base/SecBase.h

   1 /*
   2  * Copyright (c) 2000-2016 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #ifndef _SECURITY_SECBASE_H_
  25 #define _SECURITY_SECBASE_H_
  26
  27 #include <TargetConditionals.h>
  28 #include <CoreFoundation/CFBase.h>
  29 #include <Availability.h>
  30
  31 // Truth table for following declarations:
  32 //
  33 //                          TARGET_OS_OSX   TARGET_OS_OSX   TARGET_OS_IPHONE    TARGET_OS_IPHONE    TARGET_OS_MACCATALYST
  34 //                                          SEC_IOS_ON_OSX                      SEC_IOS_ON_OSX
  35 // =================================================================================================================
  36 // SEC_OS_IPHONE            0               1               1                   1                   1
  37 // SEC_OS_OSX               1               0               0                   0                   0
  38 // SEC_OS_OSX_INCLUDES      1               1               0                   0                   0
  39
  40 #if TARGET_OS_OSX
  41   #ifdef SEC_IOS_ON_OSX
  42     #define SEC_OS_IPHONE 1
  43
  44     #define SEC_OS_OSX 0
  45     #define SEC_OS_OSX_INCLUDES 1
  46   #endif // SEC_IOS_ON_OSX
  47 #endif // TARGET_OS_OSX
  48
  49 #if TARGET_OS_MACCATALYST
  50   #define SEC_OS_IPHONE 1
  51
  52   #define SEC_OS_OSX 0
  53   #define SEC_OS_OSX_INCLUDES 0
  54 #endif // TARGET_OS_MACCATALYST
  55
  56 #ifndef SEC_OS_IPHONE
  57     // block above did not fire; set flags to current platform
  58     #define SEC_OS_IPHONE TARGET_OS_IPHONE
  59
  60     #define SEC_OS_OSX TARGET_OS_OSX
  61     #define SEC_OS_OSX_INCLUDES TARGET_OS_OSX
  62 #endif
  63
  64 #if SEC_OS_IPHONE
  65 #include <sys/cdefs.h>
  66 #endif
  67
  68 #if defined(__clang__)
  69 #define SEC_DEPRECATED_ATTRIBUTE DEPRECATED_ATTRIBUTE
  70 #else
  71 #define SEC_DEPRECATED_ATTRIBUTE
  72 #endif
  73
  74 #define CSSM_DEPRECATED API_DEPRECATED("CSSM is not supported", macos(10.0, 10.7)) API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst)
  75
  76 __BEGIN_DECLS
  77
  78 CF_ASSUME_NONNULL_BEGIN
  79 CF_IMPLICIT_BRIDGING_ENABLED
  80
  81 #define SECURITY_TYPE_UNIFICATION 1
  82
  83 /*!
  84     @typedef SecCertificateRef
  85     @abstract CFType representing a X.509 certificate.
  86     See SecCertificate.h for details.
  87 */
  88 typedef struct CF_BRIDGED_TYPE(id) __SecCertificate *SecCertificateRef;
  89
  90 #if TARGET_OS_OSX
  91 typedef struct __SecCertificate OpaqueSecCertificateRef;
  92 #endif
  93
  94 /*!
  95     @typedef SecIdentityRef
  96     @abstract CFType representing an identity, which contains
  97     a SecKeyRef and an associated SecCertificateRef. See
  98     SecIdentity.h for details.
  99 */
 100 typedef struct CF_BRIDGED_TYPE(id) __SecIdentity *SecIdentityRef;
 101
 102 #if TARGET_OS_OSX
 103 typedef struct __SecIdentity OpaqueSecIdentityRef;
 104 #endif
 105
 106 /*!
 107     @typedef SecKeyRef
 108     @abstract CFType representing a cryptographic key. See
 109     SecKey.h for details.
 110 */
 111 typedef struct CF_BRIDGED_TYPE(id) __SecKey *SecKeyRef;
 112
 113 #if TARGET_OS_OSX
 114 typedef struct __SecKey OpaqueSecKeyRef;
 115 #endif
 116
 117 /*!
 118     @typedef SecPolicyRef
 119     @abstract CFType representing a X.509 certificate trust policy.
 120     See SecPolicy.h for details.
 121 */
 122 typedef struct CF_BRIDGED_TYPE(id) __SecPolicy *SecPolicyRef;
 123
 124 /*!
 125     @typedef SecAccessControl
 126     @abstract CFType representing access control for an item.
 127     SecAccessControl.h for details.
 128 */
 129 typedef struct CF_BRIDGED_TYPE(id) __SecAccessControl *SecAccessControlRef;
 130
 131 /*!
 132     @typedef SecKeychainRef
 133     @abstract Contains information about a keychain.
 134 */
 135 typedef struct CF_BRIDGED_TYPE(id) __SecKeychain *SecKeychainRef
 136     API_AVAILABLE(macos(10.0)) SPI_AVAILABLE(ios(1.0), tvos(9.0), watchos(1.0));
 137
 138 /*!
 139     @typedef SecKeychainItemRef
 140     @abstract Contains information about a keychain item.
 141 */
 142 typedef struct CF_BRIDGED_TYPE(id) __SecKeychainItem *SecKeychainItemRef API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst);
 143
 144 /*!
 145     @typedef SecKeychainSearchRef
 146     @abstract Contains information about a keychain search.
 147 */
 148 typedef struct CF_BRIDGED_TYPE(id) __SecKeychainSearch *SecKeychainSearchRef API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst);
 149
 150 /*!
 151     @typedef SecKeychainAttrType
 152     @abstract Represents a keychain attribute type.
 153 */
 154 typedef OSType SecKeychainAttrType API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst);
 155
 156 /*!
 157     @struct SecKeychainAttribute
 158     @abstract Contains keychain attributes.
 159     @field tag A 4-byte attribute tag.
 160     @field length The length of the buffer pointed to by data.
 161     @field data A pointer to the attribute data.
 162 */
 163 struct API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst) SecKeychainAttribute
 164 {
 165     SecKeychainAttrType tag;
 166     UInt32 length;
 167     void * __nullable data;
 168 };
 169 typedef struct SecKeychainAttribute SecKeychainAttribute API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst);
 170
 171 /*!
 172     @typedef SecKeychainAttributePtr
 173     @abstract Represents a pointer to a keychain attribute structure.
 174 */
 175 typedef SecKeychainAttribute *SecKeychainAttributePtr API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst);
 176
 177 /*!
 178     @typedef SecKeychainAttributeList
 179     @abstract Represents a list of keychain attributes.
 180     @field count An unsigned 32-bit integer that represents the number of keychain attributes in the array.
 181     @field attr A pointer to the first keychain attribute in the array.
 182 */
 183 struct API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst) SecKeychainAttributeList
 184 {
 185     UInt32 count;
 186     SecKeychainAttribute * __nullable attr;
 187 };
 188 typedef struct SecKeychainAttributeList SecKeychainAttributeList API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst);
 189
 190 /*!
 191     @typedef SecKeychainStatus
 192     @abstract Represents the status of a keychain.
 193 */
 194 typedef UInt32 SecKeychainStatus API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst);
 195
 196 /*!
 197     @typedef SecTrustedApplicationRef
 198     @abstract Contains information about a trusted application.
 199 */
 200 typedef struct CF_BRIDGED_TYPE(id) __SecTrustedApplication *SecTrustedApplicationRef API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst);
 201
 202 /*!
 203     @typedef SecAccessRef
 204     @abstract Contains information about an access.
 205 */
 206 typedef struct CF_BRIDGED_TYPE(id) __SecAccess *SecAccessRef API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst);
 207
 208 #if TARGET_OS_OSX
 209 typedef struct __SecAccess OpaqueSecAccessRef;
 210 #endif
 211
 212 /*!
 213     @typedef SecACLRef
 214     @abstract Contains information about an access control list (ACL) entry.
 215 */
 216 typedef struct CF_BRIDGED_TYPE(id) __SecACL *SecACLRef API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst);
 217
 218 /*!
