trust/SecTrustPriv.h

   1 /*
   2  * Copyright (c) 2003-2017 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*!
  25      @header SecTrustPriv
  26      The functions and data types in SecTrustPriv implement trust computation
  27      and allow the user to apply trust decisions to the trust configuration.
  28  */
  29
  30 #ifndef _SECURITY_SECTRUSTPRIV_H_
  31 #define _SECURITY_SECTRUSTPRIV_H_
  32
  33 #include <Security/SecTrust.h>
  34 #include <CoreFoundation/CFString.h>
  35 #include <CoreFoundation/CFData.h>
  36 #include <CoreFoundation/CFDictionary.h>
  37
  38 __BEGIN_DECLS
  39
  40 CF_ASSUME_NONNULL_BEGIN
  41 CF_IMPLICIT_BRIDGING_ENABLED
  42
  43 /* Constants used as keys in property lists.  See
  44  SecTrustCopySummaryPropertiesAtIndex for more information. */
  45 extern const CFStringRef kSecPropertyKeyType;
  46 extern const CFStringRef kSecPropertyKeyLabel;
  47 extern const CFStringRef kSecPropertyKeyLocalizedLabel;
  48 extern const CFStringRef kSecPropertyKeyValue;
  49
  50 extern const CFStringRef kSecPropertyTypeWarning;
  51 extern const CFStringRef kSecPropertyTypeSuccess;
  52 extern const CFStringRef kSecPropertyTypeSection;
  53 extern const CFStringRef kSecPropertyTypeData;
  54 extern const CFStringRef kSecPropertyTypeString;
  55 extern const CFStringRef kSecPropertyTypeURL;
  56 extern const CFStringRef kSecPropertyTypeDate;
  57
  58 /* Constants used as keys in the dictionary returned by SecTrustCopyInfo. */
  59 extern const CFStringRef kSecTrustInfoExtendedValidationKey;
  60 extern const CFStringRef kSecTrustInfoCompanyNameKey;
  61 extern const CFStringRef kSecTrustInfoRevocationKey;
  62 extern const CFStringRef kSecTrustInfoRevocationValidUntilKey;
  63 extern const CFStringRef kSecTrustInfoCertificateTransparencyKey;
  64
  65 /* Constants used as keys in the certificate details dictionary.
  66  An array of per-certificate details is returned by SecTrustCopyResult
  67  as the value of the kSecTrustResultDetails key.
  68 */
  69 extern const CFStringRef kSecCertificateDetailStatusCodes;
  70     /*__OSX_AVAILABLE_STARTING(__MAC_10_13, __IPHONE_11_0);*/
  71
  72 /*!
  73  @enum Trust Result Constants
  74  @discussion Predefined key constants used to obtain values in a
  75  dictionary of trust evaluation results for a certificate chain,
  76  as retrieved from a call to SecTrustCopyResult.
  77
  78  @constant kSecTrustResultDetails
  79  This key will be present if a trust evaluation has been performed.
  80  Its value is a CFArrayRef of CFDictionaryRef representing detailed
  81  status info for each certificate in the completed chain.
  82  @constant kSecTrustRevocationReason
  83  This key will be present iff this chain had its revocation checked,
  84  and a "revoked" response was received. The value of this key will
  85  be a CFNumberRef indicating the reason for revocation. The possible
  86  reason code values are described in RFC 5280, section 5.3.1.
  87  */
  88 extern const CFStringRef kSecTrustResultDetails;
  89     /*__OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_9_0);*/
  90 extern const CFStringRef kSecTrustRevocationReason;
  91     /*__OSX_AVAILABLE_STARTING(__MAC_10_11, __IPHONE_9_0);*/
  92
  93 /*!
  94      @function SecTrustCopySummaryPropertiesAtIndex
  95      @abstract Return a property array for the certificate.
  96      @param trust A reference to the trust object to evaluate.
  97      @param ix The index of the requested certificate.  Indices run from 0
  98      (leaf) to the anchor (or last certificate found if no anchor was found).
