OSX/sec/securityd/SecCertificateServer.h

   1 /*
   2  * Copyright (c) 2017 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*
  25  * SecCertificateServer.h - SecCertificate and SecCertificatePath types
  26  *  with additonal validation context.
  27  */
  28
  29
  30 #ifndef _SECURITY_SECCERTIFICATESERVER_H_
  31 #define _SECURITY_SECCERTIFICATESERVER_H_
  32
  33 #include <CoreFoundation/CoreFoundation.h>
  34
  35 #include <Security/SecCertificate.h>
  36 #include <Security/SecCertificatePath.h>
  37
  38 #include <securityd/policytree.h>
  39
  40
  41 typedef struct SecCertificateVC *SecCertificateVCRef;
  42
  43 SecCertificateVCRef SecCertificateVCCreate(SecCertificateRef certificate, CFArrayRef usageContraints);
  44
  45 typedef struct SecCertificatePathVC *SecCertificatePathVCRef;
  46
  47 /* Create a new certificate path from an old one. */
  48 SecCertificatePathVCRef SecCertificatePathVCCreate(SecCertificatePathVCRef path,
  49                                                SecCertificateRef certificate, CFArrayRef usageConstraints);
  50
  51 SecCertificatePathVCRef SecCertificatePathVCCopyAddingLeaf(SecCertificatePathVCRef path,
  52                                                        SecCertificateRef leaf);
  53
  54 /* Return a new certificate path without the first skipCount certificates. */
  55 SecCertificatePathVCRef SecCertificatePathVCCopyFromParent(SecCertificatePathVCRef path, CFIndex skipCount);
  56
  57 /* Create an array of SecCertificateRefs from a certificate path. */
  58 CFArrayRef SecCertificatePathVCCopyCertificates(SecCertificatePathVCRef path);
  59
  60 SecCertificatePathRef SecCertificatePathVCCopyCertificatePath(SecCertificatePathVCRef path);
  61
  62 /* Record the fact that we found our own root cert as our parent
  63  certificate. */
  64 void SecCertificatePathVCSetSelfIssued(SecCertificatePathVCRef certificatePath);
  65 bool SecCertificatePathVCIsCertificateAtIndexSelfIssued(SecCertificatePathVCRef path, CFIndex ix);
  66
  67 void SecCertificatePathVCSetIsAnchored(SecCertificatePathVCRef certificatePath);
  68
  69 /* Return the index of the first non anchor certificate in the chain that is
  70  self signed counting from the leaf up.  Return -1 if there is none. */
  71 CFIndex SecCertificatePathVCSelfSignedIndex(SecCertificatePathVCRef certificatePath);
  72
  73 Boolean SecCertificatePathVCIsAnchored(SecCertificatePathVCRef certificatePath);
  74
  75 void SecCertificatePathVCSetNextSourceIndex(SecCertificatePathVCRef certificatePath, CFIndex sourceIndex);
  76
  77 CFIndex SecCertificatePathVCGetNextSourceIndex(SecCertificatePathVCRef certificatePath);
  78
  79 CFIndex SecCertificatePathVCGetCount(SecCertificatePathVCRef certificatePath);
  80
  81 SecCertificateRef SecCertificatePathVCGetCertificateAtIndex(SecCertificatePathVCRef certificatePath, CFIndex ix);
  82
  83 void SecCertificatePathVCForEachCertificate(SecCertificatePathVCRef path, void(^operation)(SecCertificateRef certificate, bool *stop));
  84
  85 /* Return the index of certificate in path or kCFNotFound if certificate is
  86  not in path. */
  87 CFIndex SecCertificatePathVCGetIndexOfCertificate(SecCertificatePathVCRef path,
  88                                                 SecCertificateRef certificate);
  89
  90 /* Return the root certificate for certificatePath.  Note that root is just
  91  the top of the path as far as it is constructed.  It may or may not be
  92  trusted or self signed.  */
  93 SecCertificateRef SecCertificatePathVCGetRoot(SecCertificatePathVCRef certificatePath);