 219     @typedef SecPasswordRef
 220     @abstract Contains information about a password.
 221 */
 222 typedef struct CF_BRIDGED_TYPE(id) __SecPassword *SecPasswordRef API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst);
 223
 224 /*!
 225     @typedef SecKeychainAttributeInfo
 226     @abstract Represents an attribute.
 227     @field count The number of tag-format pairs in the respective arrays.
 228     @field tag A pointer to the first attribute tag in the array.
 229     @field format A pointer to the first CSSM_DB_ATTRIBUTE_FORMAT in the array.
 230     @discussion Each tag and format item form a pair.
 231 */
 232 struct API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst) SecKeychainAttributeInfo
 233 {
 234     UInt32 count;
 235     UInt32 *tag;
 236     UInt32 * __nullable format;
 237 };
 238 typedef struct SecKeychainAttributeInfo SecKeychainAttributeInfo API_UNAVAILABLE(ios, watchos, tvos, bridgeos, macCatalyst);
 239
 240 /*!
 241     @function SecCopyErrorMessageString
 242     @abstract Returns a string describing the specified error result code.
 243     @param status An error result code of type OSStatus or CSSM_RETURN, as returned by a Security or CSSM function.
 244     @reserved Reserved for future use. Your code should pass NULL in this parameter.
 245     @result A reference to an error string, or NULL if no error string is available for the specified result code. Your code must release this reference by calling the CFRelease function.
 246 */
 247 __nullable
 248 CFStringRef SecCopyErrorMessageString(OSStatus status, void * __nullable reserved)
 249     __OSX_AVAILABLE_STARTING(__MAC_10_3, __IPHONE_11_3);
 250
 251
 252 /*!
 253 @enum Security Error Codes
 254 @abstract Result codes returned from Security framework functions.
 255 @constant errSecSuccess No error.
 256 @constant errSecUnimplemented Function or operation not implemented.
 257 @constant errSecDiskFull Disk Full error.
 258 @constant errSecIO I/O error.
 259 @constant errSecParam One or more parameters passed to a function were not valid.
 260 @constant errSecWrPerm    Write permissions error.
 261 @constant errSecAllocate Failed to allocate memory.
 262 @constant errSecUserCanceled User canceled the operation.
 263 @constant errSecBadReq Bad parameter or invalid state for operation.
 264 @constant errSecInternalComponent
 265 @constant errSecCoreFoundationUnknown
 266 @constant errSecNotAvailable No keychain is available.
 267 @constant errSecReadOnly Read only error.
 268 @constant errSecAuthFailed Authorization/Authentication failed.
 269 @constant errSecNoSuchKeychain The keychain does not exist.
 270 @constant errSecInvalidKeychain The keychain is not valid.
 271 @constant errSecDuplicateKeychain A keychain with the same name already exists.
 272 @constant errSecDuplicateCallback The specified callback is already installed.
 273 @constant errSecInvalidCallback The specified callback is not valid.
 274 @constant errSecDuplicateItem The item already exists.
 275 @constant errSecItemNotFound The item cannot be found.
 276 @constant errSecBufferTooSmall The buffer is too small.
 277 @constant errSecDataTooLarge The data is too large.
 278 @constant errSecNoSuchAttr The attribute does not exist.
 279 @constant errSecInvalidItemRef The item reference is invalid.
 280 @constant errSecInvalidSearchRef The search reference is invalid.
 281 @constant errSecNoSuchClass The keychain item class does not exist.
 282 @constant errSecNoDefaultKeychain A default keychain does not exist.
 283 @constant errSecInteractionNotAllowed User interaction is not allowed.
 284 @constant errSecReadOnlyAttr The attribute is read only.
 285 @constant errSecWrongSecVersion The version is incorrect.
 286 @constant errSecKeySizeNotAllowed The key size is not allowed.
 287 @constant errSecNoStorageModule There is no storage module available.
 288 @constant errSecNoCertificateModule There is no certificate module available.
 289 @constant errSecNoPolicyModule There is no policy module available.
 290 @constant errSecInteractionRequired User interaction is required.
 291 @constant errSecDataNotAvailable The data is not available.
 292 @constant errSecDataNotModifiable The data is not modifiable.
 293 @constant errSecCreateChainFailed The attempt to create a certificate chain failed.
 294 @constant errSecACLNotSimple The access control list is not in standard simple form.
 295 @constant errSecPolicyNotFound The policy specified cannot be found.
 296 @constant errSecInvalidTrustSetting The specified trust setting is invalid.
 297 @constant errSecNoAccessForItem The specified item has no access control.
 298 @constant errSecInvalidOwnerEdit Invalid attempt to change the owner of this item.
 299 @constant errSecTrustNotAvailable No trust results are available.
 300 @constant errSecUnsupportedFormat Import/Export format unsupported.
 301 @constant errSecUnknownFormat Unknown format in import.
 302 @constant errSecKeyIsSensitive Key material must be wrapped for export.
 303 @constant errSecMultiplePrivKeys An attempt was made to import multiple private keys.
 304 @constant errSecPassphraseRequired Passphrase is required for import/export.
 305 @constant errSecInvalidPasswordRef The password reference was invalid.
 306 @constant errSecInvalidTrustSettings The Trust Settings Record was corrupted.
 307 @constant errSecNoTrustSettings No Trust Settings were found.
 308 @constant errSecPkcs12VerifyFailure MAC verification failed during PKCS12 Import.
 309 @constant errSecDecode Unable to decode the provided data.
 310
 311 @discussion The assigned error space is discontinuous: e.g. -25240..-25279, -25290..-25329, -68608..-67585, and so on.
 312 */
 313
 314 /*
 315     Note: the comments that appear after these errors are used to create SecErrorMessages.strings.
 316     The comments must not be multi-line, and should be in a form meaningful to an end user. If
 317     a different or additional comment is needed, it can be put in the header doc format, or on a
 318     line that does not start with errZZZ.
