[apple/security.git] / OSX / libsecurity_apple_x509_tp / lib / tpPolicies.h

/*
 * Copyright (c) 2000-2015 Apple Inc. All Rights Reserved.
 *
 * The contents of this file constitute Original Code as defined in and are
 * subject to the Apple Public Source License Version 1.2 (the 'License').
 * You may not use this file except in compliance with the License. Please obtain
 * a copy of the License at http://www.apple.com/publicsource and read it before
 * using this file.
 *
 * This Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
 * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
 * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
 * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
 * specific language governing rights and limitations under the License.
 */


/*
	tpPolicies.h - TP module policy implementation
*/

#ifndef	_TP_POLICIES_H_
#define _TP_POLICIES_H_

#include <Security/cssmtype.h>
#include <security_utilities/alloc.h>
#include <Security/cssmapple.h>
#include "TPCertInfo.h"

#ifdef __cplusplus
extern	"C" {
#endif /* __cplusplus */

/*
 * Enumerated certificate policies enforced by this module.
 */
typedef enum {
	kTPDefault,			/* no extension parsing, just sig and expiration */
	kTPx509Basic,		/* basic X.509/RFC3280 */
	kTPiSign,			/* (obsolete) Apple code signing */
	kTP_SSL,			/* SecureTransport/SSL */
	kCrlPolicy,			/* cert chain verification via CRL */
	kTP_SMIME,			/* S/MIME */
	kTP_EAP,
	kTP_SWUpdateSign,	/* Apple SW Update signing (was Apple Code Signing) */
	kTP_ResourceSign,	/* Apple Resource Signing */
	kTP_IPSec,			/* IPSEC */
	kTP_iChat,			/* iChat */
	kTP_PKINIT_Client,	/* PKINIT client cert */
	kTP_PKINIT_Server,	/* PKINIT server cert */
	kTP_CodeSigning,	/* new Apple Code Signing (Leopard/10.5) */
	kTP_PackageSigning,	/* Package Signing */
	kTP_MacAppStoreRec,	/* MacApp store receipt */
	kTP_AppleIDSharing,	/* AppleID Sharing */
	kTP_TimeStamping,	/* RFC3161 time stamping */
	kTP_PassbookSigning,	/* Passbook Signing */
	kTP_MobileStore,	/* Apple Mobile Store Signing */
	kTP_TestMobileStore,	/* Apple Test Mobile Store Signing */
	kTP_EscrowService,	/* Apple Escrow Service Signing */
	kTP_ProfileSigning,	/* Apple Configuration Profile Signing */
	kTP_QAProfileSigning,	/* Apple QA Configuration Profile Signing */
	kTP_PCSEscrowService,	/* Apple PCS Escrow Service Signing */
	kTP_ProvisioningProfileSigning, /* Apple OS X Provisioning Profile Signing */
} TPPolicy;

/*
 * Perform TP verification on a constructed (ordered) cert group.
 */
CSSM_RETURN tp_policyVerify(
	TPPolicy						policy,
	Allocator						&alloc,
	CSSM_CL_HANDLE					clHand,
	CSSM_CSP_HANDLE					cspHand,
	TPCertGroup 					*certGroup,
	CSSM_BOOL						verifiedToRoot,		// last cert is good root
	CSSM_BOOL						verifiedViaTrustSetting,// last cert has valid user trust
	CSSM_APPLE_TP_ACTION_FLAGS		actionFlags,
	const CSSM_DATA					*policyFieldData,	// optional
    void 							*policyControl);	// future use

/*
 * Obtain policy-specific User Trust parameters
 */
void tp_policyTrustSettingParams(
	TPPolicy				policy,
	const CSSM_DATA			*policyFieldData,		// optional
	/* returned values - not mallocd */
	const char				**policyStr,
	uint32					*policyStrLen,
	SecTrustSettingsKeyUsage	*keyUse);

