OSX/sec/Security/Regressions/secitem/si-65-cms-cert-policy.c

   1 /*
   2  * Copyright (c) 2010,2012,2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #include <CoreFoundation/CoreFoundation.h>
  25 #include <Security/Security.h>
  26 #include <Security/SecCMS.h>
  27 #include <Security/SecInternal.h>
  28 #include <Security/SecPolicyPriv.h>
  29 #include <CommonCrypto/CommonDigest.h>
  30 #include "Security_regressions.h"
  31
  32
  33 const uint8_t root_ca[] = {
  34   0x30, 0x82, 0x03, 0x59, 0x30, 0x82, 0x02, 0x41, 0xa0, 0x03, 0x02, 0x01,
  35   0x02, 0x02, 0x01, 0x00, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
  36   0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00, 0x30, 0x44, 0x31, 0x0b, 0x30,
  37   0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13,
  38   0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x41, 0x70, 0x70,
  39   0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x20, 0x30, 0x1e, 0x06,
  40   0x03, 0x55, 0x04, 0x03, 0x13, 0x17, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
  41   0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x41, 0x75, 0x74, 0x68,
  42   0x6f, 0x72, 0x69, 0x74, 0x79, 0x30, 0x1e, 0x17, 0x0d, 0x31, 0x30, 0x30,
  43   0x39, 0x32, 0x39, 0x32, 0x32, 0x31, 0x30, 0x31, 0x38, 0x5a, 0x17, 0x0d,
  44   0x31, 0x30, 0x31, 0x30, 0x32, 0x39, 0x32, 0x32, 0x31, 0x30, 0x31, 0x38,
  45   0x5a, 0x30, 0x44, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06,
  46   0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04,
  47   0x0a, 0x13, 0x0a, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63,
  48   0x2e, 0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x17,
  49   0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f,
  50   0x6e, 0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x30,
  51   0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
  52   0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00, 0x30,
  53   0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xab, 0xb2, 0x30, 0x5a,
  54   0xf7, 0x0b, 0xe5, 0xb1, 0xcf, 0xd8, 0x21, 0xe8, 0x13, 0x0a, 0x73, 0x31,
  55   0x5e, 0x8d, 0xbb, 0xf8, 0xb4, 0xcf, 0x7a, 0x6c, 0xb3, 0xa4, 0x57, 0x7b,
  56   0xa3, 0xea, 0x0c, 0x89, 0xe3, 0x4f, 0x03, 0x41, 0x02, 0xd0, 0xcd, 0x29,
  57   0x43, 0x20, 0x56, 0xc5, 0x4f, 0xda, 0xb7, 0xeb, 0x43, 0x7e, 0xcd, 0x39,
  58   0xca, 0xbe, 0x6f, 0xdb, 0x7e, 0x31, 0x04, 0x5e, 0xa9, 0x9e, 0x1c, 0x57,
