]> git.saurik.com Git - apple/security.git/blob - cssm/cssmapple.h
projects / apple / security.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Security-59306.80.4.tar.gz
[apple/security.git] / cssm / cssmapple.h
1 /*
2 * Copyright (c) 2000-2016 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 *
23 * cssmapple.h -- CSSM features specific to Apple's Implementation
24 */
25
26 #ifndef _CSSMAPPLE_H_
27 #define _CSSMAPPLE_H_ 1
28
29 #include <Security/SecBase.h>
30
31 #if SEC_OS_OSX_INCLUDES
32 #include <Security/cssmerr.h>
33 #include <Security/cssmtype.h>
34 #include <Security/x509defs.h> /* for CSSM_APPLE_TP_CERT_REQUEST fields */
35 #include <Security/certextensions.h> /* ditto */
36 #include <sys/types.h> /* for the BSD *_t types */
37 #include <stdbool.h>
38 #endif /* SEC_OS_OSX */
39
40 #ifdef __cplusplus
41 extern "C" {
42 #endif
43
44 #pragma clang diagnostic push
45 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
46
47 #if SEC_OS_OSX
48 /* Guids for standard Apple addin modules. */
49
50 /* CSSM itself: {87191ca0-0fc9-11d4-849a-000502b52122} */
51 extern const CSSM_GUID gGuidCssm;
52
53 /* File based DL (aka "Keychain DL"): {87191ca1-0fc9-11d4-849a-000502b52122} */
54 extern const CSSM_GUID gGuidAppleFileDL;
55
56 /* Core CSP (local space): {87191ca2-0fc9-11d4-849a-000502b52122} */
57 extern const CSSM_GUID gGuidAppleCSP;
58
59 /* Secure CSP/DL (aka "Keychain CSPDL): {87191ca3-0fc9-11d4-849a-000502b52122} */
60 extern const CSSM_GUID gGuidAppleCSPDL;
61
62 /* X509 Certificate CL: {87191ca4-0fc9-11d4-849a-000502b52122} */
63 extern const CSSM_GUID gGuidAppleX509CL;
64
65 /* X509 Certificate TP: {87191ca5-0fc9-11d4-849a-000502b52122} */
66 extern const CSSM_GUID gGuidAppleX509TP;
67
68 /* DLAP/OpenDirectory access DL: {87191ca6-0fc9-11d4-849a-000502b52122} */
69 extern const CSSM_GUID gGuidAppleLDAPDL;
70
71 /* TP for ".mac" related policies: {87191ca7-0fc9-11d4-849a-000502b52122} */
72 extern const CSSM_GUID gGuidAppleDotMacTP;
73
74 /* Smartcard CSP/DL: {87191ca8-0fc9-11d4-849a-000502b52122} */
75 extern const CSSM_GUID gGuidAppleSdCSPDL;
76
77 /* DL for ".mac" certificate access: {87191ca9-0fc9-11d4-849a-000502b52122} */
78 extern const CSSM_GUID gGuidAppleDotMacDL;
79
80
81 /* Apple defined WORDID values */
82 enum
83 {
84 CSSM_WORDID_KEYCHAIN_PROMPT = CSSM_WORDID_VENDOR_START,
85 CSSM_WORDID_KEYCHAIN_LOCK,
86 CSSM_WORDID_KEYCHAIN_CHANGE_LOCK,
87 CSSM_WORDID_PROCESS,
88 CSSM_WORDID__RESERVED_1, /* was used in 10.2 test seeds; no longer in use */
89 CSSM_WORDID_SYMMETRIC_KEY,
90 CSSM_WORDID_SYSTEM,
91 CSSM_WORDID_KEY,
92 CSSM_WORDID_PIN,
93 CSSM_WORDID_PREAUTH,
94 CSSM_WORDID_PREAUTH_SOURCE,
95 CSSM_WORDID_ASYMMETRIC_KEY,
96 CSSM_WORDID_PARTITION,
97 CSSM_WORDID_KEYBAG_KEY,
98 CSSM_WORDID__FIRST_UNUSED
99 };
100
101 /* Apple defined ACL subject and credential types */
102 enum
103 {
104 CSSM_ACL_SUBJECT_TYPE_KEYCHAIN_PROMPT = CSSM_WORDID_KEYCHAIN_PROMPT,
105 CSSM_ACL_SUBJECT_TYPE_PROCESS = CSSM_WORDID_PROCESS,
106 CSSM_ACL_SUBJECT_TYPE_CODE_SIGNATURE = CSSM_WORDID_SIGNATURE,
107 CSSM_ACL_SUBJECT_TYPE_COMMENT = CSSM_WORDID_COMMENT,
108 CSSM_ACL_SUBJECT_TYPE_SYMMETRIC_KEY = CSSM_WORDID_SYMMETRIC_KEY,
109 CSSM_ACL_SUBJECT_TYPE_PREAUTH = CSSM_WORDID_PREAUTH,
110 CSSM_ACL_SUBJECT_TYPE_PREAUTH_SOURCE = CSSM_WORDID_PREAUTH_SOURCE,
111 CSSM_ACL_SUBJECT_TYPE_ASYMMETRIC_KEY = CSSM_WORDID_ASYMMETRIC_KEY,
112 CSSM_ACL_SUBJECT_TYPE_PARTITION = CSSM_WORDID_PARTITION,
113 };
114
115 enum
116 {
117 CSSM_SAMPLE_TYPE_KEYCHAIN_PROMPT = CSSM_WORDID_KEYCHAIN_PROMPT,
118 CSSM_SAMPLE_TYPE_KEYCHAIN_LOCK = CSSM_WORDID_KEYCHAIN_LOCK,
119 CSSM_SAMPLE_TYPE_KEYCHAIN_CHANGE_LOCK = CSSM_WORDID_KEYCHAIN_CHANGE_LOCK,
120 CSSM_SAMPLE_TYPE_PROCESS = CSSM_WORDID_PROCESS,
121 CSSM_SAMPLE_TYPE_COMMENT = CSSM_WORDID_COMMENT,
122 CSSM_SAMPLE_TYPE_RETRY_ID = CSSM_WORDID_PROPAGATE,
123 CSSM_SAMPLE_TYPE_SYMMETRIC_KEY = CSSM_WORDID_SYMMETRIC_KEY,
124 CSSM_SAMPLE_TYPE_PREAUTH = CSSM_WORDID_PREAUTH,
125 CSSM_SAMPLE_TYPE_ASYMMETRIC_KEY = CSSM_WORDID_ASYMMETRIC_KEY,
126 CSSM_SAMPLE_TYPE_KEYBAG_KEY = CSSM_WORDID_KEYBAG_KEY,
127 // there is no CSSM_SAMPLE_TYPE_PREAUTH_SOURCE
128 };
129
130
131 /* Apple-defined ACL authorization tags */
132 enum {
133 CSSM_ACL_AUTHORIZATION_CHANGE_ACL = CSSM_ACL_AUTHORIZATION_TAG_VENDOR_DEFINED_START,
134 CSSM_ACL_AUTHORIZATION_CHANGE_OWNER,
135 CSSM_ACL_AUTHORIZATION_PARTITION_ID,
136 CSSM_ACL_AUTHORIZATION_INTEGRITY,
137
138 // the "pre-auth" tags form a contiguous range of (up to) 64K pre-authorizations
139 CSSM_ACL_AUTHORIZATION_PREAUTH_BASE =
140 CSSM_ACL_AUTHORIZATION_TAG_VENDOR_DEFINED_START + 0x1000000,
141 CSSM_ACL_AUTHORIZATION_PREAUTH_END = CSSM_ACL_AUTHORIZATION_PREAUTH_BASE + 0x10000
142 };
143
144 /* pre-authorization conversions (auth-tag to slot and back) */
145 #define CSSM_ACL_AUTHORIZATION_PREAUTH(slot) \
146 (CSSM_ACL_AUTHORIZATION_PREAUTH_BASE + (slot))
147 #define CSSM_ACL_AUTHORIZATION_PREAUTH_SLOT(auth) \
148 ((auth) - CSSM_ACL_AUTHORIZATION_PREAUTH_BASE)
149 #define CSSM_ACL_AUTHORIZATION_IS_PREAUTH(auth) \
150 ((auth) >= CSSM_ACL_AUTHORIZATION_PREAUTH_BASE && \
