OSX/sec/Security/SecPolicyPriv.h

   1 /*
   2  * Copyright (c) 2007-2015 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*!
  25     @header SecPolicyPriv
  26     The functions provided in SecPolicyPriv provide an interface to various
  27         X.509 certificate trust policies.
  28 */
  29
  30 #ifndef _SECURITY_SECPOLICYPRIV_H_
  31 #define _SECURITY_SECPOLICYPRIV_H_
  32
  33 #include <Security/SecPolicy.h>
  34 #include <Security/SecCertificate.h>
  35 #include <CoreFoundation/CFArray.h>
  36 #include <CoreFoundation/CFString.h>
  37 #include <Availability.h>
  38
  39 __BEGIN_DECLS
  40
  41 /*!
  42         @enum Policy Constants (Private)
  43         @discussion Predefined constants used to specify a policy.
  44         @constant kSecPolicyApplePassbookSigning
  45         @constant kSecPolicyAppleMobileStore
  46         @constant kSecPolicyAppleTestMobileStore
  47         @constant kSecPolicyAppleEscrowService
  48         @constant kSecPolicyAppleProfileSigner
  49         @constant kSecPolicyAppleQAProfileSigner
  50         @constant kSecPolicyAppleServerAuthentication
  51         @constant kSecPolicyAppleOTAPKISigner
  52         @constant kSecPolicyAppleTestOTAPKISigner
  53         @constant kSecPolicyAppleIDValidationRecordSigning
  54         @constant kSecPolicyAppleSMPEncryption
  55         @constant kSecPolicyAppleTestSMPEncryption
  56         @constant kSecPolicyApplePCSEscrowService
  57         @constant kSecPolicyAppleSWUpdateSigning
  58         @constant kSecPolicyApplePackageSigning
  59         @constant kSecPolicyAppleATVAppSigning
  60         @constant kSecPolicyAppleTestATVAppSigning
  61         @constant kSecPolicyAppleOSXProvisioningProfileSigning
  62 */
  63 extern const CFStringRef kSecPolicyApplePassbookSigning
  64     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
  65 extern const CFStringRef kSecPolicyAppleMobileStore
  66     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
  67 extern const CFStringRef kSecPolicyAppleTestMobileStore
  68     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
  69 extern const CFStringRef kSecPolicyAppleEscrowService
  70     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
  71 extern const CFStringRef kSecPolicyAppleProfileSigner
  72     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
  73 extern const CFStringRef kSecPolicyAppleQAProfileSigner
  74     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
  75 extern const CFStringRef kSecPolicyAppleServerAuthentication
  76     __OSX_AVAILABLE_STARTING(__MAC_10_10, __IPHONE_8_0);
  77 #if TARGET_OS_IPHONE
  78 extern const CFStringRef kSecPolicyAppleOTAPKISigner
  79     __OSX_AVAILABLE_STARTING(__MAC_NA, __IPHONE_7_0);
  80 extern const CFStringRef kSecPolicyAppleTestOTAPKISigner
  81     __OSX_AVAILABLE_STARTING(__MAC_NA, __IPHONE_7_0);
  82 extern const CFStringRef kSecPolicyAppleIDValidationRecordSigningPolicy
  83     __OSX_AVAILABLE_STARTING(__MAC_NA, __IPHONE_7_0);
  84 extern const CFStringRef kSecPolicyAppleSMPEncryption
  85     __OSX_AVAILABLE_STARTING(__MAC_NA, __IPHONE_8_0);
  86 extern const CFStringRef kSecPolicyAppleTestSMPEncryption
  87     __OSX_AVAILABLE_STARTING(__MAC_NA, __IPHONE_8_0);
  88 #endif
  89 extern const CFStringRef kSecPolicyApplePCSEscrowService
  90     __OSX_AVAILABLE_STARTING(__MAC_10_10, __IPHONE_7_0);
  91 extern const CFStringRef kSecPolicyAppleSWUpdateSigning
  92     __OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);
  93 extern const CFStringRef kSecPolicyApplePackageSigning
  94     __OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);
  95 extern const CFStringRef kSecPolicyAppleATVAppSigning
  96     __OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);
  97 extern const CFStringRef kSecPolicyAppleTestATVAppSigning
  98     __OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);
  99 extern const CFStringRef kSecPolicyAppleOSXProvisioningProfileSigning
 100     __OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);
 101 extern const CFStringRef kSecPolicyAppleAST2DiagnosticsServerAuth
 102     __OSX_AVAILABLE_STARTING(__MAC_10_11_4, __IPHONE_9_3);
 103
 104
 105 /*!