  59   0xb3, 0x2f, 0x8d, 0xa9, 0x32, 0x51, 0x22, 0xae, 0xd4, 0xc2, 0xec, 0xc3,
  60   0xc4, 0xfd, 0xd8, 0xc4, 0xb1, 0xc9, 0x69, 0xe5, 0x49, 0xad, 0x50, 0xbe,
  61   0xc5, 0x36, 0xfe, 0x1f, 0x36, 0x37, 0x18, 0x1a, 0x0e, 0xee, 0x1f, 0x5a,
  62   0xcc, 0xa7, 0x83, 0x76, 0xc4, 0x58, 0x78, 0xdc, 0xd5, 0xd9, 0x41, 0xd9,
  63   0x24, 0xe3, 0x31, 0xa3, 0x35, 0xa0, 0xe5, 0x0e, 0xae, 0xaa, 0x8b, 0xda,
  64   0x71, 0xd2, 0xa4, 0xfc, 0x8c, 0xd2, 0x0e, 0x70, 0x83, 0x09, 0x19, 0x26,
  65   0xb2, 0x4a, 0x2b, 0x92, 0xed, 0x4f, 0x09, 0x46, 0x5e, 0xe9, 0x50, 0x9d,
  66   0xaf, 0x0c, 0x8d, 0x9e, 0xaa, 0x9b, 0xc2, 0x2f, 0xb7, 0xa3, 0x39, 0x22,
  67   0x6b, 0xde, 0x97, 0xd9, 0xec, 0xb6, 0x44, 0x07, 0x2e, 0x6b, 0x7a, 0xe6,
  68   0xcf, 0x8d, 0x7d, 0xeb, 0xd3, 0xc8, 0x06, 0xdf, 0x09, 0x98, 0x9f, 0x22,
  69   0x88, 0x30, 0x29, 0xa7, 0xec, 0xa7, 0x3d, 0x65, 0x18, 0x0d, 0xe9, 0x7d,
  70   0x32, 0x95, 0x0a, 0xe3, 0x6b, 0x14, 0x65, 0xb7, 0xa1, 0xd6, 0x83, 0x79,
  71   0x07, 0x98, 0x9f, 0xff, 0x90, 0x25, 0x2c, 0xa6, 0x4d, 0xc1, 0xc2, 0x07,
  72   0x51, 0x63, 0x5b, 0x3d, 0x77, 0x79, 0xc9, 0x8b, 0xae, 0xdd, 0x16, 0x21,
  73   0x7d, 0xc6, 0x3d, 0xa2, 0x73, 0x80, 0x9c, 0xb1, 0x27, 0x81, 0x65, 0x92,
  74   0x33, 0xd9, 0xda, 0xf0, 0xe1, 0xc4, 0x7a, 0x2d, 0xbf, 0xe0, 0x76, 0x0d,
  75   0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x56, 0x30, 0x54, 0x30, 0x12, 0x06,
  76   0x03, 0x55, 0x1d, 0x13, 0x01, 0x01, 0xff, 0x04, 0x08, 0x30, 0x06, 0x01,
  77   0x01, 0xff, 0x02, 0x01, 0x00, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
  78   0x04, 0x16, 0x04, 0x14, 0x78, 0x2f, 0x9f, 0x48, 0x53, 0x25, 0xe3, 0x8c,
  79   0x2f, 0xaf, 0x1d, 0x21, 0x86, 0xdc, 0xb0, 0x50, 0x93, 0xa9, 0x24, 0xc2,
  80   0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80,
  81   0x14, 0x78, 0x2f, 0x9f, 0x48, 0x53, 0x25, 0xe3, 0x8c, 0x2f, 0xaf, 0x1d,
  82   0x21, 0x86, 0xdc, 0xb0, 0x50, 0x93, 0xa9, 0x24, 0xc2, 0x30, 0x0d, 0x06,
  83   0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00,
  84   0x03, 0x82, 0x01, 0x01, 0x00, 0x5b, 0x89, 0x64, 0x90, 0xa4, 0x22, 0x05,
  85   0x55, 0xd7, 0x31, 0x26, 0xd7, 0x38, 0x22, 0x23, 0xac, 0xd6, 0x35, 0xe4,
  86   0x0e, 0xfd, 0xb2, 0x53, 0x6c, 0xb8, 0x22, 0x32, 0x91, 0xdf, 0xd1, 0xfc,
  87   0x70, 0xb6, 0xa0, 0x2d, 0xa4, 0xea, 0x81, 0x26, 0x48, 0xca, 0x05, 0x4d,
  88   0x1b, 0x5a, 0x7d, 0xc8, 0x2e, 0x6c, 0xc4, 0x1a, 0x0d, 0x0a, 0xc8, 0x5b,