 319 */
 320
 321 CF_ENUM(OSStatus)
 322 {
 323     errSecSuccess                            = 0,       /* No error. */
 324     errSecUnimplemented                      = -4,      /* Function or operation not implemented. */
 325     errSecDiskFull                           = -34,     /* The disk is full. */
 326     errSecDskFull __attribute__((deprecated("use errSecDiskFull"))) = errSecDiskFull,
 327     errSecIO                                 = -36,     /* I/O error. */
 328     errSecOpWr                               = -49,     /* File already open with write permission. */
 329     errSecParam                              = -50,     /* One or more parameters passed to a function were not valid. */
 330     errSecWrPerm                             = -61,     /* Write permissions error. */
 331     errSecAllocate                           = -108,    /* Failed to allocate memory. */
 332     errSecUserCanceled                       = -128,    /* User canceled the operation. */
 333     errSecBadReq                             = -909,    /* Bad parameter or invalid state for operation. */
 334
 335     errSecInternalComponent                  = -2070,
 336     errSecCoreFoundationUnknown              = -4960,
 337
 338     errSecMissingEntitlement                 = -34018,    /* A required entitlement isn't present. */
 339     errSecRestrictedAPI                      = -34020,    /* Client is restricted and is not permitted to perform this operation. */
 340
 341     errSecNotAvailable                       = -25291,    /* No keychain is available. You may need to restart your computer. */
 342     errSecReadOnly                           = -25292,    /* This keychain cannot be modified. */
 343     errSecAuthFailed                         = -25293,    /* The user name or passphrase you entered is not correct. */
 344     errSecNoSuchKeychain                     = -25294,    /* The specified keychain could not be found. */
 345     errSecInvalidKeychain                    = -25295,    /* The specified keychain is not a valid keychain file. */
 346     errSecDuplicateKeychain                  = -25296,    /* A keychain with the same name already exists. */
 347     errSecDuplicateCallback                  = -25297,    /* The specified callback function is already installed. */
 348     errSecInvalidCallback                    = -25298,    /* The specified callback function is not valid. */
 349     errSecDuplicateItem                      = -25299,    /* The specified item already exists in the keychain. */
 350     errSecItemNotFound                       = -25300,    /* The specified item could not be found in the keychain. */
 351     errSecBufferTooSmall                     = -25301,    /* There is not enough memory available to use the specified item. */
 352     errSecDataTooLarge                       = -25302,    /* This item contains information which is too large or in a format that cannot be displayed. */
 353     errSecNoSuchAttr                         = -25303,    /* The specified attribute does not exist. */
 354     errSecInvalidItemRef                     = -25304,    /* The specified item is no longer valid. It may have been deleted from the keychain. */
 355     errSecInvalidSearchRef                   = -25305,    /* Unable to search the current keychain. */
 356     errSecNoSuchClass                        = -25306,    /* The specified item does not appear to be a valid keychain item. */
 357     errSecNoDefaultKeychain                  = -25307,    /* A default keychain could not be found. */
 358     errSecInteractionNotAllowed              = -25308,    /* User interaction is not allowed. */
 359     errSecReadOnlyAttr                       = -25309,    /* The specified attribute could not be modified. */
 360     errSecWrongSecVersion                    = -25310,    /* This keychain was created by a different version of the system software and cannot be opened. */
 361     errSecKeySizeNotAllowed                  = -25311,    /* This item specifies a key size which is too large or too small. */
 362     errSecNoStorageModule                    = -25312,    /* A required component (data storage module) could not be loaded. You may need to restart your computer. */
 363     errSecNoCertificateModule                = -25313,    /* A required component (certificate module) could not be loaded. You may need to restart your computer. */
 364     errSecNoPolicyModule                     = -25314,    /* A required component (policy module) could not be loaded. You may need to restart your computer. */
 365     errSecInteractionRequired                = -25315,    /* User interaction is required, but is currently not allowed. */
 366     errSecDataNotAvailable                   = -25316,    /* The contents of this item cannot be retrieved. */
 367     errSecDataNotModifiable                  = -25317,    /* The contents of this item cannot be modified. */
 368     errSecCreateChainFailed                  = -25318,    /* One or more certificates required to validate this certificate cannot be found. */
 369     errSecInvalidPrefsDomain                 = -25319,    /* The specified preferences domain is not valid. */
 370     errSecInDarkWake                         = -25320,    /* In dark wake, no UI possible */
 371
 372     errSecACLNotSimple                       = -25240,    /* The specified access control list is not in standard (simple) form. */
 373     errSecPolicyNotFound                     = -25241,    /* The specified policy cannot be found. */
 374     errSecInvalidTrustSetting                = -25242,    /* The specified trust setting is invalid. */
 375     errSecNoAccessForItem                    = -25243,    /* The specified item has no access control. */
 376     errSecInvalidOwnerEdit                   = -25244,    /* Invalid attempt to change the owner of this item. */
 377     errSecTrustNotAvailable                  = -25245,    /* No trust results are available. */
 378     errSecUnsupportedFormat                  = -25256,    /* Import/Export format unsupported. */
 379     errSecUnknownFormat                      = -25257,    /* Unknown format in import. */
 380     errSecKeyIsSensitive                     = -25258,    /* Key material must be wrapped for export. */
 381     errSecMultiplePrivKeys                   = -25259,    /* An attempt was made to import multiple private keys. */
 382     errSecPassphraseRequired                 = -25260,    /* Passphrase is required for import/export. */
 383     errSecInvalidPasswordRef                 = -25261,    /* The password reference was invalid. */
 384     errSecInvalidTrustSettings               = -25262,    /* The Trust Settings Record was corrupted. */
 385     errSecNoTrustSettings                    = -25263,    /* No Trust Settings were found. */
 386     errSecPkcs12VerifyFailure                = -25264,    /* MAC verification failed during PKCS12 import (wrong password?) */
 387     errSecNotSigner                          = -26267,    /* A certificate was not signed by its proposed parent. */
 388
 389     errSecDecode                             = -26275,    /* Unable to decode the provided data. */
 390
 391     errSecServiceNotAvailable                = -67585,    /* The required service is not available. */
 392     errSecInsufficientClientID               = -67586,    /* The client ID is not correct. */
 393     errSecDeviceReset                        = -67587,    /* A device reset has occurred. */
 394     errSecDeviceFailed                       = -67588,    /* A device failure has occurred. */
 395     errSecAppleAddAppACLSubject              = -67589,    /* Adding an application ACL subject failed. */
 396     errSecApplePublicKeyIncomplete           = -67590,    /* The public key is incomplete. */
 397     errSecAppleSignatureMismatch             = -67591,    /* A signature mismatch has occurred. */
 398     errSecAppleInvalidKeyStartDate           = -67592,    /* The specified key has an invalid start date. */
 399     errSecAppleInvalidKeyEndDate             = -67593,    /* The specified key has an invalid end date. */
 400     errSecConversionError                    = -67594,    /* A conversion error has occurred. */
 401     errSecAppleSSLv2Rollback                 = -67595,    /* A SSLv2 rollback error has occurred. */
 402     errSecQuotaExceeded                      = -67596,    /* The quota was exceeded. */
 403     errSecFileTooBig                         = -67597,    /* The file is too big. */
 404     errSecInvalidDatabaseBlob                = -67598,    /* The specified database has an invalid blob. */
 405     errSecInvalidKeyBlob                     = -67599,    /* The specified database has an invalid key blob. */
 406     errSecIncompatibleDatabaseBlob           = -67600,    /* The specified database has an incompatible blob. */
 407     errSecIncompatibleKeyBlob                = -67601,    /* The specified database has an incompatible key blob. */
 408     errSecHostNameMismatch                   = -67602,    /* A host name mismatch has occurred. */
 409     errSecUnknownCriticalExtensionFlag       = -67603,    /* There is an unknown critical extension flag. */