 106     @enum Policy Value Constants
 107     @abstract Predefined property key constants used to get or set values in
 108         a dictionary for a policy instance.
 109     @constant kSecPolicyTeamIdentifier Specifies a CFStringRef containing a
 110         team identifier which must be matched in the certificate to satisfy
 111         this policy. For the Passbook signing policy, this string must match
 112         the Organizational Unit field of the certificate subject.
 113 */
 114 extern const CFStringRef kSecPolicyTeamIdentifier
 115     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
 116
 117 /*!
 118     @function SecPolicyCreateiPhoneActivation
 119     @abstract Returns a policy object for verifying iPhone Activation
 120     certificate chains.
 121     @discussion This policy is like the Basic X.509 policy with the additional
 122     requirements that the chain must contain exactly three certificates, the
 123     anchor is the Apple Inc. CA, and the subject of the first intermediate
 124     certificate has "Apple iPhone Certification Authority" as its only
 125     Common Name entry.
 126     @result A policy object. The caller is responsible for calling CFRelease
 127         on this when it is no longer needed.
 128 */
 129 SecPolicyRef SecPolicyCreateiPhoneActivation(void);
 130
 131 /*!
 132     @function SecPolicyCreateiPhoneDeviceCertificate
 133     @abstract Returns a policy object for verifying iPhone Device certificate
 134     chains.
 135     @discussion This policy is like the Basic X.509 policy with the additional
 136     requirements that the chain must contain exactly four certificates, the
 137     anchor is the Apple Inc. CA, and the subject of the first intermediate
 138     certificate has "Apple iPhone Device CA" as its only Common Name entry.
 139     @result A policy object. The caller is responsible for calling CFRelease
 140         on this when it is no longer needed.
 141 */
 142 SecPolicyRef SecPolicyCreateiPhoneDeviceCertificate(void);
 143
 144 /*!
 145     @function SecPolicyCreateFactoryDeviceCertificate
 146     @abstract Returns a policy object for verifying Factory Device certificate
 147     chains.
 148     @discussion This policy is like the Basic X.509 policy with the additional
 149     requirements that the chain must be anchored to the factory device certificate
 150     issuer.
 151     @result A policy object. The caller is responsible for calling CFRelease
 152         on this when it is no longer needed.
 153 */
 154 SecPolicyRef SecPolicyCreateFactoryDeviceCertificate(void);
 155
 156 /*!
 157     @function SecPolicyCreateiAP
 158     @abstract Returns a policy object for verifying iAP certificate chains.
 159     @discussion This policy is like the Basic X.509 policy with these
 160         additional requirements:
 161          * The leaf's NotValidBefore should be greater than 5/31/06 midnight GMT.
 162          * The Common Name of the leaf begins with the characters "IPA_".
 163          * No validity checking is performed for any of the certificates.
 164         The intended use of this policy is that the caller pass in the
 165         intermediates for iAP1 and iAP2 to SecTrustSetAnchorCertificates().
 166     @result A policy object. The caller is responsible for calling CFRelease
 167         on this when it is no longer needed.
 168 */
 169 SecPolicyRef SecPolicyCreateiAP(void);
 170
 171 /*!
 172     @function SecPolicyCreateiTunesStoreURLBag
 173     @abstract Returns a policy object for verifying iTunes Store URL bag
 174     certificates.
 175     @discussion This policy is like the Basic X.509 policy with these
 176         additional requirements:
 177          * The leaf's Organization is Apple Inc.
 178          * The Common Name of the leaf is "iTunes Store URL Bag".
 179     @result A policy object. The caller is responsible for calling CFRelease
 180         on this when it is no longer needed.
 181 */
 182 SecPolicyRef SecPolicyCreateiTunesStoreURLBag(void);
 183
 184 /*!
 185     @function SecPolicyCreateEAP
 186     @abstract Returns a policy object for verifying for 802.1x/EAP certificates.