  99      @result A property array. It is the caller's responsibility to CFRelease
 100      the returned array when it is no longer needed. This function returns a
 101      short summary description of the certificate in question.  The property
 102      at index 0 of the array might also include general information about the
 103      entire chain's validity in the context of this trust evaluation.
 104
 105      @discussion Returns a property array for this trust certificate. A property
 106      array is an array of CFDictionaryRefs.  Each dictionary (we call it a
 107      property for short) has the following keys:
 108
 109         kSecPropertyKeyType This key's value determines how this property
 110             should be displayed. Its associated value is one of the
 111             following:
 112             kSecPropertyTypeWarning
 113                 The kSecPropertyKeyLocalizedLabel and kSecPropertyKeyLabel keys are not
 114                 set.  The kSecPropertyKeyValue is a CFStringRef which should
 115                 be displayed in yellow with a warning triangle.
 116             kSecPropertyTypeError
 117                 The kSecPropertyKeyLocalizedLabel and kSecPropertyKeyLabel keys are not
 118                 set.  The kSecPropertyKeyValue is a CFStringRef which should
 119                 be displayed in red with an error X.
 120             kSecPropertyTypeSuccess
 121                 The kSecPropertyKeyLocalizedLabel and kSecPropertyKeyLabel keys are not
 122                 set.  The kSecPropertyKeyValue is a CFStringRef which should
 123                 be displayed in green with a checkmark in front of it.
 124             kSecPropertyTypeTitle
 125                 The kSecPropertyKeyLocalizedLabel and kSecPropertyKeyLabel keys are not
 126                 set.  The kSecPropertyKeyValue is a CFStringRef which should
 127                 be displayed in a larger bold font.
 128             kSecPropertyTypeSection
 129                 The optional kSecPropertyKeyLocalizedLabel is a CFStringRef with the name
 130                 of the next section to display.  The value of the
 131                 kSecPropertyKeyValue key is a CFArrayRef which is a property
 132                 array as defined here.
 133             kSecPropertyTypeData
 134                 The optional kSecPropertyKeyLocalizedLabel is a CFStringRef containing
 135                 the localized label for the value for the kSecPropertyKeyValue.
 136                 The type of this value is a CFDataRef.  Its contents should be
 137                 displayed as: "bytes length_of_data : hexdump_of_data". Ideally
 138                 the UI will only show one line of hex dump data and have a
 139                 disclosure arrow to see the remainder.
 140             kSecPropertyTypeString
 141                 The optional kSecPropertyKeyLocalizedLabel is a CFStringRef containing
 142                 the localized label for the value for the kSecPropertyKeyValue.
 143                 The type of this value is a CFStringRef.  It's contents should be
 144                 displayed in the normal font.
 145             kSecPropertyTypeURL
 146                 The optional kSecPropertyKeyLocalizedLabel is a CFStringRef containing
 147                 the localized label for the value for the kSecPropertyKeyValue.
 148                 The type of this value is a CFURLRef.  It's contents should be
 149                 displayed as a hyperlink.
 150             kSecPropertyTypeDate
 151                 The optional kSecPropertyKeyLocalizedLabel is a CFStringRef containing
 152                 the localized label for the value for the kSecPropertyKeyValue.
 153                 The type of this value is a CFDateRef.  It's contents should be
 154                 displayed in human readable form (probably in the current
 155                 timezone).
 156         kSecPropertyKeyLocalizedLabel
 157             Human readable localized label for a given property.
 158         kSecPropertyKeyValue
 159             See description of kSecPropertyKeyType to determine what the value
 160             for this key is.
 161         kSecPropertyKeyLabel
 162             Non localized key (label) for this value.  This is only
 163             present for properties with fixed label names.
 164      @result A property array. It is the caller's responsability to CFRelease
 165      the returned array when it is no longer needed.
 166  */
 167 __nullable CF_RETURNS_RETAINED
 168 CFArrayRef SecTrustCopySummaryPropertiesAtIndex(SecTrustRef trust, CFIndex ix);
 169
 170 /*!
 171      @function SecTrustCopyDetailedPropertiesAtIndex
 172      @abstract Return a property array for the certificate.
 173      @param trust A reference to the trust object to evaluate.
