libsecurity_cssm/lib/oidscert.cpp

   1 /*
   2  * Copyright (c) 2000-2004 Apple Computer, Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 /*
  26
  27  File:      oidscert.cpp
  28
  29  Contains:  Object Identifiers for X509 Certificate Library
  30
  31  Copyright (c) 1999,2001-2004 Apple Computer, Inc. All Rights Reserved.
  32
  33  */
  34
  35 #include "oidsbase.h"
  36 #include "oidscert.h"
  37
  38 /* required until PR-3347430 Security/cdsa/cdsa/oidscert.h is checked
  39  * into TOT - pending public API review */
  40 extern "C" {
  41         extern const CSSM_OID CSSMOID_X509V1IssuerNameStd,
  42                 CSSMOID_X509V1SubjectNameStd;
  43 }
  44
  45 static const uint8
  46
  47         /* Certificate OID Fields */
  48         X509V3SignedCertificate[]                                       = {INTEL_X509V3_CERT_R08, 0},
  49         X509V3SignedCertificateCStruct[]                        = {INTEL_X509V3_CERT_R08, 0, INTEL_X509_C_DATATYPE},
  50         X509V3Certificate[]                                                     = {INTEL_X509V3_CERT_R08, 1},
  51         X509V3CertificateCStruct[]                                      = {INTEL_X509V3_CERT_R08, 1, INTEL_X509_C_DATATYPE},
  52         X509V1Version[]                                                         = {INTEL_X509V3_CERT_R08, 2},
  53         X509V1SerialNumber[]                                            = {INTEL_X509V3_CERT_R08, 3},
  54         X509V1IssuerName[]                                                      = {INTEL_X509V3_CERT_R08, 5},
  55         X509V1IssuerNameCStruct[]                                       = {INTEL_X509V3_CERT_R08, 5, INTEL_X509_C_DATATYPE},
  56         X509V1IssuerNameLDAP[]                                          = {INTEL_X509V3_CERT_R08, 5, INTEL_X509_LDAPSTRING_DATATYPE},
  57         X509V1ValidityNotBefore[]                                       = {INTEL_X509V3_CERT_R08, 6},
  58         X509V1ValidityNotAfter[]                                        = {INTEL_X509V3_CERT_R08, 7},
  59         X509V1SubjectName[]                                                     = {INTEL_X509V3_CERT_R08, 8},
  60         X509V1SubjectNameCStruct[]                                      = {INTEL_X509V3_CERT_R08, 8, INTEL_X509_C_DATATYPE},
  61         X509V1SubjectNameLDAP[]                                         = {INTEL_X509V3_CERT_R08, 8, INTEL_X509_LDAPSTRING_DATATYPE},
  62         X509V1SubjectPublicKeyAlgorithm[]                       = {INTEL_X509V3_CERT_R08, 9},
  63         X509V1SubjectPublicKey[]                                        = {INTEL_X509V3_CERT_R08, 10},
  64         X509V1CertificateIssuerUniqueId[]                       = {INTEL_X509V3_CERT_R08, 11},
  65         X509V1CertificateSubjectUniqueId[]                      = {INTEL_X509V3_CERT_R08, 12},
  66         X509V3CertificateExtensionStruct[]                      = {INTEL_X509V3_CERT_R08, 13},
  67         X509V3CertificateExtensionCStruct[]                     = {INTEL_X509V3_CERT_R08, 13, INTEL_X509_C_DATATYPE},
  68         X509V3CertificateNumberOfExtensions[]           = {INTEL_X509V3_CERT_R08, 14},
  69         X509V3CertificateExtensionId[]                          = {INTEL_X509V3_CERT_R08, 15},
  70         X509V3CertificateExtensionCritical[]            = {INTEL_X509V3_CERT_R08, 16},
  71         X509V3CertificateExtensionValue[]                       = {INTEL_X509V3_CERT_R08, 17},
  72         X509V1SubjectPublicKeyAlgorithmParameters[]     = {INTEL_X509V3_CERT_R08, 18},
  73         X509V3CertificateExtensionType[]                        = {INTEL_X509V3_CERT_R08, 19},
  74         CSSMKeyStruct[]                                                         = {INTEL_X509V3_CERT_R08, 20},
  75         X509V1SubjectPublicKeyCStruct[]                         = {INTEL_X509V3_CERT_R08, 20, INTEL_X509_C_DATATYPE},
  76         X509V3CertificateExtensionsStruct[]                     = {INTEL_X509V3_CERT_R08, 21},
  77         X509V3CertificateExtensionsCStruct[]            = {INTEL_X509V3_CERT_R08, 21, INTEL_X509_C_DATATYPE},
  78         X509V1SubjectNameStd[]                                          = {INTEL_X509V3_CERT_R08, 22},
  79         X509V1IssuerNameStd[]                                           = {INTEL_X509V3_CERT_R08, 23},
  80
  81         /* Signature OID Fields */
  82         X509V1SignatureStruct[]                                         = {INTEL_X509V3_SIGN_R08, 0},