 187         @param server Passing true for this parameter create a policy for EAP
 188         server certificates.
 189         @param trustedServerNames Optional; if present, the hostname in the leaf
 190     certificate must be in the trustedServerNames list.  Note that contrary
 191     to all other policies the trustedServerNames list entries can have wildcards
 192     whilst the certificate cannot.  This matches the existing deployments.
 193     @result A policy object. The caller is responsible for calling CFRelease
 194         on this when it is no longer needed.
 195 */
 196 SecPolicyRef SecPolicyCreateEAP(Boolean server, CFArrayRef trustedServerNames);
 197
 198 /*!
 199     @function SecPolicyCreateIPSec
 200     @abstract Returns a policy object for evaluating IPSec certificate chains.
 201         @param server Passing true for this parameter create a policy for IPSec
 202         server certificates.
 203         @param hostname Optional; if present, the policy will require the specified
 204         hostname or ip address to match the hostname in the leaf certificate.
 205     @result A policy object. The caller is responsible for calling CFRelease
 206         on this when it is no longer needed.
 207 */
 208 SecPolicyRef SecPolicyCreateIPSec(Boolean server, CFStringRef hostname);
 209
 210 /*!
 211         @function SecPolicyCreateAppleSWUpdateSigning
 212         @abstract Returned a policy object for evaluating SW update signing certs.
 213         @result A policy object. The caller is responsible for calling CFRelease
 214         on this when it is no longer needed.
 215 */
 216 SecPolicyRef SecPolicyCreateAppleSWUpdateSigning(void);
 217
 218 /*!
 219         @function SecPolicyCreateApplePackageSigning
 220         @abstract Returned a policy object for evaluating installer package signing certs.
 221         @result A policy object. The caller is responsible for calling CFRelease
 222         on this when it is no longer needed.
 223 */
 224 SecPolicyRef SecPolicyCreateApplePackageSigning(void);
 225
 226 /*!
 227     @function SecPolicyCreateiPhoneApplicationSigning
 228     @abstract Returns a policy object for evaluating signed application
 229     signatures.  This is for apps signed directly by the app store.
 230     @result A policy object. The caller is responsible for calling CFRelease
 231         on this when it is no longer needed.
 232 */
 233 SecPolicyRef SecPolicyCreateiPhoneApplicationSigning(void);
 234
 235 /*!
 236     @function SecPolicyCreateiPhoneProfileApplicationSigning
 237     @abstract Returns a policy object for evaluating signed application
 238     signatures.  This is meant for certificates inside a UPP or regular
 239     profile.  Currently it only checks for experation of the leaf and
 240     revocation status.
 241     @result A policy object. The caller is responsible for calling CFRelease
 242         on this when it is no longer needed.
 243 */
 244 SecPolicyRef SecPolicyCreateiPhoneProfileApplicationSigning(void);
 245
 246 /*!
 247     @function SecPolicyCreateiPhoneProvisioningProfileSigning
 248     @abstract Returns a policy object for evaluating provisioning profile signatures.
 249     @result A policy object. The caller is responsible for calling CFRelease
 250         on this when it is no longer needed.
 251 */
 252 SecPolicyRef SecPolicyCreateiPhoneProvisioningProfileSigning(void);
 253
 254 /*!
 255     @function SecPolicyCreateAppleTVOSApplicationSigning
 256     @abstract Returns a policy object for evaluating signed application
 257     signatures.  This is for apps signed directly by the Apple TV app store,
 258     and allows for both the prod and the dev/test certs.
 259     @result A policy object. The caller is responsible for calling CFRelease
 260         on this when it is no longer needed.
 261 */
 262 SecPolicyRef SecPolicyCreateAppleTVOSApplicationSigning(void);
 263
 264 /*!
 265     @function SecPolicyCreateOCSPSigner
 266     @abstract Returns a policy object for evaluating ocsp response signers.
 267     @result A policy object. The caller is responsible for calling CFRelease
 268         on this when it is no longer needed.