151 (auth) < CSSM_ACL_AUTHORIZATION_PREAUTH_END)
152
153
154 /* Parameters and structures for Apple-defined ACL subjects and samples */
155
156 enum { /* types of code signatures - item 1 of CSSM_ACL_SUBJECT_TYPE_CODE_SIGNATURE subjects */
157 CSSM_ACL_CODE_SIGNATURE_INVALID = 0, /* standard OS X code signature */
158 CSSM_ACL_CODE_SIGNATURE_OSX = 1 /* standard OS X code signature */
159 };
160
161 /* ACL subjects of type PROCESS */
162
163 enum { /* PROCESS_SUBJECT mask fields */
164 CSSM_ACL_MATCH_UID = 0x01, /* match userid against uid field */
165 CSSM_ACL_MATCH_GID = 0x02, /* match groupid against gid field */
166 CSSM_ACL_MATCH_HONOR_ROOT = 0x100, /* let root (uid 0) match any userid */
167 CSSM_ACL_MATCH_BITS = CSSM_ACL_MATCH_UID | CSSM_ACL_MATCH_GID
168 };
169
170 enum { /* PROCESS_SUBJECT structure version field */
171 CSSM_ACL_PROCESS_SELECTOR_CURRENT_VERSION = 0x101
172 };
173
174 typedef struct cssm_acl_process_subject_selector { /* PROCESS_SUBJECT selector */
175 uint16 version; /* version of this selector */
176 uint16 mask; /* active fields mask */
177 uint32 uid; /* effective user id match */
178 uint32 gid; /* effective group id match */
179 } CSSM_ACL_PROCESS_SUBJECT_SELECTOR;
180
181 /* ACL subjects of type KEYCHAIN_PROMPT */
182
183 enum { /* KEYCHAIN_PROMPT structure version field */
184 CSSM_ACL_KEYCHAIN_PROMPT_CURRENT_VERSION = 0x101
185 };
186
187 enum { /* KEYCHAIN_PROMPT operational flags */
188 CSSM_ACL_KEYCHAIN_PROMPT_REQUIRE_PASSPHRASE = 0x0001, /* require re-entering of passphrase */
189 /* the following bits are ignored by 10.4 and earlier */
190 CSSM_ACL_KEYCHAIN_PROMPT_UNSIGNED = 0x0010, /* prompt for unsigned clients */
191 CSSM_ACL_KEYCHAIN_PROMPT_UNSIGNED_ACT = 0x0020, /* UNSIGNED bit overrides system default */
192 CSSM_ACL_KEYCHAIN_PROMPT_INVALID = 0x0040, /* prompt for invalid signed clients */
193 CSSM_ACL_KEYCHAIN_PROMPT_INVALID_ACT = 0x0080, /* INVALID bit overrides system default */
194 };
195
196 typedef struct cssm_acl_keychain_prompt_selector { /* KEYCHAIN_PROMPT selector */
197 uint16 version; /* version of this selector */
198 uint16 flags; /* flag bits */
199 } CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR;
200
201 /* ACL subjects of type CSSM_ACL_SUBJECT_TYPE_PREAUTH_SOURCE */
202 typedef uint32 CSSM_ACL_PREAUTH_TRACKING_STATE;
203 enum { /* preauth tracking state */
204 CSSM_ACL_PREAUTH_TRACKING_COUNT_MASK = 0xff, /* mask for count status */
205 CSSM_ACL_PREAUTH_TRACKING_BLOCKED = 0, /* retries exhausted; the slot is blocked */
206 /* 0 .. 255 is a count of (re)tries remaining */
207
208 /* bits or'ed into any count given */
209 CSSM_ACL_PREAUTH_TRACKING_UNKNOWN = 0x40000000, /* status of slot is unknown (ignore count) */
210 CSSM_ACL_PREAUTH_TRACKING_AUTHORIZED = 0x80000000 /* the slot is currently authorized (or'ed in) */
211 };
212
213
214 /* Apple defined values of a CSSM_DB_ACCESS_TYPE */
215 enum {
216 CSSM_DB_ACCESS_RESET = 0x10000 /* clear pre-authentications (or'ed bit) */
217 };
218
219
220 /* Apple defined algorithm IDs */
221 enum
222 {
223 CSSM_ALGID_APPLE_YARROW = CSSM_ALGID_VENDOR_DEFINED,
224 CSSM_ALGID_AES, /* RijnDael */
225 CSSM_ALGID_FEE, /* FEE Key Generation */
226 CSSM_ALGID_FEE_MD5, /* FEE/ElGamal signature w/ MD5 hash */
227 CSSM_ALGID_FEE_SHA1, /* FEE/ElGamal signature w/ SHA1 hash */
228 CSSM_ALGID_FEED, /* 1:1 FEE asymmetric encryption */
229 CSSM_ALGID_FEEDEXP, /* 2:1 FEE asymmetric encryption */
230 CSSM_ALGID_ASC, /* Apple Secure Compression */
231 CSSM_ALGID_SHA1HMAC_LEGACY, /* HMAC/SHA1, legacy compatible */
232 CSSM_ALGID_KEYCHAIN_KEY, /* derive or manipulate keychain master keys */
233 CSSM_ALGID_PKCS12_PBE_ENCR, /* PKCS12, encrypt/decrypt key */
234 CSSM_ALGID_PKCS12_PBE_MAC, /* PKCS12, MAC key */
235 CSSM_ALGID_SECURE_PASSPHRASE, /* passphrase acquired by SecurityServer */
236 CSSM_ALGID_PBE_OPENSSL_MD5, /* traditional openssl key derivation */
237 CSSM_ALGID_SHA256, /* 256-bit SHA2 */
238 CSSM_ALGID_SHA384, /* 384-bit SHA2 */
239 CSSM_ALGID_SHA512, /* 512-bit SHA2 */
240 CSSM_ALGID_ENTROPY_DEFAULT, /* default entropy source of (CSP) device, if any */
241 CSSM_ALGID_SHA224, /* SHA2, 224 bit */
242 CSSM_ALGID_SHA224WithRSA, /* RSA signature on SHA224 digest */
243 CSSM_ALGID_SHA256WithRSA, /* RSA signature on SHA256 digest */
244 CSSM_ALGID_SHA384WithRSA, /* RSA signature on SHA384 digest */
245 CSSM_ALGID_SHA512WithRSA, /* RSA signature on SHA512 digest */
246 CSSM_ALGID_OPENSSH1, /* OpenSSH v1 RSA key wrapping */
247 CSSM_ALGID_SHA224WithECDSA, /* ECDSA signature on SHA224 digest */
248 CSSM_ALGID_SHA256WithECDSA, /* ECDSA signature on SHA256 digest */
249 CSSM_ALGID_SHA384WithECDSA, /* ECDSA signature on SHA384 digest */
250 CSSM_ALGID_SHA512WithECDSA, /* ECDSA signature on SHA512 digest */
251 CSSM_ALGID_ECDSA_SPECIFIED, /* ECDSA with separate digest algorithm specifier */
252 CSSM_ALGID_ECDH_X963_KDF, /* ECDH with X9.63 key derivation */
253 CSSM_ALGID__FIRST_UNUSED
254 };
255
256 /* Apple defined padding */
257 enum
258 {
259 /* RFC 2246 section E.2 for SSLv2 rollback detection */
