]> git.saurik.com Git - apple/security.git/blob - OSX/libsecurity_keychain/lib/TrustAdditions.cpp
Security-57337.20.44.tar.gz
[apple/security.git] / OSX / libsecurity_keychain / lib / TrustAdditions.cpp
1 /*
2 * Copyright (c) 2002-2009,2011-2014 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24 //
25 // TrustAdditions.cpp
26 //
27 #include "TrustAdditions.h"
28 #include "TrustKeychains.h"
29 #include "SecBridge.h"
30 #include <security_keychain/SecCFTypes.h>
31 #include <security_keychain/Globals.h>
32 #include <security_keychain/Certificate.h>
33 #include <security_keychain/Item.h>
34 #include <security_keychain/KCCursor.h>
35 #include <security_keychain/KCUtilities.h>
36
37 #include <sys/stat.h>
38 #include <sys/file.h>
39 #include <sys/unistd.h>
40 #include <string>
41 #include <AvailabilityMacros.h>
42 #include <CoreFoundation/CoreFoundation.h>
43 #include <CommonCrypto/CommonDigest.h>
44 #include <Security/SecBase.h>
45 #include <Security/Security.h>
46 #include <Security/SecCertificatePriv.h>
47 #include <Security/cssmtype.h>
48 #include <Security/cssmapplePriv.h> // for CSSM_APPLE_TP_OCSP_OPTIONS, CSSM_APPLE_TP_OCSP_OPT_FLAGS
49
50 #include "SecTrustPriv.h"
51 #include "SecTrustSettings.h"
52 #include "SecTrustSettingsPriv.h"
53
54 //
55 // Macros
56 //
57 #define BEGIN_SECAPI_INTERNAL_CALL \
58 try {
59 #define END_SECAPI_INTERNAL_CALL \
60 } /* status is only set on error */ \
61 catch (const MacOSError &err) { status=err.osStatus(); } \
62 catch (const CommonError &err) { status=SecKeychainErrFromOSStatus(err.osStatus()); } \
63 catch (const std::bad_alloc &) { status=errSecAllocate; } \
64 catch (...) { status=errSecInternalComponent; }
65
66 #ifdef NDEBUG
67 /* this actually compiles to nothing */
68 #define trustDebug(args...) secdebug("trust", ## args)
69 #else
70 #define trustDebug(args...) printf(args)
71 #endif
72
73 //
74 // Static constants
75 //
76 static const char *EV_ROOTS_PLIST_SYSTEM_PATH = "/System/Library/Keychains/EVRoots.plist";
77 static const char *SYSTEM_ROOTS_PLIST_SYSTEM_PATH = "/System/Library/Keychains/SystemRootCertificates.keychain";
78 static const char *X509ANCHORS_SYSTEM_PATH = "/System/Library/Keychains/X509Anchors";
79
80 //
81 // Static functions
82 //
83 static CFArrayRef _allowedRootCertificatesForOidString(CFStringRef oidString);
84 static CSSM_DATA_PTR _copyFieldDataForOid(CSSM_OID_PTR oid, CSSM_DATA_PTR cert, CSSM_CL_HANDLE clHandle);
85 static CFStringRef _decimalStringForOid(CSSM_OID_PTR oid);
86 static CFDictionaryRef _evCAOidDict();
87 static void _freeFieldData(CSSM_DATA_PTR value, CSSM_OID_PTR oid, CSSM_CL_HANDLE clHandle);
88 static CFStringRef _oidStringForCertificatePolicies(const CE_CertPolicies *certPolicies);
89 static SecCertificateRef _rootCertificateWithSubjectOfCertificate(SecCertificateRef certificate);
90 static SecCertificateRef _rootCertificateWithSubjectKeyIDOfCertificate(SecCertificateRef certificate);
91
92 // utility function to safely release (and clear) the given CFTypeRef variable.
93 //
94 static void SafeCFRelease(void *cfTypeRefPtr)
95 {
96 CFTypeRef *obj = (CFTypeRef *)cfTypeRefPtr;
97 if (obj && *obj) {
98 CFRelease(*obj);
99 *obj = NULL;
100 }
101 }
102
103 // utility function to create a CFDataRef from the contents of the specified file;
104 // caller must release
105 //
106 static CFDataRef dataWithContentsOfFile(const char *fileName)
107 {
108 int rtn;
109 int fd;
110 struct stat sb;
111 size_t fileSize;
112 UInt8 *fileData = NULL;
113 CFDataRef outCFData = NULL;
114
115 fd = open(fileName, O_RDONLY, 0);
116 if(fd < 0)
117 return NULL;
118
119 rtn = fstat(fd, &sb);
120 if(rtn)
121 goto errOut;
122
123 fileSize = (size_t)sb.st_size;
124 fileData = (UInt8 *) malloc(fileSize);
125 if(fileData == NULL)
126 goto errOut;
127
128 rtn = (int)lseek(fd, 0, SEEK_SET);
129 if(rtn < 0)
130 goto errOut;
131
132 rtn = (int)read(fd, fileData, fileSize);
133 if(rtn != (int)fileSize) {
134 rtn = EIO;
135 } else {
136 rtn = 0;
137 outCFData = CFDataCreate(NULL, fileData, fileSize);
138 }
139 errOut:
140 close(fd);
141 if (fileData) {
142 free(fileData);
143 }
144 return outCFData;
145 }
146
147 // returns a SecKeychainRef for the system root certificate store; caller must release
148 //
149 static SecKeychainRef systemRootStore()
150 {
151 SecKeychainStatus keychainStatus = 0;
152 SecKeychainRef systemRoots = NULL;
153 OSStatus status = errSecSuccess;
154 // note: Sec* APIs are not re-entrant due to the API lock
155 // status = SecKeychainOpen(SYSTEM_ROOTS_PLIST_SYSTEM_PATH, &systemRoots);
156 BEGIN_SECAPI_INTERNAL_CALL
157 systemRoots=globals().storageManager.make(SYSTEM_ROOTS_PLIST_SYSTEM_PATH, false)->handle();
158 END_SECAPI_INTERNAL_CALL
159
160 // SecKeychainOpen will return errSecSuccess even if the file didn't exist on disk.
161 // We need to do a further check using SecKeychainGetStatus().
162 if (!status && systemRoots) {
163 // note: Sec* APIs are not re-entrant due to the API lock
164 // status = SecKeychainGetStatus(systemRoots, &keychainStatus);
165 BEGIN_SECAPI_INTERNAL_CALL
166 keychainStatus=(SecKeychainStatus)Keychain::optional(systemRoots)->status();
167 END_SECAPI_INTERNAL_CALL
168 }
169 if (status || !systemRoots) {
170 // SystemRootCertificates.keychain can't be opened; look in X509Anchors instead.
171 SafeCFRelease(&systemRoots);
172 // note: Sec* APIs are not re-entrant due to the API lock
173 // status = SecKeychainOpen(X509ANCHORS_SYSTEM_PATH, &systemRoots);
174 BEGIN_SECAPI_INTERNAL_CALL
175 systemRoots=globals().storageManager.make(X509ANCHORS_SYSTEM_PATH, false)->handle();
176 END_SECAPI_INTERNAL_CALL
177 // SecKeychainOpen will return errSecSuccess even if the file didn't exist on disk.
178 // We need to do a further check using SecKeychainGetStatus().
179 if (!status && systemRoots) {
180 // note: Sec* APIs are not re-entrant due to the API lock
181 // status = SecKeychainGetStatus(systemRoots, &keychainStatus);
182 BEGIN_SECAPI_INTERNAL_CALL
183 keychainStatus=(SecKeychainStatus)Keychain::optional(systemRoots)->status();
184 END_SECAPI_INTERNAL_CALL
185 }
186 }
187 if (status || !systemRoots) {
188 // Cannot get root certificates if there is no trusted system root certificate store.
