]> git.saurik.com Git - apple/security.git/blob - cssm/cssmapple.h
projects / apple / security.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Security-59754.41.1.tar.gz
[apple/security.git] / cssm / cssmapple.h
1 /*
2 * Copyright (c) 2000-2016 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 *
23 * cssmapple.h -- CSSM features specific to Apple's Implementation
24 */
25
26 #ifndef _CSSMAPPLE_H_
27 #define _CSSMAPPLE_H_ 1
28
29 #include <Security/SecBase.h>
30
31 #if SEC_OS_OSX_INCLUDES
32 #include <Security/cssmerr.h>
33 #include <Security/cssmtype.h>
34 #include <Security/x509defs.h> /* for CSSM_APPLE_TP_CERT_REQUEST fields */
35 #include <Security/certextensions.h> /* ditto */
36 #include <sys/types.h> /* for the BSD *_t types */
37 #include <stdbool.h>
38 #endif /* SEC_OS_OSX */
39
40 #ifdef __cplusplus
41 extern "C" {
42 #endif
43
44 #pragma clang diagnostic push
45 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
46
47 #if SEC_OS_OSX
48 /* Guids for standard Apple addin modules. */
49
50 /* CSSM itself: {87191ca0-0fc9-11d4-849a-000502b52122} */
51 extern const CSSM_GUID gGuidCssm;
52
53 /* File based DL (aka "Keychain DL"): {87191ca1-0fc9-11d4-849a-000502b52122} */
54 extern const CSSM_GUID gGuidAppleFileDL;
55
56 /* Core CSP (local space): {87191ca2-0fc9-11d4-849a-000502b52122} */
57 extern const CSSM_GUID gGuidAppleCSP;
58
59 /* Secure CSP/DL (aka "Keychain CSPDL): {87191ca3-0fc9-11d4-849a-000502b52122} */
60 extern const CSSM_GUID gGuidAppleCSPDL;
61
62 /* X509 Certificate CL: {87191ca4-0fc9-11d4-849a-000502b52122} */
63 extern const CSSM_GUID gGuidAppleX509CL;
64
65 /* X509 Certificate TP: {87191ca5-0fc9-11d4-849a-000502b52122} */
66 extern const CSSM_GUID gGuidAppleX509TP;
67
68 /* DLAP/OpenDirectory access DL: {87191ca6-0fc9-11d4-849a-000502b52122} */
69 extern const CSSM_GUID gGuidAppleLDAPDL;
70
71 /* TP for ".mac" related policies: {87191ca7-0fc9-11d4-849a-000502b52122} */
72 extern const CSSM_GUID gGuidAppleDotMacTP;
73
74 /* Smartcard CSP/DL: {87191ca8-0fc9-11d4-849a-000502b52122} */
75 extern const CSSM_GUID gGuidAppleSdCSPDL;
76
77 /* DL for ".mac" certificate access: {87191ca9-0fc9-11d4-849a-000502b52122} */
78 extern const CSSM_GUID gGuidAppleDotMacDL;
79
80
81 /* Apple defined WORDID values */
82 enum
83 {
84 CSSM_WORDID_KEYCHAIN_PROMPT = CSSM_WORDID_VENDOR_START,
85 CSSM_WORDID_KEYCHAIN_LOCK,
86 CSSM_WORDID_KEYCHAIN_CHANGE_LOCK,
87 CSSM_WORDID_PROCESS,
88 CSSM_WORDID__RESERVED_1, /* was used in 10.2 test seeds; no longer in use */
89 CSSM_WORDID_SYMMETRIC_KEY,
