sec/Security/SecPolicyPriv.h

   1 /*
   2  * Copyright (c) 2007-2009 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*!
  25     @header SecPolicyPriv
  26     The functions provided in SecPolicyPriv provide an interface to various
  27         X.509 certificate trust policies.
  28 */
  29
  30 #ifndef _SECURITY_SECPOLICYPRIV_H_
  31 #define _SECURITY_SECPOLICYPRIV_H_
  32
  33 #include <Security/SecPolicy.h>
  34 #include <CoreFoundation/CFArray.h>
  35 #include <CoreFoundation/CFString.h>
  36
  37 #if defined(__cplusplus)
  38 extern "C" {
  39 #endif
  40
  41 /*!
  42     @function SecPolicyCreateiPhoneActivation
  43     @abstract Returns a policy object for verifying iPhone Activation
  44     certificate chains.
  45     @discussion This policy is like the Basic X.509 policy with the additional
  46     requirements that the chain must contain exactly three certificates, the
  47     anchor is the Apple Inc. CA, and the subject of the first intermediate
  48     certificate has "Apple iPhone Certification Authority" as its only
  49     Common Name entry.
  50     @result A policy object. The caller is responsible for calling CFRelease
  51         on this when it is no longer needed.
  52 */
  53 SecPolicyRef SecPolicyCreateiPhoneActivation(void);
  54
  55 /*!
  56     @function SecPolicyCreateiPhoneDeviceCertificate
  57     @abstract Returns a policy object for verifying iPhone Device certificate
  58     chains.
  59     @discussion This policy is like the Basic X.509 policy with the additional
  60     requirements that the chain must contain exactly four certificates, the
  61     anchor is the Apple Inc. CA, and the subject of the first intermediate
  62     certificate has "Apple iPhone Device CA" as its only Common Name entry.
  63     @result A policy object. The caller is responsible for calling CFRelease
  64         on this when it is no longer needed.
  65 */
  66 SecPolicyRef SecPolicyCreateiPhoneDeviceCertificate(void);
  67
  68 /*!
  69     @function SecPolicyCreateFactoryDeviceCertificate
  70     @abstract Returns a policy object for verifying Factory Device certificate
  71     chains.
  72     @discussion This policy is like the Basic X.509 policy with the additional
  73     requirements that the chain must be anchored to the factory device certificate
  74     issuer.
  75     @result A policy object. The caller is responsible for calling CFRelease
  76         on this when it is no longer needed.
  77 */
  78 SecPolicyRef SecPolicyCreateFactoryDeviceCertificate(void);
  79
  80 /*!
  81     @function SecPolicyCreateiAP
  82     @abstract Returns a policy object for verifying iAP certificate chains.
  83     @discussion This policy is like the Basic X.509 policy with these
  84         additional requirements:
  85          * The leaf's NotValidBefore should be greater than 5/31/06 midnight GMT.
  86          * The Common Name of the leaf begins with the characters "IPA_".
  87          * No validity checking is performed for any of the certificates.
  88         The intended use of this policy is that the caller pass in the
  89         intermediates for iAP1 and iAP2 to SecTrustSetAnchorCertificates().
  90     @result A policy object. The caller is responsible for calling CFRelease
  91         on this when it is no longer needed.
  92 */
  93 SecPolicyRef SecPolicyCreateiAP(void);
  94
  95 /*!
  96     @function SecPolicyCreateiTunesStoreURLBag
  97     @abstract Returns a policy object for verifying iTunes Store URL bag
  98     certificates.
  99     @discussion This policy is like the Basic X.509 policy with these
 100         additional requirements:
 101          * The leaf's Organization is Apple Inc.
 102          * The Common Name of the leaf is "iTunes Store URL Bag".
 103     @result A policy object. The caller is responsible for calling CFRelease
 104         on this when it is no longer needed.
 105 */
 106 SecPolicyRef SecPolicyCreateiTunesStoreURLBag(void);
 107
 108 /*!
 109     @function SecPolicyCreateEAP
 110     @abstract Returns a policy object for verifying for 802.1x/EAP certificates.
 111         @param server Passing true for this parameter create a policy for EAP
 112         server certificates.
 113         @param trustedServerNames Optional; if present, the hostname in the leaf
 114     certificate must be in the trustedServerNames list.  Note that contrary
 115     to all other policies the trustedServerNames list entries can have wildcards
 116     whilst the certificate cannot.  This matches the existing deployments.
 117     @result A policy object. The caller is responsible for calling CFRelease
 118         on this when it is no longer needed.
 119 */
 120 SecPolicyRef SecPolicyCreateEAP(Boolean server, CFArrayRef trustedServerNames);
 121
 122 /*!
 123     @function SecPolicyCreateIPSec
 124     @abstract Returns a policy object for evaluating IPSec certificate chains.
 125         @param server Passing true for this parameter create a policy for IPSec
 126         server certificates.
 127         @param hostname Optional; if present, the policy will require the specified
 128         hostname or ip address to match the hostname in the leaf certificate.
 129     @result A policy object. The caller is responsible for calling CFRelease
 130         on this when it is no longer needed.
 131 */
 132 SecPolicyRef SecPolicyCreateIPSec(Boolean server, CFStringRef hostname);
 133
 134 /*!