 269 */
 270 SecPolicyRef SecPolicyCreateOCSPSigner(void);
 271
 272
 273 enum {
 274     kSecSignSMIMEUsage = (1 << 0),
 275     kSecKeyEncryptSMIMEUsage = (1 << 1),
 276     kSecDataEncryptSMIMEUsage = (1 << 2),
 277     kSecKeyExchangeDecryptSMIMEUsage = (1 << 3),
 278     kSecKeyExchangeEncryptSMIMEUsage = (1 << 4),
 279     kSecKeyExchangeBothSMIMEUsage = (1 << 5),
 280     kSecAnyEncryptSMIME = kSecKeyEncryptSMIMEUsage | kSecDataEncryptSMIMEUsage |
 281         kSecKeyExchangeDecryptSMIMEUsage | kSecKeyExchangeEncryptSMIMEUsage
 282 };
 283
 284 /*!
 285     @function SecPolicyCreateSMIME
 286     @abstract Returns a policy object for evaluating S/MIME certificate chains.
 287         @param smimeUsage Pass the bitwise or of one or more kSecXXXSMIMEUsage
 288     flags, to indicated the intended usage of this certificate.  A certificate which allows
 289         @param email Optional; if present, the policy will require the specified
 290         email to match the email in the leaf certificate.
 291     @result A policy object. The caller is responsible for calling CFRelease
 292         on this when it is no longer needed.
 293 */
 294 SecPolicyRef SecPolicyCreateSMIME(CFIndex smimeUsage, CFStringRef email);
 295
 296 /*!
 297     @function SecPolicyCreateCodeSigning
 298     @abstract Returns a policy object for evaluating code signing certificate chains.
 299     @result A policy object. The caller is responsible for calling CFRelease
 300         on this when it is no longer needed.
 301 */
 302 SecPolicyRef SecPolicyCreateCodeSigning(void);
 303
 304 /*!
 305     @function SecPolicyCreateLockdownPairing
 306     @abstract basic x509 policy for checking lockdown pairing certificate chains.
 307         It explicitly allows for empty subjects
 308 */
 309 SecPolicyRef SecPolicyCreateLockdownPairing(void);
 310
 311 /*!
 312  @function SecPolicyCreateURLBag
 313  @abstract check for private CA, eku codesigning and certificate policy that
 314  pertains to signing of URL bags.
 315  */
 316 SecPolicyRef SecPolicyCreateURLBag(void);
 317
 318 /*!
 319  @function SecPolicyCreateOTATasking
 320  @abstract check for 3 long chain through Apple Certification Policy with common name
 321            "OTA Task Signing".
 322  */
 323 SecPolicyRef SecPolicyCreateOTATasking(void);
 324
 325 /*!
 326  @function SecPolicyCreateMobileAsset
 327  @abstract check for 3 long chain through Apple Certification Policy with common name
 328            "Asset Manifest Signing".
 329  */
 330 SecPolicyRef SecPolicyCreateMobileAsset(void);
 331
 332 /*!
 333  @function SecPolicyCreateAppleIDAuthorityPolicy
 334  @abstract check for an Apple ID identity per marker in the leaf and marker in the intermediate, rooted in the Apple CA.
 335  */
 336 SecPolicyRef SecPolicyCreateAppleIDAuthorityPolicy(void);
 337
 338 /*!
 339  @function SecPolicyCreateMacAppStoreReceipt
 340  @abstract check for valid Mac App Store receipt signing certificate chain
 341  */
 342 SecPolicyRef SecPolicyCreateMacAppStoreReceipt(void);
 343
 344 /*!
 345  @function SecPolicyCreatePassbookCardSigner
 346  @abstract check rooted in the Apple CA, eku passbook, marker passbook and name matching
 347  @param cardIssuer Required; must match name in marker extension.
 348  @param teamIdentifier Optional; if present, the policy will require the specified
 349  team ID to match the organizationalUnit field in the leaf certificate's subject.
 350  @result A policy object. The caller is responsible for calling CFRelease
 351         on this when it is no longer needed.
 352  */
 353 SecPolicyRef SecPolicyCreatePassbookCardSigner(CFStringRef cardIssuer,
 354         CFStringRef teamIdentifier);
 355
 356 /*!
 357  @function SecPolicyCreateMobileStoreSigner
 358  @abstract Check for key usage of digital signature,
 359         check for 3 long chain through Apple System Integration 2 Certification Authority
 360         with a certificate policy OID of 1.2.840.113635.100.5.12 that roots to the
 361         Apple root
 362  */
 363 SecPolicyRef SecPolicyCreateMobileStoreSigner(void);
 364
 365 /*!