90 CSSM_WORDID_SYSTEM,
91 CSSM_WORDID_KEY,
92 CSSM_WORDID_PIN,
93 CSSM_WORDID_PREAUTH,
94 CSSM_WORDID_PREAUTH_SOURCE,
95 CSSM_WORDID_ASYMMETRIC_KEY,
96 CSSM_WORDID_PARTITION,
97 CSSM_WORDID_KEYBAG_KEY,
98 CSSM_WORDID__FIRST_UNUSED
99 };
100
101 /* Apple defined ACL subject and credential types */
102 enum
103 {
104 CSSM_ACL_SUBJECT_TYPE_KEYCHAIN_PROMPT = CSSM_WORDID_KEYCHAIN_PROMPT,
105 CSSM_ACL_SUBJECT_TYPE_PROCESS = CSSM_WORDID_PROCESS,
106 CSSM_ACL_SUBJECT_TYPE_CODE_SIGNATURE = CSSM_WORDID_SIGNATURE,
107 CSSM_ACL_SUBJECT_TYPE_COMMENT = CSSM_WORDID_COMMENT,
108 CSSM_ACL_SUBJECT_TYPE_SYMMETRIC_KEY = CSSM_WORDID_SYMMETRIC_KEY,
109 CSSM_ACL_SUBJECT_TYPE_PREAUTH = CSSM_WORDID_PREAUTH,
110 CSSM_ACL_SUBJECT_TYPE_PREAUTH_SOURCE = CSSM_WORDID_PREAUTH_SOURCE,
111 CSSM_ACL_SUBJECT_TYPE_ASYMMETRIC_KEY = CSSM_WORDID_ASYMMETRIC_KEY,
112 CSSM_ACL_SUBJECT_TYPE_PARTITION = CSSM_WORDID_PARTITION,
113 };
114
115 enum
116 {
117 CSSM_SAMPLE_TYPE_KEYCHAIN_PROMPT = CSSM_WORDID_KEYCHAIN_PROMPT,
118 CSSM_SAMPLE_TYPE_KEYCHAIN_LOCK = CSSM_WORDID_KEYCHAIN_LOCK,
119 CSSM_SAMPLE_TYPE_KEYCHAIN_CHANGE_LOCK = CSSM_WORDID_KEYCHAIN_CHANGE_LOCK,
120 CSSM_SAMPLE_TYPE_PROCESS = CSSM_WORDID_PROCESS,
121 CSSM_SAMPLE_TYPE_COMMENT = CSSM_WORDID_COMMENT,
122 CSSM_SAMPLE_TYPE_RETRY_ID = CSSM_WORDID_PROPAGATE,
123 CSSM_SAMPLE_TYPE_SYMMETRIC_KEY = CSSM_WORDID_SYMMETRIC_KEY,
124 CSSM_SAMPLE_TYPE_PREAUTH = CSSM_WORDID_PREAUTH,
125 CSSM_SAMPLE_TYPE_ASYMMETRIC_KEY = CSSM_WORDID_ASYMMETRIC_KEY,
126 CSSM_SAMPLE_TYPE_KEYBAG_KEY = CSSM_WORDID_KEYBAG_KEY,
127 // there is no CSSM_SAMPLE_TYPE_PREAUTH_SOURCE
128 };
129
130
131 /* Apple-defined ACL authorization tags */
132 enum {
133 CSSM_ACL_AUTHORIZATION_CHANGE_ACL = CSSM_ACL_AUTHORIZATION_TAG_VENDOR_DEFINED_START,
134 CSSM_ACL_AUTHORIZATION_CHANGE_OWNER,
135 CSSM_ACL_AUTHORIZATION_PARTITION_ID,
136 CSSM_ACL_AUTHORIZATION_INTEGRITY,
137
138 // the "pre-auth" tags form a contiguous range of (up to) 64K pre-authorizations
139 CSSM_ACL_AUTHORIZATION_PREAUTH_BASE =
140 CSSM_ACL_AUTHORIZATION_TAG_VENDOR_DEFINED_START + 0x1000000,
141 CSSM_ACL_AUTHORIZATION_PREAUTH_END = CSSM_ACL_AUTHORIZATION_PREAUTH_BASE + 0x10000
142 };
143
144 /* pre-authorization conversions (auth-tag to slot and back) */
145 #define CSSM_ACL_AUTHORIZATION_PREAUTH(slot) \
146 (CSSM_ACL_AUTHORIZATION_PREAUTH_BASE + (slot))
147 #define CSSM_ACL_AUTHORIZATION_PREAUTH_SLOT(auth) \
148 ((auth) - CSSM_ACL_AUTHORIZATION_PREAUTH_BASE)
149 #define CSSM_ACL_AUTHORIZATION_IS_PREAUTH(auth) \
150 ((auth) >= CSSM_ACL_AUTHORIZATION_PREAUTH_BASE && \