 410     errSecNoBasicConstraints                 = -67604,    /* No basic constraints were found. */
 411     errSecNoBasicConstraintsCA               = -67605,    /* No basic CA constraints were found. */
 412     errSecInvalidAuthorityKeyID              = -67606,    /* The authority key ID is not valid. */
 413     errSecInvalidSubjectKeyID                = -67607,    /* The subject key ID is not valid. */
 414     errSecInvalidKeyUsageForPolicy           = -67608,    /* The key usage is not valid for the specified policy. */
 415     errSecInvalidExtendedKeyUsage            = -67609,    /* The extended key usage is not valid. */
 416     errSecInvalidIDLinkage                   = -67610,    /* The ID linkage is not valid. */
 417     errSecPathLengthConstraintExceeded       = -67611,    /* The path length constraint was exceeded. */
 418     errSecInvalidRoot                        = -67612,    /* The root or anchor certificate is not valid. */
 419     errSecCRLExpired                         = -67613,    /* The CRL has expired. */
 420     errSecCRLNotValidYet                     = -67614,    /* The CRL is not yet valid. */
 421     errSecCRLNotFound                        = -67615,    /* The CRL was not found. */
 422     errSecCRLServerDown                      = -67616,    /* The CRL server is down. */
 423     errSecCRLBadURI                          = -67617,    /* The CRL has a bad Uniform Resource Identifier. */
 424     errSecUnknownCertExtension               = -67618,    /* An unknown certificate extension was encountered. */
 425     errSecUnknownCRLExtension                = -67619,    /* An unknown CRL extension was encountered. */
 426     errSecCRLNotTrusted                      = -67620,    /* The CRL is not trusted. */
 427     errSecCRLPolicyFailed                    = -67621,    /* The CRL policy failed. */
 428     errSecIDPFailure                         = -67622,    /* The issuing distribution point was not valid. */
 429     errSecSMIMEEmailAddressesNotFound        = -67623,    /* An email address mismatch was encountered. */
 430     errSecSMIMEBadExtendedKeyUsage           = -67624,    /* The appropriate extended key usage for SMIME was not found. */
 431     errSecSMIMEBadKeyUsage                   = -67625,    /* The key usage is not compatible with SMIME. */
 432     errSecSMIMEKeyUsageNotCritical           = -67626,    /* The key usage extension is not marked as critical. */
 433     errSecSMIMENoEmailAddress                = -67627,    /* No email address was found in the certificate. */
 434     errSecSMIMESubjAltNameNotCritical        = -67628,    /* The subject alternative name extension is not marked as critical. */
 435     errSecSSLBadExtendedKeyUsage             = -67629,    /* The appropriate extended key usage for SSL was not found. */
 436     errSecOCSPBadResponse                    = -67630,    /* The OCSP response was incorrect or could not be parsed. */
 437     errSecOCSPBadRequest                     = -67631,    /* The OCSP request was incorrect or could not be parsed. */
 438     errSecOCSPUnavailable                    = -67632,    /* OCSP service is unavailable. */
 439     errSecOCSPStatusUnrecognized             = -67633,    /* The OCSP server did not recognize this certificate. */
 440     errSecEndOfData                          = -67634,    /* An end-of-data was detected. */
 441     errSecIncompleteCertRevocationCheck      = -67635,    /* An incomplete certificate revocation check occurred. */
 442     errSecNetworkFailure                     = -67636,    /* A network failure occurred. */
 443     errSecOCSPNotTrustedToAnchor             = -67637,    /* The OCSP response was not trusted to a root or anchor certificate. */
 444     errSecRecordModified                     = -67638,    /* The record was modified. */
 445     errSecOCSPSignatureError                 = -67639,    /* The OCSP response had an invalid signature. */
 446     errSecOCSPNoSigner                       = -67640,    /* The OCSP response had no signer. */
 447     errSecOCSPResponderMalformedReq          = -67641,    /* The OCSP responder was given a malformed request. */
 448     errSecOCSPResponderInternalError         = -67642,    /* The OCSP responder encountered an internal error. */
 449     errSecOCSPResponderTryLater              = -67643,    /* The OCSP responder is busy, try again later. */
 450     errSecOCSPResponderSignatureRequired     = -67644,    /* The OCSP responder requires a signature. */
 451     errSecOCSPResponderUnauthorized          = -67645,    /* The OCSP responder rejected this request as unauthorized. */
 452     errSecOCSPResponseNonceMismatch          = -67646,    /* The OCSP response nonce did not match the request. */
 453     errSecCodeSigningBadCertChainLength      = -67647,    /* Code signing encountered an incorrect certificate chain length. */
 454     errSecCodeSigningNoBasicConstraints      = -67648,    /* Code signing found no basic constraints. */
 455     errSecCodeSigningBadPathLengthConstraint = -67649,    /* Code signing encountered an incorrect path length constraint. */
 456     errSecCodeSigningNoExtendedKeyUsage      = -67650,    /* Code signing found no extended key usage. */
 457     errSecCodeSigningDevelopment             = -67651,    /* Code signing indicated use of a development-only certificate. */
 458     errSecResourceSignBadCertChainLength     = -67652,    /* Resource signing has encountered an incorrect certificate chain length. */
 459     errSecResourceSignBadExtKeyUsage         = -67653,    /* Resource signing has encountered an error in the extended key usage. */
 460     errSecTrustSettingDeny                   = -67654,    /* The trust setting for this policy was set to Deny. */
 461     errSecInvalidSubjectName                 = -67655,    /* An invalid certificate subject name was encountered. */
 462     errSecUnknownQualifiedCertStatement      = -67656,    /* An unknown qualified certificate statement was encountered. */
 463     errSecMobileMeRequestQueued              = -67657,
 464     errSecMobileMeRequestRedirected          = -67658,
 465     errSecMobileMeServerError                = -67659,
 466     errSecMobileMeServerNotAvailable         = -67660,
 467     errSecMobileMeServerAlreadyExists        = -67661,
 468     errSecMobileMeServerServiceErr           = -67662,
 469     errSecMobileMeRequestAlreadyPending      = -67663,
 470     errSecMobileMeNoRequestPending           = -67664,
 471     errSecMobileMeCSRVerifyFailure           = -67665,
 472     errSecMobileMeFailedConsistencyCheck     = -67666,
 473     errSecNotInitialized                     = -67667,    /* A function was called without initializing CSSM. */
 474     errSecInvalidHandleUsage                 = -67668,    /* The CSSM handle does not match with the service type. */
 475     errSecPVCReferentNotFound                = -67669,    /* A reference to the calling module was not found in the list of authorized callers. */
 476     errSecFunctionIntegrityFail              = -67670,    /* A function address was not within the verified module. */
 477     errSecInternalError                      = -67671,    /* An internal error has occurred. */
 478     errSecMemoryError                        = -67672,    /* A memory error has occurred. */
 479     errSecInvalidData                        = -67673,    /* Invalid data was encountered. */
 480     errSecMDSError                           = -67674,    /* A Module Directory Service error has occurred. */
 481     errSecInvalidPointer                     = -67675,    /* An invalid pointer was encountered. */
 482     errSecSelfCheckFailed                    = -67676,    /* Self-check has failed. */
 483     errSecFunctionFailed                     = -67677,    /* A function has failed. */
 484     errSecModuleManifestVerifyFailed         = -67678,    /* A module manifest verification failure has occurred. */
 485     errSecInvalidGUID                        = -67679,    /* An invalid GUID was encountered. */
 486     errSecInvalidHandle                      = -67680,    /* An invalid handle was encountered. */
 487     errSecInvalidDBList                      = -67681,    /* An invalid DB list was encountered. */
 488     errSecInvalidPassthroughID               = -67682,    /* An invalid passthrough ID was encountered. */
 489     errSecInvalidNetworkAddress              = -67683,    /* An invalid network address was encountered. */
 490     errSecCRLAlreadySigned                   = -67684,    /* The certificate revocation list is already signed. */
 491     errSecInvalidNumberOfFields              = -67685,    /* An invalid number of fields were encountered. */
 492     errSecVerificationFailure                = -67686,    /* A verification failure occurred. */
 493     errSecUnknownTag                         = -67687,    /* An unknown tag was encountered. */
 494     errSecInvalidSignature                   = -67688,    /* An invalid signature was encountered. */
 495     errSecInvalidName                        = -67689,    /* An invalid name was encountered. */
 496     errSecInvalidCertificateRef              = -67690,    /* An invalid certificate reference was encountered. */
 497     errSecInvalidCertificateGroup            = -67691,    /* An invalid certificate group was encountered. */