 174      @param ix The index of the requested certificate.  Indices run from 0
 175      (leaf) to the anchor (or last certificate found if no anchor was found).
 176      @result A property array. It is the caller's responsibility to CFRelease
 177      the returned array when it is no longer needed.
 178      See SecTrustCopySummaryPropertiesAtIndex on how to intepret this array.
 179      Unlike that function call this function returns a detailed description
 180     of the certificate in question.
 181  */
 182 __nullable CF_RETURNS_RETAINED
 183 CFArrayRef SecTrustCopyDetailedPropertiesAtIndex(SecTrustRef trust, CFIndex ix);
 184
 185 /*!
 186      @function SecTrustCopyInfo
 187      @abstract Return a dictionary with additional information about the
 188      evaluated certificate chain for use by clients.
 189      @param trust A reference to an evaluated trust object.
 190      @discussion Returns a dictionary for this trust evaluation. This
 191      dictionary may have the following keys:
 192
 193         kSecTrustInfoExtendedValidationKey this key will be present and have
 194             a value of kCFBooleanTrue if this chain was validated for EV.
 195         kSecTrustInfoCompanyNameKey Company name field of subject of leaf
 196             certificate, this field is meant to be displayed to the user
 197             if the kSecTrustInfoExtendedValidationKey is present.
 198         kSecTrustInfoRevocationKey this key will be present iff this chain
 199             had its revocation checked. The value will be a kCFBooleanTrue
 200             if revocation checking was successful and none of the
 201             certificates in the chain were revoked.
 202             The value will be kCFBooleanFalse if no current revocation status
 203             could be obtained for one or more certificates in the chain due
 204             to connection problems or timeouts etc.  This is a hint to a
 205             client to retry revocation checking at a later time.
 206         kSecTrustInfoRevocationValidUntilKey this key will be present iff
 207         kSecTrustInfoRevocationKey has a value of kCFBooleanTrue.
 208             The value will be a CFDateRef representing the earliest date at
 209             which the revocation info for one of the certificates in this chain
 210             might change.
 211
 212      @result A dictionary with various fields that can be displayed to the user,
 213      or NULL if no additional info is available or the trust has not yet been
 214      validated.  The caller is responsible for calling CFRelease on the value
 215      returned when it is no longer needed.
 216  */
 217 __nullable CF_RETURNS_RETAINED
 218 CFDictionaryRef SecTrustCopyInfo(SecTrustRef trust);
 219
 220 /* For debugging purposes. */
 221 __nullable
 222 CFArrayRef SecTrustGetDetails(SecTrustRef trust);
 223
 224 __nullable CF_RETURNS_RETAINED
 225 CFArrayRef SecTrustCopyFilteredDetails(SecTrustRef trust);
 226
 227 /*!
 228  @function SecTrustIsExpiredOnly
 229  @abstract Determine whether expiration is the only problem with a certificate chain.
 230  @param trust A reference to a trust object.
 231  @result A boolean value indicating whether expiration is the only problem found
 232  with the certificate chain in the given trust reference.
 233  @discussion Returns true if one or more certificates in the chain have expired,
 234  expiration is an error (i.e. it is not being ignored by existing trust settings),
 235  and it is the only error encountered. Returns false if the certificate(s) have not
 236  expired, or are expired but have trust settings to override their expiration,
 237  or if the trust chain has other errors beside expiration. Your code should call
 238  this function after SecTrustEvaluate has returned a recoverable trust failure,
 239  so you can distinguish this case from other possible errors.
 240  */
 241 Boolean SecTrustIsExpiredOnly(SecTrustRef trust)
 242     __OSX_AVAILABLE(10.13) __IOS_AVAILABLE(11.0) __TVOS_AVAILABLE(11.0) __WATCHOS_AVAILABLE(4.0);
 243
 244 /* For debugging purposes. */
 245 __nullable CF_RETURNS_RETAINED
 246 CFStringRef SecTrustCopyFailureDescription(SecTrustRef trust);
 247
 248 OSStatus SecTrustGetOTAPKIAssetVersionNumber(int* versionNumber);
 249
 250 OSStatus SecTrustOTAPKIGetUpdatedAsset(int* didUpdateAsset);
 251
 252 /*!
