[apple/security.git] / AppleX509TP / TPCertInfo.h

/*
 * Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
 * 
 * The contents of this file constitute Original Code as defined in and are
 * subject to the Apple Public Source License Version 1.2 (the 'License').
 * You may not use this file except in compliance with the License. Please obtain
 * a copy of the License at http://www.apple.com/publicsource and read it before
 * using this file.
 * 
 * This Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
 * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
 * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
 * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
 * specific language governing rights and limitations under the License.
 */


/*
 * TPCertInfo.h - TP's private certificate info and cert group classes
 *
 * Written 10/23/2000 by Doug Mitchell.
 */
 
#ifndef	_TP_CERT_INFO_H_
#define _TP_CERT_INFO_H_

#include <Security/cssmtype.h>
#include <Security/utilities.h>
#include <Security/cssmalloc.h>
#include <Security/threading.h>
#include <Security/globalizer.h>

/*** Interim hack, disable not before/not after checking during cert chain processing ***/
/*** code #ifdef'd with this gets ripped out later ***/
#define TP_CERT_CURRENT_CHECK_INLINE		0

/* protects TP-wide access to time() and gmtime() */
extern ModuleNexus<Mutex> tpTimeLock;

/*
 * Class representing one certificate. The raw cert data usually comes from
 * a client (via incoming cert groups in CertGroupConstruct() and CertGroupVerify());
 * In this case, we don't own the raw data and don't copy or free it. Caller can 
 * optionally specify that we copy (and own and eventnually free) the raw cert data. 
 * The constructor throws on any error (bad cert data); subsequent to successful 
 * construction, no CSSM errors are thrown and it's guaranteed that the cert is
 * basically good and successfully cached in the CL, and that we have a locally
 * cached subject and issuer name (in normalized encoded format). 
 */ 
class TPCertInfo
{
public:
	/* 
	 * No default constructor - this is the only way.
	 * This caches the cert and fetches subjectName and issuerName
	 * to ensure the incoming certData is well-constructed.
	 */
	TPCertInfo(
		const CSSM_DATA		*certData,
		CSSM_CL_HANDLE		clHand,
		const char 			*cssmTimeStr = NULL,	// NULL ==> time base = right now
		bool				copyCertData = false);	// true: we copy, we free
													// false - caller owns
		
	/* frees mSubjectName, mIssuerName, mCacheHand via mClHand */
	~TPCertInfo();
	
	/* 
	 * Fetch arbitrary field from cached cert.
	 * Only should be used when caller is sure there is either zero or one
	 * of the requested fields present in the cert.
	 */
	CSSM_RETURN fetchField(
		const CSSM_OID	*fieldOid,
		CSSM_DATA_PTR	*fieldData);			// mallocd by CL and RETURNED

	/* free arbitrary field obtained from fetchField() */
	CSSM_RETURN freeField( 
		const CSSM_OID	*fieldOid,
		CSSM_DATA_PTR	fieldData);
		
	/* accessors */
	CSSM_CL_HANDLE	clHand();
	CSSM_HANDLE		cacheHand();
	const CSSM_DATA *certData();
	const CSSM_DATA *subjectName();
	const CSSM_DATA *issuerName();				

	bool 		isSelfSigned()			{ return mIsRoot; }				
	bool 		isExpired() 			{ return mExpired; }
	bool 		isNotValidYet()			{ return mNotValidYet; }

	unsigned 	index()					{ return mIndex; }	
	void 		index(unsigned dex)		{ mIndex = dex; }
	bool		isAnchor()				{ return mIsAnchor; }
	void		isAnchor(bool a)		{ mIsAnchor = a; }
	unsigned	numStatusCodes()		{ return mNumStatusCodes; }
	CSSM_RETURN	*statusCodes()			{ return mStatusCodes; }
	void		addStatusCode(CSSM_RETURN code);
	CSSM_DL_DB_HANDLE dlDbHandle()		{ return mDlDbHandle; }
	void dlDbHandle(CSSM_DL_DB_HANDLE hand)
										{ mDlDbHandle = hand; }
	CSSM_DB_UNIQUE_RECORD_PTR uniqueRecord()
										{ return mUniqueRecord; }
	void uniqueRecord(CSSM_DB_UNIQUE_RECORD_PTR rec)
										{ mUniqueRecord = rec; }
										