 498     errSecTagNotFound                        = -67692,    /* The specified tag was not found. */
 499     errSecInvalidQuery                       = -67693,    /* The specified query was not valid. */
 500     errSecInvalidValue                       = -67694,    /* An invalid value was detected. */
 501     errSecCallbackFailed                     = -67695,    /* A callback has failed. */
 502     errSecACLDeleteFailed                    = -67696,    /* An ACL delete operation has failed. */
 503     errSecACLReplaceFailed                   = -67697,    /* An ACL replace operation has failed. */
 504     errSecACLAddFailed                       = -67698,    /* An ACL add operation has failed. */
 505     errSecACLChangeFailed                    = -67699,    /* An ACL change operation has failed. */
 506     errSecInvalidAccessCredentials           = -67700,    /* Invalid access credentials were encountered. */
 507     errSecInvalidRecord                      = -67701,    /* An invalid record was encountered. */
 508     errSecInvalidACL                         = -67702,    /* An invalid ACL was encountered. */
 509     errSecInvalidSampleValue                 = -67703,    /* An invalid sample value was encountered. */
 510     errSecIncompatibleVersion                = -67704,    /* An incompatible version was encountered. */
 511     errSecPrivilegeNotGranted                = -67705,    /* The privilege was not granted. */
 512     errSecInvalidScope                       = -67706,    /* An invalid scope was encountered. */
 513     errSecPVCAlreadyConfigured               = -67707,    /* The PVC is already configured. */
 514     errSecInvalidPVC                         = -67708,    /* An invalid PVC was encountered. */
 515     errSecEMMLoadFailed                      = -67709,    /* The EMM load has failed. */
 516     errSecEMMUnloadFailed                    = -67710,    /* The EMM unload has failed. */
 517     errSecAddinLoadFailed                    = -67711,    /* The add-in load operation has failed. */
 518     errSecInvalidKeyRef                      = -67712,    /* An invalid key was encountered. */
 519     errSecInvalidKeyHierarchy                = -67713,    /* An invalid key hierarchy was encountered. */
 520     errSecAddinUnloadFailed                  = -67714,    /* The add-in unload operation has failed. */
 521     errSecLibraryReferenceNotFound           = -67715,    /* A library reference was not found. */
 522     errSecInvalidAddinFunctionTable          = -67716,    /* An invalid add-in function table was encountered. */
 523     errSecInvalidServiceMask                 = -67717,    /* An invalid service mask was encountered. */
 524     errSecModuleNotLoaded                    = -67718,    /* A module was not loaded. */
 525     errSecInvalidSubServiceID                = -67719,    /* An invalid subservice ID was encountered. */
 526     errSecAttributeNotInContext              = -67720,    /* An attribute was not in the context. */
 527     errSecModuleManagerInitializeFailed      = -67721,    /* A module failed to initialize. */
 528     errSecModuleManagerNotFound              = -67722,    /* A module was not found. */
 529     errSecEventNotificationCallbackNotFound  = -67723,    /* An event notification callback was not found. */
 530     errSecInputLengthError                   = -67724,    /* An input length error was encountered. */
 531     errSecOutputLengthError                  = -67725,    /* An output length error was encountered. */
 532     errSecPrivilegeNotSupported              = -67726,    /* The privilege is not supported. */
 533     errSecDeviceError                        = -67727,    /* A device error was encountered. */
 534     errSecAttachHandleBusy                   = -67728,    /* The CSP handle was busy. */
 535     errSecNotLoggedIn                        = -67729,    /* You are not logged in. */
 536     errSecAlgorithmMismatch                  = -67730,    /* An algorithm mismatch was encountered. */
 537     errSecKeyUsageIncorrect                  = -67731,    /* The key usage is incorrect. */
 538     errSecKeyBlobTypeIncorrect               = -67732,    /* The key blob type is incorrect. */
 539     errSecKeyHeaderInconsistent              = -67733,    /* The key header is inconsistent. */
 540     errSecUnsupportedKeyFormat               = -67734,    /* The key header format is not supported. */
 541     errSecUnsupportedKeySize                 = -67735,    /* The key size is not supported. */
 542     errSecInvalidKeyUsageMask                = -67736,    /* The key usage mask is not valid. */
 543     errSecUnsupportedKeyUsageMask            = -67737,    /* The key usage mask is not supported. */
 544     errSecInvalidKeyAttributeMask            = -67738,    /* The key attribute mask is not valid. */
 545     errSecUnsupportedKeyAttributeMask        = -67739,    /* The key attribute mask is not supported. */
 546     errSecInvalidKeyLabel                    = -67740,    /* The key label is not valid. */
 547     errSecUnsupportedKeyLabel                = -67741,    /* The key label is not supported. */
 548     errSecInvalidKeyFormat                   = -67742,    /* The key format is not valid. */
 549     errSecUnsupportedVectorOfBuffers         = -67743,    /* The vector of buffers is not supported. */
 550     errSecInvalidInputVector                 = -67744,    /* The input vector is not valid. */
 551     errSecInvalidOutputVector                = -67745,    /* The output vector is not valid. */
 552     errSecInvalidContext                     = -67746,    /* An invalid context was encountered. */
 553     errSecInvalidAlgorithm                   = -67747,    /* An invalid algorithm was encountered. */
 554     errSecInvalidAttributeKey                = -67748,    /* A key attribute was not valid. */
 555     errSecMissingAttributeKey                = -67749,    /* A key attribute was missing. */
 556     errSecInvalidAttributeInitVector         = -67750,    /* An init vector attribute was not valid. */
 557     errSecMissingAttributeInitVector         = -67751,    /* An init vector attribute was missing. */
 558     errSecInvalidAttributeSalt               = -67752,    /* A salt attribute was not valid. */
 559     errSecMissingAttributeSalt               = -67753,    /* A salt attribute was missing. */
 560     errSecInvalidAttributePadding            = -67754,    /* A padding attribute was not valid. */
 561     errSecMissingAttributePadding            = -67755,    /* A padding attribute was missing. */
 562     errSecInvalidAttributeRandom             = -67756,    /* A random number attribute was not valid. */
 563     errSecMissingAttributeRandom             = -67757,    /* A random number attribute was missing. */
 564     errSecInvalidAttributeSeed               = -67758,    /* A seed attribute was not valid. */
 565     errSecMissingAttributeSeed               = -67759,    /* A seed attribute was missing. */
 566     errSecInvalidAttributePassphrase         = -67760,    /* A passphrase attribute was not valid. */
 567     errSecMissingAttributePassphrase         = -67761,    /* A passphrase attribute was missing. */
 568     errSecInvalidAttributeKeyLength          = -67762,    /* A key length attribute was not valid. */
 569     errSecMissingAttributeKeyLength          = -67763,    /* A key length attribute was missing. */
 570     errSecInvalidAttributeBlockSize          = -67764,    /* A block size attribute was not valid. */
 571     errSecMissingAttributeBlockSize          = -67765,    /* A block size attribute was missing. */
 572     errSecInvalidAttributeOutputSize         = -67766,    /* An output size attribute was not valid. */
 573     errSecMissingAttributeOutputSize         = -67767,    /* An output size attribute was missing. */
 574     errSecInvalidAttributeRounds             = -67768,    /* The number of rounds attribute was not valid. */
 575     errSecMissingAttributeRounds             = -67769,    /* The number of rounds attribute was missing. */
 576     errSecInvalidAlgorithmParms              = -67770,    /* An algorithm parameters attribute was not valid. */
 577     errSecMissingAlgorithmParms              = -67771,    /* An algorithm parameters attribute was missing. */
 578     errSecInvalidAttributeLabel              = -67772,    /* A label attribute was not valid. */
 579     errSecMissingAttributeLabel              = -67773,    /* A label attribute was missing. */
 580     errSecInvalidAttributeKeyType            = -67774,    /* A key type attribute was not valid. */
 581     errSecMissingAttributeKeyType            = -67775,    /* A key type attribute was missing. */
 582     errSecInvalidAttributeMode               = -67776,    /* A mode attribute was not valid. */
 583     errSecMissingAttributeMode               = -67777,    /* A mode attribute was missing. */
 584     errSecInvalidAttributeEffectiveBits      = -67778,    /* An effective bits attribute was not valid. */
 585     errSecMissingAttributeEffectiveBits      = -67779,    /* An effective bits attribute was missing. */
 586     errSecInvalidAttributeStartDate          = -67780,    /* A start date attribute was not valid. */