260 CSSM_PADDING_APPLE_SSLv2 = CSSM_PADDING_VENDOR_DEFINED
261 };
262
263
264 /* Apple defined keyblob formats */
265 enum {
266 CSSM_KEYBLOB_RAW_FORMAT_VENDOR_DEFINED = 0x80000000
267 };
268 enum {
269 /* X509 SubjectPublicKeyInfo */
270 CSSM_KEYBLOB_RAW_FORMAT_X509 = CSSM_KEYBLOB_RAW_FORMAT_VENDOR_DEFINED,
271 /* OpenSSH v1 */
272 CSSM_KEYBLOB_RAW_FORMAT_OPENSSH,
273 /* openssl-style DSA private key */
274 CSSM_KEYBLOB_RAW_FORMAT_OPENSSL,
275 /* OpenSSH v2 */
276 CSSM_KEYBLOB_RAW_FORMAT_OPENSSH2
277 };
278
279 /* Apple adds some "common" error codes. CDSA does not define an official start value for this. */
280 enum
281 {
282 CSSM_CUSTOM_COMMON_ERROR_EXTENT = 0x00e0,
283
284 CSSM_ERRCODE_NO_USER_INTERACTION = 0x00e0,
285 CSSM_ERRCODE_USER_CANCELED = 0x00e1,
286 CSSM_ERRCODE_SERVICE_NOT_AVAILABLE = 0x00e2,
287 CSSM_ERRCODE_INSUFFICIENT_CLIENT_IDENTIFICATION = 0x00e3,
288 CSSM_ERRCODE_DEVICE_RESET = 0x00e4,
289 CSSM_ERRCODE_DEVICE_FAILED = 0x00e5,
290 CSSM_ERRCODE_IN_DARK_WAKE = 0x00e6
291 };
292
293 enum {
294 CSSMERR_CSSM_NO_USER_INTERACTION = -2147417888,
295 CSSMERR_AC_NO_USER_INTERACTION = -2147405600,
296 CSSMERR_CSP_NO_USER_INTERACTION = -2147415840,
297 CSSMERR_CL_NO_USER_INTERACTION = -2147411744,
298 CSSMERR_DL_NO_USER_INTERACTION = -2147413792,
299 CSSMERR_TP_NO_USER_INTERACTION = -2147409696,
300
301 CSSMERR_CSSM_USER_CANCELED = -2147417887,
302 CSSMERR_AC_USER_CANCELED = -2147405599,
303 CSSMERR_CSP_USER_CANCELED = -2147415839,
304 CSSMERR_CL_USER_CANCELED = -2147411743,
305 CSSMERR_DL_USER_CANCELED = -2147413791,
306 CSSMERR_TP_USER_CANCELED = -2147409695,
307
308 CSSMERR_CSSM_SERVICE_NOT_AVAILABLE = -2147417886,
309 CSSMERR_AC_SERVICE_NOT_AVAILABLE = -2147405598,
310 CSSMERR_CSP_SERVICE_NOT_AVAILABLE = -2147415838,
311 CSSMERR_CL_SERVICE_NOT_AVAILABLE = -2147411742,
312 CSSMERR_DL_SERVICE_NOT_AVAILABLE = -2147413790,
313 CSSMERR_TP_SERVICE_NOT_AVAILABLE = -2147409694,
314
315 CSSMERR_CSSM_INSUFFICIENT_CLIENT_IDENTIFICATION = -2147417885,
316 CSSMERR_AC_INSUFFICIENT_CLIENT_IDENTIFICATION = -2147405597,
317 CSSMERR_CSP_INSUFFICIENT_CLIENT_IDENTIFICATION = -2147415837,
318 CSSMERR_CL_INSUFFICIENT_CLIENT_IDENTIFICATION = -2147411741,
319 CSSMERR_DL_INSUFFICIENT_CLIENT_IDENTIFICATION = -2147413789,
320 CSSMERR_TP_INSUFFICIENT_CLIENT_IDENTIFICATION = -2147409693,
321
322 CSSMERR_CSSM_DEVICE_RESET = -2147417884,
323 CSSMERR_AC_DEVICE_RESET = -2147405596,
324 CSSMERR_CSP_DEVICE_RESET = -2147415836,
325 CSSMERR_CL_DEVICE_RESET = -2147411740,
326 CSSMERR_DL_DEVICE_RESET = -2147413788,
327 CSSMERR_TP_DEVICE_RESET = -2147409692,
328
329 CSSMERR_CSSM_DEVICE_FAILED = -2147417883,
330 CSSMERR_AC_DEVICE_FAILED = -2147405595,
331 CSSMERR_CSP_DEVICE_FAILED = -2147415835,
332 CSSMERR_CL_DEVICE_FAILED = -2147411739,
333 CSSMERR_DL_DEVICE_FAILED = -2147413787,
334 CSSMERR_TP_DEVICE_FAILED = -2147409691,
335
336 CSSMERR_CSSM_IN_DARK_WAKE = -2147417882,
337 CSSMERR_AC_IN_DARK_WAKE = -2147405594,
338 CSSMERR_CSP_IN_DARK_WAKE = -2147415834,
339 CSSMERR_CL_IN_DARK_WAKE = -2147411738,
340 CSSMERR_DL_IN_DARK_WAKE = -2147413786,
341 CSSMERR_TP_IN_DARK_WAKE = -2147409690,
342 };
343
344 /* AppleCSPDL, AppleCSP private error codes. */
345 enum {
346 CSSMERR_CSP_APPLE_ADD_APPLICATION_ACL_SUBJECT = -2147415040,
347 /* An attempt was made to use a public key which is incomplete due to
348 the lack of algorithm-specific parameters. */
349 CSSMERR_CSP_APPLE_PUBLIC_KEY_INCOMPLETE = -2147415039,
350
351 /* a code signature match failed */
352 CSSMERR_CSP_APPLE_SIGNATURE_MISMATCH = -2147415038,
353
354 /* Key start date invalid */
355 CSSMERR_CSP_APPLE_INVALID_KEY_START_DATE = -2147415037,
356 /* Key end date invalid */
357 CSSMERR_CSP_APPLE_INVALID_KEY_END_DATE = -2147415036,
358
359 /* Keychain Syncing error codes */
360 CSSMERR_CSPDL_APPLE_DL_CONVERSION_ERROR = -2147415035,
361
362 /* SSLv2 padding check: rollback attack detected */
363 CSSMERR_CSP_APPLE_SSLv2_ROLLBACK = -2147415034,
364 };
365
366
367 /* AppleFileDL record types. */
368 enum
369 {
370 CSSM_DL_DB_RECORD_GENERIC_PASSWORD = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 0,
371 CSSM_DL_DB_RECORD_INTERNET_PASSWORD = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 1,
372 CSSM_DL_DB_RECORD_APPLESHARE_PASSWORD = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 2,
373
374 CSSM_DL_DB_RECORD_X509_CERTIFICATE = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 0x1000,
375 CSSM_DL_DB_RECORD_USER_TRUST,
376 CSSM_DL_DB_RECORD_X509_CRL,
377 CSSM_DL_DB_RECORD_UNLOCK_REFERRAL,
378 CSSM_DL_DB_RECORD_EXTENDED_ATTRIBUTE,
379 CSSM_DL_DB_RECORD_METADATA = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 0x8000
380 };
381
382 /* AppleFileDL extentions: passthrough ids */
383 enum {
384 // Toggle whether or not to autocommit after modifying the database.
385 // The input parameter is a CSSM_BOOL, where TRUE turns autocommit on
386 // and FALSE turns it off.
387 CSSM_APPLEFILEDL_TOGGLE_AUTOCOMMIT,
388
389 // Commit any pending changes to the database.
390 CSSM_APPLEFILEDL_COMMIT,
391
392 // Rollback and discard any pending changes to the database.