  89   0x0e, 0xf3, 0xeb, 0xf2, 0x02, 0xad, 0xb7, 0x6d, 0xf9, 0x02, 0xb6, 0xc9,
  90   0x0b, 0xbc, 0xf2, 0x0b, 0xb1, 0x31, 0x3f, 0x6a, 0x93, 0x9d, 0x2e, 0x54,
  91   0x29, 0xff, 0xc0, 0xa0, 0xd5, 0xe2, 0x1d, 0x1a, 0x62, 0x46, 0x89, 0x58,
  92   0x90, 0x6a, 0x39, 0xf8, 0x76, 0x16, 0xa6, 0xde, 0x08, 0xe6, 0x76, 0xf1,
  93   0xb1, 0xe1, 0x06, 0x08, 0xb1, 0x41, 0x0f, 0x44, 0x26, 0x7e, 0x9b, 0xc1,
  94   0xc1, 0x21, 0x07, 0x70, 0x79, 0x36, 0xe6, 0xc2, 0x27, 0x7c, 0x2d, 0x17,
  95   0x4f, 0x46, 0x8c, 0xac, 0x54, 0x4b, 0x6e, 0xbc, 0x5c, 0xca, 0x37, 0xc0,
  96   0x32, 0xfe, 0x1b, 0x02, 0xf7, 0x29, 0x6e, 0x30, 0x86, 0xf0, 0x1a, 0xc7,
  97   0x62, 0xa1, 0xaa, 0x8a, 0x2e, 0x5f, 0x37, 0xd9, 0xf6, 0xf5, 0x29, 0xf9,
  98   0xc9, 0x4a, 0x4e, 0xc7, 0xaf, 0x4f, 0xdc, 0x99, 0xa5, 0x8d, 0x7f, 0x3b,
  99   0xf4, 0x04, 0xc5, 0x9d, 0x3e, 0x8e, 0xbe, 0x58, 0x6d, 0x62, 0xd7, 0x62,
 100   0x57, 0x68, 0x46, 0x4e, 0x74, 0x17, 0x1f, 0x4e, 0x27, 0x49, 0xf5, 0xc7,
 101   0x5c, 0xdb, 0x30, 0x73, 0x77, 0x90, 0x2d, 0xc9, 0xed, 0x4d, 0x46, 0x68,
 102   0xe0, 0x91, 0xb8, 0xea, 0xa2, 0xa5, 0x79, 0x32, 0x60, 0xb8, 0xef, 0xcd,
 103   0x89, 0x0d, 0xab, 0x18, 0x9b, 0x06, 0xf9, 0xab, 0xac, 0xc1, 0xfb, 0xe3,
 104   0xf0, 0xf3, 0x5c, 0xc6, 0x87, 0x2e, 0xf3, 0xec, 0x2b, 0x88, 0x37, 0xaa,
 105   0x32, 0x76, 0x33, 0xf9, 0xa2, 0xb9, 0x2e, 0xc1, 0x11
 106 };
 107
 108 unsigned char signed_urlbag[] = {
 109   0x30, 0x82, 0x04, 0xe8, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
 110   0x01, 0x07, 0x02, 0xa0, 0x82, 0x04, 0xd9, 0x30, 0x82, 0x04, 0xd5, 0x02,
 111   0x01, 0x01, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02,
 112   0x1a, 0x05, 0x00, 0x30, 0x14, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
 113   0x0d, 0x01, 0x07, 0x01, 0xa0, 0x07, 0x04, 0x05, 0x66, 0x6f, 0x6f, 0x0d,
 114   0x0a, 0xa0, 0x82, 0x03, 0x04, 0x30, 0x82, 0x03, 0x00, 0x30, 0x82, 0x01,
 115   0xe8, 0xa0, 0x03, 0x02, 0x01, 0x02, 0x02, 0x01, 0x01, 0x30, 0x0d, 0x06,
 116   0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00,
 117   0x30, 0x44, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
 118   0x02, 0x55, 0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a,
 119   0x13, 0x0a, 0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x2e,
 120   0x31, 0x20, 0x30, 0x1e, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x17, 0x43,
 121   0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e,