  83         X509V1SignatureCStruct[]                                        = {INTEL_X509V3_SIGN_R08, 0, INTEL_X509_C_DATATYPE},
  84         /* for the algorithm ID in the cert proper */
  85         X509V1SignatureAlgorithm[]                                      = {INTEL_X509V3_SIGN_R08, 1},
  86         /* for the one in TBSCert */
  87         X509V1SignatureAlgorithmTBS[]                           = {INTEL_X509V3_SIGN_R08, 10},
  88         X509V1SignatureAlgorithmParameters[]            = {INTEL_X509V3_SIGN_R08, 3},
  89         X509V1Signature[]                                                       = {INTEL_X509V3_SIGN_R08, 2},
  90
  91         /* Extension OID Fields */
  92         SubjectSignatureBitmap[]                                        = {INTEL_X509V3_CERT_PRIVATE_EXTENSIONS, 1},
  93         SubjectPicture[]                                                        = {INTEL_X509V3_CERT_PRIVATE_EXTENSIONS, 2},
  94         SubjectEmailAddress[]                                           = {INTEL_X509V3_CERT_PRIVATE_EXTENSIONS, 3},
  95         UseExemptions[]                                                         = {INTEL_X509V3_CERT_PRIVATE_EXTENSIONS, 4};
  96
  97
  98 const CSSM_OID
  99
 100         /* Certificate OIDS */
 101         CSSMOID_X509V3SignedCertificate                         = {INTEL_X509V3_CERT_R08_LENGTH+1,  (uint8 *)X509V3SignedCertificate},
 102         CSSMOID_X509V3SignedCertificateCStruct          = {INTEL_X509V3_CERT_R08_LENGTH+2,
 103                                                                                                         (uint8 *)X509V3SignedCertificateCStruct},
 104         CSSMOID_X509V3Certificate                                       = {INTEL_X509V3_CERT_R08_LENGTH+1,  (uint8 *)X509V3Certificate},
 105         CSSMOID_X509V3CertificateCStruct                        = {INTEL_X509V3_CERT_R08_LENGTH+2,  (uint8 *)X509V3CertificateCStruct},
 106         CSSMOID_X509V1Version                                           = {INTEL_X509V3_CERT_R08_LENGTH+1,  (uint8 *)X509V1Version},
 107         CSSMOID_X509V1SerialNumber                              = {INTEL_X509V3_CERT_R08_LENGTH+1,  (uint8 *)X509V1SerialNumber},
 108         CSSMOID_X509V1IssuerName                                        = {INTEL_X509V3_CERT_R08_LENGTH+1,  (uint8 *)X509V1IssuerName},
 109         CSSMOID_X509V1IssuerNameStd                             = {INTEL_X509V3_CERT_R08_LENGTH+1,  (uint8 *)X509V1IssuerNameStd},
 110         CSSMOID_X509V1IssuerNameCStruct                         = {INTEL_X509V3_CERT_R08_LENGTH+2,  (uint8 *)X509V1IssuerNameCStruct},
 111         CSSMOID_X509V1IssuerNameLDAP                            = {INTEL_X509V3_CERT_R08_LENGTH+2,  (uint8 *)X509V1IssuerNameLDAP},
 112         CSSMOID_X509V1ValidityNotBefore                         = {INTEL_X509V3_CERT_R08_LENGTH+1,  (uint8 *)X509V1ValidityNotBefore},
 113         CSSMOID_X509V1ValidityNotAfter                          = {INTEL_X509V3_CERT_R08_LENGTH+1,  (uint8 *)X509V1ValidityNotAfter},
 114         CSSMOID_X509V1SubjectName                                       = {INTEL_X509V3_CERT_R08_LENGTH+1,  (uint8 *)X509V1SubjectName},
 115         CSSMOID_X509V1SubjectNameStd                            = {INTEL_X509V3_CERT_R08_LENGTH+1,  (uint8 *)X509V1SubjectNameStd},
 116         CSSMOID_X509V1SubjectNameCStruct                        = {INTEL_X509V3_CERT_R08_LENGTH+2,  (uint8 *)X509V1SubjectNameCStruct},
 117         CSSMOID_X509V1SubjectNameLDAP                           = {INTEL_X509V3_CERT_R08_LENGTH+2,  (uint8 *)X509V1SubjectNameLDAP},
 118         CSSMOID_CSSMKeyStruct                                           = {INTEL_X509V3_CERT_R08_LENGTH+1,  (uint8 *)CSSMKeyStruct},
 119         CSSMOID_X509V1SubjectPublicKeyCStruct           = {INTEL_X509V3_CERT_R08_LENGTH+2,
 120                                                                                                         (uint8 *)X509V1SubjectPublicKeyCStruct},
 121         CSSMOID_X509V1SubjectPublicKeyAlgorithm         = {INTEL_X509V3_CERT_R08_LENGTH+1,
 122                                                                                                         (uint8 *)X509V1SubjectPublicKeyAlgorithm},
 123         CSSMOID_X509V1SubjectPublicKeyAlgorithmParameters = {INTEL_X509V3_CERT_R08_LENGTH+1,
 124                                                                                                         (uint8 *)X509V1SubjectPublicKeyAlgorithmParameters},