393 CSSM_APPLEFILEDL_ROLLBACK,
394
395 // Try to take the file lock on the underlying database
396 // Calling commit or rollback will release the lock
397 CSSM_APPLEFILEDL_TAKE_FILE_LOCK,
398
399 // Make a backup of this database in a new file
400 CSSM_APPLEFILEDL_MAKE_BACKUP,
401
402 // Make a copy of this database
403 CSSM_APPLEFILEDL_MAKE_COPY,
404
405 // Delete this database
406 CSSM_APPLEFILEDL_DELETE_FILE,
407 };
408
409 /* UNLOCK_REFERRAL "type" attribute values */
410 enum {
411 CSSM_APPLE_UNLOCK_TYPE_KEY_DIRECT = 1, // master secret key stored directly
412 CSSM_APPLE_UNLOCK_TYPE_WRAPPED_PRIVATE = 2, // master key wrapped by public key
413 CSSM_APPLE_UNLOCK_TYPE_KEYBAG = 3 // master key wrapped via keybag
414 };
415
416 /* Apple DL private error codes. */
417 enum
418 {
419 /* The OpenParameters argument passed to CSSM_DL_DbCreate or CSSM_DL_DbOpen
420 was neither NULL nor a pointer to a valid CSSM_APPLEDL_OPEN_PARAMETERS
421 structure. */
422 CSSMERR_APPLEDL_INVALID_OPEN_PARAMETERS = -2147412992,
423
424 /* an operation failed because the disk was full */
425 CSSMERR_APPLEDL_DISK_FULL = -2147412991,
426
427 /* an operation failed because a disk quota was exceeded */
428 CSSMERR_APPLEDL_QUOTA_EXCEEDED = -2147412990,
429
430 /* an operation failed because a file was too large */
431 CSSMERR_APPLEDL_FILE_TOO_BIG = -2147412989,
432
433 /* a keychain database's internal information ("blob") is invalid */
434 CSSMERR_APPLEDL_INVALID_DATABASE_BLOB = -2147412988,
435
436 /* a keychain database's internal information ("blob") is invalid */
437 CSSMERR_APPLEDL_INVALID_KEY_BLOB = -2147412987,
438
439 /* the internal data format version for a database's internal information ("blob") is invalid */
440 CSSMERR_APPLEDL_INCOMPATIBLE_DATABASE_BLOB = -2147412986,
441
442 /* the internal data format version for a database's internal information ("blob") is invalid */
443 CSSMERR_APPLEDL_INCOMPATIBLE_KEY_BLOB = -2147412985,
444 };
445
446 /* Apple X509TP private error codes. */
447 enum
448 {
449 /* Host name mismatch */
450 CSSMERR_APPLETP_HOSTNAME_MISMATCH = -2147408896,
451 /* Non-understood extension with Critical flag true */
452 CSSMERR_APPLETP_UNKNOWN_CRITICAL_EXTEN = -2147408895,
453 /* Basic Constraints extension required per policy, but not present */
454 CSSMERR_APPLETP_NO_BASIC_CONSTRAINTS = -2147408894,
455 /* Invalid BasicConstraints.CA */
456 CSSMERR_APPLETP_INVALID_CA = -2147408893,
457 /* Invalid Authority Key ID */
458 CSSMERR_APPLETP_INVALID_AUTHORITY_ID = -2147408892,
459 /* Invalid Subject Key ID */
460 CSSMERR_APPLETP_INVALID_SUBJECT_ID = -2147408891,
461 /* Invalid Key Usage for policy */
462 CSSMERR_APPLETP_INVALID_KEY_USAGE = -2147408890,
463 /* Invalid Extended Key Usage for policy */
464 CSSMERR_APPLETP_INVALID_EXTENDED_KEY_USAGE = -2147408889,
465 /* Invalid Subject/Authority Key ID Linkage */
466 CSSMERR_APPLETP_INVALID_ID_LINKAGE = -2147408888,
467 /* PathLengthConstraint exceeded */
468 CSSMERR_APPLETP_PATH_LEN_CONSTRAINT = -2147408887,
469 /* Cert group terminated at a root cert which did not self-verify */
470 CSSMERR_APPLETP_INVALID_ROOT = -2147408886,
471 /* CRL expired */
472 CSSMERR_APPLETP_CRL_EXPIRED = -2147408885,
473 /* CRL not valid yet */
474 CSSMERR_APPLETP_CRL_NOT_VALID_YET = -2147408884,
475 /* Cannot find appropriate CRL */
476 CSSMERR_APPLETP_CRL_NOT_FOUND = -2147408883,
477 /* specified CRL server down */
478 CSSMERR_APPLETP_CRL_SERVER_DOWN = -2147408882,
479 /* illegible CRL distribution point URL */
480 CSSMERR_APPLETP_CRL_BAD_URI = -2147408881,
481 /* Unknown critical cert extension */
482 CSSMERR_APPLETP_UNKNOWN_CERT_EXTEN = -2147408880,
483 /* Unknown critical CRL extension */
484 CSSMERR_APPLETP_UNKNOWN_CRL_EXTEN = -2147408879,
485 /* CRL not verifiable to anchor or root */
486 CSSMERR_APPLETP_CRL_NOT_TRUSTED = -2147408878,
487 /* CRL verified to untrusted root */
488 CSSMERR_APPLETP_CRL_INVALID_ANCHOR_CERT = -2147408877,
489 /* CRL failed policy verification */
490 CSSMERR_APPLETP_CRL_POLICY_FAIL = -2147408876,
491 /* IssuingDistributionPoint extension violation */
492 CSSMERR_APPLETP_IDP_FAIL = -2147408875,
493 /* Cert not found at specified issuerAltName */
494 CSSMERR_APPLETP_CERT_NOT_FOUND_FROM_ISSUER = -2147408874,
495 /* Bad cert obtained from specified issuerAltName */
496 CSSMERR_APPLETP_BAD_CERT_FROM_ISSUER = -2147408873,
497 /* S/MIME Email address mismatch */
498 CSSMERR_APPLETP_SMIME_EMAIL_ADDRS_NOT_FOUND = -2147408872,
499 /* Appropriate S/MIME ExtendedKeyUsage not found */
500 CSSMERR_APPLETP_SMIME_BAD_EXT_KEY_USE = -2147408871,
501 /* S/MIME KeyUsage incompatibility */
502 CSSMERR_APPLETP_SMIME_BAD_KEY_USE = -2147408870,
503 /* S/MIME, cert with KeyUsage flagged !critical */
504 CSSMERR_APPLETP_SMIME_KEYUSAGE_NOT_CRITICAL = -2147408869,
505 /* S/MIME, leaf with empty subject name and no email addrs
506 in SubjectAltName */
507 CSSMERR_APPLETP_SMIME_NO_EMAIL_ADDRS = -2147408868,
508 /* S/MIME, leaf with empty subject name, SubjectAltName
509 not critical */
510 CSSMERR_APPLETP_SMIME_SUBJ_ALT_NAME_NOT_CRIT = -2147408867,
511 /* Appropriate SSL ExtendedKeyUsage not found */
512 CSSMERR_APPLETP_SSL_BAD_EXT_KEY_USE = -2147408866,
513 /* unparseable OCSP response */
514 CSSMERR_APPLETP_OCSP_BAD_RESPONSE = -2147408865,
515 /* unparseable OCSP request */
516 CSSMERR_APPLETP_OCSP_BAD_REQUEST = -2147408864,
517 /* OCSP service unavailable */
518 CSSMERR_APPLETP_OCSP_UNAVAILABLE = -2147408863,
519 /* OCSP status: cert unrecognized */
520 CSSMERR_APPLETP_OCSP_STATUS_UNRECOGNIZED = -2147408862,
521 /* revocation check not successful for each cert */
522 CSSMERR_APPLETP_INCOMPLETE_REVOCATION_CHECK = -2147408861,
523 /* general network error */
524 CSSMERR_APPLETP_NETWORK_FAILURE = -2147408860,
525 /* OCSP response not verifiable to anchor or root */
526 CSSMERR_APPLETP_OCSP_NOT_TRUSTED = -2147408859,
527 /* OCSP response verified to untrusted root */
528 CSSMERR_APPLETP_OCSP_INVALID_ANCHOR_CERT = -2147408858,
529 /* OCSP response signature error */
530 CSSMERR_APPLETP_OCSP_SIG_ERROR = -2147408857,
531 /* No signer for OCSP response found */
532 CSSMERR_APPLETP_OCSP_NO_SIGNER = -2147408856,
533 /* OCSP responder status: malformed request */
534 CSSMERR_APPLETP_OCSP_RESP_MALFORMED_REQ = -2147408855,
535 /* OCSP responder status: internal error */
536 CSSMERR_APPLETP_OCSP_RESP_INTERNAL_ERR = -2147408854,
537 /* OCSP responder status: try later */
538 CSSMERR_APPLETP_OCSP_RESP_TRY_LATER = -2147408853,
539 /* OCSP responder status: signature required */
540 CSSMERR_APPLETP_OCSP_RESP_SIG_REQUIRED = -2147408852,
541 /* OCSP responder status: unauthorized */
542 CSSMERR_APPLETP_OCSP_RESP_UNAUTHORIZED = -2147408851,
543 /* OCSP response nonce did not match request */
544 CSSMERR_APPLETP_OCSP_NONCE_MISMATCH = -2147408850,
545 /* Illegal cert chain length for Code Signing */
546 CSSMERR_APPLETP_CS_BAD_CERT_CHAIN_LENGTH = -2147408849,
547 /* Missing Basic Constraints for Code Signing */
548 CSSMERR_APPLETP_CS_NO_BASIC_CONSTRAINTS = -2147408848,
549 /* Bad PathLengthConstraint for Code Signing */
550 CSSMERR_APPLETP_CS_BAD_PATH_LENGTH = -2147408847,