 253  @function SecTrustSignedCertificateTimestampList
 254  @abstract Attach SignedCertificateTimestampList data to a trust object.
 255  @param trust A reference to a trust object.
 256  @param sctArray is a CFArray of CFData objects each containing a SCT (per RFC 6962).
 257  @result A result code. See "Security Error Codes" (SecBase.h).
 258  @discussion Allows the caller to provide SCT data (which may be
 259  obtained during a TLS/SSL handshake, per RFC 6962) as input to a trust
 260  evaluation.
 261  */
 262 OSStatus SecTrustSetSignedCertificateTimestamps(SecTrustRef trust, CFArrayRef sctArray);
 263
 264 /*!
 265  @function SecTrustSetTrustedLogs
 266  @abstract Sets the trusted CT logs for a given trust.
 267  @param trust A reference to a trust object.
 268  @param trustedLogs An array of trusted logs.
 269  @result A result code.  See "Security Error Codes" (SecBase.h).
 270  @discussion trustedLog is a CFArray of CFData containing the DER-encode SubjectPublicKeyInfo
 271  of the trusted CT logs.
 272  */
 273 OSStatus SecTrustSetTrustedLogs(SecTrustRef trust, CFArrayRef trustedLogs);
 274
 275 /* Keychain searches are allowed by default. Use this to turn off seaching of
 276     -keychain search list (i.e. login.keychain, system.keychain)
 277     -Local Items/iCloud Keychain
 278     -user- and admin-trusted roots
 279     -network-fetched issuers
 280  User must provide all necessary certificates in the input certificates and/or anchors. */
 281 OSStatus SecTrustSetKeychainsAllowed(SecTrustRef trust, Boolean allowed)
 282     __OSX_AVAILABLE(10.12) __IOS_AVAILABLE(10.0) __TVOS_AVAILABLE(10.0) __WATCHOS_AVAILABLE(3.0);
 283
 284 /* Get the keychain search policy for the trust object. */
 285 OSStatus SecTrustGetKeychainsAllowed(SecTrustRef trust, Boolean * __nonnull allowed)
 286     __OSX_AVAILABLE(10.12) __IOS_AVAILABLE(10.0) __TVOS_AVAILABLE(10.0) __WATCHOS_AVAILABLE(3.0);
 287
 288 /*!
 289  @function SecTrustEvaluateLeafOnly
 290  @abstract Evaluates the leaf of the trust reference synchronously.
 291  @param trust A reference to the trust object to evaluate.
 292  @param result A pointer to a result type.
 293  @result A result code. See "Security Error Codes" (SecBase.h).
 294  @discussion This function will only evaluate the trust of the leaf certificate.
 295  No chain will be built and only those aspects of the SecPolicyRef that address
 296  the expected contents of the leaf will be checked. This function does not honor
 297  any set exceptions or usage constraints.
 298  */
 299 OSStatus SecTrustEvaluateLeafOnly(SecTrustRef trust, SecTrustResultType * __nonnull result)
 300     __OSX_AVAILABLE(10.12) __IOS_AVAILABLE(10.0) __TVOS_AVAILABLE(10.0) __WATCHOS_AVAILABLE(3.0);
 301
 302 /*!
 303  @function SecTrustSerialize
 304  @abstract Creates a serialized version of the trust object
 305  @param trust A reference to the trust object to serialize.
 306  @param error A pointer to an error.
 307  @result The serialized trust object.
 308  @discussion This function is intended to be used to share SecTrustRefs between
 309  processes. Saving the results to disk or sending them over network channels
 310  may cause unexpected behavior.
 311  */
 312 __nullable CF_RETURNS_RETAINED
 313 CFDataRef SecTrustSerialize(SecTrustRef trust, CFErrorRef *error)
 314     __OSX_AVAILABLE(10.12) __IOS_AVAILABLE(10.0) __TVOS_AVAILABLE(10.0) __WATCHOS_AVAILABLE(3.0);
 315
 316 /*!
 317  @function SecTrustDeserialize
 318  @abstract Creates a trust object from the serialized data
 319  @param serializedTrust A reference to the serialized trust object
 320  @param error A pointer to an error.