 125         CSSMOID_X509V1SubjectPublicKey                          = {INTEL_X509V3_CERT_R08_LENGTH+1,  (uint8 *)X509V1SubjectPublicKey},
 126         CSSMOID_X509V1CertificateIssuerUniqueId         = {INTEL_X509V3_CERT_R08_LENGTH+1,
 127                                                                                                         (uint8 *)X509V1CertificateIssuerUniqueId},
 128         CSSMOID_X509V1CertificateSubjectUniqueId        = {INTEL_X509V3_CERT_R08_LENGTH+1,
 129                                                                                                         (uint8 *)X509V1CertificateSubjectUniqueId},
 130         CSSMOID_X509V3CertificateExtensionsStruct       = {INTEL_X509V3_CERT_R08_LENGTH+1,
 131                                                                                                         (uint8 *)X509V3CertificateExtensionsStruct},
 132         CSSMOID_X509V3CertificateExtensionsCStruct  = {INTEL_X509V3_CERT_R08_LENGTH+2,
 133                                                                                                         (uint8 *)X509V3CertificateExtensionsCStruct},
 134         CSSMOID_X509V3CertificateNumberOfExtensions = {INTEL_X509V3_CERT_R08_LENGTH+1,
 135                                                                                                         (uint8 *)X509V3CertificateNumberOfExtensions},
 136         CSSMOID_X509V3CertificateExtensionStruct        = {INTEL_X509V3_CERT_R08_LENGTH+1,
 137                                                                                                         (uint8 *)X509V3CertificateExtensionStruct},
 138         CSSMOID_X509V3CertificateExtensionCStruct       = {INTEL_X509V3_CERT_R08_LENGTH+2,
 139                                                                                                         (uint8 *)X509V3CertificateExtensionCStruct},
 140         CSSMOID_X509V3CertificateExtensionId            = {INTEL_X509V3_CERT_R08_LENGTH+1,
 141                                                                                                         (uint8 *)X509V3CertificateExtensionId},
 142         CSSMOID_X509V3CertificateExtensionCritical  = {INTEL_X509V3_CERT_R08_LENGTH+1,
 143                                                                                                         (uint8 *)X509V3CertificateExtensionCritical},
 144         CSSMOID_X509V3CertificateExtensionType          = {INTEL_X509V3_CERT_R08_LENGTH+1,
 145                                                                                                         (uint8 *)X509V3CertificateExtensionType},
 146         CSSMOID_X509V3CertificateExtensionValue         = {INTEL_X509V3_CERT_R08_LENGTH+1,
 147                                                                                                         (uint8 *)X509V3CertificateExtensionValue},
 148
 149         /* Signature OID Fields */
 150         CSSMOID_X509V1SignatureStruct                           = {INTEL_X509V3_SIGN_R08_LENGTH+1,  (uint8 *)X509V1SignatureStruct},
 151         CSSMOID_X509V1SignatureCStruct                          = {INTEL_X509V3_SIGN_R08_LENGTH+2,  (uint8 *)X509V1SignatureCStruct},
 152         CSSMOID_X509V1SignatureAlgorithm                        = {INTEL_X509V3_SIGN_R08_LENGTH+1,  (uint8 *)X509V1SignatureAlgorithm},
 153         CSSMOID_X509V1SignatureAlgorithmTBS             = {INTEL_X509V3_SIGN_R08_LENGTH+1,  (uint8 *)X509V1SignatureAlgorithmTBS},
 154         CSSMOID_X509V1SignatureAlgorithmParameters      = {INTEL_X509V3_SIGN_R08_LENGTH+1,
 155                                                                                                         (uint8 *)X509V1SignatureAlgorithmParameters},
 156         CSSMOID_X509V1Signature                                         = {INTEL_X509V3_SIGN_R08_LENGTH+1,  (uint8 *)X509V1Signature},
 157
 158         /* Extension OID Fields */
 159         CSSMOID_SubjectSignatureBitmap                          = {INTEL_X509V3_CERT_PRIVATE_EXTENSIONS_LENGTH+1,  (uint8 *)SubjectSignatureBitmap},
 160         CSSMOID_SubjectPicture                                          = {INTEL_X509V3_CERT_PRIVATE_EXTENSIONS_LENGTH+1,  (uint8 *)SubjectPicture},
 161         CSSMOID_SubjectEmailAddress                             = {INTEL_X509V3_CERT_PRIVATE_EXTENSIONS_LENGTH+1,  (uint8 *)SubjectEmailAddress},
 162         CSSMOID_UseExemptions                                           = {INTEL_X509V3_CERT_PRIVATE_EXTENSIONS_LENGTH+1, (uint8 *)UseExemptions};
 163
 164
 165 /***
 166  *** Apple addenda.