 122   0x20, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x30, 0x1e,
 123   0x17, 0x0d, 0x31, 0x30, 0x30, 0x39, 0x32, 0x39, 0x32, 0x32, 0x31, 0x30,
 124   0x31, 0x38, 0x5a, 0x17, 0x0d, 0x31, 0x30, 0x31, 0x30, 0x32, 0x39, 0x32,
 125   0x32, 0x31, 0x30, 0x31, 0x38, 0x5a, 0x30, 0x4f, 0x31, 0x0b, 0x30, 0x09,
 126   0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55, 0x53, 0x31, 0x13, 0x30,
 127   0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a, 0x41, 0x70, 0x70, 0x6c,
 128   0x65, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x2b, 0x30, 0x29, 0x06, 0x03,
 129   0x55, 0x04, 0x03, 0x13, 0x22, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75,
 130   0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x2e, 0x61, 0x70, 0x70, 0x6c, 0x65,
 131   0x2e, 0x63, 0x6f, 0x6d, 0x20, 0x62, 0x61, 0x67, 0x20, 0x73, 0x69, 0x67,
 132   0x6e, 0x65, 0x72, 0x30, 0x81, 0x9f, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86,
 133   0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x81, 0x8d,
 134   0x00, 0x30, 0x81, 0x89, 0x02, 0x81, 0x81, 0x00, 0xb5, 0x4d, 0xea, 0xa2,
 135   0xfa, 0x13, 0x1d, 0x80, 0x3d, 0xe5, 0x9d, 0x2b, 0x2f, 0x92, 0xe9, 0xff,
 136   0x51, 0x2c, 0xef, 0x09, 0x15, 0x12, 0x72, 0x48, 0x12, 0x87, 0xa9, 0xe4,
 137   0x8e, 0x4a, 0x37, 0x46, 0x47, 0xa1, 0xe4, 0x72, 0xb1, 0xba, 0x8f, 0xd5,
 138   0xd2, 0x26, 0x8c, 0x1b, 0xf2, 0x0e, 0x36, 0xb0, 0x71, 0xa0, 0x2a, 0x23,
 139   0xb6, 0x3b, 0x27, 0x36, 0x8d, 0x1d, 0xa9, 0xc0, 0xba, 0x82, 0xcc, 0x7d,
 140   0x97, 0xbe, 0xa5, 0x49, 0x08, 0x26, 0x84, 0x7e, 0x99, 0x55, 0x05, 0x75,
 141   0xc8, 0x9c, 0xd0, 0xa2, 0x1b, 0x9b, 0x86, 0x82, 0xd8, 0x51, 0xd1, 0xf9,
 142   0x37, 0xee, 0xac, 0x8a, 0xe3, 0x59, 0xc5, 0xcf, 0x22, 0x5e, 0x95, 0x20,
 143   0x47, 0x48, 0x85, 0x67, 0xb2, 0xe7, 0x9c, 0x8a, 0xc3, 0x01, 0xbe, 0xf1,
 144   0x27, 0x41, 0x4f, 0x70, 0x21, 0x11, 0xff, 0x09, 0x5a, 0x08, 0x14, 0x0b,
 145   0xed, 0xdd, 0x81, 0x13, 0x02, 0x03, 0x01, 0x00, 0x01, 0xa3, 0x76, 0x30,
 146   0x74, 0x30, 0x16, 0x06, 0x03, 0x55, 0x1d, 0x25, 0x01, 0x01, 0xff, 0x04,
 147   0x0c, 0x30, 0x0a, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x03,
 148   0x03, 0x30, 0x1a, 0x06, 0x03, 0x55, 0x1d, 0x20, 0x01, 0x01, 0xff, 0x04,
 149   0x10, 0x30, 0x0e, 0x30, 0x0c, 0x06, 0x0a, 0x2a, 0x86, 0x48, 0x86, 0xf7,
 150   0x63, 0x64, 0x05, 0x05, 0x01, 0x30, 0x1d, 0x06, 0x03, 0x55, 0x1d, 0x0e,