189 SafeCFRelease(&systemRoots);
190 return NULL;
191 }
192 return systemRoots;
193 }
194
195 // returns a CFDictionaryRef created from the specified XML plist file; caller must release
196 //
197 static CFDictionaryRef dictionaryWithContentsOfPlistFile(const char *fileName)
198 {
199 CFDictionaryRef resultDict = NULL;
200 CFDataRef fileData = dataWithContentsOfFile(fileName);
201 if (fileData) {
202 CFPropertyListRef xmlPlist = CFPropertyListCreateFromXMLData(NULL, fileData, kCFPropertyListImmutable, NULL);
203 if (xmlPlist && CFGetTypeID(xmlPlist) == CFDictionaryGetTypeID()) {
204 resultDict = (CFDictionaryRef)xmlPlist;
205 } else {
206 SafeCFRelease(&xmlPlist);
207 }
208 SafeCFRelease(&fileData);
209 }
210 return resultDict;
211 }
212
213 // returns the Organization component of the given certificate's subject name,
214 // or nil if that component could not be found. Caller must release the string.
215 //
216 static CFStringRef organizationNameForCertificate(SecCertificateRef certificate)
217 {
218 CFStringRef organizationName = nil;
219 OSStatus status = errSecSuccess;
220
221 #if MAC_OS_X_VERSION_MAX_ALLOWED > MAC_OS_X_VERSION_10_4
222 CSSM_OID_PTR oidPtr = (CSSM_OID_PTR) &CSSMOID_OrganizationName;
223 // note: Sec* APIs are not re-entrant due to the API lock
224 // status = SecCertificateCopySubjectComponent(certificate, oidPtr, &organizationName);
225 BEGIN_SECAPI_INTERNAL_CALL
226 organizationName = Certificate::required(certificate)->distinguishedName(&CSSMOID_X509V1SubjectNameCStruct, oidPtr);
227 END_SECAPI_INTERNAL_CALL
228 if (status) {
229 return (CFStringRef)NULL;
230 }
231 #else
232 // SecCertificateCopySubjectComponent() doesn't exist on Tiger, so we have
233 // to go get the CSSMOID_OrganizationName the hard way, ourselves.
234 CSSM_DATA_PTR *fieldValues = NULL;
235 // note: Sec* APIs are not re-entrant due to the API lock
236 // status = SecCertificateCopyFieldValues(certificate, &CSSMOID_X509V1SubjectNameCStruct, &fieldValues);
237 BEGIN_SECAPI_INTERNAL_CALL
238 fieldValues = Certificate::required(certificate)->copyFieldValues(&CSSMOID_X509V1SubjectNameCStruct);
239 END_SECAPI_INTERNAL_CALL
240 if (*fieldValues == NULL) {
241 return (CFStringRef)NULL;
242 }
243 if (status || (*fieldValues)->Length == 0 || (*fieldValues)->Data == NULL) {
244 // note: Sec* APIs are not re-entrant due to the API lock
245 // status = SecCertificateReleaseFieldValues(certificate, &CSSMOID_X509V1SubjectNameCStruct, fieldValues);
246 BEGIN_SECAPI_INTERNAL_CALL
247 Certificate::required(certificate)->releaseFieldValues(&CSSMOID_X509V1SubjectNameCStruct, fieldValues);
248 END_SECAPI_INTERNAL_CALL
249 return (CFStringRef)NULL;
250 }
251
252 CSSM_X509_NAME_PTR x509Name = (CSSM_X509_NAME_PTR)(*fieldValues)->Data;
253
254 // Iterate over all the relative distinguished name (RDN) entries...
255 unsigned rdnIndex = 0;
256 bool foundIt = FALSE;
257 for (rdnIndex = 0; rdnIndex < x509Name->numberOfRDNs; rdnIndex++) {
258 CSSM_X509_RDN *rdnPtr = x509Name->RelativeDistinguishedName + rdnIndex;
259
260 // And then iterate over the attribute-value pairs of each RDN, looking for a CSSMOID_OrganizationName.
261 unsigned pairIndex;
262 for (pairIndex = 0; pairIndex < rdnPtr->numberOfPairs; pairIndex++) {
263 CSSM_X509_TYPE_VALUE_PAIR *pair = rdnPtr->AttributeTypeAndValue + pairIndex;
264
265 // If this pair isn't the organization name, move on to check the next one.
266 if (!oidsAreEqual(&pair->type, &CSSMOID_OrganizationName))
267 continue;
268
269 // We've found the organization name. Convert value to a string (eg, "Apple Inc.")
270 // Note: there can be more than one organization name in any given CSSM_X509_RDN.
271 // In practice, it's OK to use the first one. In future, if we have a means for
272 // displaying more than one name, this would be where they should be collected
273 // into an array.
274 switch (pair->valueType) {
275 case BER_TAG_PKIX_UTF8_STRING:
276 case BER_TAG_PKIX_UNIVERSAL_STRING:
277 case BER_TAG_GENERAL_STRING:
278 organizationName = CFStringCreateWithBytes(NULL, pair->value.Data, pair->value.Length, kCFStringEncodingUTF8, FALSE);
279 break;
280 case BER_TAG_PRINTABLE_STRING:
281 case BER_TAG_IA5_STRING:
282 organizationName = CFStringCreateWithBytes(NULL, pair->value.Data, pair->value.Length, kCFStringEncodingASCII, FALSE);
283 break;
284 case BER_TAG_T61_STRING:
285 case BER_TAG_VIDEOTEX_STRING:
286 case BER_TAG_ISO646_STRING:
287 organizationName = CFStringCreateWithBytes(NULL, pair->value.Data, pair->value.Length, kCFStringEncodingUTF8, FALSE);
288 // If the data cannot be represented as a UTF-8 string, fall back to ISO Latin 1
289 if (!organizationName) {
290 organizationName = CFStringCreateWithBytes(NULL, pair->value.Data, pair->value.Length, kCFStringEncodingISOLatin1, FALSE);
291 }
292 break;
293 case BER_TAG_PKIX_BMP_STRING:
294 organizationName = CFStringCreateWithBytes(NULL, pair->value.Data, pair->value.Length, kCFStringEncodingUnicode, FALSE);
295 break;
296 default:
297 break;
298 }
299
300 // If we found the organization name, there's no need to keep looping.
301 if (organizationName) {
302 foundIt = TRUE;
303 break;
304 }
305 }
306 if (foundIt)
307 break;
308 }
309 // note: Sec* APIs are not re-entrant due to the API lock
310 // status = SecCertificateReleaseFieldValues(certificate, &CSSMOID_X509V1SubjectNameCStruct, fieldValues);
311 BEGIN_SECAPI_INTERNAL_CALL
312 Certificate::required(certificate)->releaseFieldValues(&CSSMOID_X509V1SubjectNameCStruct, fieldValues);
313 END_SECAPI_INTERNAL_CALL
314 #endif
315 return organizationName;
316 }
317
318 #if !defined(NDEBUG)
319 void showCertSKID(const void *value, void *context);
320 #endif
321
322 static ModuleNexus<Mutex> gPotentialEVChainWithCertificatesMutex;
323
324 // returns a CFArrayRef of SecCertificateRef instances; caller must release the returned array
325 //
326 CFArrayRef potentialEVChainWithCertificates(CFArrayRef certificates)
327 {
328 StLock<Mutex> _(gPotentialEVChainWithCertificatesMutex());
329
330 // Given a partial certificate chain (which may or may not include the root,
331 // and does not have a guaranteed order except the first item is the leaf),
332 // examine intermediate certificates to see if they are cross-certified (i.e.