 167  ***/
 168
 169 /*
 170  * Standard Cert extensions.
 171  */
 172 static const uint8
 173         OID_SubjectDirectoryAttributes[]        = { OID_EXTENSION, 9 },
 174         OID_SubjectKeyIdentifier[]                      = { OID_EXTENSION, 14 },
 175         OID_KeyUsage[]                                  = { OID_EXTENSION, 15 },
 176         OID_PrivateKeyUsagePeriod[]             = { OID_EXTENSION, 16 },
 177         OID_SubjectAltName[]                            = { OID_EXTENSION, 17 },
 178         OID_IssuerAltName[]                     = { OID_EXTENSION, 18 },
 179         OID_BasicConstraints[]                  = { OID_EXTENSION, 19 },
 180         OID_CrlNumber[]                         = { OID_EXTENSION, 20 },
 181         OID_CrlReason[]                         = { OID_EXTENSION, 21 },
 182         OID_HoldInstructionCode[]               = { OID_EXTENSION, 23 },
 183         OID_InvalidityDate[]                    = { OID_EXTENSION, 24 },
 184         OID_DeltaCrlIndicator[]                 = { OID_EXTENSION, 27 },
 185         OID_IssuingDistributionPoint[]      = { OID_EXTENSION, 28 },
 186         OID_CertIssuer[]                                    = { OID_EXTENSION, 29 },
 187         OID_NameConstraints[]                   = { OID_EXTENSION, 30 },
 188         OID_CrlDistributionPoints[]             = { OID_EXTENSION, 31 },
 189         OID_CertificatePolicies[]               = { OID_EXTENSION, 32 },
 190         OID_PolicyMappings[]                    = { OID_EXTENSION, 33 },
 191         OID_AuthorityKeyIdentifier[]            = { OID_EXTENSION, 35 },
 192         OID_PolicyConstraints[]                 = { OID_EXTENSION, 36 },
 193         OID_ExtendedKeyUsage[]                          = { OID_EXTENSION, 37 },
 194         OID_InhibitAnyPolicy[]                          = { OID_EXTENSION, 54 },
 195         OID_AuthorityInfoAccess[]                       = { OID_PE, 1 },
 196         OID_BiometricInfo[]                                     = { OID_PE, 2 },
 197         OID_QC_Statements[]                                     = { OID_PE, 3 },
 198         OID_SubjectInfoAccess[]                         = { OID_PE, 11 },
 199
 200         /* Individual OIDS appearing in an ExtendedKeyUsage extension */
 201         OID_ExtendedKeyUsageAny[]                       = { OID_EXTENSION, 37, 0 },
 202         OID_KP_ServerAuth[]                                     = { OID_KP, 1 },
 203         OID_KP_ClientAuth[]                                     = { OID_KP, 2 },
 204         OID_KP_ExtendedUseCodeSigning[]         = { OID_KP, 3 },
 205         OID_KP_EmailProtection[]                        = { OID_KP, 4 },
 206         OID_KP_TimeStamping[]                           = { OID_KP, 8 },
 207         OID_KP_OCSPSigning[]                            = { OID_KP, 9 },
 208         /* Kerberos PKINIT Extended Key Use values */
 209         OID_KERBv5_PKINIT_KP_CLIENT_AUTH[]      = { OID_KERBv5_PKINIT, 4 },
 210         OID_KERBv5_PKINIT_KP_KDC[]                      = { OID_KERBv5_PKINIT, 5 },
 211         /* IPSec */
 212         OID_EKU_IPSec[]                                         = { 0x2B, 0x06, 0x01, 0x05, 0x05, 0x08, 0x02, 0x02 },
 213
 214         /* .mac Certificate Extended Key Use values */
 215         OID_DOTMAC_CERT_EXTENSION[]             = { APPLE_DOTMAC_CERT_EXTEN_OID },
 216         OID_DOTMAC_CERT_IDENTITY[]              = { APPLE_DOTMAC_CERT_EXTEN_OID, 1 },
 217         OID_DOTMAC_CERT_EMAIL_SIGN[]    = { APPLE_DOTMAC_CERT_EXTEN_OID, 2 },
 218         OID_DOTMAC_CERT_EMAIL_ENCRYPT[] = { APPLE_DOTMAC_CERT_EXTEN_OID, 3 },
 219         /* Other Apple extended key usage values */
 220         OID_APPLE_EKU_CODE_SIGNING[]            = { APPLE_EKU_CODE_SIGNING },