 366  @function SecPolicyCreateTestMobileStoreSigner
 367  @abstract Check for key usage of digital signature,
 368         check for 3 long chain through Apple System Integration 2 Certification Authority
 369         with a certificate policy OID of 1.2.840.113635.100.5.12.1 that roots to the
 370         Apple root
 371  */
 372 SecPolicyRef SecPolicyCreateTestMobileStoreSigner(void);
 373
 374 /*!
 375  @function SecPolicyCreateEscrowServiceSigner
 376  @abstract Check for key usage of digital signature, has a leaf marker OID of
 377          1.2.840.113635.100.6.23.1 and roots to the production Escrow Root
 378  */
 379 SecPolicyRef SecPolicyCreateEscrowServiceSigner(void);
 380
 381 /*!
 382  @function SecPolicyCreatePCSEscrowServiceSigner
 383  @abstract Check for key usage of digital signature, has a leaf marker OID of
 384          1.2.840.113635.100.6.23.1 and roots to the production PCS Escrow Root
 385  */
 386 SecPolicyRef SecPolicyCreatePCSEscrowServiceSigner(void);
 387
 388 /*!
 389  @function SecPolicyCopyEscrowRootCertificate
 390  @abstract Return back the Root certificate for the Escrow service
 391 */
 392 SecCertificateRef SecPolicyCopyEscrowRootCertificate(void);
 393
 394 /*!
 395  @function SecPolicyCreateOSXProvisioningProfileSigning
 396  @abstract Check for leaf marker OID 1.2.840.113635.100.4.11,
 397          intermediate marker OID 1.2.840.113635.100.6.2.1,
 398          chains to Apple Root CA
 399 */
 400 SecPolicyRef SecPolicyCreateOSXProvisioningProfileSigning(void);
 401
 402 /*!
 403  @function SecPolicyCreateConfigurationProfileSigner
 404  @abstract Check for key usage of digital signature, has a EKU OID of
 405      1.2.840.113635.100.4.16 and
 406     roots to Apple Application Integration 2 Certification Authority
 407 */
 408 SecPolicyRef SecPolicyCreateConfigurationProfileSigner(void);
 409
 410 /*!
 411  @function SecPolicyCreateQAConfigurationProfileSigner
 412  @abstract Check for key usage of digital signature, has a EKU OID of
 413     1.2.840.113635.100.4.17 and
 414     roots to Apple Application Integration 2 Certification Authority
 415 */
 416 SecPolicyRef SecPolicyCreateQAConfigurationProfileSigner(void);
 417
 418 /*!
 419  @function SecPolicyCreateOTAPKISigner
 420  @abstract Check for key usage of digital signature, and
 421     roots to Apple PKI Settings Root Certification Authority
 422 */
 423 SecPolicyRef SecPolicyCreateOTAPKISigner(void);
 424
 425 /*!
 426  @function SecPolicyCreateTestOTAPKISigner
 427  @abstract Check for key usage of digital signature, and
 428     roots to Apple PKI Settings Root - TESTING
 429 */
 430 SecPolicyRef SecPolicyCreateTestOTAPKISigner(void);
 431
 432 /*!
 433  @function SecPolicyCreateAppleIDValidationRecordSigningPolicy
 434  @abstract Check for leaf certificate contains the
 435         appleIDValidationRecordSigning (1 2 840 113635 100 6 25), and
 436         intermediate certificate contains
 437         appleCertificateExtensionApplicationIntegrationIntermediate
 438         (1 2 840 113635 100 6 2 3) and
 439         appleCertificateExtensionSystemIntegration2Intermediate
 440         (1 2 840 113635 100 6 2 10) and roots to the Apple root
 441 */
 442 SecPolicyRef SecPolicyCreateAppleIDValidationRecordSigningPolicy(void);
 443
 444 /*!
 445  @function SecPolicyCreateAppleSMPEncryption
 446  @abstract Check for intermediate certificate 'Apple System Integration CA - ECC' by name,
 447     and root certificate 'Apple Root CA - ECC' by hash.
 448     Leaf cert must have Key Encipherment usage. Other checks TBD.
 449  */
 450 SecPolicyRef SecPolicyCreateAppleSMPEncryption(void);
 451
 452 /*!