333 // have the same subject and public key as a trusted root); if so, remove the
334 // intermediate from the returned certificate array.
335
336 CFIndex chainIndex, chainLen = (certificates) ? CFArrayGetCount(certificates) : 0;
337 secdebug("trusteval", "potentialEVChainWithCertificates: chainLen: %ld", chainLen);
338 if (chainLen < 2) {
339 if (certificates) {
340 CFRetain(certificates);
341 }
342 return certificates;
343 }
344
345 CFMutableArrayRef certArray = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
346 for (chainIndex = 0; chainIndex < chainLen; chainIndex++) {
347 SecCertificateRef aCert = (SecCertificateRef) CFArrayGetValueAtIndex(certificates, chainIndex);
348 SecCertificateRef replacementCert = NULL;
349 secdebug("trusteval", "potentialEVChainWithCertificates: examining chainIndex: %ld", chainIndex);
350 if (chainIndex > 0) {
351 // if this is not the leaf, then look for a possible replacement root to end the chain
352 // Try lookup using Subject Key ID first
353 replacementCert = _rootCertificateWithSubjectKeyIDOfCertificate(aCert);
354 if (!replacementCert)
355 {
356 secdebug("trusteval", " not found using SKID, try by subject");
357 replacementCert = _rootCertificateWithSubjectOfCertificate(aCert);
358 }
359 }
360 if (!replacementCert) {
361 secdebug("trusteval", " No replacement found using SKID or subject; keeping original intermediate");
362 CFArrayAppendValue(certArray, aCert);
363 }
364 SafeCFRelease(&replacementCert);
365 }
366 secdebug("trusteval", "potentialEVChainWithCertificates: exit: new chainLen: %ld", CFArrayGetCount(certArray));
367 #if !defined(NDEBUG)
368 CFArrayApplyFunction(certArray, CFRangeMake(0, CFArrayGetCount(certArray)), showCertSKID, NULL);
369 #endif
370
371 return certArray;
372 }
373
374 // returns a reference to a root certificate, if one can be found in the
375 // system root store whose subject name and public key are identical to
376 // that of the provided certificate, otherwise returns nil.
377 //
378 static SecCertificateRef _rootCertificateWithSubjectOfCertificate(SecCertificateRef certificate)
379 {
380 if (!certificate)
381 return NULL;
382
383 StLock<Mutex> _(SecTrustKeychainsGetMutex());
384
385 // get data+length for the provided certificate
386 CSSM_CL_HANDLE clHandle = 0;
387 CSSM_DATA certData = { 0, NULL };
388 OSStatus status = errSecSuccess;
389 // note: Sec* APIs are not re-entrant due to the API lock
390 // status = SecCertificateGetCLHandle(certificate, &clHandle);
391 BEGIN_SECAPI_INTERNAL_CALL
392 clHandle = Certificate::required(certificate)->clHandle();
393 END_SECAPI_INTERNAL_CALL
394 if (status)
395 return NULL;
396 // note: Sec* APIs are not re-entrant due to the API lock
397 // status = SecCertificateGetData(certificate, &certData);
398 BEGIN_SECAPI_INTERNAL_CALL
399 certData = Certificate::required(certificate)->data();
400 END_SECAPI_INTERNAL_CALL
401 if (status)
402 return NULL;
403
404 // get system roots keychain reference
405 SecKeychainRef systemRoots = systemRootStore();
406 if (!systemRoots)
407 return NULL;
408
409 // copy (normalized) subject for the provided certificate
410 const CSSM_OID_PTR oidPtr = (const CSSM_OID_PTR) &CSSMOID_X509V1SubjectName;
411 const CSSM_DATA_PTR subjectDataPtr = _copyFieldDataForOid(oidPtr, &certData, clHandle);
412 if (!subjectDataPtr)
413 return NULL;
414
415 // copy public key for the provided certificate
416 SecKeyRef keyRef = NULL;
417 SecCertificateRef resultCert = NULL;
418 // note: Sec* APIs are not re-entrant due to the API lock
419 // status = SecCertificateCopyPublicKey(certificate, &keyRef);
420 BEGIN_SECAPI_INTERNAL_CALL
421 keyRef = Certificate::required(certificate)->publicKey()->handle();
422 END_SECAPI_INTERNAL_CALL
423 if (!status) {
424 const CSSM_KEY *cssmKey = NULL;
425 // note: Sec* APIs are not re-entrant due to the API lock
426 // status = SecKeyGetCSSMKey(keyRef, &cssmKey);
427 BEGIN_SECAPI_INTERNAL_CALL
428 cssmKey = KeyItem::required(keyRef)->key();
429 END_SECAPI_INTERNAL_CALL
430 if (!status) {
431 // get SHA-1 hash of the public key
432 uint8 buf[CC_SHA1_DIGEST_LENGTH];
433 CSSM_DATA digest = { sizeof(buf), buf };
434 if (!cssmKey || !cssmKey->KeyData.Data || !cssmKey->KeyData.Length) {
435 status = errSecParam;
436 } else {
437 CC_SHA1(cssmKey->KeyData.Data, (CC_LONG)cssmKey->KeyData.Length, buf);
438 }
439 if (!status) {
440 // set up attribute vector (each attribute consists of {tag, length, pointer})
441 // we want to match on the public key hash and the normalized subject name
442 // as well as ensure that the issuer matches the subject
443 SecKeychainAttribute attrs[] = {
444 { kSecPublicKeyHashItemAttr, (UInt32)digest.Length, (void *)digest.Data },
445 { kSecSubjectItemAttr, (UInt32)subjectDataPtr->Length, (void *)subjectDataPtr->Data },
446 { kSecIssuerItemAttr, (UInt32)subjectDataPtr->Length, (void *)subjectDataPtr->Data }
447 };
448 const SecKeychainAttributeList attributes = { sizeof(attrs) / sizeof(attrs[0]), attrs };
449 SecKeychainSearchRef searchRef = NULL;
450 // note: Sec* APIs are not re-entrant due to the API lock
451 // status = SecKeychainSearchCreateFromAttributes(systemRoots, kSecCertificateItemClass, &attributes, &searchRef);
452 BEGIN_SECAPI_INTERNAL_CALL
453 StorageManager::KeychainList keychains;
454 globals().storageManager.optionalSearchList(systemRoots, keychains);
455 KCCursor cursor(keychains, kSecCertificateItemClass, &attributes);
456 searchRef = cursor->handle();
457 END_SECAPI_INTERNAL_CALL
458 if (!status && searchRef) {
459 SecKeychainItemRef certRef = nil;
460 // note: Sec* APIs are not re-entrant due to the API lock
461 // status = SecKeychainSearchCopyNext(searchRef, &certRef); // only need the first one that matches
462 BEGIN_SECAPI_INTERNAL_CALL
463 Item item;
464 if (!KCCursorImpl::required(searchRef)->next(item)) {
465 status=errSecItemNotFound;
466 } else {
467 certRef=item->handle();
468 }
469 END_SECAPI_INTERNAL_CALL
470 if (!status)
471 resultCert = (SecCertificateRef)certRef; // caller must release
472 SafeCFRelease(&searchRef);
473 }
474 }
475 }
476 }
477 _freeFieldData(subjectDataPtr, oidPtr, clHandle);
478 SafeCFRelease(&keyRef);
479 SafeCFRelease(&systemRoots);
480
481 return resultCert;
482 }
483
484
485 #if !defined(NDEBUG)
486 static void logSKID(const char *msg, const CssmData &subjectKeyID)
487 {
488 const unsigned char *px = (const unsigned char *)subjectKeyID.data();
489 char buffer[256]={0,};
490 char bytes[16];
491 if (px && msg)
492 {
493 strcpy(buffer, msg);
494 for (unsigned int ix=0; ix<20; ix++)
495 {
496 sprintf(bytes, "%02X", px[ix]);
497 strcat(buffer, bytes);
498 }
499 secdebug("trusteval", " SKID: %s",buffer);
500 }
501 }
502
503 void showCertSKID(const void *value, void *context)
504 {
505 SecCertificateRef certificate = (SecCertificateRef)value;
506 OSStatus status = errSecSuccess;
507 BEGIN_SECAPI_INTERNAL_CALL
508 const CssmData &subjectKeyID = Certificate::required(certificate)->subjectKeyIdentifier();
509 logSKID("subjectKeyID: ", subjectKeyID);
510 END_SECAPI_INTERNAL_CALL
511 }
512 #endif
513
514 // returns a reference to a root certificate, if one can be found in the
515 // system root store whose subject key ID are identical to
516 // that of the provided certificate, otherwise returns nil.