 221         OID_APPLE_EKU_CODE_SIGNING_DEV[]        = { APPLE_EKU_CODE_SIGNING, 1 },
 222         OID_APPLE_EKU_RESOURCE_SIGNING[]        = { APPLE_EKU_CODE_SIGNING, 4 },
 223         OID_APPLE_EKU_ICHAT_SIGNING[]           = { APPLE_EKU_OID, 2 },
 224         OID_APPLE_EKU_ICHAT_ENCRYPTION[]        = { APPLE_EKU_OID, 3 },
 225         OID_APPLE_EKU_SYSTEM_IDENTITY[]         = { APPLE_EKU_OID, 4 },
 226         /* Apple cert policies */
 227         OID_APPLE_CERT_POLICY[]                         = { APPLE_CERT_POLICIES, 1 },
 228         OID_DOTMAC_CERT_POLICY[]                        = { APPLE_CERT_POLICIES, 2 },
 229         OID_ADC_CERT_POLICY[]                           = { APPLE_CERT_POLICIES, 3 },
 230         OID_APPLE_CERT_POLICY_MACAPPSTORE[] = { APPLE_CERT_POLICIES_MACAPPSTORE },
 231         OID_APPLE_CERT_POLICY_MACAPPSTORE_RECEIPT[] = { APPLE_CERT_POLICIES_MACAPPSTORE_RECEIPT },
 232         OID_APPLE_CERT_POLICY_APPLEID[] = { APPLE_CERT_POLICIES_APPLEID },
 233         OID_APPLE_CERT_POLICY_APPLEID_SHARING[] = { APPLE_CERT_POLICIES_APPLEID_SHARING },
 234
 235     /* Apple-specific extensions */
 236     OID_APPLE_EXTENSION[]                               = { APPLE_EXTENSION_OID },
 237     OID_APPLE_EXTENSION_CODE_SIGNING[]          = { APPLE_EXTENSION_CODE_SIGNING },
 238     OID_APPLE_EXTENSION_APPLE_SIGNING[]         = { APPLE_EXTENSION_CODE_SIGNING, 1 },
 239     OID_APPLE_EXTENSION_ADC_DEV_SIGNING[]       = { APPLE_EXTENSION_CODE_SIGNING, 2 },
 240     OID_APPLE_EXTENSION_ADC_APPLE_SIGNING[]     = { APPLE_EXTENSION_CODE_SIGNING, 3 },
 241         OID_APPLE_EXTENSION_MACAPPSTORE_RECEIPT[] = { APPLE_EXTENSION_MACAPPSTORE_RECEIPT },
 242         OID_APPLE_EXTENSION_INTERMEDIATE_MARKER[] = { APPLE_EXTENSION_INTERMEDIATE_MARKER },
 243         OID_APPLE_EXTENSION_WWDR_INTERMEDIATE[] = { APPLE_EXTENSION_WWDR_INTERMEDIATE },
 244         OID_APPLE_EXTENSION_ITMS_INTERMEDIATE[] = { APPLE_EXTENSION_ITMS_INTERMEDIATE },
 245         OID_APPLE_EXTENSION_AAI_INTERMEDIATE[] = { APPLE_EXTENSION_AAI_INTERMEDIATE },
 246         OID_APPLE_EXTENSION_APPLEID_INTERMEDIATE[] = { APPLE_EXTENSION_APPLEID_INTERMEDIATE },
 247         OID_APPLE_EXTENSION_APPLEID_SHARING[]   = { APPLE_EXTENSION_APPLEID_SHARING }
 248 ;
 249
 250 #define OID_PKCS_CE_LENGTH      OID_EXTENSION_LENGTH + 1
 251
 252 const CSSM_OID
 253 CSSMOID_SubjectDirectoryAttributes = { OID_PKCS_CE_LENGTH, (uint8 *)OID_SubjectDirectoryAttributes},
 254 CSSMOID_SubjectKeyIdentifier    = { OID_PKCS_CE_LENGTH, (uint8 *)OID_SubjectKeyIdentifier},
 255 CSSMOID_KeyUsage                                = { OID_PKCS_CE_LENGTH, (uint8 *)OID_KeyUsage},
 256 CSSMOID_PrivateKeyUsagePeriod   = { OID_PKCS_CE_LENGTH, (uint8 *)OID_PrivateKeyUsagePeriod},
 257 CSSMOID_SubjectAltName                  = { OID_PKCS_CE_LENGTH, (uint8 *)OID_SubjectAltName},
 258 CSSMOID_IssuerAltName                   = { OID_PKCS_CE_LENGTH, (uint8 *)OID_IssuerAltName},
 259 CSSMOID_BasicConstraints                = { OID_PKCS_CE_LENGTH, (uint8 *)OID_BasicConstraints},
 260 CSSMOID_CrlNumber                               = { OID_PKCS_CE_LENGTH, (uint8 *)OID_CrlNumber},
 261 CSSMOID_CrlReason                               = { OID_PKCS_CE_LENGTH, (uint8 *)OID_CrlReason},
 262 CSSMOID_HoldInstructionCode     = { OID_PKCS_CE_LENGTH, (uint8 *)OID_HoldInstructionCode},
 263 CSSMOID_InvalidityDate                  = { OID_PKCS_CE_LENGTH, (uint8 *)OID_InvalidityDate},
 264 CSSMOID_DeltaCrlIndicator               = { OID_PKCS_CE_LENGTH, (uint8 *)OID_DeltaCrlIndicator},
 265 CSSMOID_IssuingDistributionPoint = { OID_PKCS_CE_LENGTH, (uint8 *)OID_IssuingDistributionPoint},
 266 /* for backwards compatibility... */
 267 CSSMOID_IssuingDistributionPoints = { OID_PKCS_CE_LENGTH, (uint8 *)OID_IssuingDistributionPoint},