 587     errSecMissingAttributeStartDate          = -67781,    /* A start date attribute was missing. */
 588     errSecInvalidAttributeEndDate            = -67782,    /* An end date attribute was not valid. */
 589     errSecMissingAttributeEndDate            = -67783,    /* An end date attribute was missing. */
 590     errSecInvalidAttributeVersion            = -67784,    /* A version attribute was not valid. */
 591     errSecMissingAttributeVersion            = -67785,    /* A version attribute was missing. */
 592     errSecInvalidAttributePrime              = -67786,    /* A prime attribute was not valid. */
 593     errSecMissingAttributePrime              = -67787,    /* A prime attribute was missing. */
 594     errSecInvalidAttributeBase               = -67788,    /* A base attribute was not valid. */
 595     errSecMissingAttributeBase               = -67789,    /* A base attribute was missing. */
 596     errSecInvalidAttributeSubprime           = -67790,    /* A subprime attribute was not valid. */
 597     errSecMissingAttributeSubprime           = -67791,    /* A subprime attribute was missing. */
 598     errSecInvalidAttributeIterationCount     = -67792,    /* An iteration count attribute was not valid. */
 599     errSecMissingAttributeIterationCount     = -67793,    /* An iteration count attribute was missing. */
 600     errSecInvalidAttributeDLDBHandle         = -67794,    /* A database handle attribute was not valid. */
 601     errSecMissingAttributeDLDBHandle         = -67795,    /* A database handle attribute was missing. */
 602     errSecInvalidAttributeAccessCredentials  = -67796,    /* An access credentials attribute was not valid. */
 603     errSecMissingAttributeAccessCredentials  = -67797,    /* An access credentials attribute was missing. */
 604     errSecInvalidAttributePublicKeyFormat    = -67798,    /* A public key format attribute was not valid. */
 605     errSecMissingAttributePublicKeyFormat    = -67799,    /* A public key format attribute was missing. */
 606     errSecInvalidAttributePrivateKeyFormat   = -67800,    /* A private key format attribute was not valid. */
 607     errSecMissingAttributePrivateKeyFormat   = -67801,    /* A private key format attribute was missing. */
 608     errSecInvalidAttributeSymmetricKeyFormat = -67802,    /* A symmetric key format attribute was not valid. */
 609     errSecMissingAttributeSymmetricKeyFormat = -67803,    /* A symmetric key format attribute was missing. */
 610     errSecInvalidAttributeWrappedKeyFormat   = -67804,    /* A wrapped key format attribute was not valid. */
 611     errSecMissingAttributeWrappedKeyFormat   = -67805,    /* A wrapped key format attribute was missing. */
 612     errSecStagedOperationInProgress          = -67806,    /* A staged operation is in progress. */
 613     errSecStagedOperationNotStarted          = -67807,    /* A staged operation was not started. */
 614     errSecVerifyFailed                       = -67808,    /* A cryptographic verification failure has occurred. */
 615     errSecQuerySizeUnknown                   = -67809,    /* The query size is unknown. */
 616     errSecBlockSizeMismatch                  = -67810,    /* A block size mismatch occurred. */
 617     errSecPublicKeyInconsistent              = -67811,    /* The public key was inconsistent. */
 618     errSecDeviceVerifyFailed                 = -67812,    /* A device verification failure has occurred. */
 619     errSecInvalidLoginName                   = -67813,    /* An invalid login name was detected. */
 620     errSecAlreadyLoggedIn                    = -67814,    /* The user is already logged in. */
 621     errSecInvalidDigestAlgorithm             = -67815,    /* An invalid digest algorithm was detected. */
 622     errSecInvalidCRLGroup                    = -67816,    /* An invalid CRL group was detected. */
 623     errSecCertificateCannotOperate           = -67817,    /* The certificate cannot operate. */
 624     errSecCertificateExpired                 = -67818,    /* An expired certificate was detected. */
 625     errSecCertificateNotValidYet             = -67819,    /* The certificate is not yet valid. */
 626     errSecCertificateRevoked                 = -67820,    /* The certificate was revoked. */
 627     errSecCertificateSuspended               = -67821,    /* The certificate was suspended. */
 628     errSecInsufficientCredentials            = -67822,    /* Insufficient credentials were detected. */
 629     errSecInvalidAction                      = -67823,    /* The action was not valid. */
 630     errSecInvalidAuthority                   = -67824,    /* The authority was not valid. */
 631     errSecVerifyActionFailed                 = -67825,    /* A verify action has failed. */
 632     errSecInvalidCertAuthority               = -67826,    /* The certificate authority was not valid. */
 633     errSecInvaldCRLAuthority                 = -67827,    /* The CRL authority was not valid. */
 634     errSecInvalidCRLEncoding                 = -67828,    /* The CRL encoding was not valid. */
 635     errSecInvalidCRLType                     = -67829,    /* The CRL type was not valid. */
 636     errSecInvalidCRL                         = -67830,    /* The CRL was not valid. */
 637     errSecInvalidFormType                    = -67831,    /* The form type was not valid. */
 638     errSecInvalidID                          = -67832,    /* The ID was not valid. */
 639     errSecInvalidIdentifier                  = -67833,    /* The identifier was not valid. */
 640     errSecInvalidIndex                       = -67834,    /* The index was not valid. */
 641     errSecInvalidPolicyIdentifiers           = -67835,    /* The policy identifiers are not valid. */
 642     errSecInvalidTimeString                  = -67836,    /* The time specified was not valid. */
 643     errSecInvalidReason                      = -67837,    /* The trust policy reason was not valid. */
 644     errSecInvalidRequestInputs               = -67838,    /* The request inputs are not valid. */
 645     errSecInvalidResponseVector              = -67839,    /* The response vector was not valid. */
 646     errSecInvalidStopOnPolicy                = -67840,    /* The stop-on policy was not valid. */
 647     errSecInvalidTuple                       = -67841,    /* The tuple was not valid. */
 648     errSecMultipleValuesUnsupported          = -67842,    /* Multiple values are not supported. */
 649     errSecNotTrusted                         = -67843,    /* The certificate was not trusted. */
 650     errSecNoDefaultAuthority                 = -67844,    /* No default authority was detected. */
 651     errSecRejectedForm                       = -67845,    /* The trust policy had a rejected form. */
 652     errSecRequestLost                        = -67846,    /* The request was lost. */
 653     errSecRequestRejected                    = -67847,    /* The request was rejected. */
 654     errSecUnsupportedAddressType             = -67848,    /* The address type is not supported. */
 655     errSecUnsupportedService                 = -67849,    /* The service is not supported. */
 656     errSecInvalidTupleGroup                  = -67850,    /* The tuple group was not valid. */
 657     errSecInvalidBaseACLs                    = -67851,    /* The base ACLs are not valid. */
 658     errSecInvalidTupleCredendtials           = -67852,    /* The tuple credentials are not valid. */
 659     errSecInvalidEncoding                    = -67853,    /* The encoding was not valid. */
 660     errSecInvalidValidityPeriod              = -67854,    /* The validity period was not valid. */
 661     errSecInvalidRequestor                   = -67855,    /* The requestor was not valid. */
 662     errSecRequestDescriptor                  = -67856,    /* The request descriptor was not valid. */
 663     errSecInvalidBundleInfo                  = -67857,    /* The bundle information was not valid. */
 664     errSecInvalidCRLIndex                    = -67858,    /* The CRL index was not valid. */
 665     errSecNoFieldValues                      = -67859,    /* No field values were detected. */
 666     errSecUnsupportedFieldFormat             = -67860,    /* The field format is not supported. */
 667     errSecUnsupportedIndexInfo               = -67861,    /* The index information is not supported. */
 668     errSecUnsupportedLocality                = -67862,    /* The locality is not supported. */
 669     errSecUnsupportedNumAttributes           = -67863,    /* The number of attributes is not supported. */
 670     errSecUnsupportedNumIndexes              = -67864,    /* The number of indexes is not supported. */
 671     errSecUnsupportedNumRecordTypes          = -67865,    /* The number of record types is not supported. */
 672     errSecFieldSpecifiedMultiple             = -67866,    /* Too many fields were specified. */
 673     errSecIncompatibleFieldFormat            = -67867,    /* The field format was incompatible. */
 674     errSecInvalidParsingModule               = -67868,    /* The parsing module was not valid. */
 675     errSecDatabaseLocked                     = -67869,    /* The database is locked. */