 321  @result A trust object
 322  @discussion This function is intended to be used to share SecTrustRefs between
 323  processes. Saving the results to disk or sending them over network channels
 324  may cause unexpected behavior.
 325  */
 326 __nullable CF_RETURNS_RETAINED
 327 SecTrustRef SecTrustDeserialize(CFDataRef serializedTrust, CFErrorRef *error)
 328     __OSX_AVAILABLE(10.12) __IOS_AVAILABLE(10.0) __TVOS_AVAILABLE(10.0) __WATCHOS_AVAILABLE(3.0);
 329
 330 /*!
 331  @function SecTrustGetTrustExceptionsArray
 332  @abstract Return the exceptions array currently set in the trust object
 333  @param trust A reference to the trust object
 334  @result The array of exceptions.
 335  @discussion This function returns an array of exceptions that was previously set
 336  using SecTrustSetExceptions, unlike SecTrustCopyExceptions which returns the
 337  exceptions which could be set using SecTrustSetExceptions.
 338  */
 339 __nullable CFArrayRef SecTrustGetTrustExceptionsArray(SecTrustRef trust)
 340     __OSX_AVAILABLE(10.12) __IOS_AVAILABLE(10.0) __TVOS_AVAILABLE(10.0) __WATCHOS_AVAILABLE(3.0);
 341
 342 /*!
 343  @function SecTrustCopyInputCertificates
 344  @abstract Return the array of certificates currently set in the trust object
 345  @param trust A reference to the trust object
 346  @param certificates On return, an array of the certificates used by this trust.
 347  Call the CFRelease function to release this reference.
 348  @result A result code. See "Security Error Codes" (SecBase.h)
 349 */
 350 OSStatus SecTrustCopyInputCertificates(SecTrustRef trust, CFArrayRef * _Nonnull CF_RETURNS_RETAINED certificates)
 351 __OSX_AVAILABLE(10.12.4) __IOS_AVAILABLE(10.3) __TVOS_AVAILABLE(10.2) __WATCHOS_AVAILABLE(3.2);
 352
 353 /*!
 354  @function SecTrustAddToInputCertificates
 355  @abstract Add certificate(s) to the currently set certificates in the trust object
 356  @param trust A reference to the trust object
 357  @param certificates The group of certificates to add. This can either be a CFArrayRef
 358  of SecCertificateRef objects or a single SecCertificateRef.
 359  @result A result code. See "Security Error Codes" (SecBase.h)
 360  */
 361 OSStatus SecTrustAddToInputCertificates(SecTrustRef trust, CFTypeRef _Nonnull certificates)
 362     __OSX_AVAILABLE(10.12.4) __IOS_AVAILABLE(10.3) __TVOS_AVAILABLE(10.2) __WATCHOS_AVAILABLE(3.2);
 363
 364 /*!
 365  @function SecTrustSetPinningPolicyName
 366  @abstract Set the policy name to be used during the trust evaluation.
 367  @param trust A reference to the trust object
 368  @param policyName A string representing the name of the pinning policy to be used.
 369  @result A result code. See "Security Error Codes" (SecBase.h)
 370  @discussion This function permits the caller to enable the dynamic lookup of the
 371  pinning policy using a built-in database as an alternative to using a SecPolicyCreate function
 372  with the pinning rules and calling SecTrustCreateWithCertificates or SecTrustSetPolicies.
 373  */
 374 OSStatus SecTrustSetPinningPolicyName(SecTrustRef trust, CFStringRef policyName)
 375     __OSX_AVAILABLE(10.13) __IOS_AVAILABLE(11.0) __TVOS_AVAILABLE(11.0) __WATCHOS_AVAILABLE(4.0);
 376
 377 /*!
 378  @function SecTrustSetPinningException
 379  @abstract Remove pinning requirement from this trust evaluation
 380  @param trust A reference to the trust object
 381  @result A result code. See "Security Error Codes" (SecBase.h)
 382  @discussion This function provides an exception for this particular trust for a bundle that
 383  otherwise requires pinning for all connections. Bundles use the SecTrustPinningRequired key
 384  with boolean value of true in their info plist to indicate that all SSL connections from the
 385  bundle must be pinned.