 268 CSSMOID_CertIssuer                              = { OID_PKCS_CE_LENGTH, (uint8 *)OID_CertIssuer},
 269 CSSMOID_NameConstraints                 = { OID_PKCS_CE_LENGTH, (uint8 *)OID_NameConstraints},
 270 CSSMOID_CrlDistributionPoints   = { OID_PKCS_CE_LENGTH, (uint8 *)OID_CrlDistributionPoints},
 271 CSSMOID_CertificatePolicies     = { OID_PKCS_CE_LENGTH, (uint8 *)OID_CertificatePolicies},
 272 CSSMOID_PolicyMappings                  = { OID_PKCS_CE_LENGTH, (uint8 *)OID_PolicyMappings},
 273 CSSMOID_PolicyConstraints               = { OID_PKCS_CE_LENGTH, (uint8 *)OID_PolicyConstraints},
 274 CSSMOID_AuthorityKeyIdentifier  = { OID_PKCS_CE_LENGTH, (uint8 *)OID_AuthorityKeyIdentifier},
 275 CSSMOID_ExtendedKeyUsage                = { OID_PKCS_CE_LENGTH, (uint8 *)OID_ExtendedKeyUsage},
 276 CSSMOID_InhibitAnyPolicy                = { OID_PKCS_CE_LENGTH, (uint8 *)OID_InhibitAnyPolicy},
 277 CSSMOID_AuthorityInfoAccess             = { OID_PE_LENGTH+1, (uint8 *)OID_AuthorityInfoAccess},
 278 CSSMOID_BiometricInfo                   = { OID_PE_LENGTH+1, (uint8 *)OID_BiometricInfo},
 279 CSSMOID_QC_Statements                   = { OID_PE_LENGTH+1, (uint8 *)OID_QC_Statements},
 280 CSSMOID_SubjectInfoAccess               = { OID_PE_LENGTH+1, (uint8 *)OID_SubjectInfoAccess},
 281 CSSMOID_ExtendedKeyUsageAny             = { OID_PKCS_CE_LENGTH+1, (uint8 *)OID_ExtendedKeyUsageAny},
 282 CSSMOID_ServerAuth                              = { OID_KP_LENGTH+1, (uint8 *)OID_KP_ServerAuth},
 283 CSSMOID_ClientAuth                              = { OID_KP_LENGTH+1, (uint8 *)OID_KP_ClientAuth},
 284 CSSMOID_ExtendedUseCodeSigning  = { OID_KP_LENGTH+1, (uint8 *)OID_KP_ExtendedUseCodeSigning},
 285 CSSMOID_EmailProtection                 = { OID_KP_LENGTH+1, (uint8 *)OID_KP_EmailProtection},
 286 CSSMOID_TimeStamping                    = { OID_KP_LENGTH+1, (uint8 *)OID_KP_TimeStamping},
 287 CSSMOID_OCSPSigning                             = { OID_KP_LENGTH+1, (uint8 *)OID_KP_OCSPSigning},
 288 CSSMOID_KERBv5_PKINIT_KP_CLIENT_AUTH = { OID_KERBv5_PKINIT_LEN + 1,
 289                                                                                 (uint8 *)OID_KERBv5_PKINIT_KP_CLIENT_AUTH },
 290 CSSMOID_KERBv5_PKINIT_KP_KDC            = { OID_KERBv5_PKINIT_LEN + 1,
 291                                                                                 (uint8 *)OID_KERBv5_PKINIT_KP_KDC },
 292 CSSMOID_EKU_IPSec                                       = { 8, (uint8 *)OID_EKU_IPSec },
 293 CSSMOID_DOTMAC_CERT_EXTENSION           = { APPLE_DOTMAC_CERT_EXTEN_OID_LENGTH,
 294                                                                                 (uint8 *)OID_DOTMAC_CERT_EXTENSION },
 295 CSSMOID_DOTMAC_CERT_IDENTITY            = { APPLE_DOTMAC_CERT_EXTEN_OID_LENGTH + 1,
 296                                                                                 (uint8 *)OID_DOTMAC_CERT_IDENTITY },
 297 CSSMOID_DOTMAC_CERT_EMAIL_SIGN          = { APPLE_DOTMAC_CERT_EXTEN_OID_LENGTH + 1,
 298                                                                                 (uint8 *)OID_DOTMAC_CERT_EMAIL_SIGN },
 299 CSSMOID_DOTMAC_CERT_EMAIL_ENCRYPT       = { APPLE_DOTMAC_CERT_EXTEN_OID_LENGTH + 1,
 300                                                                                 (uint8 *)OID_DOTMAC_CERT_EMAIL_ENCRYPT },
 301 CSSMOID_APPLE_CERT_POLICY                       = { APPLE_CERT_POLICIES_LENGTH + 1,
 302                                                                                 (uint8 *)OID_APPLE_CERT_POLICY },
 303 CSSMOID_DOTMAC_CERT_POLICY                      = { APPLE_CERT_POLICIES_LENGTH + 1,
 304                                                                                 (uint8 *)OID_DOTMAC_CERT_POLICY },