 453  @function SecPolicyCreateTestAppleSMPEncryption
 454  @abstract Check for intermediate certificate 'Test Apple System Integration CA - ECC' by name,
 455     and root certificate 'Test Apple Root CA - ECC' by hash.
 456     Leaf cert must have Key Encipherment usage. Other checks TBD.
 457  */
 458 SecPolicyRef SecPolicyCreateTestAppleSMPEncryption(void);
 459
 460 /*!
 461  @function SecPolicyCreateApplePPQSigning
 462  @abstract Check for intermediate certificate 'Apple System Integration 2 Certification Authority' by name,
 463  and apple anchor.
 464  Leaf cert must have Digital Signature usage.
 465  Leaf cert must have Apple PPQ Signing marker OID (1.2.840.113635.100.6.38.2).
 466  Intermediate must have marker OID (1.2.840.113635.100.6.2.10).
 467  */
 468 SecPolicyRef SecPolicyCreateApplePPQSigning(void);
 469
 470 /*!
 471  @function SecPolicyCreateTestApplePPQSigning
 472  @abstract Check for intermediate certificate 'Apple System Integration 2 Certification Authority' by name,
 473  and apple anchor.
 474  Leaf cert must have Digital Signature usage.
 475  Leaf cert must have Apple PPQ Signing Test marker OID (1.2.840.113635.100.6.38.1).
 476  Intermediate must have marker OID (1.2.840.113635.100.6.2.10).
 477  */
 478 SecPolicyRef SecPolicyCreateTestApplePPQSigning(void);
 479
 480 /*!
 481  @function SecPolicyCreateAppleIDSService
 482  @abstract Ensure we're appropriately pinned to the IDS service (SSL + Apple restrictions)
 483  */
 484 SecPolicyRef SecPolicyCreateAppleIDSService(CFStringRef hostname);
 485
 486 /*!
 487  @function SecPolicyCreateAppleIDSServiceContext
 488  @abstract Ensure we're appropriately pinned to the IDS service (SSL + Apple restrictions)
 489  */
 490 SecPolicyRef SecPolicyCreateAppleIDSServiceContext(CFStringRef hostname, CFDictionaryRef context);
 491
 492 /*!
 493  @function SecPolicyCreateApplePushService
 494  @abstract Ensure we're appropriately pinned to the Push service (SSL + Apple restrictions)
 495  */
 496 SecPolicyRef SecPolicyCreateApplePushService(CFStringRef hostname, CFDictionaryRef context);
 497
 498 /*!
 499  @function SecPolicyCreateApplePushServiceLegacy
 500  @abstract Ensure we're appropriately pinned to the Push service (via Entrust)
 501  */
 502 SecPolicyRef SecPolicyCreateApplePushServiceLegacy(CFStringRef hostname);
 503
 504 /*!
 505  @function SecPolicyCreateAppleMMCSService
 506  @abstract Ensure we're appropriately pinned to the MMCS service (SSL + Apple restrictions)
 507  */
 508 SecPolicyRef SecPolicyCreateAppleMMCSService(CFStringRef hostname, CFDictionaryRef context);
 509
 510 /*!
 511  @function SecPolicyCreateAppleGSService
 512  @abstract Ensure we're appropriately pinned to the GS service (SSL + Apple restrictions)
 513  */
 514 SecPolicyRef SecPolicyCreateAppleGSService(CFStringRef hostname, CFDictionaryRef context)
 515     __OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);
 516
 517 /*!
 518  @function SecPolicyCreateApplePPQService
 519  @abstract Ensure we're appropriately pinned to the PPQ service (SSL + Apple restrictions)
 520  */
 521 SecPolicyRef SecPolicyCreateApplePPQService(CFStringRef hostname, CFDictionaryRef context)
 522     __OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);
 523
 524 /*!
 525  @function SecPolicyCreateAppleAST2Service
 526  @abstract Ensure we're appropriately pinned to the AST2 Diagnostic service (SSL + Apple restrictions)
 527  */
 528 SecPolicyRef SecPolicyCreateAppleAST2Service(CFStringRef hostname, CFDictionaryRef context)
 529     __OSX_AVAILABLE_STARTING(__MAC_10_11_4, __IPHONE_9_3);
 530
 531 /*!