	/* 
	 * Verify validity (not before/after). Returns 
	 * 		CSSMERR_TP_CERT_NOT_VALID_YET
	 *		CSSMERR_TP_CERT_EXPIRED
	 *		CSSM_OK
	 *		CSSMERR_TP_INVALID_CERT_POINTER, other "bogus cert" errors
	 */
	CSSM_RETURN isCurrent(
		CSSM_BOOL		allowExpired = CSSM_FALSE);
		
private:
	CSSM_DATA				*mCertData;			// always valid
	bool					mWeOwnTheData;		// if true, we have to free mCertData
	CSSM_CL_HANDLE			mClHand;			// always valid
	CSSM_HANDLE				mCacheHand;			// always valid
	CSSM_DATA_PTR			mSubjectName;		// always valid
	CSSM_DATA_PTR			mIssuerName;		// always valid
	
	/* maintained by caller, default at constructor 0/false */
	unsigned				mIndex;
	bool					mIsAnchor;
	bool					mIsFromDb;
	unsigned				mNumStatusCodes;
	CSSM_RETURN				*mStatusCodes;
	CSSM_DL_DB_HANDLE		mDlDbHandle;
	CSSM_DB_UNIQUE_RECORD_PTR mUniqueRecord;
	
	/* calculated implicitly at construction */
	bool					mExpired;
	bool					mNotValidYet;
	bool					mIsRoot;		// i.e., subject == issuer

	void releaseResources();
	void calculateCurrent(
		const char *cssmTimeStr = NULL);	// set mExpired, mNotValidYet
	
};

/*
 * TP's private Cert Group class. Provides a list of TPCertInfo pointers, to which 
 * caller can append additional elements, access an element at an arbitrary position, 
 * and remover an element at an arbitrrary position. 
 */
class TPCertGroup
{
public:
	/*
	 * No default constructor - use this to cook up an instance with 
	 * space for numCerts TPCertInfos. 
	 */
	TPCertGroup(
		CssmAllocator		&alloc,
		unsigned			numCerts);
	
	/*
	 * Deletes all TPCertInfo's.
	 */
	~TPCertGroup();
	
	/* add/remove/access TPTCertInfo's. */
	void appendCert(
		TPCertInfo			*certInfo);			// appends to end of mCertInfo
	TPCertInfo *certAtIndex(
		unsigned			index);
	TPCertInfo *removeCertAtIndex(
		unsigned			index);				// doesn't delete the cert, just 
												// removes it from our list
	unsigned numCerts();						// how many do we have? 
	
	/* 
	 * Convenience accessors for first and last cert, only valid when we have
	 * at least one cert.
	 */
	TPCertInfo *firstCert();
	TPCertInfo *lastCert();
		
	/* build a CSSM_CERTGROUP corresponding with our mCertInfo */
	CSSM_CERTGROUP_PTR buildCssmCertGroup();

	/* build a CSSM_TP_APPLE_EVIDENCE_INFO array corresponding with our
	 * mCertInfo */
	CSSM_TP_APPLE_EVIDENCE_INFO *buildCssmEvidenceInfo();
		
	/* Given a status for basic construction of a cert group and a status
	 * of (optional) policy verification, plus the implicit notBefore/notAfter
	 * status in the certs, calculate a global return code. This just 
	 * encapsulates a policy for CertGroupeConstruct and CertGroupVerify.
	 */
	CSSM_RETURN getReturnCode(
		CSSM_RETURN constructStatus,
		CSSM_BOOL	allowExpired,
		CSSM_BOOL	allowExpiredRoot,
		CSSM_RETURN policyStatus = CSSM_OK);
	 