151 (auth) < CSSM_ACL_AUTHORIZATION_PREAUTH_END)
152
153
154 /* Parameters and structures for Apple-defined ACL subjects and samples */
155
156 enum { /* types of code signatures - item 1 of CSSM_ACL_SUBJECT_TYPE_CODE_SIGNATURE subjects */
157 CSSM_ACL_CODE_SIGNATURE_INVALID = 0, /* standard OS X code signature */
158 CSSM_ACL_CODE_SIGNATURE_OSX = 1 /* standard OS X code signature */
159 };
160
161 /* ACL subjects of type PROCESS */
162
163 enum { /* PROCESS_SUBJECT mask fields */
164 CSSM_ACL_MATCH_UID = 0x01, /* match userid against uid field */
165 CSSM_ACL_MATCH_GID = 0x02, /* match groupid against gid field */
166 CSSM_ACL_MATCH_HONOR_ROOT = 0x100, /* let root (uid 0) match any userid */
167 CSSM_ACL_MATCH_BITS = CSSM_ACL_MATCH_UID | CSSM_ACL_MATCH_GID
168 };
169
170 enum { /* PROCESS_SUBJECT structure version field */
171 CSSM_ACL_PROCESS_SELECTOR_CURRENT_VERSION = 0x101
172 };
173
174 typedef struct cssm_acl_process_subject_selector { /* PROCESS_SUBJECT selector */
175 uint16 version; /* version of this selector */
176 uint16 mask; /* active fields mask */
177 uint32 uid; /* effective user id match */
178 uint32 gid; /* effective group id match */
179 } CSSM_ACL_PROCESS_SUBJECT_SELECTOR;
180
181 /* ACL subjects of type KEYCHAIN_PROMPT */
182
183 enum { /* KEYCHAIN_PROMPT structure version field */
184 CSSM_ACL_KEYCHAIN_PROMPT_CURRENT_VERSION = 0x101
185 };
186
187 enum { /* KEYCHAIN_PROMPT operational flags */
188 CSSM_ACL_KEYCHAIN_PROMPT_REQUIRE_PASSPHRASE = 0x0001, /* require re-entering of passphrase */
189 /* the following bits are ignored by 10.4 and earlier */
190 CSSM_ACL_KEYCHAIN_PROMPT_UNSIGNED = 0x0010, /* prompt for unsigned clients */
191 CSSM_ACL_KEYCHAIN_PROMPT_UNSIGNED_ACT = 0x0020, /* UNSIGNED bit overrides system default */
192 CSSM_ACL_KEYCHAIN_PROMPT_INVALID = 0x0040, /* prompt for invalid signed clients */
193 CSSM_ACL_KEYCHAIN_PROMPT_INVALID_ACT = 0x0080, /* INVALID bit overrides system default */
194 };
195
196 typedef struct cssm_acl_keychain_prompt_selector { /* KEYCHAIN_PROMPT selector */
197 uint16 version; /* version of this selector */
198 uint16 flags; /* flag bits */
199 } CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR;
200
201 /* ACL subjects of type CSSM_ACL_SUBJECT_TYPE_PREAUTH_SOURCE */
202 typedef uint32 CSSM_ACL_PREAUTH_TRACKING_STATE;
203 enum { /* preauth tracking state */
204 CSSM_ACL_PREAUTH_TRACKING_COUNT_MASK = 0xff, /* mask for count status */
205 CSSM_ACL_PREAUTH_TRACKING_BLOCKED = 0, /* retries exhausted; the slot is blocked */