551 /* Missing ExtendedKeyUsage for Code Signing */
552 CSSMERR_APPLETP_CS_NO_EXTENDED_KEY_USAGE = -2147408846,
553 /* Development style Code Signing Cert Detected */
554 CSSMERR_APPLETP_CODE_SIGN_DEVELOPMENT = -2147408845,
555 /* Illegal cert chain length for Resource Signing */
556 CSSMERR_APPLETP_RS_BAD_CERT_CHAIN_LENGTH = -2147408844,
557 /* Bad extended key usage for Resource Signing */
558 CSSMERR_APPLETP_RS_BAD_EXTENDED_KEY_USAGE = -2147408843,
559 /* Trust Setting: deny */
560 CSSMERR_APPLETP_TRUST_SETTING_DENY = -2147408842,
561 /* Invalid empty SubjectName */
562 CSSMERR_APPLETP_INVALID_EMPTY_SUBJECT = -2147408841,
563 /* Unknown critical Qualified Cert Statement ID */
564 CSSMERR_APPLETP_UNKNOWN_QUAL_CERT_STATEMENT = -2147408840,
565 /* Missing required extension */
566 CSSMERR_APPLETP_MISSING_REQUIRED_EXTENSION = -2147408839,
567 /* Extended key usage not marked critical */
568 CSSMERR_APPLETP_EXT_KEYUSAGE_NOT_CRITICAL = -2147408838,
569 /* Required name or identifier not present */
570 CSSMERR_APPLETP_IDENTIFIER_MISSING = -2147408837,
571 /* Certificate authority pinning mismatch */
572 CSSMERR_APPLETP_CA_PIN_MISMATCH = -2147408836,
573 };
574
575 /* Apple .mac TP private error codes. */
576 enum
577 {
578 /* cert request queued */
579 CSSMERR_APPLE_DOTMAC_REQ_QUEUED = -2147408796,
580 /* cert request redirected */
581 CSSMERR_APPLE_DOTMAC_REQ_REDIRECT = -2147408795,
582 /* general server-reported error */
583 CSSMERR_APPLE_DOTMAC_REQ_SERVER_ERR = -2147408794,
584 /* server-reported parameter error */
585 CSSMERR_APPLE_DOTMAC_REQ_SERVER_PARAM = -2147408793,
586 /* server-reported authorization error */
587 CSSMERR_APPLE_DOTMAC_REQ_SERVER_AUTH = -2147408792,
588 /* server-reported unimplemented */
589 CSSMERR_APPLE_DOTMAC_REQ_SERVER_UNIMPL = -2147408791,
590 /* server-reported not available */
591 CSSMERR_APPLE_DOTMAC_REQ_SERVER_NOT_AVAIL = -2147408790,
592 /* server-reported already exists */
593 CSSMERR_APPLE_DOTMAC_REQ_SERVER_ALREADY_EXIST = -2147408789,
594 /* server-reported service error */
595 CSSMERR_APPLE_DOTMAC_REQ_SERVER_SERVICE_ERROR = -2147408788,
596 /* request already pending for specified user */
597 CSSMERR_APPLE_DOTMAC_REQ_IS_PENDING = -2147408787,
598 /* no request pending for specified user */
599 CSSMERR_APPLE_DOTMAC_NO_REQ_PENDING = -2147408786,
600 /* CSR failed to verify */
601 CSSMERR_APPLE_DOTMAC_CSR_VERIFY_FAIL = -2147408785,
602 /* server reported failed consistency check */
603 CSSMERR_APPLE_DOTMAC_FAILED_CONSISTENCY_CHECK = -2147408784,
604 };
605
606 enum
607 {
608 CSSM_APPLEDL_OPEN_PARAMETERS_VERSION = 1
609 };
610
611 enum cssm_appledl_open_parameters_mask
612 {
613 kCSSM_APPLEDL_MASK_MODE = (1 << 0)
614 };
615
616 /* Pass a CSSM_APPLEDL_OPEN_PARAMETERS_PTR as the OpenParameters argument to
617 CSSM_DL_DbCreate or CSSM_DL_DbOpen. When using this struct, you must zero
618 out the entire struct before setting any additional parameters to ensure
619 forward compatibility. */
620 typedef struct cssm_appledl_open_parameters
621 {
622 uint32 length; /* Should be sizeof(CSSM_APPLEDL_OPEN_PARAMETERS). */
623 uint32 version; /* Should be CSSM_APPLEDL_OPEN_PARAMETERS_VERSION. */
624
625 /* If no OpenParameters are specified, autoCommit is on (!CSSM_FALSE) by default.
626 When autoCommit is on (!CSSM_FALSE), changes made to the Db are written to disk
627 before returning from each function.
628 When autoCommit is off (CSSM_FALSE), changes made to the database are not guaranteed
629 to be written to disk until the Db is closed. This is useful for bulk writes.
630 Be aware that if autoCommit is off, changes made in previous calls to the DL might
631 get rolled back if a new modification operation fails. */
632 CSSM_BOOL autoCommit;
633
634 /* Mask marking which of the following fields are to be used. */
635 uint32 mask;
636
637 /* When calling DbCreate, the initial mode to create the database file with; ignored on DbOpen. You must set the kCSSM_APPLEDL_MASK_MODE bit in mask or mode is ignored. */
638 mode_t mode;
639 } CSSM_APPLEDL_OPEN_PARAMETERS, *CSSM_APPLEDL_OPEN_PARAMETERS_PTR;
640
641
642 /* AppleCSPDL passthough ids */
643 enum
644 {
645 /* Tell the SecurityServer to lock the database specified by the DLDBHandle argument.
646 The InputParams and OutputParams arguments are ignored. */
647 CSSM_APPLECSPDL_DB_LOCK = 0,
648
649 /* Tell the SecurityServer to unlock the database specified by the DLDBHandle argument.
650 The InputParameters argument is a CSSM_DATA_PTR containing the password, or NULL if
651 the SecurityServer should prompt for the password.
652 The OutputParams argument is ignored.
653 The SecurityServer will put up UI (though the SecurityAgent) when this function is called
654 iff InputParameters is NULL. */
655 CSSM_APPLECSPDL_DB_UNLOCK = 1,
656
657 /* Ask the SecurityServer to get the db settings specified for the database
658 specified by the DLDBHandle argument. The settings are returned in the OutputParameters argument.
659 The OutputParameters argument is a pointer to a CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS_PTR.
660 Upon successful completion, the AppleCSPDL will have allocated a
661 CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS structure using the application-specified
662 allocators for the DL attachment specified by the DLDBHandle argument. The structure will contain
663 the current database settings for the specified database. The client should free the
664 CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS_PTR after it has finished using it.
665 The InputParameters argument is ignored.
666 The SecurityServer might put up UI (though the SecurityAgent) when this function is called. */
667 CSSM_APPLECSPDL_DB_GET_SETTINGS = 2,
668
669 /* Tell the SecurityServer to set the db settings specified in InputParameters on the database
670 specified by the DLDBHandle argument.
671 The InputParameters argument is a const CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS * containing
672 the new settings for the specified database.
673 The OutputParams argument is ignored.
674 The SecurityServer might put up UI (though the SecurityAgent) when this function is called. */
675 CSSM_APPLECSPDL_DB_SET_SETTINGS = 3,
676
677 /* Ask the SecurityServer whether the database specified by the DLDBHandle argument is locked.
678 The InputParameters argument is ignored.
679 The OutputParameters argument is a pointer to a CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS_PTR.
680 Upon successful completion, the AppleCSPDL will have allocated a
681 CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS structure using the application-specified
682 allocators for the DL attachment specified by the DLDBHandle argument. The structure will contain
683 the current lock status for the specified database. The client should free the
684 CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS_PTR after it has finished using it.
685 The SecurityServer will put up UI (though the SecurityAgent) when this function is called. */
686 CSSM_APPLECSPDL_DB_IS_LOCKED = 4,
687
688 /* Tell the SecurityServer to change the password for the database specified by
689 the DLDBHandle.