	CssmAllocator
		&alloc() {return mAlloc; }
	
private:
	CssmAllocator			&mAlloc;
	TPCertInfo				**mCertInfo;		// just an array of pointers
	unsigned				mNumCerts;			// valid certs in certInfo
	unsigned				mSizeofCertInfo;	// mallocd space in certInfo
};
#endif	/* _TP_CERT_INFO_H_ */
Commit	Line	Data
bac41a7b A	1	/*
	2	* Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
	3	*
	4	* The contents of this file constitute Original Code as defined in and are
	5	* subject to the Apple Public Source License Version 1.2 (the 'License').
	6	* You may not use this file except in compliance with the License. Please obtain
	7	* a copy of the License at http://www.apple.com/publicsource and read it before
	8	* using this file.
	9	*
	10	* This Original Code and all software distributed under the License are
	11	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
	12	* OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
	13	* LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
	14	* PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
	15	* specific language governing rights and limitations under the License.
	16	*/
	17
	18
	19	/*
	20	* TPCertInfo.h - TP's private certificate info and cert group classes
	21	*
	22	* Written 10/23/2000 by Doug Mitchell.
	23	*/
	24
	25	#ifndef _TP_CERT_INFO_H_
	26	#define _TP_CERT_INFO_H_
	27
	28	#include <Security/cssmtype.h>
	29	#include <Security/utilities.h>
	30	#include <Security/cssmalloc.h>
29654253 A	31	#include <Security/threading.h>
	32	#include <Security/globalizer.h>
	33
	34	/* Interim hack, disable not before/not after checking during cert chain processing */
	35	/* code #ifdef'd with this gets ripped out later */
	36	#define TP_CERT_CURRENT_CHECK_INLINE 0
	37
	38	/* protects TP-wide access to time() and gmtime() */
	39	extern ModuleNexus<Mutex> tpTimeLock;
bac41a7b A	40
	41	/*
	42	* Class representing one certificate. The raw cert data usually comes from
	43	* a client (via incoming cert groups in CertGroupConstruct() and CertGroupVerify());
	44	* In this case, we don't own the raw data and don't copy or free it. Caller can
	45	* optionally specify that we copy (and own and eventnually free) the raw cert data.
	46	* The constructor throws on any error (bad cert data); subsequent to successful
	47	* construction, no CSSM errors are thrown and it's guaranteed that the cert is
	48	* basically good and successfully cached in the CL, and that we have a locally
	49	* cached subject and issuer name (in normalized encoded format).
	50	*/
	51	class TPCertInfo
	52	{
	53	public:
	54	/*
	55	* No default constructor - this is the only way.
	56	* This caches the cert and fetches subjectName and issuerName
	57	* to ensure the incoming certData is well-constructed.
	58	*/
	59	TPCertInfo(
	60	const CSSM_DATA *certData,
	61	CSSM_CL_HANDLE clHand,
29654253	62	const char *cssmTimeStr = NULL, // NULL ==> time base = right now
bac41a7b A	63	bool copyCertData = false); // true: we copy, we free
	64	// false - caller owns
	65
	66	/* frees mSubjectName, mIssuerName, mCacheHand via mClHand */
	67	~TPCertInfo();
	68
	69	/*
	70	* Fetch arbitrary field from cached cert.
	71	* Only should be used when caller is sure there is either zero or one
	72	* of the requested fields present in the cert.
	73	*/
	74	CSSM_RETURN fetchField(
	75	const CSSM_OID *fieldOid,
	76	CSSM_DATA_PTR *fieldData); // mallocd by CL and RETURNED
	77
	78	/* free arbitrary field obtained from fetchField() */
	79	CSSM_RETURN freeField(
	80	const CSSM_OID *fieldOid,
	81	CSSM_DATA_PTR fieldData);
	82
	83	/* accessors */
	84	CSSM_CL_HANDLE clHand();
	85	CSSM_HANDLE cacheHand();
	86	const CSSM_DATA *certData();
	87	const CSSM_DATA *subjectName();
	88	const CSSM_DATA *issuerName();
	89
29654253 A	90	bool isSelfSigned() { return mIsRoot; }
	91	bool isExpired() { return mExpired; }
	92	bool isNotValidYet() { return mNotValidYet; }
	93
	94	unsigned index() { return mIndex; }
	95	void index(unsigned dex) { mIndex = dex; }
	96	bool isAnchor() { return mIsAnchor; }