206 /* 0 .. 255 is a count of (re)tries remaining */
207
208 /* bits or'ed into any count given */
209 CSSM_ACL_PREAUTH_TRACKING_UNKNOWN = 0x40000000, /* status of slot is unknown (ignore count) */
210 CSSM_ACL_PREAUTH_TRACKING_AUTHORIZED = 0x80000000 /* the slot is currently authorized (or'ed in) */
211 };
212
213
214 /* Apple defined values of a CSSM_DB_ACCESS_TYPE */
215 enum {
216 CSSM_DB_ACCESS_RESET = 0x10000 /* clear pre-authentications (or'ed bit) */
217 };
218
219
220 /* Apple defined algorithm IDs */
221 enum
222 {
223 CSSM_ALGID_APPLE_YARROW = CSSM_ALGID_VENDOR_DEFINED,
224 CSSM_ALGID_AES, /* RijnDael */
225 CSSM_ALGID_FEE, /* FEE Key Generation */
226 CSSM_ALGID_FEE_MD5, /* FEE/ElGamal signature w/ MD5 hash */
227 CSSM_ALGID_FEE_SHA1, /* FEE/ElGamal signature w/ SHA1 hash */
228 CSSM_ALGID_FEED, /* 1:1 FEE asymmetric encryption */
229 CSSM_ALGID_FEEDEXP, /* 2:1 FEE asymmetric encryption */
230 CSSM_ALGID_ASC, /* Apple Secure Compression */
231 CSSM_ALGID_SHA1HMAC_LEGACY, /* HMAC/SHA1, legacy compatible */
232 CSSM_ALGID_KEYCHAIN_KEY, /* derive or manipulate keychain master keys */
233 CSSM_ALGID_PKCS12_PBE_ENCR, /* PKCS12, encrypt/decrypt key */
234 CSSM_ALGID_PKCS12_PBE_MAC, /* PKCS12, MAC key */
235 CSSM_ALGID_SECURE_PASSPHRASE, /* passphrase acquired by SecurityServer */
236 CSSM_ALGID_PBE_OPENSSL_MD5, /* traditional openssl key derivation */
237 CSSM_ALGID_SHA256, /* 256-bit SHA2 */
238 CSSM_ALGID_SHA384, /* 384-bit SHA2 */
239 CSSM_ALGID_SHA512, /* 512-bit SHA2 */
240 CSSM_ALGID_ENTROPY_DEFAULT, /* default entropy source of (CSP) device, if any */
241 CSSM_ALGID_SHA224, /* SHA2, 224 bit */
242 CSSM_ALGID_SHA224WithRSA, /* RSA signature on SHA224 digest */
243 CSSM_ALGID_SHA256WithRSA, /* RSA signature on SHA256 digest */
244 CSSM_ALGID_SHA384WithRSA, /* RSA signature on SHA384 digest */
245 CSSM_ALGID_SHA512WithRSA, /* RSA signature on SHA512 digest */
246 CSSM_ALGID_OPENSSH1, /* OpenSSH v1 RSA key wrapping */
247 CSSM_ALGID_SHA224WithECDSA, /* ECDSA signature on SHA224 digest */
248 CSSM_ALGID_SHA256WithECDSA, /* ECDSA signature on SHA256 digest */
249 CSSM_ALGID_SHA384WithECDSA, /* ECDSA signature on SHA384 digest */
250 CSSM_ALGID_SHA512WithECDSA, /* ECDSA signature on SHA512 digest */
251 CSSM_ALGID_ECDSA_SPECIFIED, /* ECDSA with separate digest algorithm specifier */
252 CSSM_ALGID_ECDH_X963_KDF, /* ECDH with X9.63 key derivation */
253 CSSM_ALGID__FIRST_UNUSED
254 };
255
256 /* Apple defined padding */
257 enum
258 {
259 /* RFC 2246 section E.2 for SSLv2 rollback detection */