#ifdef __cplusplus
}
#endif
#endif	/* _TP_POLICIES_H_ */
Commit	Line	Data
b1ab9ed8	1	/*
e0e0d90e	2	* Copyright (c) 2000-2015 Apple Inc. All Rights Reserved.
427c49bc	3	*
b1ab9ed8 A	4	* The contents of this file constitute Original Code as defined in and are
	5	* subject to the Apple Public Source License Version 1.2 (the 'License').
	6	* You may not use this file except in compliance with the License. Please obtain
	7	* a copy of the License at http://www.apple.com/publicsource and read it before
	8	* using this file.
427c49bc	9	*
b1ab9ed8 A	10	* This Original Code and all software distributed under the License are
	11	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
	12	* OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
	13	* LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
	14	* PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
	15	* specific language governing rights and limitations under the License.
	16	*/
	17
	18
	19	/*
	20	tpPolicies.h - TP module policy implementation
	21	*/
	22
	23	#ifndef _TP_POLICIES_H_
	24	#define _TP_POLICIES_H_
	25
	26	#include <Security/cssmtype.h>
	27	#include <security_utilities/alloc.h>
	28	#include <Security/cssmapple.h>
	29	#include "TPCertInfo.h"
	30
	31	#ifdef __cplusplus
	32	extern "C" {
	33	#endif /* __cplusplus */
	34
	35	/*
	36	* Enumerated certificate policies enforced by this module.
	37	*/
	38	typedef enum {
	39	kTPDefault, /* no extension parsing, just sig and expiration */
	40	kTPx509Basic, /* basic X.509/RFC3280 */
	41	kTPiSign, /* (obsolete) Apple code signing */
	42	kTP_SSL, /* SecureTransport/SSL */
	43	kCrlPolicy, /* cert chain verification via CRL */
427c49bc	44	kTP_SMIME, /* S/MIME */
b1ab9ed8 A	45	kTP_EAP,
	46	kTP_SWUpdateSign, /* Apple SW Update signing (was Apple Code Signing) */
	47	kTP_ResourceSign, /* Apple Resource Signing */
	48	kTP_IPSec, /* IPSEC */
	49	kTP_iChat, /* iChat */
	50	kTP_PKINIT_Client, /* PKINIT client cert */
	51	kTP_PKINIT_Server, /* PKINIT server cert */
	52	kTP_CodeSigning, /* new Apple Code Signing (Leopard/10.5) */
	53	kTP_PackageSigning, /* Package Signing */
	54	kTP_MacAppStoreRec, /* MacApp store receipt */
	55	kTP_AppleIDSharing, /* AppleID Sharing */
427c49bc A	56	kTP_TimeStamping, /* RFC3161 time stamping */
	57	kTP_PassbookSigning, /* Passbook Signing */
	58	kTP_MobileStore, /* Apple Mobile Store Signing */
	59	kTP_TestMobileStore, /* Apple Test Mobile Store Signing */
	60	kTP_EscrowService, /* Apple Escrow Service Signing */
	61	kTP_ProfileSigning, /* Apple Configuration Profile Signing */
	62	kTP_QAProfileSigning, /* Apple QA Configuration Profile Signing */
d8f41ccd	63	kTP_PCSEscrowService, /* Apple PCS Escrow Service Signing */
e0e0d90e	64	kTP_ProvisioningProfileSigning, /* Apple OS X Provisioning Profile Signing */
b1ab9ed8 A	65	} TPPolicy;
	66
	67	/*
	68	* Perform TP verification on a constructed (ordered) cert group.
	69	*/
	70	CSSM_RETURN tp_policyVerify(
	71	TPPolicy policy,
	72	Allocator &alloc,
	73	CSSM_CL_HANDLE clHand,
	74	CSSM_CSP_HANDLE cspHand,
	75	TPCertGroup *certGroup,
	76	CSSM_BOOL verifiedToRoot, // last cert is good root
	77	CSSM_BOOL verifiedViaTrustSetting,// last cert has valid user trust
	78	CSSM_APPLE_TP_ACTION_FLAGS actionFlags,
	79	const CSSM_DATA *policyFieldData, // optional
	80	void *policyControl); // future use
	81
427c49bc	82	/*
b1ab9ed8 A	83	* Obtain policy-specific User Trust parameters
	84	*/
	85	void tp_policyTrustSettingParams(
	86	TPPolicy policy,
	87	const CSSM_DATA *policyFieldData, // optional
	88	/* returned values - not mallocd */
	89	const char **policyStr,
	90	uint32 *policyStrLen,
	91	SecTrustSettingsKeyUsage *keyUse);
427c49bc	92
b1ab9ed8 A	93	#ifdef __cplusplus
	94	}
	95	#endif
	96	#endif /* _TP_POLICIES_H_ */