 386  */
 387 OSStatus SecTrustSetPinningException(SecTrustRef trust)
 388     __OSX_AVAILABLE(10.13) __IOS_AVAILABLE(11.0) __TVOS_AVAILABLE(11.0) __WATCHOS_AVAILABLE(4.0);
 389
 390 CF_IMPLICIT_BRIDGING_DISABLED
 391 CF_ASSUME_NONNULL_END
 392
 393 /*
 394  *  Legacy functions (OS X only)
 395  */
 396 #if TARGET_OS_MAC && !TARGET_OS_IPHONE
 397
 398 CF_ASSUME_NONNULL_BEGIN
 399 CF_IMPLICIT_BRIDGING_ENABLED
 400
 401 #if SEC_OS_IPHONE
 402 #pragma clang diagnostic push
 403 #pragma clang diagnostic ignored "-Wfour-char-constants"
 404 #endif /* SEC_OS_IPHONE */
 405 /*
 406      unique keychain item attributes for user trust records.
 407  */
 408 enum {
 409     kSecTrustCertAttr                    = 'tcrt',
 410     kSecTrustPolicyAttr                  = 'tpol',
 411     /* Leopard and later */
 412     kSecTrustPubKeyAttr                  = 'tpbk',
 413     kSecTrustSignatureAttr               = 'tsig'
 414 };
 415
 416 #if SEC_OS_IPHONE
 417 #pragma clang diagnostic pop
 418 #endif /* SEC_OS_IPHONE */
 419
 420 /*!
 421      @function SecTrustGetUserTrust
 422      @abstract Gets the user-specified trust settings of a certificate and policy.
 423      @param certificate A reference to a certificate.
 424      @param policy A reference to a policy.
 425      @param trustSetting On return, a pointer to the user specified trust settings.
 426      @result A result code. See "Security Error Codes" (SecBase.h).
 427      @availability Mac OS X version 10.4. Deprecated in Mac OS X version 10.5.
 428  */
 429 OSStatus SecTrustGetUserTrust(SecCertificateRef __nullable certificate, SecPolicyRef __nullable policy, SecTrustUserSetting * __nullable trustSetting)
 430     __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_4, __MAC_10_5, __IPHONE_NA, __IPHONE_NA);
 431
 432 /*!
 433      @function SecTrustSetUserTrust
 434      @abstract Sets the user-specified trust settings of a certificate and policy.
 435      @param certificate A reference to a certificate.
 436      @param policy A reference to a policy.
 437      @param trustSetting The user-specified trust settings.
 438      @result A result code. See "Security Error Codes" (SecBase.h).
 439      @availability Mac OS X version 10.4. Deprecated in Mac OS X version 10.5.
 440      @discussion as of Mac OS version 10.5, this will result in a call to
 441      SecTrustSettingsSetTrustSettings().
 442  */
 443 OSStatus SecTrustSetUserTrust(SecCertificateRef __nullable certificate, SecPolicyRef __nullable policy, SecTrustUserSetting trustSetting)
 444     __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_4, __MAC_10_5, __IPHONE_NA, __IPHONE_NA);
 445
 446 /*!
 447      @function SecTrustSetUserTrustLegacy
 448      @abstract Sets the user-specified trust settings of a certificate and policy.
 449      @param certificate A reference to a certificate.
 450      @param policy A reference to a policy.
 451      @param trustSetting The user-specified trust settings.
 452      @result A result code.  See "Security Error Codes" (SecBase.h).
 453
 454      @This is the private version of what used to be SecTrustSetUserTrust(); it operates
 455      on UserTrust entries as that function used to. The current SecTrustSetUserTrust()
 456      function operated on Trust Settings.
 457  */
 458 OSStatus SecTrustSetUserTrustLegacy(SecCertificateRef __nullable certificate, SecPolicyRef __nullable policy, SecTrustUserSetting trustSetting)
 459     __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_5, __MAC_10_12, __IPHONE_NA, __IPHONE_NA);
 460
 461 /*!