517 //
518 static SecCertificateRef _rootCertificateWithSubjectKeyIDOfCertificate(SecCertificateRef certificate)
519 {
520 SecCertificateRef resultCert = NULL;
521 OSStatus status = errSecSuccess;
522
523 if (!certificate)
524 return NULL;
525
526 StLock<Mutex> _(SecTrustKeychainsGetMutex());
527
528 // get system roots keychain reference
529 SecKeychainRef systemRoots = systemRootStore();
530 if (!systemRoots)
531 return NULL;
532
533 StorageManager::KeychainList keychains;
534 globals().storageManager.optionalSearchList(systemRoots, keychains);
535
536 BEGIN_SECAPI_INTERNAL_CALL
537 const CssmData &subjectKeyID = Certificate::required(certificate)->subjectKeyIdentifier();
538 #if !defined(NDEBUG)
539 logSKID("search for SKID: ", subjectKeyID);
540 #endif
541 // caller must release
542 resultCert = Certificate::required(certificate)->findBySubjectKeyID(keychains, subjectKeyID)->handle();
543 #if !defined(NDEBUG)
544 logSKID(" found SKID: ", subjectKeyID);
545 #endif
546 END_SECAPI_INTERNAL_CALL
547
548 SafeCFRelease(&systemRoots);
549
550 return resultCert;
551 }
552
553 // returns an array of possible root certificates (SecCertificateRef instances)
554 // for the given EV OID (a hex string); caller must release the array
555 //
556 static
557 CFArrayRef _possibleRootCertificatesForOidString(CFStringRef oidString)
558 {
559 StLock<Mutex> _(SecTrustKeychainsGetMutex());
560
561 if (!oidString)
562 return NULL;
563 CFDictionaryRef evOidDict = _evCAOidDict();
564 if (!evOidDict)
565 return NULL;
566 CFArrayRef possibleCertificateHashes = (CFArrayRef) CFDictionaryGetValue(evOidDict, oidString);
567 SecKeychainRef systemRoots = systemRootStore();
568 if (!possibleCertificateHashes || !systemRoots) {
569 SafeCFRelease(&evOidDict);
570 return NULL;
571 }
572
573 CFMutableArrayRef possibleRootCertificates = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
574 CFIndex hashCount = CFArrayGetCount(possibleCertificateHashes);
575 secdebug("evTrust", "_possibleRootCertificatesForOidString: %d possible hashes", (int)hashCount);
576
577 OSStatus status = errSecSuccess;
578 SecKeychainSearchRef searchRef = NULL;
579 // note: Sec* APIs are not re-entrant due to the API lock
580 // status = SecKeychainSearchCreateFromAttributes(systemRoots, kSecCertificateItemClass, NULL, &searchRef);
581 BEGIN_SECAPI_INTERNAL_CALL
582 StorageManager::KeychainList keychains;
583 globals().storageManager.optionalSearchList(systemRoots, keychains);
584 KCCursor cursor(keychains, kSecCertificateItemClass, NULL);
585 searchRef = cursor->handle();
586 END_SECAPI_INTERNAL_CALL
587 if (searchRef) {
588 while (!status) {
589 SecKeychainItemRef certRef = NULL;
590 // note: Sec* APIs are not re-entrant due to the API lock
591 // status = SecKeychainSearchCopyNext(searchRef, &certRef);
592 BEGIN_SECAPI_INTERNAL_CALL
593 Item item;
594 if (!KCCursorImpl::required(searchRef)->next(item)) {
595 certRef=NULL;
596 status=errSecItemNotFound;
597 } else {
598 certRef=item->handle();
599 }
600 END_SECAPI_INTERNAL_CALL
601 if (status || !certRef) {
602 break;
603 }
604
605 CSSM_DATA certData = { 0, NULL };
606 // note: Sec* APIs are not re-entrant due to the API lock
607 // status = SecCertificateGetData((SecCertificateRef) certRef, &certData);
608 BEGIN_SECAPI_INTERNAL_CALL
609 certData = Certificate::required((SecCertificateRef)certRef)->data();
610 END_SECAPI_INTERNAL_CALL
611 if (!status) {
612 uint8 buf[CC_SHA1_DIGEST_LENGTH];
613 CSSM_DATA digest = { sizeof(buf), buf };
614 if (!certData.Data || !certData.Length) {
615 status = errSecParam;
616 } else {
617 CC_SHA1(certData.Data, (CC_LONG)certData.Length, buf);
618 }
619 if (!status) {
620 CFDataRef hashData = CFDataCreateWithBytesNoCopy(NULL, digest.Data, digest.Length, kCFAllocatorNull);
621 if (hashData && CFArrayContainsValue(possibleCertificateHashes, CFRangeMake(0, hashCount), hashData)) {
622 CFArrayAppendValue(possibleRootCertificates, certRef);
623 }
624 SafeCFRelease(&hashData);
625 }
626 }
627 SafeCFRelease(&certRef);
628 }
629 }
630 SafeCFRelease(&searchRef);
631 SafeCFRelease(&systemRoots);
632 SafeCFRelease(&evOidDict);
633
634 return possibleRootCertificates;
635 }
636
637 // returns an array of allowed root certificates (SecCertificateRef instances)
638 // for the given EV OID (a hex string); caller must release the array.
639 // This differs from _possibleRootCertificatesForOidString in that each possible
640 // certificate is further checked for trust settings, so we don't include
641 // a certificate which is untrusted (or explicitly distrusted).
642 //
643 CFArrayRef _allowedRootCertificatesForOidString(CFStringRef oidString)
644 {
645 CFMutableArrayRef allowedRootCertificates = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
646 CFArrayRef possibleRootCertificates = _possibleRootCertificatesForOidString(oidString);
647 if (possibleRootCertificates) {
648 CFIndex idx, count = CFArrayGetCount(possibleRootCertificates);
649 for (idx=0; idx<count; idx++) {
650 SecCertificateRef cert = (SecCertificateRef) CFArrayGetValueAtIndex(possibleRootCertificates, idx);
651 #if SECTRUST_OSX
652 /* Need a unified SecCertificateRef instance to hand to SecTrustSettingsCertHashStrFromCert */
653 SecCertificateRef certRef = SecCertificateCreateFromItemImplInstance(cert);
654 #else
655 SecCertificateRef certRef = (SecCertificateRef)((cert) ? CFRetain(cert) : NULL);
656 #endif
657 CFStringRef hashStr = SecTrustSettingsCertHashStrFromCert(certRef);
658 if (hashStr) {
659 bool foundMatch = false;
660 bool foundAny = false;
661 CSSM_RETURN *errors = NULL;
662 uint32 errorCount = 0;
663 SecTrustSettingsDomain foundDomain = 0;
664 SecTrustSettingsResult result = kSecTrustSettingsResultInvalid;
665 OSStatus status = SecTrustSettingsEvaluateCert(
666 hashStr, /* certHashStr */
667 NULL, /* policyOID (optional) */
668 NULL, /* policyString (optional) */
669 0, /* policyStringLen */
670 0, /* keyUsage */
671 true, /* isRootCert */
672 &foundDomain, /* foundDomain */
673 &errors, /* allowedErrors */
674 &errorCount, /* numAllowedErrors */
675 &result, /* resultType */
676 &foundMatch, /* foundMatchingEntry */
677 &foundAny); /* foundAnyEntry */
678
679 if (status == errSecSuccess) {
680 secdebug("evTrust", "_allowedRootCertificatesForOidString: cert %lu has result %d from domain %d",
681 idx, (int)result, (int)foundDomain);
682 // Root certificates must be trusted by the system (and not have
683 // any explicit trust overrides) to be allowed for EV use.