 305 CSSMOID_ADC_CERT_POLICY                         = { APPLE_CERT_POLICIES_LENGTH + 1,
 306                                                                                 (uint8 *)OID_ADC_CERT_POLICY },
 307 CSSMOID_MACAPPSTORE_CERT_POLICY         = { APPLE_CERT_POLICIES_MACAPPSTORE_LENGTH,
 308                                                                                 (uint8 *)OID_APPLE_CERT_POLICY_MACAPPSTORE },
 309 CSSMOID_MACAPPSTORE_RECEIPT_CERT_POLICY = { APPLE_CERT_POLICIES_MACAPPSTORE_RECEIPT_LENGTH,
 310                                                                                 (uint8 *)OID_APPLE_CERT_POLICY_MACAPPSTORE_RECEIPT },
 311 CSSMOID_APPLEID_CERT_POLICY                     = { APPLE_CERT_POLICIES_APPLEID_LENGTH,
 312                                                                                 (uint8 *)OID_APPLE_CERT_POLICY_APPLEID },
 313 CSSMOID_APPLEID_SHARING_CERT_POLICY     = { APPLE_CERT_POLICIES_APPLEID_SHARING_LENGTH,
 314                                                                                 (uint8 *)OID_APPLE_CERT_POLICY_APPLEID_SHARING },
 315 CSSMOID_APPLE_EKU_CODE_SIGNING          = { APPLE_EKU_CODE_SIGNING_LENGTH,
 316                                                                                 (uint8 *)OID_APPLE_EKU_CODE_SIGNING },
 317 CSSMOID_APPLE_EKU_CODE_SIGNING_DEV      = { APPLE_EKU_CODE_SIGNING_LENGTH + 1,
 318                                                                                 (uint8 *)OID_APPLE_EKU_CODE_SIGNING_DEV },
 319 CSSMOID_APPLE_EKU_RESOURCE_SIGNING      = { APPLE_EKU_CODE_SIGNING_LENGTH + 1,
 320                                                                                 (uint8 *)OID_APPLE_EKU_RESOURCE_SIGNING },
 321 CSSMOID_APPLE_EKU_ICHAT_SIGNING         = { APPLE_EKU_OID_LENGTH + 1,
 322                                                                                 (uint8 *)OID_APPLE_EKU_ICHAT_SIGNING },
 323 CSSMOID_APPLE_EKU_ICHAT_ENCRYPTION      = { APPLE_EKU_OID_LENGTH + 1,
 324                                                                                 (uint8 *)OID_APPLE_EKU_ICHAT_ENCRYPTION },
 325 CSSMOID_APPLE_EKU_SYSTEM_IDENTITY       = { APPLE_EKU_OID_LENGTH + 1,
 326                                                                                 (uint8 *)OID_APPLE_EKU_SYSTEM_IDENTITY },
 327 CSSMOID_APPLE_EXTENSION                         = { APPLE_EXTENSION_OID_LENGTH,
 328                                                                                 (uint8 *)OID_APPLE_EXTENSION },
 329 CSSMOID_APPLE_EXTENSION_CODE_SIGNING            = { APPLE_EXTENSION_CODE_SIGNING_LENGTH,
 330                                                                                                 (uint8 *)OID_APPLE_EXTENSION_CODE_SIGNING },
 331 CSSMOID_APPLE_EXTENSION_APPLE_SIGNING           = { APPLE_EXTENSION_CODE_SIGNING_LENGTH + 1,
 332                                                                                                 (uint8 *)OID_APPLE_EXTENSION_APPLE_SIGNING },
 333 CSSMOID_APPLE_EXTENSION_ADC_DEV_SIGNING         = { APPLE_EXTENSION_CODE_SIGNING_LENGTH + 2,
 334                                                                                                 (uint8 *)OID_APPLE_EXTENSION_ADC_DEV_SIGNING },
 335 CSSMOID_APPLE_EXTENSION_ADC_APPLE_SIGNING       = { APPLE_EXTENSION_CODE_SIGNING_LENGTH + 3,
 336                                                                                                 (uint8 *)OID_APPLE_EXTENSION_ADC_DEV_SIGNING },
 337 CSSMOID_APPLE_EXTENSION_MACAPPSTORE_RECEIPT    = { APPLE_EXTENSION_MACAPPSTORE_RECEIPT_LENGTH,
 338                                                                                                 (uint8 *)OID_APPLE_EXTENSION_MACAPPSTORE_RECEIPT },