 676     errSecDatastoreIsOpen                    = -67870,    /* The data store is open. */
 677     errSecMissingValue                       = -67871,    /* A missing value was detected. */
 678     errSecUnsupportedQueryLimits             = -67872,    /* The query limits are not supported. */
 679     errSecUnsupportedNumSelectionPreds       = -67873,    /* The number of selection predicates is not supported. */
 680     errSecUnsupportedOperator                = -67874,    /* The operator is not supported. */
 681     errSecInvalidDBLocation                  = -67875,    /* The database location is not valid. */
 682     errSecInvalidAccessRequest               = -67876,    /* The access request is not valid. */
 683     errSecInvalidIndexInfo                   = -67877,    /* The index information is not valid. */
 684     errSecInvalidNewOwner                    = -67878,    /* The new owner is not valid. */
 685     errSecInvalidModifyMode                  = -67879,    /* The modify mode is not valid. */
 686     errSecMissingRequiredExtension           = -67880,    /* A required certificate extension is missing. */
 687     errSecExtendedKeyUsageNotCritical        = -67881,    /* The extended key usage extension was not marked critical. */
 688     errSecTimestampMissing                   = -67882,    /* A timestamp was expected but was not found. */
 689     errSecTimestampInvalid                   = -67883,    /* The timestamp was not valid. */
 690     errSecTimestampNotTrusted                = -67884,    /* The timestamp was not trusted. */
 691     errSecTimestampServiceNotAvailable       = -67885,    /* The timestamp service is not available. */
 692     errSecTimestampBadAlg                    = -67886,    /* An unrecognized or unsupported Algorithm Identifier in timestamp. */
 693     errSecTimestampBadRequest                = -67887,    /* The timestamp transaction is not permitted or supported. */
 694     errSecTimestampBadDataFormat             = -67888,    /* The timestamp data submitted has the wrong format. */
 695     errSecTimestampTimeNotAvailable          = -67889,    /* The time source for the Timestamp Authority is not available. */
 696     errSecTimestampUnacceptedPolicy          = -67890,    /* The requested policy is not supported by the Timestamp Authority. */
 697     errSecTimestampUnacceptedExtension       = -67891,    /* The requested extension is not supported by the Timestamp Authority. */
 698     errSecTimestampAddInfoNotAvailable       = -67892,    /* The additional information requested is not available. */
 699     errSecTimestampSystemFailure             = -67893,    /* The timestamp request cannot be handled due to system failure. */
 700     errSecSigningTimeMissing                 = -67894,    /* A signing time was expected but was not found. */
 701     errSecTimestampRejection                 = -67895,    /* A timestamp transaction was rejected. */
 702     errSecTimestampWaiting                   = -67896,    /* A timestamp transaction is waiting. */
 703     errSecTimestampRevocationWarning         = -67897,    /* A timestamp authority revocation warning was issued. */
 704     errSecTimestampRevocationNotification    = -67898,    /* A timestamp authority revocation notification was issued. */
 705     errSecCertificatePolicyNotAllowed        = -67899,    /* The requested policy is not allowed for this certificate. */
 706     errSecCertificateNameNotAllowed          = -67900,    /* The requested name is not allowed for this certificate. */
 707     errSecCertificateValidityPeriodTooLong   = -67901,    /* The validity period in the certificate exceeds the maximum allowed. */
 708     errSecCertificateIsCA                    = -67902,    /* The verified certificate is a CA rather than an end-entity */
 709 };
 710
 711
 712 /*!
 713  @enum SecureTransport Error Codes
 714  @abstract Result codes returned from SecureTransport and SecProtocol functions. This is also the domain
 715    for TLS errors in the network stack.
 716
 717  @constant errSSLProtocol SSL protocol error
 718  @constant errSSLNegotiation Cipher Suite negotiation failure
 719  @constant errSSLFatalAlert Fatal alert
 720  @constant errSSLWouldBlock I/O would block (not fatal)
 721  @constant errSSLSessionNotFound attempt to restore an unknown session
 722  @constant errSSLClosedGraceful connection closed gracefully
 723  @constant errSSLClosedAbort connection closed via error
 724  @constant errSSLXCertChainInvalid invalid certificate chain
 725  @constant errSSLBadCert bad certificate format
 726  @constant errSSLCrypto underlying cryptographic error
 727  @constant errSSLInternal Internal error
 728  @constant errSSLModuleAttach module attach failure
 729  @constant errSSLUnknownRootCert valid cert chain, untrusted root
 730  @constant errSSLNoRootCert cert chain not verified by root
 731  @constant errSSLCertExpired chain had an expired cert
 732  @constant errSSLCertNotYetValid chain had a cert not yet valid
 733  @constant errSSLClosedNoNotify server closed session with no notification
 734  @constant errSSLBufferOverflow insufficient buffer provided
 735  @constant errSSLBadCipherSuite bad SSLCipherSuite
 736  @constant errSSLPeerUnexpectedMsg unexpected message received
 737  @constant errSSLPeerBadRecordMac bad MAC
 738  @constant errSSLPeerDecryptionFail decryption failed
 739  @constant errSSLPeerRecordOverflow record overflow
 740  @constant errSSLPeerDecompressFail decompression failure
 741  @constant errSSLPeerHandshakeFail handshake failure
 742  @constant errSSLPeerBadCert misc. bad certificate
 743  @constant errSSLPeerUnsupportedCert bad unsupported cert format
 744  @constant errSSLPeerCertRevoked certificate revoked
 745  @constant errSSLPeerCertExpired certificate expired
 746  @constant errSSLPeerCertUnknown unknown certificate
 747  @constant errSSLIllegalParam illegal parameter
 748  @constant errSSLPeerUnknownCA unknown Cert Authority
 749  @constant errSSLPeerAccessDenied access denied
 750  @constant errSSLPeerDecodeError decoding error
 751  @constant errSSLPeerDecryptError decryption error
 752  @constant errSSLPeerExportRestriction export restriction
 753  @constant errSSLPeerProtocolVersion bad protocol version
 754  @constant errSSLPeerInsufficientSecurity insufficient security
 755  @constant errSSLPeerInternalError internal error
 756  @constant errSSLPeerUserCancelled user canceled
 757  @constant errSSLPeerNoRenegotiation no renegotiation allowed
 758  @constant errSSLPeerAuthCompleted peer cert is valid, or was ignored if verification disabled
 759  @constant errSSLClientCertRequested server has requested a client cert
 760  @constant errSSLHostNameMismatch peer host name mismatch
 761  @constant errSSLConnectionRefused peer dropped connection before responding
 762  @constant errSSLDecryptionFail decryption failure
 763  @constant errSSLBadRecordMac bad MAC
 764  @constant errSSLRecordOverflow record overflow
 765  @constant errSSLBadConfiguration configuration error
 766  @constant errSSLUnexpectedRecord unexpected (skipped) record in DTLS
 767  @constant errSSLWeakPeerEphemeralDHKey weak ephemeral dh key
 768  @constant errSSLClientHelloReceived SNI
 769  @constant errSSLTransportReset transport (socket) shutdown, e.g., TCP RST or FIN.
 770  @constant errSSLNetworkTimeout network timeout triggered
 771  @constant errSSLConfigurationFailed TLS configuration failed
 772  @constant errSSLUnsupportedExtension unsupported TLS extension
 773  @constant errSSLUnexpectedMessage peer rejected unexpected message
 774  @constant errSSLDecompressFail decompression failed
 775  @constant errSSLHandshakeFail handshake failed
 776  @constant errSSLDecodeError decode failed
 777  @constant errSSLInappropriateFallback inappropriate fallback
 778  @constant errSSLMissingExtension missing extension
 779  @constant errSSLBadCertificateStatusResponse bad OCSP response
 780  @constant errSSLCertificateRequired certificate required
 781  @constant errSSLUnknownPSKIdentity unknown PSK identity
 782  @constant errSSLUnrecognizedName unknown or unrecognized name
 783  @constant errSSLATSViolation ATS violation
 784  @constant errSSLATSMinimumVersionViolation ATS violation: minimum protocol version is not ATS compliant
 785  @constant errSSLATSCiphersuiteViolation ATS violation: selected ciphersuite is not ATS compliant
 786  @constant errSSLATSMinimumKeySizeViolation ATS violation: peer key size is not ATS compliant
 787  @constant errSSLATSLeafCertificateHashAlgorithmViolation ATS violation: peer leaf certificate hash algorithm is not ATS compliant
 788  @constant errSSLATSCertificateHashAlgorithmViolation ATS violation: peer certificate hash algorithm is not ATS compliant
 789  @constant errSSLATSCertificateTrustViolation ATS violation: peer certificate is not issued by trusted peer
 790  @constant errSSLEarlyDataRejected Early application data rejected by peer
 791  */
 792
 793 /*
 794  Note: the comments that appear after these errors are used to create SecErrorMessages.strings.
 795  The comments must not be multi-line, and should be in a form meaningful to an end user. If
 796  a different or additional comment is needed, it can be put in the header doc format, or on a
 797  line that does not start with errZZZ.