 532  @function SecPolicyCreateAppleSSLService
 533  @abstract Ensure we're appropriately pinned to an Apple server (SSL + Apple restrictions)
 534  */
 535 SecPolicyRef SecPolicyCreateAppleSSLService(CFStringRef hostname);
 536
 537 /*!
 538  @function SecPolicyCreateAppleTimeStamping
 539  @abstract Check for RFC3161 timestamping EKU.
 540  */
 541 SecPolicyRef SecPolicyCreateAppleTimeStamping(void);
 542
 543 /*!
 544  @function SecPolicyCreateAppleATVAppSigning
 545  @abstract Check for intermediate certificate 'Apple Worldwide Developer Relations Certification Authority' by name,
 546  and apple anchor.
 547  Leaf cert must have Digital Signature usage.
 548  Leaf cert must have Apple ATV App Signing marker OID (1.2.840.113635.100.6.1.24).
 549  Leaf cert must have 'Apple TVOS Application Signing' common name.
 550  */
 551 SecPolicyRef SecPolicyCreateAppleATVAppSigning(void)
 552     __OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);
 553
 554 /*!
 555  @function SecPolicyCreateTestAppleATVAppSigning
 556  @abstract Check for intermediate certificate 'Apple Worldwide Developer Relations Certification Authority' by name,
 557  and apple anchor.
 558  Leaf cert must have Digital Signature usage.
 559  Leaf cert must have Apple ATV App Signing Test marker OID (1.2.840.113635.100.6.1.24.1).
 560  Leaf cert must have 'TEST Apple TVOS Application Signing TEST' common name.
 561  */
 562 SecPolicyRef SecPolicyCreateTestAppleATVAppSigning(void)
 563     __OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);
 564
 565
 566 /*!
 567  @function SecPolicyCreateApplePayIssuerEncryption
 568  @abstract Check for intermediate certificate 'Apple Worldwide Developer Relations CA - G2' by name,
 569  and apple anchor.
 570  Leaf cert must have Key Encipherment and Key Agreement usage.
 571  Leaf cert must have Apple Pay Issuer Encryption marker OID (1.2.840.113635.100.6.39).
 572  */
 573 SecPolicyRef SecPolicyCreateApplePayIssuerEncryption(void)
 574     __OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);
 575
 576
 577 /*!
 578  @function SecPolicyCreateAppleATVVPNProfileSigning
 579  @abstract Check for leaf marker OID 1.2.840.113635.100.6.43,
 580  intermediate marker OID 1.2.840.113635.100.6.2.10,
 581  chains to Apple Root CA, path length 3
 582  */
 583 SecPolicyRef SecPolicyCreateAppleATVVPNProfileSigning(void)
 584 __OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);
 585
 586 /*!
 587  @function SecPolicyCreateAppleHomeKitServerAuth
 588  @abstract Ensure we're appropriately pinned to the HomeKit service (SSL + Apple restrictions)
 589  @param hostname Required; hostname to verify the certificate name against.
 590  @discussion This policy uses the Basic X.509 policy with validity check
 591  and pinning options:
 592  * The chain is anchored to any of the production Apple Root CAs via full certificate
 593  comparison. Test Apple Root CAs are permitted only on internal releases with defaults write.
 594  * The intermediate has a marker extension with OID 1.2.840.113635.100.6.2.16
 595  * The leaf has a marker extension with OID 1.2.840.113635.100.6.27.9.
 596  * The leaf has the provided hostname in the DNSName of the SubjectAlternativeName
 597  extension or Common Name.
 598  * The leaf is checked against the Black and Gray lists.
 599  * The leaf has ExtendedKeyUsage with the ServerAuth OID.
 600  * Revocation is checked via CRL.
 601  @result A policy object. The caller is responsible for calling CFRelease
 602  on this when it is no longer needed.
 603  */
 604 SecPolicyRef SecPolicyCreateAppleHomeKitServerAuth(CFStringRef hostname)
 605 __OSX_AVAILABLE_STARTING(__MAC_10_11_4, __IPHONE_9_3);
 606
 607 __END_DECLS
 608
 609 #endif /* !_SECURITY_SECPOLICYPRIV_H_ */