260 CSSM_PADDING_APPLE_SSLv2 = CSSM_PADDING_VENDOR_DEFINED
261 };
262
263
264 /* Apple defined keyblob formats */
265 enum {
266 CSSM_KEYBLOB_RAW_FORMAT_VENDOR_DEFINED = 0x80000000
267 };
268 enum {
269 /* X509 SubjectPublicKeyInfo */
270 CSSM_KEYBLOB_RAW_FORMAT_X509 = CSSM_KEYBLOB_RAW_FORMAT_VENDOR_DEFINED,
271 /* OpenSSH v1 */
272 CSSM_KEYBLOB_RAW_FORMAT_OPENSSH,
273 /* openssl-style DSA private key */
274 CSSM_KEYBLOB_RAW_FORMAT_OPENSSL,
275 /* OpenSSH v2 */
276 CSSM_KEYBLOB_RAW_FORMAT_OPENSSH2
277 };
278
279 /* Apple adds some "common" error codes. CDSA does not define an official start value for this. */
280 enum
281 {
282 CSSM_CUSTOM_COMMON_ERROR_EXTENT = 0x00e0,
283
284 CSSM_ERRCODE_NO_USER_INTERACTION = 0x00e0,
285 CSSM_ERRCODE_USER_CANCELED = 0x00e1,
286 CSSM_ERRCODE_SERVICE_NOT_AVAILABLE = 0x00e2,
287 CSSM_ERRCODE_INSUFFICIENT_CLIENT_IDENTIFICATION = 0x00e3,
288 CSSM_ERRCODE_DEVICE_RESET = 0x00e4,
289 CSSM_ERRCODE_DEVICE_FAILED = 0x00e5,
290 CSSM_ERRCODE_IN_DARK_WAKE = 0x00e6
291 };
292
293 enum {
294 CSSMERR_CSSM_NO_USER_INTERACTION = -2147417888,
295 CSSMERR_AC_NO_USER_INTERACTION = -2147405600,
296 CSSMERR_CSP_NO_USER_INTERACTION = -2147415840,
297 CSSMERR_CL_NO_USER_INTERACTION = -2147411744,
298 CSSMERR_DL_NO_USER_INTERACTION = -2147413792,
299 CSSMERR_TP_NO_USER_INTERACTION = -2147409696,
300
301 CSSMERR_CSSM_USER_CANCELED = -2147417887,
302 CSSMERR_AC_USER_CANCELED = -2147405599,
303 CSSMERR_CSP_USER_CANCELED = -2147415839,
304 CSSMERR_CL_USER_CANCELED = -2147411743,
305 CSSMERR_DL_USER_CANCELED = -2147413791,
306 CSSMERR_TP_USER_CANCELED = -2147409695,
307
308 CSSMERR_CSSM_SERVICE_NOT_AVAILABLE = -2147417886,
309 CSSMERR_AC_SERVICE_NOT_AVAILABLE = -2147405598,
310 CSSMERR_CSP_SERVICE_NOT_AVAILABLE = -2147415838,
311 CSSMERR_CL_SERVICE_NOT_AVAILABLE = -2147411742,
312 CSSMERR_DL_SERVICE_NOT_AVAILABLE = -2147413790,
313 CSSMERR_TP_SERVICE_NOT_AVAILABLE = -2147409694,
314
315 CSSMERR_CSSM_INSUFFICIENT_CLIENT_IDENTIFICATION = -2147417885,
316 CSSMERR_AC_INSUFFICIENT_CLIENT_IDENTIFICATION = -2147405597,
317 CSSMERR_CSP_INSUFFICIENT_CLIENT_IDENTIFICATION = -2147415837,
318 CSSMERR_CL_INSUFFICIENT_CLIENT_IDENTIFICATION = -2147411741,
319 CSSMERR_DL_INSUFFICIENT_CLIENT_IDENTIFICATION = -2147413789,
320 CSSMERR_TP_INSUFFICIENT_CLIENT_IDENTIFICATION = -2147409693,
321
322 CSSMERR_CSSM_DEVICE_RESET = -2147417884,
323 CSSMERR_AC_DEVICE_RESET = -2147405596,
324 CSSMERR_CSP_DEVICE_RESET = -2147415836,
325 CSSMERR_CL_DEVICE_RESET = -2147411740,
326 CSSMERR_DL_DEVICE_RESET = -2147413788,