 151   0x04, 0x16, 0x04, 0x14, 0x30, 0x0f, 0xe5, 0x40, 0x51, 0xc8, 0x26, 0x61,
 152   0x3a, 0xba, 0xa1, 0xd0, 0xc0, 0x61, 0x84, 0x97, 0xa6, 0x46, 0xbd, 0x50,
 153   0x30, 0x1f, 0x06, 0x03, 0x55, 0x1d, 0x23, 0x04, 0x18, 0x30, 0x16, 0x80,
 154   0x14, 0x78, 0x2f, 0x9f, 0x48, 0x53, 0x25, 0xe3, 0x8c, 0x2f, 0xaf, 0x1d,
 155   0x21, 0x86, 0xdc, 0xb0, 0x50, 0x93, 0xa9, 0x24, 0xc2, 0x30, 0x0d, 0x06,
 156   0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x05, 0x05, 0x00,
 157   0x03, 0x82, 0x01, 0x01, 0x00, 0x60, 0x72, 0x78, 0xf5, 0x1e, 0x3f, 0x30,
 158   0x7c, 0x3a, 0xf5, 0xd6, 0xe2, 0x01, 0x62, 0x3b, 0x0e, 0x5d, 0xa1, 0xbb,
 159   0x77, 0xb1, 0x68, 0x53, 0xdb, 0x9b, 0x43, 0x5e, 0x82, 0xd4, 0xd7, 0xb7,
 160   0x72, 0xa1, 0x24, 0xce, 0x9e, 0x16, 0x3e, 0x91, 0xc7, 0xb0, 0x56, 0xd0,
 161   0xe2, 0xd7, 0x86, 0x04, 0x46, 0x15, 0x87, 0xf8, 0xd1, 0x3c, 0x0c, 0xd7,
 162   0xdf, 0x6f, 0xbb, 0x58, 0xc0, 0xf2, 0xde, 0x38, 0x0e, 0x20, 0xcc, 0x2b,
 163   0x3a, 0x64, 0xee, 0x5c, 0x59, 0x15, 0x05, 0x57, 0x8b, 0x8c, 0xf8, 0x19,
 164   0xc0, 0x1d, 0x0f, 0x8d, 0x11, 0xf9, 0x77, 0xc4, 0x90, 0x2b, 0x63, 0x1c,
 165   0x5c, 0x36, 0x36, 0x2d, 0x99, 0xa6, 0x4c, 0x0f, 0xad, 0x85, 0xab, 0x26,
 166   0x38, 0x19, 0x86, 0xf8, 0x1b, 0xd1, 0x4a, 0x1e, 0xcf, 0x0e, 0x91, 0x5a,
 167   0x26, 0x8d, 0x91, 0xc7, 0x2f, 0x5c, 0x53, 0x0e, 0x0c, 0x2b, 0xf9, 0xd0,
 168   0x03, 0xf3, 0x0b, 0xb8, 0x85, 0x67, 0x8b, 0xfc, 0x56, 0x1f, 0x6e, 0x2b,
 169   0xa0, 0x20, 0x81, 0xe6, 0xd6, 0xc7, 0x1b, 0x68, 0xf6, 0x7a, 0xdb, 0x27,
 170   0x95, 0x0d, 0xfd, 0x03, 0xd0, 0x1c, 0x95, 0x31, 0x8f, 0x9d, 0x26, 0xe1,
 171   0x30, 0xf1, 0xf5, 0x6f, 0xe2, 0xb6, 0x4a, 0x3c, 0x43, 0xfd, 0x02, 0xd1,
 172   0x86, 0x1e, 0x70, 0x71, 0xeb, 0xeb, 0x76, 0x6e, 0xb2, 0x17, 0x10, 0x9e,
 173   0x78, 0x83, 0xb9, 0xff, 0x39, 0xa1, 0xeb, 0xf3, 0x63, 0xd6, 0x21, 0xeb,
 174   0x6e, 0x27, 0xee, 0x79, 0x02, 0x44, 0x8f, 0xd2, 0x3c, 0x3f, 0x81, 0x74,
 175   0x4a, 0x8a, 0xb7, 0x6d, 0x6a, 0x5c, 0x4f, 0x90, 0x58, 0x4b, 0x79, 0xdd,
 176   0x80, 0xe3, 0xa6, 0x05, 0xe7, 0x65, 0xd8, 0x6d, 0xb6, 0xe0, 0x6c, 0xdc,
 177   0xad, 0xc5, 0x61, 0x16, 0x0b, 0xb6, 0x9e, 0x1e, 0x89, 0x43, 0x3e, 0x93,
 178   0x8d, 0x1b, 0x8a, 0x42, 0xa0, 0x00, 0xa8, 0x60, 0x61, 0x31, 0x82, 0x01,
 179   0xa3, 0x30, 0x82, 0x01, 0x9f, 0x02, 0x01, 0x01, 0x30, 0x49, 0x30, 0x44,
 180   0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13, 0x02, 0x55,
 181   0x53, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x0a, 0x13, 0x0a,