684 if (foundMatch && foundDomain == kSecTrustSettingsDomainSystem &&
685 result == kSecTrustSettingsResultTrustRoot) {
686 CFArrayAppendValue(allowedRootCertificates, cert);
687 }
688 } else {
689 secdebug("evTrust", "_allowedRootCertificatesForOidString: cert %lu SecTrustSettingsEvaluateCert error %d",
690 idx, (int)status);
691 }
692 if (errors) {
693 free(errors);
694 }
695 CFRelease(hashStr);
696 }
697 if (certRef) {
698 CFRelease(certRef);
699 }
700 }
701 CFRelease(possibleRootCertificates);
702 }
703
704 return allowedRootCertificates;
705 }
706
707 // return a CSSM_DATA_PTR containing field data; caller must release with _freeFieldData
708 //
709 static CSSM_DATA_PTR _copyFieldDataForOid(CSSM_OID_PTR oid, CSSM_DATA_PTR cert, CSSM_CL_HANDLE clHandle)
710 {
711 uint32 numFields = 0;
712 CSSM_HANDLE results = 0;
713 CSSM_DATA_PTR value = 0;
714 CSSM_RETURN crtn = CSSM_CL_CertGetFirstFieldValue(clHandle, cert, oid, &results, &numFields, &value);
715
716 // we aren't going to look for any further fields, so free the results handle immediately
717 if (results) {
718 CSSM_CL_CertAbortQuery(clHandle, results);
719 }
720
721 return (crtn || !numFields) ? NULL : value;
722 }
723
724 // Some errors are ignorable errors because they do not indicate a problem
725 // with the certificate itself, but rather a problem getting a response from
726 // the CA server. The EV Certificate spec does not mandate that the application
727 // software vendor *must* get a response from OCSP or CRL, it is a "best
728 // attempt" approach which will not fail if the server does not respond.
729 //
730 // The EV spec (26. EV Certificate Status Checking) says that CAs have to
731 // maintain either a CRL or OCSP server. They are not required to maintain
732 // an OCSP server until after Dec 31, 2010.
733 //
734 // As to the responsibility of the application software vendor to perform
735 // revocation checking, this is only covered by the following section (37.2.):
736 //
737 // This [indemnification of Application Software Vendors]
738 // shall not apply, however, to any claim, damages, or loss
739 // suffered by such Application Software Vendor related to an EV Certificate
740 // issued by the CA where such claim, damage, or loss was directly caused by
741 // such Application Software Vendor’s software displaying as not trustworthy an
742 // EV Certificate that is still valid, or displaying as trustworthy: (1) an EV
743 // Certificate that has expired, or (2) an EV Certificate that has been revoked
744 // (but only in cases where the revocation status is currently available from the
745 // CA online, and the browser software either failed to check such status or
746 // ignored an indication of revoked status).
747 //
748 // The last section describes what a browser is required to do: it must attempt
749 // to check revocation status (as indicated by the OCSP or CRL server info in
750 // the certificate), and it cannot ignore an indication of revoked status
751 // (i.e. a positive thumbs-down response from the server, which would be a
752 // different error than the ones being skipped.) However, given that we meet
753 // those requirements, if the revocation server is down or will not give us a
754 // response for whatever reason, that is not our problem.
755
756 bool isRevocationServerMetaError(CSSM_RETURN statusCode)
757 {
758 switch (statusCode) {
759 case CSSMERR_APPLETP_CRL_NOT_FOUND: // 13. CRL not found
760 case CSSMERR_APPLETP_CRL_SERVER_DOWN: // 14. CRL server down
761 case CSSMERR_APPLETP_OCSP_UNAVAILABLE: // 33. OCSP service unavailable
762 case CSSMERR_APPLETP_NETWORK_FAILURE: // 36. General network failure
763 case CSSMERR_APPLETP_OCSP_RESP_MALFORMED_REQ: // 41. OCSP responder status: malformed request
764 case CSSMERR_APPLETP_OCSP_RESP_INTERNAL_ERR: // 42. OCSP responder status: internal error
765 case CSSMERR_APPLETP_OCSP_RESP_TRY_LATER: // 43. OCSP responder status: try later
766 case CSSMERR_APPLETP_OCSP_RESP_SIG_REQUIRED: // 44. OCSP responder status: signature required
767 case CSSMERR_APPLETP_OCSP_RESP_UNAUTHORIZED: // 45. OCSP responder status: unauthorized
768 return true;
769 default:
770 return false;
771 }
772 }
773
774 // returns true if the given status code is related to performing an OCSP revocation check
775 //
776 bool isOCSPStatusCode(CSSM_RETURN statusCode)
777 {
778 switch (statusCode)
779 {
780 case CSSMERR_APPLETP_OCSP_BAD_RESPONSE: // 31. Unparseable OCSP response
781 case CSSMERR_APPLETP_OCSP_BAD_REQUEST: // 32. Unparseable OCSP request
782 case CSSMERR_APPLETP_OCSP_RESP_MALFORMED_REQ: // 41. OCSP responder status: malformed request
783 case CSSMERR_APPLETP_OCSP_UNAVAILABLE: // 33. OCSP service unavailable
784 case CSSMERR_APPLETP_OCSP_STATUS_UNRECOGNIZED: // 34. OCSP status: cert unrecognized
785 case CSSMERR_APPLETP_OCSP_NOT_TRUSTED: // 37. OCSP response not verifiable to anchor or root
786 case CSSMERR_APPLETP_OCSP_INVALID_ANCHOR_CERT: // 38. OCSP response verified to untrusted root
787 case CSSMERR_APPLETP_OCSP_SIG_ERROR: // 39. OCSP response signature error
788 case CSSMERR_APPLETP_OCSP_NO_SIGNER: // 40. No signer for OCSP response found
789 case CSSMERR_APPLETP_OCSP_RESP_INTERNAL_ERR: // 42. OCSP responder status: internal error
790 case CSSMERR_APPLETP_OCSP_RESP_TRY_LATER: // 43. OCSP responder status: try later
791 case CSSMERR_APPLETP_OCSP_RESP_SIG_REQUIRED: // 44. OCSP responder status: signature required
792 case CSSMERR_APPLETP_OCSP_RESP_UNAUTHORIZED: // 45. OCSP responder status: unauthorized
793 case CSSMERR_APPLETP_OCSP_NONCE_MISMATCH: // 46. OCSP response nonce did not match request
794 return true;
795 default:
796 return false;
797 }
798 }
799
800 // returns true if the given status code is related to performing a CRL revocation check
801 //
802 bool isCRLStatusCode(CSSM_RETURN statusCode)
803 {
804 switch (statusCode)
805 {
806 case CSSMERR_APPLETP_CRL_EXPIRED: // 11. CRL expired
807 case CSSMERR_APPLETP_CRL_NOT_VALID_YET: // 12. CRL not yet valid
808 case CSSMERR_APPLETP_CRL_NOT_FOUND: // 13. CRL not found
809 case CSSMERR_APPLETP_CRL_SERVER_DOWN: // 14. CRL server down
810 case CSSMERR_APPLETP_CRL_BAD_URI: // 15. Illegal CRL distribution point URI
811 case CSSMERR_APPLETP_CRL_NOT_TRUSTED: // 18. CRL not verifiable to anchor or root
812 case CSSMERR_APPLETP_CRL_INVALID_ANCHOR_CERT: // 19. CRL verified to untrusted root
813 case CSSMERR_APPLETP_CRL_POLICY_FAIL: // 20. CRL failed policy verification
814 return true;
815 default:
816 return false;
817 }
818 }
819
820 // returns true if the given status code is related to performing a revocation check
821 //
822 bool isRevocationStatusCode(CSSM_RETURN statusCode)
823 {
824 if (statusCode == CSSMERR_APPLETP_INCOMPLETE_REVOCATION_CHECK || // 35. Revocation check not successful for each cert
825 statusCode == CSSMERR_APPLETP_NETWORK_FAILURE || // 36. General network error
826 isOCSPStatusCode(statusCode) == true || // OCSP error
827 isCRLStatusCode(statusCode) == true) // CRL error
828 return true;
829 else
830 return false;
831 }
832
833 // returns true if the given revocation status code can be ignored.
