 0x800B0107,
/// A certificate is missing or has an empty value for an important field, such as a subject or issuer name.
CERT_E_MALFORMED = 0x800B0108,
/// A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
CERT_E_UNTRUSTEDROOT = 0x800B0109,
/// A certificate chain could not be built to a trusted root authority.
CERT_E_CHAINING = 0x800B010A,
/// Generic trust failure.
TRUST_E_FAIL = 0x800B010B,
/// A certificate was explicitly revoked by its issuer.
CERT_E_REVOKED = 0x800B010C,
/// The certification path terminates with the test root which is not trusted with the current policy settings.
CERT_E_UNTRUSTEDTESTROOT = 0x800B010D,
/// The revocation process could not continue - the certificate(s) could not be checked.
CERT_E_REVOCATION_FAILURE = 0x800B010E,
/// The certificate's CN name does not match the passed value.
CERT_E_CN_NO_MATCH = 0x800B010F,
/// The certificate is not valid for the requested usage.
CERT_E_WRONG_USAGE = 0x800B0110,
/// The certificate was explicitly marked as untrusted by the user.
TRUST_E_EXPLICIT_DISTRUST = 0x800B0111,
/// A certification chain processed correctly, but one of the CA certificates is not trusted by the policy provider.
CERT_E_UNTRUSTEDCA = 0x800B0112,
/// The certificate has invalid policy.
CERT_E_INVALID_POLICY = 0x800B0113,
/// The certificate has an invalid name. The name is not included in the permitted list or is explicitly excluded.
CERT_E_INVALID_NAME = 0x800B0114,
_,
};