 182   0x41, 0x70, 0x70, 0x6c, 0x65, 0x20, 0x49, 0x6e, 0x63, 0x2e, 0x31, 0x20,
 183   0x30, 0x1e, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x17, 0x43, 0x6f, 0x6e,
 184   0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x20, 0x41,
 185   0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x74, 0x79, 0x02, 0x01, 0x01, 0x30,
 186   0x09, 0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x1a, 0x05, 0x00, 0xa0, 0x81,
 187   0xb1, 0x30, 0x18, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
 188   0x09, 0x03, 0x31, 0x0b, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
 189   0x01, 0x07, 0x01, 0x30, 0x1c, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
 190   0x0d, 0x01, 0x09, 0x05, 0x31, 0x0f, 0x17, 0x0d, 0x31, 0x30, 0x30, 0x39,
 191   0x32, 0x39, 0x32, 0x33, 0x33, 0x34, 0x33, 0x39, 0x5a, 0x30, 0x23, 0x06,
 192   0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x04, 0x31, 0x16,
 193   0x04, 0x14, 0x85, 0x54, 0x26, 0x06, 0x8e, 0xe8, 0x93, 0x9d, 0xf6, 0xbc,
 194   0xe2, 0xc2, 0xc4, 0xb1, 0xe7, 0x34, 0x65, 0x32, 0xa1, 0x33, 0x30, 0x52,
 195   0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x09, 0x0f, 0x31,
 196   0x45, 0x30, 0x43, 0x30, 0x0a, 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7,
 197   0x0d, 0x03, 0x07, 0x30, 0x0e, 0x06, 0x08, 0x2a, 0x86, 0x48, 0x86, 0xf7,
 198   0x0d, 0x03, 0x02, 0x02, 0x02, 0x00, 0x80, 0x30, 0x0d, 0x06, 0x08, 0x2a,
 199   0x86, 0x48, 0x86, 0xf7, 0x0d, 0x03, 0x02, 0x02, 0x01, 0x40, 0x30, 0x07,
 200   0x06, 0x05, 0x2b, 0x0e, 0x03, 0x02, 0x07, 0x30, 0x0d, 0x06, 0x08, 0x2a,
 201   0x86, 0x48, 0x86, 0xf7, 0x0d, 0x03, 0x02, 0x02, 0x01, 0x28, 0x30, 0x0d,
 202   0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05,
 203   0x00, 0x04, 0x81, 0x80, 0x5a, 0xc8, 0x72, 0x37, 0xe4, 0x7a, 0xdd, 0xde,
 204   0x47, 0x6e, 0x27, 0x4c, 0x73, 0x70, 0x27, 0x01, 0xf3, 0x2c, 0x52, 0x1f,
 205   0xa2, 0xa5, 0xbd, 0xd4, 0x6b, 0x6e, 0x44, 0x1a, 0xfc, 0x43, 0x55, 0xbc,
 206   0xe5, 0x9a, 0xdb, 0x06, 0x1c, 0x67, 0x49, 0xb7, 0x06, 0x45, 0x98, 0xd8,
 207   0x72, 0xc3, 0xc9, 0x6e, 0x47, 0xc8, 0x29, 0x33, 0xbd, 0x05, 0x2c, 0x9f,
 208   0x74, 0x13, 0x2f, 0x57, 0x30, 0x86, 0x07, 0x08, 0xfd, 0xea, 0x38, 0x7f,
 209   0xec, 0xcd, 0x47, 0x64, 0xfb, 0xea, 0x60, 0x6e, 0xea, 0xc6, 0xd4, 0x57,
 210   0x46, 0xe3, 0x71, 0xc3, 0xa4, 0xfc, 0x7a, 0x2c, 0xed, 0x6b, 0xe7, 0x7f,