834 //
835 bool ignorableRevocationStatusCode(CSSM_RETURN statusCode)
836 {
837 if (!isRevocationStatusCode(statusCode))
838 return false;
839
840 // if OCSP and/or CRL revocation info was unavailable for this certificate,
841 // and revocation checking is not required, we can ignore this status code.
842
843 CFStringRef ocsp_val = (CFStringRef) CFPreferencesCopyValue(kSecRevocationOcspStyle, CFSTR(kSecRevocationDomain), kCFPreferencesCurrentUser, kCFPreferencesAnyHost);
844 CFStringRef crl_val = (CFStringRef) CFPreferencesCopyValue(kSecRevocationCrlStyle, CFSTR(kSecRevocationDomain), kCFPreferencesCurrentUser, kCFPreferencesAnyHost);
845 bool ocspRequired = (ocsp_val && CFEqual(ocsp_val, kSecRevocationRequireForAll));
846 bool crlRequired = (crl_val && CFEqual(crl_val, kSecRevocationRequireForAll));
847 if (!ocspRequired && ocsp_val && CFEqual(ocsp_val, kSecRevocationRequireIfPresent))
848 ocspRequired = (statusCode != CSSMERR_APPLETP_OCSP_UNAVAILABLE);
849 if (!crlRequired && crl_val && CFEqual(crl_val, kSecRevocationRequireIfPresent))
850 crlRequired = (statusCode != CSSMERR_APPLETP_CRL_NOT_FOUND);
851 if (ocsp_val)
852 CFRelease(ocsp_val);
853 if (crl_val)
854 CFRelease(crl_val);
855
856 if (isOCSPStatusCode(statusCode))
857 return (ocspRequired) ? false : true;
858 if (isCRLStatusCode(statusCode))
859 return (crlRequired) ? false : true;
860
861 return false;
862 }
863
864 // returns a CFArrayRef of allowed root certificates for the provided leaf certificate
865 // if it passes initial EV evaluation criteria and should be subject to OCSP revocation
866 // checking; otherwise, NULL is returned. (Caller must release the result if not NULL.)
867 //
868 CFArrayRef allowedEVRootsForLeafCertificate(CFArrayRef certificates)
869 {
870 // Given a partial certificate chain (which may or may not include the root,
871 // and does not have a guaranteed order except the first item is the leaf),
872 // determine whether the leaf claims to have a supported EV policy OID.
873 //
874 // Unless this function returns NULL, a full SSL trust evaluation with OCSP revocation
875 // checking must be performed successfully for the certificate to be considered valid.
876 // This function is intended to be called before the chain has been evaluated,
877 // in order to obtain the list of allowed roots for the evaluation. Once the "regular"
878 // TP evaluation has taken place, chainMeetsExtendedValidationCriteria() should be
879 // called to complete extended validation checking.
880
881 CFIndex count = (certificates) ? CFArrayGetCount(certificates) : 0;
882 if (count < 1)
883 return NULL;
884
885 CSSM_CL_HANDLE clHandle = 0;
886 CSSM_DATA certData = { 0, NULL };
887 SecCertificateRef certRef = (SecCertificateRef) CFArrayGetValueAtIndex(certificates, 0);
888 OSStatus status = errSecSuccess;
889 // note: Sec* APIs are not re-entrant due to the API lock
890 // status = SecCertificateGetCLHandle(certRef, &clHandle);
891 BEGIN_SECAPI_INTERNAL_CALL
892 clHandle = Certificate::required(certRef)->clHandle();
893 END_SECAPI_INTERNAL_CALL
894 if (status)
895 return NULL;
896 // note: Sec* APIs are not re-entrant due to the API lock
897 // status = SecCertificateGetData(certRef, &certData);
898 BEGIN_SECAPI_INTERNAL_CALL
899 certData = Certificate::required(certRef)->data();
900 END_SECAPI_INTERNAL_CALL
901 if (status)
902 return NULL;
903
904 // Does the leaf certificate contain a Certificate Policies extension?
905 const CSSM_OID_PTR oidPtr = (CSSM_OID_PTR) &CSSMOID_CertificatePolicies;
906 CSSM_DATA_PTR extensionDataPtr = _copyFieldDataForOid(oidPtr, &certData, clHandle);
907 if (!extensionDataPtr)
908 return NULL;
909
910 // Does the extension contain one of the magic EV CA OIDs we know about?
911 CSSM_X509_EXTENSION *cssmExtension = (CSSM_X509_EXTENSION *)extensionDataPtr->Data;
912 CE_CertPolicies *certPolicies = (CE_CertPolicies *)cssmExtension->value.parsedValue;
913 CFStringRef oidString = _oidStringForCertificatePolicies(certPolicies);
914 _freeFieldData(extensionDataPtr, oidPtr, clHandle);
915
916 // Fetch the allowed root CA certificates for this OID, if any
917 CFArrayRef allowedRoots = (oidString) ? _allowedRootCertificatesForOidString(oidString) : NULL;
918 CFIndex rootCount = (allowedRoots) ? CFArrayGetCount(allowedRoots) : 0;
919 secdebug("evTrust", "allowedEVRootsForLeafCertificate: found %d allowed roots", (int)rootCount);
920 SafeCFRelease(&oidString);
921 if (!allowedRoots || !rootCount) {
922 SafeCFRelease(&allowedRoots);
923 return NULL;
924 }
925
926 // The leaf certificate needs extended validation (with revocation checking).
927 // Return the array of allowed roots for this leaf certificate.
928 return allowedRoots;
929 }
930
931 // returns true if the provided certificate contains a wildcard in either
932 // its common name or subject alternative name.
933 //
934 static
935 bool hasWildcardDNSName(SecCertificateRef certRef)
936 {
937 OSStatus status = errSecSuccess;
938 CFArrayRef dnsNames = NULL;
939
940 BEGIN_SECAPI_INTERNAL_CALL
941 Required(&dnsNames) = Certificate::required(certRef)->copyDNSNames();
942 END_SECAPI_INTERNAL_CALL
943 if (status || !dnsNames)
944 return false;
945
946 bool hasWildcard = false;
947 const CFStringRef wildcard = CFSTR("*");
948 CFIndex index, count = CFArrayGetCount(dnsNames);
949 for (index = 0; index < count; index ++) {
950 CFStringRef name = (CFStringRef) CFArrayGetValueAtIndex(dnsNames, index);
951 if (name) {
952 CFRange foundRange = CFStringFind(name, wildcard, 0);
953 if (foundRange.length != 0 && foundRange.location != kCFNotFound) {
954 hasWildcard = true;
955 break;
956 }
957 }
958 }
959 CFRelease(dnsNames);
960 return hasWildcard;
961 }
962
963 // returns a CFDictionaryRef of extended validation results for the given chain,
964 // or NULL if the certificate chain did not meet all EV criteria. (Caller must
965 // release the result if not NULL.)