690
691 The InputParameters argument is a const CSSM_APPLECSPDL_DB_CHANGE_PASSWORD_PARAMETERS * containing
692 a CSSM_ACCESS_CREDENTIALS * which determines how the password will be changed. If the
693 accessCredentials are NULL, the SecurityAgent will prompt for the old and the new password for the
694 specified database. If credentials are specified, there should be 2 entries:
695 1. a 3-element list containing:
696 CSSM_WORDID_KEYCHAIN_LOCK, CSSM_SAMPLE_TYPE_PASSWORD, and the old password.
697 2. a 3-element list containing:
698 CSSM_WORDID_KEYCHAIN_CHANGE_LOCK, CSSM_SAMPLE_TYPE_PASSWORD, and the new password.
699
700 The OutputParams argument is ignored.
701 The SecurityServer might put up UI (though the SecurityAgent) when this function is called. */
702 CSSM_APPLECSPDL_DB_CHANGE_PASSWORD =5,
703
704 /* Return the SecurityServer database handle for the database specified by the DLDBHandle */
705 CSSM_APPLECSPDL_DB_GET_HANDLE = 6,
706
707 /* Given a CSSM_KEY for the CSPDL, return the SecurityServer key handle */
708 CSSM_APPLESCPDL_CSP_GET_KEYHANDLE = 7,
709
710 CSSM_APPLE_PRIVATE_CSPDL_CODE_8 = 8,
711 CSSM_APPLE_PRIVATE_CSPDL_CODE_9 = 9,
712 CSSM_APPLE_PRIVATE_CSPDL_CODE_10 = 10,
713 CSSM_APPLE_PRIVATE_CSPDL_CODE_11 = 11,
714 CSSM_APPLE_PRIVATE_CSPDL_CODE_12 = 12,
715 CSSM_APPLE_PRIVATE_CSPDL_CODE_13 = 13,
716 CSSM_APPLE_PRIVATE_CSPDL_CODE_14 = 14,
717 CSSM_APPLE_PRIVATE_CSPDL_CODE_15 = 15,
718 CSSM_APPLE_PRIVATE_CSPDL_CODE_16 = 16,
719 CSSM_APPLE_PRIVATE_CSPDL_CODE_17 = 17,
720 CSSM_APPLE_PRIVATE_CSPDL_CODE_18 = 18,
721 CSSM_APPLE_PRIVATE_CSPDL_CODE_19 = 19,
722 CSSM_APPLE_PRIVATE_CSPDL_CODE_20 = 20,
723 CSSM_APPLE_PRIVATE_CSPDL_CODE_21 = 21,
724 CSSM_APPLE_PRIVATE_CSPDL_CODE_22 = 22,
725 CSSM_APPLE_PRIVATE_CSPDL_CODE_23 = 23,
726 CSSM_APPLE_PRIVATE_CSPDL_CODE_24 = 24,
727 CSSM_APPLE_PRIVATE_CSPDL_CODE_25 = 25,
728 CSSM_APPLE_PRIVATE_CSPDL_CODE_26 = 26,
729 CSSM_APPLE_PRIVATE_CSPDL_CODE_27 = 27,
730
731 /* Given a CSSM_KEY_PTR in any format, obtain the SHA-1 hash of the
732 * associated key blob.
733 * Key is specified in CSSM_CSP_CreatePassThroughContext.
734 * Hash is allocated bythe CSP, in the App's memory, and returned
735 * in *outData. */
736 CSSM_APPLECSP_KEYDIGEST = 0x100
737 };
738
739
740
741 /* AppleCSPDL passthough parameters */
742 typedef struct cssm_applecspdl_db_settings_parameters
743 {
744 uint32 idleTimeout; // seconds idle timeout lock
745 uint8 lockOnSleep; // lock database when system sleeps
746 } CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS, *CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS_PTR;
747
748 /* AppleCSPDL passthough parameters */
749 typedef struct cssm_applecspdl_db_is_locked_parameters
750 {
751 uint8 isLocked; // True iff the database is locked
752 } CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS, *CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS_PTR;
753
754 /* AppleCSPDL passthough parameters */
755 typedef struct cssm_applecspdl_db_change_password_parameters
756 {
757 CSSM_ACCESS_CREDENTIALS *accessCredentials;
758 } CSSM_APPLECSPDL_DB_CHANGE_PASSWORD_PARAMETERS, *CSSM_APPLECSPDL_DB_CHANGE_PASSWORD_PARAMETERS_PTR;
759
760 /* Custom wrapped key formats */
761 enum {
762 CSSM_KEYBLOB_WRAPPED_FORMAT_APPLE_CUSTOM = 100,
763 CSSM_KEYBLOB_WRAPPED_FORMAT_OPENSSL, // traditional openssl
764 CSSM_KEYBLOB_WRAPPED_FORMAT_OPENSSH1 // OpenSSH v1
765 };
766
767 /*
768 * Custom context attributes for AppleCSP.
769 */
770 enum {
771 CSSM_ATTRIBUTE_VENDOR_DEFINED = 0x800000
772 };
773
774 enum {
775 /*
776 * Public Key attribute for use with CSSM_ALGID_FEED.
777 */
778 CSSM_ATTRIBUTE_PUBLIC_KEY =
779 (CSSM_ATTRIBUTE_DATA_KEY | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 0)),
780
781 /*
782 * FEE key attributes.
783 * See CSSM_FEE_PRIME_TYPE_xxx, CSSM_FEE_CURVE_TYPE_xxx enums, below.
784 */
785 CSSM_ATTRIBUTE_FEE_PRIME_TYPE =
786 (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 1)),
787 CSSM_ATTRIBUTE_FEE_CURVE_TYPE =
788 (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 2)),
789
790 /*
791 * Apple Secure Compression (ComCryption) optimization.
792 * See CSSM_ASC_OPTIMIZE_xxx, enums, below.
793 */
794 CSSM_ATTRIBUTE_ASC_OPTIMIZATION =
795 (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 3)),
796
797 /*
798 * RSA blinding. Value is integer, nonzero (blinding on) or zero.
799 */
800 CSSM_ATTRIBUTE_RSA_BLINDING =
801 (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 4)),
802
803 /*
804 * Additional public key from which to obtain algorithm-specific
805 * parameters.
806 */
807 CSSM_ATTRIBUTE_PARAM_KEY =
808 (CSSM_ATTRIBUTE_DATA_KEY | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 5)),
809
810 /*
811 * Prompt string for CSSM_ALGID_SECURE_PASSPHRASE key acquisition.
812 * Data is a UTF8-encoded external representation of a CFString.
813 */
814 CSSM_ATTRIBUTE_PROMPT =
815 (CSSM_ATTRIBUTE_DATA_CSSM_DATA | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 6)),
816
817 /*
818 * Alert panel title for CSSM_ALGID_SECURE_PASSPHRASE key acquisition.
819 * Data is a UTF8-encoded external representation of a CFString.
820 */
821 CSSM_ATTRIBUTE_ALERT_TITLE =
822 (CSSM_ATTRIBUTE_DATA_CSSM_DATA | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 7)),
823
824 /*
825 * Boolean to specify whether secure passphrase is being used to encrypt or to
826 * recover data. In the former case the user will be prompted to enter the
827 * passphrase twice. Value is integer, nonzero (verify passphrase) or zero.
828 */
829 CSSM_ATTRIBUTE_VERIFY_PASSPHRASE =
830 (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 8))
831
832 };
833
834 /*
835 * FEE key pair prime modulus types.
836 */
837 enum {
838 CSSM_FEE_PRIME_TYPE_DEFAULT = 0, /* default per key size */
839 CSSM_FEE_PRIME_TYPE_MERSENNE, /* (2 ** q) - 1Ê*/
840 CSSM_FEE_PRIME_TYPE_FEE, /* (2 ** q) - k */
841 CSSM_FEE_PRIME_TYPE_GENERAL /* random prime */
842 };
843
844 /*
845 * FEE curve types. Comments refer to equation
846 *
847 * y**2 = x**3 + c(x**2) + ax + b
848 */
849 enum {
850 CSSM_FEE_CURVE_TYPE_DEFAULT = 0, /* default per key size */
851 CSSM_FEE_CURVE_TYPE_MONTGOMERY, /* a==1, b==0 */
852 CSSM_FEE_CURVE_TYPE_WEIERSTRASS, /* c==0. IEEE P1363 compliant. */
853 CSSM_FEE_CURVE_TYPE_ANSI_X9_62 /* ANSI X9.62 compatible */
854 };
855
856 /*
857 * Apple Secure Compression (ComCryption) optimization attributes.
858 */
859 enum {
860 CSSM_ASC_OPTIMIZE_DEFAULT = 0,
861 CSSM_ASC_OPTIMIZE_SIZE, /* max compression (currently the default) */
862 CSSM_ASC_OPTIMIZE_SECURITY, /* currently not implemented */
863 CSSM_ASC_OPTIMIZE_TIME, /* min runtime */
864 CSSM_ASC_OPTIMIZE_TIME_SIZE, /* implies loss of security */
865 CSSM_ASC_OPTIMIZE_ASCII, /* optimized for ASCC text, not implemented */
866 };
867
868 /*
869 * Apple custom CSSM_KEYATTR_FLAGS.
870 */
871 enum {
872 /*
873 * When set, indicates a public key which is incomplete (though
874 * still valid) due to the lack of algorithm-specific parameters.
875 */
876 CSSM_KEYATTR_PARTIAL = 0x00010000,
877
878 /*
879 * When set, public keys are stored encrypted. Default is to store
880 * public keys in the clear. AppleCSPDL only.