  94
  95 CFArrayRef SecCertificatePathVCGetUsageConstraintsAtIndex(SecCertificatePathVCRef certificatePath, CFIndex ix);
  96
  97 void SecCertificatePathVCSetUsageConstraintsAtIndex(SecCertificatePathVCRef certificatePath,
  98                                                   CFArrayRef newConstraints, CFIndex ix);
  99
 100 SecKeyRef SecCertificatePathVCCopyPublicKeyAtIndex(SecCertificatePathVCRef certificatePath, CFIndex ix);
 101
 102 typedef CFIndex SecPathVerifyStatus;
 103 enum {
 104     kSecPathVerifiesUnknown = -1,
 105     kSecPathVerifySuccess = 0,
 106     kSecPathVerifyFailed = 1
 107 };
 108
 109 SecPathVerifyStatus SecCertificatePathVCVerify(SecCertificatePathVCRef certificatePath);
 110
 111 bool SecCertificatePathVCIsCycleInGraph(SecCertificatePathVCRef path);
 112
 113 bool SecCertificatePathVCIsValid(SecCertificatePathVCRef certificatePath, CFAbsoluteTime verifyTime);
 114
 115 bool SecCertificatePathVCHasWeakHash(SecCertificatePathVCRef certificatePath);
 116
 117 bool SecCertificatePathVCHasWeakKeySize(SecCertificatePathVCRef certificatePath);
 118
 119 /* Score */
 120 CFIndex SecCertificatePathVCScore(SecCertificatePathVCRef certificatePath,
 121                                 CFAbsoluteTime verifyTime);
 122 CFIndex SecCertificatePathVCGetScore(SecCertificatePathVCRef certificatePath);
 123 void SecCertificatePathVCSetScore(SecCertificatePathVCRef certificatePath, CFIndex score); // only sets score if new score is higher
 124 void SecCertificatePathVCResetScore(SecCertificatePathVCRef certificatePath); // reset score to 0
 125
 126 /* Revocation */
 127 bool SecCertificatePathVCIsRevocationDone(SecCertificatePathVCRef certificatePath);
 128 void SecCertificatePathVCAllocateRVCs(SecCertificatePathVCRef certificatePath, CFIndex certCount);
 129 CFAbsoluteTime SecCertificatePathVCGetEarliestNextUpdate(SecCertificatePathVCRef path);
 130 void *SecCertificatePathVCGetRVCAtIndex(SecCertificatePathVCRef certificatePath, CFIndex ix); // Returns a SecRVCRef
 131 bool SecCertificatePathVCIsRevocationRequiredForCertificateAtIndex(SecCertificatePathVCRef certificatePath,
 132                                                                    CFIndex ix);
 133 void SecCertificatePathVCSetRevocationRequiredForCertificateAtIndex(SecCertificatePathVCRef certificatePath,
 134                                                                     CFIndex ix);
 135
 136 /* Did we already validate this path (setting EV, CT, RVC, etc.) */
 137 bool SecCertificatePathVCIsPathValidated(SecCertificatePathVCRef certificatePath);
 138 void SecCertificatePathVCSetPathValidated(SecCertificatePathVCRef certificatePath);
 139
 140 /* EV */
 141 bool SecCertificatePathVCIsEV(SecCertificatePathVCRef certificatePath);
 142 void SecCertificatePathVCSetIsEV(SecCertificatePathVCRef certificatePath, bool isEV);
 143 bool SecCertificatePathVCIsOptionallyEV(SecCertificatePathVCRef certificatePath);
 144
 145 /* CT */
 146 bool SecCertificatePathVCIsCT(SecCertificatePathVCRef certificatePath);
 147 void SecCertificatePathVCSetIsCT(SecCertificatePathVCRef certificatePath, bool isCT);
 148
 149 /* Allowlist */
 150 bool SecCertificatePathVCIsAllowlisted(SecCertificatePathVCRef certificatePath);
 151 void SecCertificatePathVCSetIsAllowlisted(SecCertificatePathVCRef certificatePath, bool isAllowlisted);
 152
 153 /* Policy Tree */
 154 bool SecCertificatePathVCVerifyPolicyTree(SecCertificatePathVCRef path, bool anchor_trusted);
 155
 156 #endif /* _SECURITY_SECCERTIFICATESERVER_H_ */