 135     @function SecPolicyCreateiPhoneApplicationSigning
 136     @abstract Returns a policy object for evaluating signed application
 137     signatures.  This is for apps signed directly by the app store.
 138     @result A policy object. The caller is responsible for calling CFRelease
 139         on this when it is no longer needed.
 140 */
 141 SecPolicyRef SecPolicyCreateiPhoneApplicationSigning(void);
 142
 143 /*!
 144     @function SecPolicyCreateiPhoneProfileApplicationSigning
 145     @abstract Returns a policy object for evaluating signed application
 146     signatures.  This is meant for certificates inside a UPP or regular
 147     profile.  Currently it only checks for experation of the leaf and
 148     revocation status.
 149     @result A policy object. The caller is responsible for calling CFRelease
 150         on this when it is no longer needed.
 151 */
 152 SecPolicyRef SecPolicyCreateiPhoneProfileApplicationSigning(void);
 153
 154 /*!
 155     @function SecPolicyCreateiPhoneProvisioningProfileSigning
 156     @abstract Returns a policy object for evaluating provisioning profile signatures.
 157     @result A policy object. The caller is responsible for calling CFRelease
 158         on this when it is no longer needed.
 159 */
 160 SecPolicyRef SecPolicyCreateiPhoneProvisioningProfileSigning(void);
 161
 162 /*!
 163     @function SecPolicyCreateOCSPSigner
 164     @abstract Returns a policy object for evaluating ocsp response signers.
 165     @result A policy object. The caller is responsible for calling CFRelease
 166         on this when it is no longer needed.
 167 */
 168 SecPolicyRef SecPolicyCreateOCSPSigner(void);
 169
 170 /*!
 171     @function SecPolicyCreateRevocation
 172     @abstract Returns a policy object for checking revocation of certificates.
 173     @result A policy object. The caller is responsible for calling CFRelease
 174         on this when it is no longer needed.
 175 */
 176 SecPolicyRef SecPolicyCreateRevocation(void);
 177
 178 enum {
 179     kSecSignSMIMEUsage = (1 << 0),
 180     kSecKeyEncryptSMIMEUsage = (1 << 1),
 181     kSecDataEncryptSMIMEUsage = (1 << 2),
 182     kSecKeyExchangeDecryptSMIMEUsage = (1 << 3),
 183     kSecKeyExchangeEncryptSMIMEUsage = (1 << 4),
 184     kSecKeyExchangeBothSMIMEUsage = (1 << 5),
 185     kSecAnyEncryptSMIME = kSecKeyEncryptSMIMEUsage | kSecDataEncryptSMIMEUsage |
 186         kSecKeyExchangeDecryptSMIMEUsage | kSecKeyExchangeEncryptSMIMEUsage
 187 };
 188
 189 /*!
 190     @function SecPolicyCreateSMIME
 191     @abstract Returns a policy object for evaluating S/MIME certificate chains.
 192         @param smimeUsage Pass the bitwise or of one or more kSecXXXSMIMEUsage
 193     flags, to indicated the intended usage of this certificate.  A certificate which allows
 194         @param email Optional; if present, the policy will require the specified
 195         email to match the email in the leaf certificate.
 196     @result A policy object. The caller is responsible for calling CFRelease
 197         on this when it is no longer needed.
 198 */
 199 SecPolicyRef SecPolicyCreateSMIME(CFIndex smimeUsage, CFStringRef email);
 200
 201 /*!
 202     @function SecPolicyCreateCodeSigning
 203     @abstract Returns a policy object for evaluating code signing certificate chains.
 204     @result A policy object. The caller is responsible for calling CFRelease
 205         on this when it is no longer needed.
 206 */
 207 SecPolicyRef SecPolicyCreateCodeSigning(void);
 208
 209 /*!
 210     @function SecPolicyCreateLockdownPairing
 211     @abstract basic x509 policy for checking lockdown pairing certificate chains.
 212         It explicitly allows for empty subjects
 213 */
 214 SecPolicyRef SecPolicyCreateLockdownPairing(void);
 215
 216 /*!
 217  @function SecPolicyCreateURLBag
 218  @abstract check for private CA, eku codesigning and certificate policy that
 219  pertains to signing of URL bags.
 220  */
 221 SecPolicyRef SecPolicyCreateURLBag(void);
 222
 223 /*!
 224  @function SecPolicyCreateOTATasking
 225  @abstract check for 3 long chain through Apple Certification Policy with common name
 226            "OTA Task Signing".
 227  */
 228 SecPolicyRef SecPolicyCreateOTATasking(void);
 229
 230 /*!
 231  @function SecPolicyCreateMobileAsset
 232  @abstract check for 3 long chain through Apple Certification Policy with common name
 233            "Asset Manifest Signing".
 234  */
 235 SecPolicyRef SecPolicyCreateMobileAsset(void);
 236
 237 /*!
 238     @function SecPolicyCreateAppleIDAuthorityPolicy
 239     @abstract check for an Apple ID identity per marker in the leaf and marker in the intermediate, rooted in the Apple CA.
 240  */
 241 SecPolicyRef SecPolicyCreateAppleIDAuthorityPolicy(void);
 242
 243 #if defined(__cplusplus)
 244 }
 245 #endif
 246
 247 #endif /* !_SECURITY_SECPOLICYPRIV_H_ */