 339 CSSMOID_APPLE_EXTENSION_INTERMEDIATE_MARKER   = { APPLE_EXTENSION_INTERMEDIATE_MARKER_LENGTH,
 340                                                                                                 (uint8 *)OID_APPLE_EXTENSION_INTERMEDIATE_MARKER },
 341 CSSMOID_APPLE_EXTENSION_WWDR_INTERMEDIATE     = { APPLE_EXTENSION_WWDR_INTERMEDIATE_LENGTH + 1,
 342                                                                                                 (uint8 *)OID_APPLE_EXTENSION_WWDR_INTERMEDIATE },
 343 CSSMOID_APPLE_EXTENSION_ITMS_INTERMEDIATE     = { APPLE_EXTENSION_ITMS_INTERMEDIATE_LENGTH + 1,
 344                                                                                                 (uint8 *)OID_APPLE_EXTENSION_ITMS_INTERMEDIATE },
 345 CSSMOID_APPLE_EXTENSION_AAI_INTERMEDIATE      = { APPLE_EXTENSION_AAI_INTERMEDIATE_LENGTH + 1,
 346                                                                                                 (uint8 *)OID_APPLE_EXTENSION_AAI_INTERMEDIATE },
 347 CSSMOID_APPLE_EXTENSION_APPLEID_INTERMEDIATE    = { APPLE_EXTENSION_APPLEID_INTERMEDIATE_LENGTH + 1,
 348                                                                                                 (uint8 *)OID_APPLE_EXTENSION_APPLEID_INTERMEDIATE },
 349 CSSMOID_APPLE_EXTENSION_APPLEID_SHARING               = { APPLE_EXTENSION_APPLEID_INTERMEDIATE_LENGTH + 1,
 350                                                                                                 (uint8 *)OID_APPLE_EXTENSION_APPLEID_SHARING }
 351 ;
 352
 353 /* Apple Intermediate Marker OIDs */
 354 #define APPLE_CERT_EXT_INTERMEDIATE_MARKER APPLE_CERT_EXT, 2
 355 /* Apple Apple ID Intermediate Marker */
 356 #define APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLEID APPLE_CERT_EXT_INTERMEDIATE_MARKER, 3
 357 /*
 358  *  Apple Apple ID Intermediate Marker (New subCA, no longer shared with push notification server cert issuer
 359  *
 360  *  appleCertificateExtensionAppleIDIntermediate ::=
 361  *    { appleCertificateExtensionIntermediateMarker 7 }
 362  *    { 1 2 840 113635 100 6 2 7 }
 363  */
 364 #define APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLEID_2 APPLE_CERT_EXT_INTERMEDIATE_MARKER, 7
 365
 366 /*
 367  * Netscape extensions.
 368  *
 369  *  netscape-cert-type OBJECT IDENTIFIER ::=
 370  *              { 2 16 840 1 113730 1 1 }
 371  *
 372  *      BER = 06 08 60 86 48 01 86 F8 42 01 01
 373  */
 374 static const uint8      OID_NetscapeCertType[]          = {NETSCAPE_CERT_EXTEN, 1};
 375 const CSSM_OID  CSSMOID_NetscapeCertType        =
 376         {NETSCAPE_CERT_EXTEN_LENGTH + 1, (uint8 *)OID_NetscapeCertType};
 377
 378 /*
 379  * netscape-cert-sequence ::= { 2 16 840 1 113730 2 5 }
 380  *
 381  * BER = 06 09 60 86 48 01 86 F8 42 02 05
 382  */
 383 static const uint8  OID_NetscapeCertSequence[]  =  { NETSCAPE_BASE_OID, 2, 5 };
 384 const CSSM_OID CSSMOID_NetscapeCertSequence             =
 385         { NETSCAPE_BASE_OID_LEN + 2, (uint8 *)OID_NetscapeCertSequence };
 386
 387 /*
 388  * Netscape version of ServerGatedCrypto ExtendedKeyUse.
 389  * OID { 2 16 840 1 113730 4 1 }
 390  */
 391 static const uint8 OID_Netscape_SGC[] = {NETSCAPE_CERT_POLICY, 1};
 392 const CSSM_OID CSSMOID_NetscapeSGC      =
 393         {NETSCAPE_CERT_POLICY_LENGTH + 1, (uint8 *)OID_Netscape_SGC};
 394
 395 /*
 396  * Microsoft version of ServerGatedCrypto ExtendedKeyUse.
 397  * OID { 1 3 6 1 4 1 311 10 3 3 }
 398  */
 399 static const uint8 OID_Microsoft_SGC[] = {0x2B, 0x06, 0x01, 0x04, 0x01, 0x82, 0x37, 0x0A, 0x03, 0x03};
 400 const CSSM_OID CSSMOID_MicrosoftSGC     =
 401         {10, (uint8 *)OID_Microsoft_SGC};
 402
 403 /*
 404  * .mac Certificate Extended Key Use values.
 405  */