966 //
967 static
968 CFDictionaryRef extendedValidationResults(CFArrayRef certChain, SecTrustResultType trustResult, OSStatus tpResult)
969 {
970 // This function is intended to be called after the "regular" TP evaluation
971 // has taken place (i.e. trustResult and tpResult are available), and there
972 // is a full certificate chain to examine.
973
974 CFIndex chainIndex, chainLen = (certChain) ? CFArrayGetCount(certChain) : 0;
975 if (chainLen < 2) {
976 return NULL; // invalid chain length
977 }
978
979 if (trustResult != kSecTrustResultUnspecified) {
980
981 // "Recoverable" means the certificate failed to meet all policy requirements, but is intrinsically OK.
982 // One of the failures we might encounter is if the OCSP responder tells us to go away. Since this is a
983 // real-world case, we'll check for OCSP and CRL meta-errors specifically.
984 bool recovered = false;
985 if (trustResult == kSecTrustResultRecoverableTrustFailure) {
986 recovered = isRevocationServerMetaError((CSSM_RETURN)tpResult);
987 }
988 if (!recovered) {
989 return NULL;
990 }
991 }
992
993 //
994 // What we know at this point:
995 //
996 // 1. From a previous call to allowedEVRootsForLeafCertificate
997 // (or we wouldn't be getting called by extendedTrustResults):
998 // - a leaf certificate exists
999 // - that certificate contains a Certificate Policies extension
1000 // - that extension contains an OID from one of the trusted EV CAs we know about
1001 // - we have found at least one allowed EV root for that OID
1002 //
1003 // 2. From the TP evaluation:
1004 // - the leaf certificate verifies back to a trusted EV root (with no trust settings overrides)
1005 // - SSL trust evaluation with OCSP revocation checking enabled returned no (fatal) errors
1006 //
1007 // We need to verify the following additional requirements for the leaf (as of EV 1.1, 6(a)(2)):
1008 // - cannot specify a wildcard in commonName or subjectAltName
1009 // (note: this is a change since EV 1.0 (9.2.1), which stated that "Wildcard FQDNs are permitted.")
1010 //
1011 // Finally, we need to check the following requirements (EV 1.1 specification, Appendix B):
1012 // - the trusted root, if created after 10/31/2006, must have:
1013 // - critical basicConstraints extension with CA bit set
1014 // - critical keyUsage extension with keyCertSign and cRLSign bits set
1015 // - intermediate certs, if present, must have:
1016 // - certificatePolicies extension, containing either a known EV CA OID, or anyPolicy
1017 // - non-critical cRLDistributionPoint extension
1018 // - critical basicConstraints extension with CA bit set
1019 // - critical keyUsage extension with keyCertSign and cRLSign bits set
1020 //
1021
1022 // check leaf certificate for wildcard names
1023 if (hasWildcardDNSName((SecCertificateRef) CFArrayGetValueAtIndex(certChain, 0))) {
1024 trustDebug("has wildcard name (does not meet EV criteria)");
1025 return NULL;
1026 }
1027
1028 // check intermediate CA certificates for required extensions per Appendix B of EV 1.1 specification.
1029 bool hasRequiredExtensions = true;
1030 CSSM_CL_HANDLE clHandle = 0;
1031 CSSM_DATA certData = { 0, NULL };
1032 CSSM_OID_PTR oidPtr = (CSSM_OID_PTR) &CSSMOID_CertificatePolicies;
1033 for (chainIndex = 1; hasRequiredExtensions && chainLen > 2 && chainIndex < chainLen - 1; chainIndex++) {
1034 SecCertificateRef intermediateCert = (SecCertificateRef) CFArrayGetValueAtIndex(certChain, chainIndex);
1035 OSStatus status = errSecSuccess;
1036 // note: Sec* APIs are not re-entrant due to the API lock
1037 // status = SecCertificateGetCLHandle(intermediateCert, &clHandle);
1038 BEGIN_SECAPI_INTERNAL_CALL
1039 clHandle = Certificate::required(intermediateCert)->clHandle();
1040 END_SECAPI_INTERNAL_CALL
1041 if (status)
1042 return NULL;
1043 // note: Sec* APIs are not re-entrant due to the API lock
1044 // status = SecCertificateGetData(intermediateCert, &certData);
1045 BEGIN_SECAPI_INTERNAL_CALL
1046 certData = Certificate::required(intermediateCert)->data();
1047 END_SECAPI_INTERNAL_CALL
1048 if (status)
1049 return NULL;
1050
1051 CSSM_DATA_PTR extensionDataPtr = _copyFieldDataForOid(oidPtr, &certData, clHandle);
1052 if (!extensionDataPtr)
1053 return NULL;
1054
1055 CSSM_X509_EXTENSION *cssmExtension = (CSSM_X509_EXTENSION *)extensionDataPtr->Data;
1056 CE_CertPolicies *certPolicies = (CE_CertPolicies *)cssmExtension->value.parsedValue;
1057 CFStringRef oidString = _oidStringForCertificatePolicies(certPolicies);
1058 hasRequiredExtensions = (oidString != NULL);
1059 SafeCFRelease(&oidString);
1060 _freeFieldData(extensionDataPtr, oidPtr, clHandle);
1061
1062 // FIX: add checks for the following (not essential to this implementation):
1063 // - non-critical cRLDistributionPoint extension
1064 // - critical basicConstraints extension with CA bit set
1065 // - critical keyUsage extension with keyCertSign and cRLSign bits set
1066 // Tracked by <rdar://problem/6119322>
1067 }
1068
1069 if (hasRequiredExtensions) {
1070 SecCertificateRef leafCert = (SecCertificateRef) CFArrayGetValueAtIndex(certChain, 0);
1071 CFStringRef organizationName = organizationNameForCertificate(leafCert);
1072 if (organizationName != NULL) {
1073 CFMutableDictionaryRef resultDict = CFDictionaryCreateMutable(NULL, 0,
1074 &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
1075 CFDictionaryAddValue(resultDict, kSecEVOrganizationName, organizationName);
1076 trustDebug("[EV] extended validation succeeded");
1077 SafeCFRelease(&organizationName);
1078 return resultDict;
1079 }
1080 }
1081
1082 return NULL;
1083 }
1084
1085 // returns a CFDictionaryRef containing extended trust results.
1086 // Caller must release this dictionary.
1087 //
1088 // If the isEVCandidate argument is true, extended validation checking is performed
1089 // and the kSecEVOrganizationName key will be set in the dictionary if EV criteria is met.
1090 // In all cases, kSecTrustEvaluationDate and kSecTrustExpirationDate will be set.