881 */
882 CSSM_KEYATTR_PUBLIC_KEY_ENCRYPT = 0x00020000
883 };
884
885 /*
886 * Name/OID pair used in CSSM_APPLE_TP_CERT_REQUEST
887 */
888 typedef struct {
889 const char *string;
890 const CSSM_OID *oid;
891 } CSSM_APPLE_TP_NAME_OID;
892
893 /*
894 * Certificate request passed to CSSM_TP_SubmitCredRequest() in the
895 * CSSM_TP_AUTHORITY_REQUEST_TYPE.Requests field. Used for requesting
896 * both locally-generated certs (CSSMOID_APPLE_TP_LOCAL_CERT_GEN) and
897 * cert signing requests (CSSMOID_APPLE_TP_CSR_GEN).
898 */
899 typedef struct {
900 CSSM_CSP_HANDLE cspHand; // sign with this CSP
901 CSSM_CL_HANDLE clHand; // and this CL
902 uint32 serialNumber;
903 uint32 numSubjectNames;// size subjectNames[]
904 CSSM_APPLE_TP_NAME_OID *subjectNames;
905
906 /*
907 * Issuer name can be expressed in the simplified CSSM_APPLE_TP_NAME_OID
908 * array, as is the subject name, or as an CSSM_X509_NAME, which is
909 * typically obtained from a signing cert.
910 * Exactly one of {issuerNames, issuerNameX509} must be non-NULL.
911 */
912 uint32 numIssuerNames; // size issuerNames[]
913 CSSM_APPLE_TP_NAME_OID *issuerNames; // optional; NULL implies root
914 // (signer == subject)
915 CSSM_X509_NAME_PTR issuerNameX509;
916 const CSSM_KEY *certPublicKey;
917 const CSSM_KEY *issuerPrivateKey;
918
919 /* Unfortunately there is no practical way to map any algorithm
920 * to its appropriate OID, and we need both.... */
921 CSSM_ALGORITHMS signatureAlg; // e.g., CSSM_ALGID_SHA1WithRSA
922 CSSM_OID signatureOid; // e.g., CSSMOID_SHA1WithRSA
923 uint32 notBefore; // relative to "now"
924 uint32 notAfter;
925 uint32 numExtensions;
926 CE_DataAndType *extensions; // optional
927
928 /*
929 * Optional challenge string for CSSMOID_APPLE_TP_CSR_GEN.
930 */
931 const char *challengeString;
932 } CSSM_APPLE_TP_CERT_REQUEST;
933
934 /*
935 * Options for X509TP's CSSM_TP_CertGroupVerify for policy CSSMOID_APPLE_TP_SSL.
936 * A pointer to, and length of, one of these is optionally placed in
937 * CSSM_TP_VERIFY_CONTEXT.Cred->Policy.PolicyIds[n].FieldValue.
938 */
939 #define CSSM_APPLE_TP_SSL_OPTS_VERSION 1
940
941 /*
942 * Values for CSSM_APPLE_TP_SSL_OPTIONS.flags.
943 *
944 * Set this flag when evaluating a client cert.
945 */
946 #define CSSM_APPLE_TP_SSL_CLIENT 0x00000001
947
948 typedef struct {
949 uint32 Version; // CSSM_APPLE_TP_SSL_OPTS_VERSION
950
951 /*
952 * The domain name of the server (e.g., "store.apple.com".) In the
953 * SSL and TLS protocols, this must match the common name of the
954 * subject cert. Expressed as a C string, optionally NULL terminated
955 * if it is NULL terminated, the length field should include the NULL).
956 */
957 uint32 ServerNameLen;
958 const char *ServerName; // optional
959
960 /* new fields for struct version 1 */
961 uint32 Flags;
962 } CSSM_APPLE_TP_SSL_OPTIONS;
963
964 /*
965 * Options for X509TP's CSSM_TP_CertGroupVerify for policy
966 * CSSMOID_APPLE_TP_REVOCATION_CRL. A pointer to, and length of, one
967 * of these is optionally placed in
968 * CSSM_TP_VERIFY_CONTEXT.Cred->Policy.PolicyIds[n].FieldValue.
969 */
970 #define CSSM_APPLE_TP_CRL_OPTS_VERSION 0
971
972 typedef uint32 CSSM_APPLE_TP_CRL_OPT_FLAGS;
973 enum {
974 // require CRL verification for each cert; default is "try"
975 CSSM_TP_ACTION_REQUIRE_CRL_PER_CERT = 0x00000001,
976 // enable fetch from network
977 CSSM_TP_ACTION_FETCH_CRL_FROM_NET = 0x00000002,
978 // if set and positive CRL verify for given cert, no further revocation
979 // checking need be done on that cert
980 CSSM_TP_ACTION_CRL_SUFFICIENT = 0x00000004,
981 // require CRL verification for certs which claim a CRL provider
982 CSSM_TP_ACTION_REQUIRE_CRL_IF_PRESENT = 0x00000008
983 };
984
985 typedef struct {
986 uint32 Version; // CSSM_APPLE_TP_CRL_OPTS_VERSION
987 CSSM_APPLE_TP_CRL_OPT_FLAGS CrlFlags;
988
989 /*
990 * When non-NULL, store CRLs fetched from net here.
991 * This is most likely a pointer to one of the
992 * CSSM_TP_CALLERAUTH_CONTEXT.DBList entries but that
993 * is not a strict requirement.
994 */
995 CSSM_DL_DB_HANDLE_PTR crlStore;
996 } CSSM_APPLE_TP_CRL_OPTIONS;
997
998 /*
999 * Options for X509TP's CSSM_TP_CertGroupVerify for policy
1000 * CSSMOID_APPLE_TP_SMIME. A pointer to, and length of, one
1001 * of these is optionally placed in
1002 * CSSM_TP_VERIFY_CONTEXT.Cred->Policy.PolicyIds[n].FieldValue.
1003 */
1004 #define CSSM_APPLE_TP_SMIME_OPTS_VERSION 0
1005 typedef struct {
1006 uint32 Version; // CSSM_APPLE_TP_SMIME_OPTS_VERSION
1007
1008 /*
1009 * Intended usage of the leaf cert. The cert's KeyUsage extension,
1010 * if present, must be a superset of this.
1011 */
1012 CE_KeyUsage IntendedUsage;
1013
1014 /*
1015 * The email address of the sender. If there is an email address
1016 * in the sender's cert, that email address must match this one.
1017 * Both (email address in the cert, and this one) are optional.
1018 * Expressed as a C string, optionally NULL terminated (i.e.,
1019 * SenderEmail[SenderEmailLen - 1] may or may not be NULL).
1020 */
1021 uint32 SenderEmailLen;
1022 const char *SenderEmail; // optional
1023 } CSSM_APPLE_TP_SMIME_OPTIONS;
1024
1025
1026 /*
1027 * Optional ActionData for all X509TP CertGroupVerify policies.
1028 * A pointer to, and length of, one of these is optionally placed in
1029 * CSSM_TP_VERIFY_CONTEXT.ActionData.
1030 */
1031 typedef uint32 CSSM_APPLE_TP_ACTION_FLAGS;
1032 enum {
1033 CSSM_TP_ACTION_ALLOW_EXPIRED = 0x00000001, // allow expired certs
1034 CSSM_TP_ACTION_LEAF_IS_CA = 0x00000002, // first cert is a CA
1035 CSSM_TP_ACTION_FETCH_CERT_FROM_NET = 0x00000004, // enable net fetch of CA cert
1036 CSSM_TP_ACTION_ALLOW_EXPIRED_ROOT = 0x00000008, // allow expired roots
1037 CSSM_TP_ACTION_REQUIRE_REV_PER_CERT = 0x00000010, // require positive revocation
1038 // check per cert
1039 CSSM_TP_ACTION_TRUST_SETTINGS = 0x00000020, // use TrustSettings instead of
1040 // anchors
1041 CSSM_TP_ACTION_IMPLICIT_ANCHORS = 0x00000040 // properly self-signed certs are
1042 // treated as anchors implicitly
1043 };
1044
1045 #define CSSM_APPLE_TP_ACTION_VERSION 0
1046 typedef struct {
1047 uint32 Version; // CSSM_APPLE_TP_ACTION_VERSION
1048 CSSM_APPLE_TP_ACTION_FLAGS ActionFlags; // CSSM_TP_ACTION_ALLOW_EXPIRED, etc.
1049 } CSSM_APPLE_TP_ACTION_DATA;
1050
1051 /*
1052 * Per-cert evidence returned from CSSM_TP_CertGroupVerify.