 798  */
 799 CF_ENUM(OSStatus) {
 800     errSSLProtocol                                  = -9800,    /* SSL protocol error */
 801     errSSLNegotiation                               = -9801,    /* Cipher Suite negotiation failure */
 802     errSSLFatalAlert                                = -9802,    /* Fatal alert */
 803     errSSLWouldBlock                                = -9803,    /* I/O would block (not fatal) */
 804     errSSLSessionNotFound                           = -9804,    /* attempt to restore an unknown session */
 805     errSSLClosedGraceful                            = -9805,    /* connection closed gracefully */
 806     errSSLClosedAbort                               = -9806,    /* connection closed via error */
 807     errSSLXCertChainInvalid                         = -9807,    /* invalid certificate chain */
 808     errSSLBadCert                                   = -9808,    /* bad certificate format */
 809     errSSLCrypto                                    = -9809,    /* underlying cryptographic error */
 810     errSSLInternal                                  = -9810,    /* Internal error */
 811     errSSLModuleAttach                              = -9811,    /* module attach failure */
 812     errSSLUnknownRootCert                           = -9812,    /* valid cert chain, untrusted root */
 813     errSSLNoRootCert                                = -9813,    /* cert chain not verified by root */
 814     errSSLCertExpired                               = -9814,    /* chain had an expired cert */
 815     errSSLCertNotYetValid                           = -9815,    /* chain had a cert not yet valid */
 816     errSSLClosedNoNotify                            = -9816,    /* server closed session with no notification */
 817     errSSLBufferOverflow                            = -9817,    /* insufficient buffer provided */
 818     errSSLBadCipherSuite                            = -9818,    /* bad SSLCipherSuite */
 819
 820     /* fatal errors detected by peer */
 821     errSSLPeerUnexpectedMsg                         = -9819,    /* unexpected message received */
 822     errSSLPeerBadRecordMac                          = -9820,    /* bad MAC */
 823     errSSLPeerDecryptionFail                        = -9821,    /* decryption failed */
 824     errSSLPeerRecordOverflow                        = -9822,    /* record overflow */
 825     errSSLPeerDecompressFail                        = -9823,    /* decompression failure */
 826     errSSLPeerHandshakeFail                         = -9824,    /* handshake failure */
 827     errSSLPeerBadCert                               = -9825,    /* misc. bad certificate */
 828     errSSLPeerUnsupportedCert                       = -9826,    /* bad unsupported cert format */
 829     errSSLPeerCertRevoked                           = -9827,    /* certificate revoked */
 830     errSSLPeerCertExpired                           = -9828,    /* certificate expired */
 831     errSSLPeerCertUnknown                           = -9829,    /* unknown certificate */
 832     errSSLIllegalParam                              = -9830,    /* illegal parameter */
 833     errSSLPeerUnknownCA                             = -9831,    /* unknown Cert Authority */
 834     errSSLPeerAccessDenied                          = -9832,    /* access denied */
 835     errSSLPeerDecodeError                           = -9833,    /* decoding error */
 836     errSSLPeerDecryptError                          = -9834,    /* decryption error */
 837     errSSLPeerExportRestriction                     = -9835,    /* export restriction */
 838     errSSLPeerProtocolVersion                       = -9836,    /* bad protocol version */
 839     errSSLPeerInsufficientSecurity                  = -9837,    /* insufficient security */
 840     errSSLPeerInternalError                         = -9838,    /* internal error */
 841     errSSLPeerUserCancelled                         = -9839,    /* user canceled */
 842     errSSLPeerNoRenegotiation                       = -9840,    /* no renegotiation allowed */
 843
 844     /* non-fatal result codes */
 845     errSSLPeerAuthCompleted                         = -9841,    /* peer cert is valid, or was ignored if verification disabled */
 846     errSSLClientCertRequested                       = -9842,    /* server has requested a client cert */
 847
 848     /* more errors detected by us */
 849     errSSLHostNameMismatch                          = -9843,    /* peer host name mismatch */
 850     errSSLConnectionRefused                         = -9844,    /* peer dropped connection before responding */
 851     errSSLDecryptionFail                            = -9845,    /* decryption failure */
 852     errSSLBadRecordMac                              = -9846,    /* bad MAC */
 853     errSSLRecordOverflow                            = -9847,    /* record overflow */
 854     errSSLBadConfiguration                          = -9848,    /* configuration error */
 855     errSSLUnexpectedRecord                          = -9849,    /* unexpected (skipped) record in DTLS */
 856     errSSLWeakPeerEphemeralDHKey                    = -9850,    /* weak ephemeral dh key  */
 857
 858     /* non-fatal result codes */
 859     errSSLClientHelloReceived                       = -9851,    /* SNI */
 860
 861     /* fatal errors resulting from transport or networking errors */
 862     errSSLTransportReset                            = -9852,    /* transport (socket) shutdown, e.g., TCP RST or FIN. */
 863     errSSLNetworkTimeout                            = -9853,    /* network timeout triggered */
 864
 865     /* fatal errors resulting from software misconfiguration */
 866     errSSLConfigurationFailed                       = -9854,    /* TLS configuration failed */
 867
 868     /* additional errors */
 869     errSSLUnsupportedExtension                      = -9855,    /* unsupported TLS extension */
 870     errSSLUnexpectedMessage                         = -9856,    /* peer rejected unexpected message */
 871     errSSLDecompressFail                            = -9857,    /* decompression failed */
 872     errSSLHandshakeFail                             = -9858,    /* handshake failed */
 873     errSSLDecodeError                               = -9859,    /* decode failed */
 874     errSSLInappropriateFallback                     = -9860,    /* inappropriate fallback */
 875     errSSLMissingExtension                          = -9861,    /* missing extension */
 876     errSSLBadCertificateStatusResponse              = -9862,    /* bad OCSP response */
 877     errSSLCertificateRequired                       = -9863,    /* certificate required */
 878     errSSLUnknownPSKIdentity                        = -9864,    /* unknown PSK identity */
 879     errSSLUnrecognizedName                          = -9865,    /* unknown or unrecognized name */
 880
 881     /* ATS compliance violation errors */
 882     errSSLATSViolation                              = -9880,    /* ATS violation */
 883     errSSLATSMinimumVersionViolation                = -9881,    /* ATS violation: minimum protocol version is not ATS compliant */
 884     errSSLATSCiphersuiteViolation                   = -9882,    /* ATS violation: selected ciphersuite is not ATS compliant */
 885     errSSLATSMinimumKeySizeViolation                = -9883,    /* ATS violation: peer key size is not ATS compliant */
 886     errSSLATSLeafCertificateHashAlgorithmViolation  = -9884,    /* ATS violation: peer leaf certificate hash algorithm is not ATS compliant */
 887     errSSLATSCertificateHashAlgorithmViolation      = -9885,    /* ATS violation: peer certificate hash algorithm is not ATS compliant */
 888     errSSLATSCertificateTrustViolation              = -9886,    /* ATS violation: peer certificate is not issued by trusted peer */
 889
 890     /* early data errors */
 891     errSSLEarlyDataRejected                         = -9890,    /* Early application data rejected by peer */
 892 };
 893
 894 CF_IMPLICIT_BRIDGING_DISABLED
 895 CF_ASSUME_NONNULL_END
 896
 897 __END_DECLS
 898
 899 #endif /* _SECURITY_SECBASE_H_ */