1091 //
1092 CFDictionaryRef extendedTrustResults(CFArrayRef certChain, SecTrustResultType trustResult, OSStatus tpResult, bool isEVCandidate)
1093 {
1094 CFMutableDictionaryRef resultDict = NULL;
1095 if (isEVCandidate) {
1096 resultDict = (CFMutableDictionaryRef) extendedValidationResults(certChain, trustResult, tpResult);
1097 }
1098 if (!resultDict) {
1099 resultDict = CFDictionaryCreateMutable(NULL, 0,
1100 &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
1101 if (!resultDict) {
1102 return NULL;
1103 }
1104 }
1105 CFAbsoluteTime at = CFAbsoluteTimeGetCurrent();
1106 CFDateRef trustEvaluationDate = CFDateCreate(kCFAllocatorDefault, at);
1107 // by default, permit caching of trust evaluation results for up to 2 hours
1108 // FIXME: need to modify this based on cert expiration and OCSP/CRL validity
1109 CFDateRef trustExpirationDate = CFDateCreate(kCFAllocatorDefault, at + (60*60*2));
1110 CFDictionaryAddValue(resultDict, kSecTrustEvaluationDate, trustEvaluationDate);
1111 SafeCFRelease(&trustEvaluationDate);
1112 CFDictionaryAddValue(resultDict, kSecTrustExpirationDate, trustExpirationDate);
1113 SafeCFRelease(&trustExpirationDate);
1114
1115 return resultDict;
1116 }
1117
1118 // returns a CFDictionaryRef containing mappings from supported EV CA OIDs to SHA-1 hash values;
1119 // caller must release
1120 //
1121 static CFDictionaryRef _evCAOidDict()
1122 {
1123 static CFDictionaryRef s_evCAOidDict = NULL;
1124 if (s_evCAOidDict) {
1125 CFRetain(s_evCAOidDict);
1126 secdebug("evTrust", "_evCAOidDict: returning static instance (rc=%d)", (int)CFGetRetainCount(s_evCAOidDict));
1127 return s_evCAOidDict;
1128 }
1129 secdebug("evTrust", "_evCAOidDict: initializing static instance");
1130
1131 s_evCAOidDict = dictionaryWithContentsOfPlistFile(EV_ROOTS_PLIST_SYSTEM_PATH);
1132 if (!s_evCAOidDict)
1133 return NULL;
1134
1135 #if !defined MAC_OS_X_VERSION_10_6 || MAC_OS_X_VERSION_MAX_ALLOWED < MAC_OS_X_VERSION_10_6
1136 // Work around rdar://6302788 by hard coding a hash that was missed when addressing <rdar://problem/6238289&6238296>
1137 // This is being addressed in SnowLeopard by rdar://6305989
1138 CFStringRef oidString = CFSTR("2.16.840.1.114028.10.1.2");
1139 CFMutableArrayRef hashes = (CFMutableArrayRef) CFDictionaryGetValue(s_evCAOidDict, oidString);
1140 if (hashes) {
1141 uint8 hashBytes[] = {0xB3, 0x1E, 0xB1, 0xB7, 0x40, 0xE3, 0x6C, 0x84, 0x02, 0xDA, 0xDC, 0x37, 0xD4, 0x4D, 0xF5, 0xD4, 0x67, 0x49, 0x52, 0xF9};
1142 CFDataRef hashData = CFDataCreate(NULL, hashBytes, sizeof(hashBytes));
1143 CFIndex hashCount = CFArrayGetCount(hashes);
1144 if (hashData && CFArrayContainsValue(hashes, CFRangeMake(0, hashCount), hashData)) {
1145 secdebug("evTrust", "_evCAOidDict: added hardcoded hash value");
1146 CFArrayAppendValue(hashes, hashData);
1147 }
1148 SafeCFRelease(&hashData);
1149 }
1150 #endif
1151 CFRetain(s_evCAOidDict);
1152 secdebug("evTrust", "_evCAOidDict: returning static instance (rc=%d)", (int)CFGetRetainCount(s_evCAOidDict));
1153 return s_evCAOidDict;
1154 }
1155
1156 // returns a CFStringRef containing a decimal representation of the given OID.
1157 // Caller must release.
1158
1159 static CFStringRef _decimalStringForOid(CSSM_OID_PTR oid)
1160 {
1161 CFMutableStringRef str = CFStringCreateMutable(NULL, 0);
1162 if (!str || oid->Length > 32)
1163 return str;
1164
1165 // The first two levels are encoded into one byte, since the root level
1166 // has only 3 nodes (40*x + y). However if x = joint-iso-itu-t(2) then
1167 // y may be > 39, so we have to add special-case handling for this.
1168 unsigned long value = 0;
1169 unsigned int x = oid->Data[0] / 40;
1170 unsigned int y = oid->Data[0] % 40;
1171 if (x > 2) {
1172 // Handle special case for large y if x = 2
1173 y += (x - 2) * 40;
1174 x = 2;
1175 }
1176
1177 CFStringAppendFormat(str, NULL, CFSTR("%d.%d"), x, y);
1178
1179 for (x = 1; x < oid->Length; x++) {
1180 value = (value << 7) | (oid->Data[x] & 0x7F);
1181 if(!(oid->Data[x] & 0x80)) {
1182 CFStringAppendFormat(str, NULL, CFSTR(".%ld"), value);
1183 value = 0;
1184 }
1185 }
1186
1187 #if !defined(NDEBUG)
1188 CFIndex nameLen = CFStringGetLength(str);
1189 CFIndex bufLen = 1 + CFStringGetMaximumSizeForEncoding(nameLen, kCFStringEncodingUTF8);
1190 char *nameBuf = (char *)malloc(bufLen);
1191 if (!CFStringGetCString(str, nameBuf, bufLen-1, kCFStringEncodingUTF8))
1192 nameBuf[0]=0;
1193 secdebug("evTrust", "_decimalStringForOid: \"%s\"", nameBuf);
1194 free(nameBuf);
1195 #endif
1196
1197 return str;
1198 }
1199
1200 static void _freeFieldData(CSSM_DATA_PTR value, CSSM_OID_PTR oid, CSSM_CL_HANDLE clHandle)
1201 {
1202 if (value && value->Data) {
1203 CSSM_CL_FreeFieldValue(clHandle, oid, value);
1204 }
1205 return;
1206 }
1207
1208 static ModuleNexus<Mutex> gOidStringForCertificatePoliciesMutex;
1209
1210 static CFStringRef _oidStringForCertificatePolicies(const CE_CertPolicies *certPolicies)
1211 {
1212 StLock<Mutex> _(gOidStringForCertificatePoliciesMutex());
1213
1214 // returns the first EV OID (as a string) found in the given Certificate Policies extension,
1215 // or NULL if the extension does not contain any known EV OIDs. (Note that the "any policy" OID
1216 // is a special case and will be returned if present, although its presence is only meaningful
1217 // in an intermediate CA.)
1218
1219 if (!certPolicies) {
1220 secdebug("evTrust", "oidStringForCertificatePolicies: missing certPolicies!");
1221 return NULL;
1222 }
1223
1224 CFDictionaryRef evOidDict = _evCAOidDict();
1225 if (!evOidDict) {
1226 secdebug("evTrust", "oidStringForCertificatePolicies: nil OID dictionary!");
1227 return NULL;
1228 }
1229
1230 CFStringRef foundOidStr = NULL;
1231 uint32 policyIndex, maxIndex = 10; // sanity check; EV certs normally have EV OID as first policy
1232 for (policyIndex = 0; policyIndex < certPolicies->numPolicies && policyIndex < maxIndex; policyIndex++) {
1233 CE_PolicyInformation *certPolicyInfo = &certPolicies->policies[policyIndex];
1234 CSSM_OID_PTR oid = &certPolicyInfo->certPolicyId;
1235 CFStringRef oidStr = _decimalStringForOid(oid);
1236 if (!oidStr)
1237 continue;
1238 if (!CFStringCompare(oidStr, CFSTR("2.5.29.32.0"), 0) || // is it the "any" OID, or
1239 CFDictionaryGetValue(evOidDict, oidStr) != NULL) { // a known EV CA OID?
1240 foundOidStr = CFStringCreateCopy(NULL, oidStr);
1241 }
1242 SafeCFRelease(&oidStr);
1243 if (foundOidStr)
1244 break;
1245 }
1246 SafeCFRelease(&evOidDict);
1247
1248 return foundOidStr;
1249 }
1250