 462      @function SecTrustGetCSSMAnchorCertificates
 463      @abstract Retrieves the CSSM anchor certificates.
 464      @param cssmAnchors A pointer to an array of anchor certificates.
 465      @param cssmAnchorCount A pointer to the number of certificates in anchors.
 466      @result A result code. See "Security Error Codes" (SecBase.h).
 467      @availability Mac OS X version 10.4. Deprecated in Mac OS X version 10.5.
 468  */
 469 OSStatus SecTrustGetCSSMAnchorCertificates(const CSSM_DATA * __nullable * __nullable cssmAnchors, uint32 *cssmAnchorCount)
 470     __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_4, __MAC_10_5, __IPHONE_NA, __IPHONE_NA);
 471
 472 /*!
 473      @function SecTrustCopyExtendedResult
 474      @abstract Gets the extended trust result after an evaluation has been performed.
 475      @param trust A trust reference.
 476      @param result On return, result points to a CFDictionaryRef containing extended trust results (if no error occurred).
 477      The caller is responsible for releasing this dictionary with CFRelease when finished with it.
 478      @result A result code. See "Security Error Codes" (SecBase.h).
 479      @discussion This function may only be used after SecTrustEvaluate has been called for the trust reference, otherwise
 480      errSecTrustNotAvailable is returned. If the certificate is not an extended validation certificate, there is
 481      no extended result data and errSecDataNotAvailable is returned. Currently, only one dictionary key is defined
 482      (kSecEVOrganizationName).
 483
 484      Note: this function will be deprecated in a future release of OS X. Your
 485      code should use SecTrustCopyResult to obtain the trust results dictionary.
 486  */
 487 OSStatus SecTrustCopyExtendedResult(SecTrustRef trust, CFDictionaryRef * __nonnull CF_RETURNS_RETAINED result)
 488     __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_5, __MAC_10_12, __IPHONE_NA, __IPHONE_NA);
 489
 490 /*
 491  * Preference-related strings for Revocation policies.
 492  */
 493
 494 /*
 495  * Preference domain, i.e., the name of a plist in ~/Library/Preferences or in
 496  * /Library/Preferences
 497  */
 498 #define kSecRevocationDomain                "com.apple.security.revocation"
 499
 500 /* OCSP and CRL style keys, followed by values used for both of them */
 501 #define kSecRevocationOcspStyle             CFSTR("OCSPStyle")
 502 #define kSecRevocationCrlStyle              CFSTR("CRLStyle")
 503 #define kSecRevocationOff                   CFSTR("None")
 504 #define kSecRevocationBestAttempt           CFSTR("BestAttempt")
 505 #define kSecRevocationRequireIfPresent      CFSTR("RequireIfPresent")
 506 #define kSecRevocationRequireForAll         CFSTR("RequireForAll")
 507
 508 /* Which first if both enabled? */
 509 #define kSecRevocationWhichFirst            CFSTR("RevocationFirst")
 510 #define kSecRevocationOcspFirst             CFSTR("OCSP")
 511 #define kSecRevocationCrlFirst              CFSTR("CRL")
 512
 513 /* boolean: A "this policy is sufficient per cert" for each */
 514 #define kSecRevocationOCSPSufficientPerCert CFSTR("OCSPSufficientPerCert")
 515 #define kSecRevocationCRLSufficientPerCert  CFSTR("CRLSufficientPerCert")
 516
 517 /* local OCSP responder URI, value arbitrary string value */
 518 #define kSecOCSPLocalResponder              CFSTR("OCSPLocalResponder")
 519
 520 /* Extended trust result keys (now in public API) */
 521 #define kSecEVOrganizationName              kSecTrustOrganizationName
 522 #define kSecTrustExpirationDate             kSecTrustRevocationValidUntilDate
 523
 524 CF_IMPLICIT_BRIDGING_DISABLED
 525 CF_ASSUME_NONNULL_END
 526
 527 #endif /* TARGET_OS_MAC && !TARGET_OS_IPHONE */
 528
 529 __END_DECLS
 530
 531 #endif /* !_SECURITY_SECTRUSTPRIV_H_ */