1053 * An array of these is presented in CSSM_TP_VERIFY_CONTEXT_RESULT.Evidence[2].
1054 * Same number of these as in the cert group in Evidence[1].
1055 */
1056
1057 #endif /* SEC_OS_OSX */
1058
1059 /* First, an array of bits indicating various status of the cert. */
1060 typedef uint32 CSSM_TP_APPLE_CERT_STATUS;
1061 enum
1062 {
1063 CSSM_CERT_STATUS_EXPIRED = 0x00000001,
1064 CSSM_CERT_STATUS_NOT_VALID_YET = 0x00000002,
1065 CSSM_CERT_STATUS_IS_IN_INPUT_CERTS = 0x00000004,
1066 CSSM_CERT_STATUS_IS_IN_ANCHORS = 0x00000008,
1067 CSSM_CERT_STATUS_IS_ROOT = 0x00000010,
1068 CSSM_CERT_STATUS_IS_FROM_NET = 0x00000020,
1069 /* settings found in per-user Trust Settings */
1070 CSSM_CERT_STATUS_TRUST_SETTINGS_FOUND_USER = 0x00000040,
1071 /* settings found in Admin Trust Settings */
1072 CSSM_CERT_STATUS_TRUST_SETTINGS_FOUND_ADMIN = 0x00000080,
1073 /* settings found in System Trust Settings */
1074 CSSM_CERT_STATUS_TRUST_SETTINGS_FOUND_SYSTEM = 0x00000100,
1075 /* Trust Settings result = Trust */
1076 CSSM_CERT_STATUS_TRUST_SETTINGS_TRUST = 0x00000200,
1077 /* Trust Settings result = Deny */
1078 CSSM_CERT_STATUS_TRUST_SETTINGS_DENY = 0x00000400,
1079 /* Per-cert error ignored due to Trust Settings */
1080 CSSM_CERT_STATUS_TRUST_SETTINGS_IGNORED_ERROR = 0x00000800
1081 };
1082
1083 typedef struct DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER {
1084 CSSM_TP_APPLE_CERT_STATUS StatusBits;
1085 uint32 NumStatusCodes;
1086 CSSM_RETURN *StatusCodes;
1087
1088 /* index into raw cert group or AnchorCerts depending on IS_IN_ANCHORS */
1089 uint32 Index;
1090
1091 /* nonzero if cert came from a DLDB */
1092 CSSM_DL_DB_HANDLE DlDbHandle;
1093 CSSM_DB_UNIQUE_RECORD_PTR UniqueRecord;
1094
1095 #if SEC_OS_IPHONE
1096 /* CRLReason code if cert is revoked */
1097 sint32 CrlReason;
1098 #endif /* SEC_OS_IPHONE */
1099 } CSSM_TP_APPLE_EVIDENCE_INFO DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER;
1100
1101 #if SEC_OS_OSX
1102
1103 /*
1104 * CSSM_TP_VERIFY_CONTEXT_RESULT.Evidence[0], basically defines which version/flavor
1105 * of remaining evidence is.
1106 */
1107 #define CSSM_TP_APPLE_EVIDENCE_VERSION 0
1108 typedef struct
1109 {
1110 uint32 Version;
1111 } CSSM_TP_APPLE_EVIDENCE_HEADER;
1112
1113
1114 /*
1115 * Apple-specific CSSM_EVIDENCE_FORM values
1116 *
1117 * The form of the evidence returns from CSSM_TP_CertGroupVerify is:
1118 *
1119 * EvidenceForm contents of *Evidence
1120 * ------------ ---------------------
1121 * CSSM_EVIDENCE_FORM_APPLE_HEADER CSSM_TP_APPLE_EVIDENCE_HEADER
1122 * CSSM_EVIDENCE_FORM_APPLE_CERTGROUP CSSM_CERTGROUP
1123 * CSSM_EVIDENCE_FORM_APPLE_CERT_INFO array of CSSM_TP_APPLE_EVIDENCE_INFO, size
1124 * CSSM_CERTGROUP.NumCerts
1125 */
1126
1127 #define CSSM_EVIDENCE_FORM_APPLE_CUSTOM 0x80000000
1128 enum
1129 {
1130 CSSM_EVIDENCE_FORM_APPLE_HEADER = CSSM_EVIDENCE_FORM_APPLE_CUSTOM + 0,
1131 CSSM_EVIDENCE_FORM_APPLE_CERTGROUP = CSSM_EVIDENCE_FORM_APPLE_CUSTOM + 1,
1132 CSSM_EVIDENCE_FORM_APPLE_CERT_INFO = CSSM_EVIDENCE_FORM_APPLE_CUSTOM + 2
1133 };
1134
1135 /* AppleX509CL extensions: passthrough ids */
1136 enum {
1137 /*
1138 * Obtain a signed Certificate Signing Request.
1139 * Input = CSSM_APPLE_CL_CSR_REQUEST
1140 * Output = allocated CSSM_DATA which points to a DER-encoded CSR.
1141 */
1142 CSSM_APPLEX509CL_OBTAIN_CSR,
1143
1144 /*
1145 * Perform signature verify of a CSR.
1146 * Input: CSSM_DATA referring to a DER-encoded CSR.
1147 * Output: Nothing, returns CSSMERR_CL_VERIFICATION_FAILURE on
1148 * on failure.
1149 */
1150 CSSM_APPLEX509CL_VERIFY_CSR
1151 };
1152
1153 /*
1154 * Used in CL's CSSM_APPLEX509_OBTAIN_CSR Passthrough. This is the
1155 * input; the output is a CSSM_DATA * containing the signed and
1156 * DER-encoded CSR.
1157 */
1158 typedef struct {
1159 CSSM_X509_NAME_PTR subjectNameX509;
1160
1161 /* Unfortunately there is no practical way to map any algorithm
1162 * to its appropriate OID, and we need both.... */
1163 CSSM_ALGORITHMS signatureAlg; // e.g., CSSM_ALGID_SHA1WithRSA
1164 CSSM_OID signatureOid; // e.g., CSSMOID_SHA1WithRSA
1165
1166 CSSM_CSP_HANDLE cspHand; // sign with this CSP
1167 const CSSM_KEY *subjectPublicKey;
1168 const CSSM_KEY *subjectPrivateKey;
1169
1170 /*
1171 * Optional challenge string.
1172 */
1173 const char *challengeString;
1174 } CSSM_APPLE_CL_CSR_REQUEST;
1175
1176 /*
1177 * When a CRL with no NextUpdate field is encountered, we use this time
1178 * as the NextUpdate attribute when storing in a DB. It represents the
1179 * virtual end of time in CSSM_TIMESTRING form.
1180 */
1181 #define CSSM_APPLE_CRL_END_OF_TIME "99991231235959"
1182
1183 /*
1184 * Default filesystem names and locations for SecurityServer features
1185 * (included here for lack of a better place)
1186 */
1187 #define kKeychainSuffix ".keychain"
1188 #define kKeychainDbSuffix ".keychain-db"
1189 #define kSystemKeychainName "System.keychain"
1190 #define kSystemKeychainDir "/Library/Keychains/"
1191 #define kSystemUnlockFile "/var/db/SystemKey"
1192
1193 #define kSystemKeychainPath kSystemKeychainDir kSystemKeychainName
1194
1195 /*
1196 * CSSM ACL tags used to store partition/integrity data in ACLs
1197 */
1198 #define CSSM_APPLE_ACL_TAG_PARTITION_ID "___PARTITION___"
1199 #define CSSM_APPLE_ACL_TAG_INTEGRITY "___INTEGRITY___"
1200
1201
1202 void cssmPerror(const char *how, CSSM_RETURN error);
1203
1204 /* Convert between CSSM_OID and CSSM_ALGORITHMS */
1205 bool cssmOidToAlg(const CSSM_OID *oid, CSSM_ALGORITHMS *alg);
1206 const CSSM_OID *cssmAlgToOid(CSSM_ALGORITHMS algId);
1207
1208 /*
1209 * The MacOS OSStatus space has an embedding for UNIX errno values, similar to
1210 * the way we embed CSSM_RETURN values in OSStatus. These are the base and limit
1211 * values for this embedding.
1212 */
1213 #define errSecErrnoBase 100000
1214 #define errSecErrnoLimit 100255
1215
1216 #endif /* SEC_OS_OSX */
1217
1218 #pragma clang diagnostic pop
1219
1220 #ifdef __cplusplus
1221 }
1222 #endif // __cplusplus
1223
1224 #endif /* _CSSMAPPLE_H_ */
mirror of Security