327 CSSMERR_TP_DEVICE_RESET = -2147409692,
328
329 CSSMERR_CSSM_DEVICE_FAILED = -2147417883,
330 CSSMERR_AC_DEVICE_FAILED = -2147405595,
331 CSSMERR_CSP_DEVICE_FAILED = -2147415835,
332 CSSMERR_CL_DEVICE_FAILED = -2147411739,
333 CSSMERR_DL_DEVICE_FAILED = -2147413787,
334 CSSMERR_TP_DEVICE_FAILED = -2147409691,
335
336 CSSMERR_CSSM_IN_DARK_WAKE = -2147417882,
337 CSSMERR_AC_IN_DARK_WAKE = -2147405594,
338 CSSMERR_CSP_IN_DARK_WAKE = -2147415834,
339 CSSMERR_CL_IN_DARK_WAKE = -2147411738,
340 CSSMERR_DL_IN_DARK_WAKE = -2147413786,
341 CSSMERR_TP_IN_DARK_WAKE = -2147409690,
342 };
343
344 /* AppleCSPDL, AppleCSP private error codes. */
345 enum {
346 CSSMERR_CSP_APPLE_ADD_APPLICATION_ACL_SUBJECT = -2147415040,
347 /* An attempt was made to use a public key which is incomplete due to
348 the lack of algorithm-specific parameters. */
349 CSSMERR_CSP_APPLE_PUBLIC_KEY_INCOMPLETE = -2147415039,
350
351 /* a code signature match failed */
352 CSSMERR_CSP_APPLE_SIGNATURE_MISMATCH = -2147415038,
353
354 /* Key start date invalid */
355 CSSMERR_CSP_APPLE_INVALID_KEY_START_DATE = -2147415037,
356 /* Key end date invalid */
357 CSSMERR_CSP_APPLE_INVALID_KEY_END_DATE = -2147415036,
358
359 /* Keychain Syncing error codes */
360 CSSMERR_CSPDL_APPLE_DL_CONVERSION_ERROR = -2147415035,
361
362 /* SSLv2 padding check: rollback attack detected */
363 CSSMERR_CSP_APPLE_SSLv2_ROLLBACK = -2147415034,
364 };
365
366
367 /* AppleFileDL record types. */
368 enum
369 {
370 CSSM_DL_DB_RECORD_GENERIC_PASSWORD = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 0,
371 CSSM_DL_DB_RECORD_INTERNET_PASSWORD = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 1,
372 CSSM_DL_DB_RECORD_APPLESHARE_PASSWORD = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 2,
373
374 CSSM_DL_DB_RECORD_X509_CERTIFICATE = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 0x1000,
375 CSSM_DL_DB_RECORD_USER_TRUST,
376 CSSM_DL_DB_RECORD_X509_CRL,
377 CSSM_DL_DB_RECORD_UNLOCK_REFERRAL,
378 CSSM_DL_DB_RECORD_EXTENDED_ATTRIBUTE,
379 CSSM_DL_DB_RECORD_METADATA = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 0x8000
380 };
381
382 /* AppleFileDL extentions: passthrough ids */
383 enum {
384 // Toggle whether or not to autocommit after modifying the database.
385 // The input parameter is a CSSM_BOOL, where TRUE turns autocommit on
386 // and FALSE turns it off.
387 CSSM_APPLEFILEDL_TOGGLE_AUTOCOMMIT,
388
389 // Commit any pending changes to the database.
390 CSSM_APPLEFILEDL_COMMIT,
391
392 // Rollback and discard any pending changes to the database.