 211   0x4c, 0xe7, 0x24, 0x8f, 0x9c, 0xd9, 0x9a, 0xa7, 0xdc, 0xf1, 0xc8, 0x20,
 212   0x59, 0xd1, 0x1d, 0x26, 0xb9, 0xd3, 0x19, 0x21, 0x68, 0x86, 0x76, 0x6e,
 213   0xb8, 0xd8, 0x42, 0x31, 0x2a, 0x32, 0x8d, 0x8b, 0x66, 0xce, 0x65, 0x2c
 214 };
 215 unsigned int signed_urlbag_len = 1260;
 216
 217 static void tests(void)
 218 {
 219     CFDataRef message = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, signed_urlbag, signed_urlbag_len, kCFAllocatorNull);
 220     CFMutableDataRef munged_message = CFDataCreateMutableCopy(kCFAllocatorDefault, 0, message);
 221     is(*(CFDataGetMutableBytePtr(munged_message) + 59), '\015', "modifying right byte");
 222     *(CFDataGetMutableBytePtr(munged_message) + 59) = '\012';
 223
 224     SecPolicyRef policy = NULL;
 225     SecTrustRef trust = NULL;
 226     SecTrustResultType result;
 227     CFDataRef root_ca_data = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, root_ca, sizeof(root_ca), kCFAllocatorNull);
 228     SecCertificateRef anchor = SecCertificateCreateWithData(kCFAllocatorDefault, root_ca_data);
 229     CFArrayRef anchors = CFArrayCreate(kCFAllocatorDefault, (const void **)&anchor, 1, &kCFTypeArrayCallBacks);
 230     CFRelease(anchor);
 231     CFReleaseNull(root_ca_data);
 232
 233     policy = SecPolicyCreateURLBag();
 234     ok_status(SecCMSVerifySignedData(message, NULL, policy, &trust, NULL, NULL, NULL), "validate message");
 235
 236     SecTrustSetAnchorCertificates(trust, anchors);
 237     ok_status(SecTrustEvaluate(trust, &result), "evaluate trust");
 238     ok(result == kSecTrustResultUnspecified, "private root");
 239
 240     CFReleaseNull(trust);
 241
 242     is_status(errSecAuthFailed, SecCMSVerifySignedData(munged_message, NULL, policy, &trust, NULL, NULL, NULL), "validate message");
 243
 244     CFReleaseNull(trust);
 245
 246     CFReleaseNull(policy);
 247     CFReleaseNull(anchors);
 248     CFReleaseNull(message);
 249     CFReleaseNull(munged_message);
 250 }
 251
 252 int si_65_cms_cert_policy(int argc, char *const *argv)
 253 {
 254         plan_tests(5);
 255
 256         tests();
 257
 258         return 0;
 259 }
 260
 261
 262
 263 /*
 264
 265 # This is a shell archive.  Save it in a file, remove anything before
 266 # this line, and then unpack it by entering "sh file".  Note, it may
 267 # create directories; files and directories will be owned by you and
 268 # have default permissions.