	97	void isAnchor(bool a) { mIsAnchor = a; }
	98	unsigned numStatusCodes() { return mNumStatusCodes; }
	99	CSSM_RETURN *statusCodes() { return mStatusCodes; }
	100	void addStatusCode(CSSM_RETURN code);
	101	CSSM_DL_DB_HANDLE dlDbHandle() { return mDlDbHandle; }
	102	void dlDbHandle(CSSM_DL_DB_HANDLE hand)
	103	{ mDlDbHandle = hand; }
	104	CSSM_DB_UNIQUE_RECORD_PTR uniqueRecord()
	105	{ return mUniqueRecord; }
	106	void uniqueRecord(CSSM_DB_UNIQUE_RECORD_PTR rec)
	107	{ mUniqueRecord = rec; }
	108
bac41a7b A	109	/*
	110	* Verify validity (not before/after). Returns
	111	* CSSMERR_TP_CERT_NOT_VALID_YET
	112	* CSSMERR_TP_CERT_EXPIRED
	113	* CSSM_OK
	114	* CSSMERR_TP_INVALID_CERT_POINTER, other "bogus cert" errors
	115	*/
	116	CSSM_RETURN isCurrent(
	117	CSSM_BOOL allowExpired = CSSM_FALSE);
	118
	119	private:
	120	CSSM_DATA *mCertData; // always valid
	121	bool mWeOwnTheData; // if true, we have to free mCertData
	122	CSSM_CL_HANDLE mClHand; // always valid
	123	CSSM_HANDLE mCacheHand; // always valid
	124	CSSM_DATA_PTR mSubjectName; // always valid
	125	CSSM_DATA_PTR mIssuerName; // always valid
	126
29654253 A	127	/* maintained by caller, default at constructor 0/false */
	128	unsigned mIndex;
	129	bool mIsAnchor;
	130	bool mIsFromDb;
	131	unsigned mNumStatusCodes;
	132	CSSM_RETURN *mStatusCodes;
	133	CSSM_DL_DB_HANDLE mDlDbHandle;
	134	CSSM_DB_UNIQUE_RECORD_PTR mUniqueRecord;
	135
	136	/* calculated implicitly at construction */
	137	bool mExpired;
	138	bool mNotValidYet;
	139	bool mIsRoot; // i.e., subject == issuer
	140
bac41a7b	141	void releaseResources();
29654253 A	142	void calculateCurrent(
29654253 A	143	const char *cssmTimeStr = NULL); // set mExpired, mNotValidYet
bac41a7b	144
bac41a7b A	145	};
	146
	147	/*
	148	* TP's private Cert Group class. Provides a list of TPCertInfo pointers, to which
	149	* caller can append additional elements, access an element at an arbitrary position,
	150	* and remover an element at an arbitrrary position.
	151	*/
	152	class TPCertGroup
	153	{
	154	public:
	155	/*
	156	* No default constructor - use this to cook up an instance with
	157	* space for numCerts TPCertInfos.
	158	*/
	159	TPCertGroup(
	160	CssmAllocator &alloc,
	161	unsigned numCerts);
	162
	163	/*
	164	* Deletes all TPCertInfo's.
	165	*/
	166	~TPCertGroup();
	167
	168	/* add/remove/access TPTCertInfo's. */
	169	void appendCert(
	170	TPCertInfo *certInfo); // appends to end of mCertInfo
	171	TPCertInfo *certAtIndex(
	172	unsigned index);
	173	TPCertInfo *removeCertAtIndex(
	174	unsigned index); // doesn't delete the cert, just
	175	// removes it from our list
	176	unsigned numCerts(); // how many do we have?
	177
	178	/*
	179	* Convenience accessors for first and last cert, only valid when we have
	180	* at least one cert.
	181	*/
29654253 A	182	TPCertInfo *firstCert();
29654253 A	183	TPCertInfo *lastCert();
bac41a7b A	184
bac41a7b A	185	/* build a CSSM_CERTGROUP corresponding with our mCertInfo */
29654253 A	186	CSSM_CERTGROUP_PTR buildCssmCertGroup();
	187
	188	/* build a CSSM_TP_APPLE_EVIDENCE_INFO array corresponding with our
	189	* mCertInfo */
	190	CSSM_TP_APPLE_EVIDENCE_INFO *buildCssmEvidenceInfo();
	191
	192	/* Given a status for basic construction of a cert group and a status
	193	* of (optional) policy verification, plus the implicit notBefore/notAfter
	194	* status in the certs, calculate a global return code. This just
	195	* encapsulates a policy for CertGroupeConstruct and CertGroupVerify.
	196	*/
	197	CSSM_RETURN getReturnCode(
	198	CSSM_RETURN constructStatus,
	199	CSSM_BOOL allowExpired,
5a719ac8	200	CSSM_BOOL allowExpiredRoot,
29654253 A	201	CSSM_RETURN policyStatus = CSSM_OK);
	202
	203	CssmAllocator
	204	&alloc() {return mAlloc; }
bac41a7b A	205
	206	private:
	207	CssmAllocator &mAlloc;
	208	TPCertInfo **mCertInfo; // just an array of pointers
	209	unsigned mNumCerts; // valid certs in certInfo
	210	unsigned mSizeofCertInfo; // mallocd space in certInfo
	211	};
	212	#endif /* _TP_CERT_INFO_H_ */