 269 #
 270 # This archive contains:
 271 #
 272 #       Makefile
 273 #       extensions.txt
 274 #
 275 echo x - Makefile
 276 sed 's/^X//' >Makefile << 'END-of-Makefile'
 277 X
 278 Xall:
 279 X       @echo "No default action"
 280 X
 281 XCA-key.pem:
 282 X       @openssl genrsa -out CA-key.pem 2048
 283 X
 284 XCA-csr.pem: CA-key.pem
 285 X       @openssl req -new -key CA-key.pem -sha1 -days 3650 -subj "/C=US/O=Apple Inc./CN=Configuration Authority" -nodes -out CA-csr.pem
 286 X
 287 XCA-cert.pem: CA-csr.pem CA-key.pem
 288 X       @openssl x509 -req -sha1 -in CA-csr.pem -signkey CA-key.pem -set_serial 0 -out CA-cert.pem -extensions authority -extfile extensions.txt
 289 X
 290 Xleaf-cert.pem: CA-cert.pem CA-key.pem
 291 X       @openssl req -newkey rsa:1024 -sha1 -days 3650 -subj "/C=US/O=Apple Inc./CN=configuration.apple.com bag signer" -nodes -out leaf-csr.pem -keyout leaf-key.pem
 292 X       @openssl x509 -req -sha1 -in leaf-csr.pem -CA CA-cert.pem -CAkey CA-key.pem -out leaf-cert.pem -set_serial 1 -extfile extensions.txt -extensions leaf
 293 X
 294 Xcheck: CA-cert.pem leaf-cert.pem
 295 X       @echo Validate leaf
 296 X       @openssl verify -CAfile CA-cert.pem leaf-cert.pem
 297 X       @echo Output SHA-1 for private root
 298 X       @openssl x509 -in CA-cert.pem -outform DER | openssl dgst -binary -sha1 | xxd -i
 299 X       @echo Display leaf
 300 X       @openssl x509 -noout -text -in leaf-cert.pem
 301 X
 302 Xsigned-urlbag: CA-cert.pem leaf-cert.pem content
 303 X       @cat leaf-cert.pem leaf-key.pem > leaf.pem
 304 X       @openssl smime -sign -aes128 -outform der -nodetach -signer leaf.pem -CAfile CA-cert.pem -in content -out signed-urlbag
 305 X
 306 Xclean:
 307 X       @rm -f leaf-cert.pem leaf-csr.pem leaf-key.pem leaf.pem signed-urlbag
 308 X
 309 Xreal-clean:
 310 X       @rm -f CA-key.pem CA-csr.pem CA-cert.pem leaf-cert.pem leaf-csr.pem leaf-key.pem leaf.pem signed-urlbag
 311 END-of-Makefile
 312 echo x - extensions.txt
 313 sed 's/^X//' >extensions.txt << 'END-of-extensions.txt'
 314 X[authority]
 315 XbasicConstraints=critical,CA:true,pathlen:0
 316 XsubjectKeyIdentifier=hash
 317 XauthorityKeyIdentifier=keyid
 318 X
 319 X[leaf]
 320 XextendedKeyUsage=critical,codeSigning
 321 XcertificatePolicies=critical,1.2.840.113635.100.5.5.1
 322 XsubjectKeyIdentifier=hash
 323 XauthorityKeyIdentifier=keyid
 324 X
 325 X[req]
 326 Xdistinguished_name     = req_distinguished_name
 327 X
 328 X[req_distinguished_name]
 329 END-of-extensions.txt
 330 exit
 331
 332 */