393 CSSM_APPLEFILEDL_ROLLBACK,
394
395 // Try to take the file lock on the underlying database
396 // Calling commit or rollback will release the lock
397 CSSM_APPLEFILEDL_TAKE_FILE_LOCK,
398
399 // Make a backup of this database in a new file
400 CSSM_APPLEFILEDL_MAKE_BACKUP,
401
402 // Make a copy of this database
403 CSSM_APPLEFILEDL_MAKE_COPY,
404
405 // Delete this database
406 CSSM_APPLEFILEDL_DELETE_FILE,
407 };
408
409 /* UNLOCK_REFERRAL "type" attribute values */
410 enum {
411 CSSM_APPLE_UNLOCK_TYPE_KEY_DIRECT = 1, // master secret key stored directly
412 CSSM_APPLE_UNLOCK_TYPE_WRAPPED_PRIVATE = 2, // master key wrapped by public key
413 CSSM_APPLE_UNLOCK_TYPE_KEYBAG = 3 // master key wrapped via keybag
414 };
415
416 /* Apple DL private error codes. */
417 enum
418 {
419 /* The OpenParameters argument passed to CSSM_DL_DbCreate or CSSM_DL_DbOpen
420 was neither NULL nor a pointer to a valid CSSM_APPLEDL_OPEN_PARAMETERS
421 structure. */
422 CSSMERR_APPLEDL_INVALID_OPEN_PARAMETERS = -2147412992,
423
424 /* an operation failed because the disk was full */
425 CSSMERR_APPLEDL_DISK_FULL = -2147412991,
426
427 /* an operation failed because a disk quota was exceeded */
428 CSSMERR_APPLEDL_QUOTA_EXCEEDED = -2147412990,
429
430 /* an operation failed because a file was too large */
431 CSSMERR_APPLEDL_FILE_TOO_BIG = -2147412989,
432
433 /* a keychain database's internal information ("blob") is invalid */
434 CSSMERR_APPLEDL_INVALID_DATABASE_BLOB = -2147412988,
435
436 /* a keychain database's internal information ("blob") is invalid */
437 CSSMERR_APPLEDL_INVALID_KEY_BLOB = -2147412987,
438
439 /* the internal data format version for a database's internal information ("blob") is invalid */
440 CSSMERR_APPLEDL_INCOMPATIBLE_DATABASE_BLOB = -2147412986,
441
442 /* the internal data format version for a database's internal information ("blob") is invalid */
443 CSSMERR_APPLEDL_INCOMPATIBLE_KEY_BLOB = -2147412985,
444 };
445
446 /* Apple X509TP private error codes. */
447 enum
448 {
449 /* Host name mismatch */
450 CSSMERR_APPLETP_HOSTNAME_MISMATCH = -2147408896,
451 /* Non-understood extension with Critical flag true */
452 CSSMERR_APPLETP_UNKNOWN_CRITICAL_EXTEN = -2147408895,
453 /* Basic Constraints extension required per policy, but not present */
454 CSSMERR_APPLETP_NO_BASIC_CONSTRAINTS = -2147408894,
455 /* Invalid BasicConstraints.CA */
456 CSSMERR_APPLETP_INVALID_CA = -2147408893,
457 /* Invalid Authority Key ID */
458 CSSMERR_APPLETP_INVALID_AUTHORITY_ID = -2147408892,
459 /* Invalid Subject Key ID */
460 CSSMERR_APPLETP_INVALID_SUBJECT_ID = -2147408891,
461 /* Invalid Key Usage for policy */
462 CSSMERR_APPLETP_INVALID_KEY_USAGE = -2147408890,
463 /* Invalid Extended Key Usage for policy */
464 CSSMERR_APPLETP_INVALID_EXTENDED_KEY_USAGE = -2147408889,
465 /* Invalid Subject/Authority Key ID Linkage */
466 CSSMERR_APPLETP_INVALID_ID_LINKAGE = -2147408888,
467 /* PathLengthConstraint exceeded */
468 CSSMERR_APPLETP_PATH_LEN_CONSTRAINT = -2147408887,
469 /* Cert group terminated at a root cert which did not self-verify */
470 CSSMERR_APPLETP_INVALID_ROOT = -2147408886,
471 /* CRL expired */
472 CSSMERR_APPLETP_CRL_EXPIRED = -2147408885,
473 /* CRL not valid yet */
474 CSSMERR_APPLETP_CRL_NOT_VALID_YET = -2147408884,
475 /* Cannot find appropriate CRL */
476 CSSMERR_APPLETP_CRL_NOT_FOUND = -2147408883,
477 /* specified CRL server down */
478 CSSMERR_APPLETP_CRL_SERVER_DOWN = -2147408882,
479 /* illegible CRL distribution point URL */
480 CSSMERR_APPLETP_CRL_BAD_URI = -2147408881,
481 /* Unknown critical cert extension */
482 CSSMERR_APPLETP_UNKNOWN_CERT_EXTEN = -2147408880,
483 /* Unknown critical CRL extension */
484 CSSMERR_APPLETP_UNKNOWN_CRL_EXTEN = -2147408879,
485 /* CRL not verifiable to anchor or root */
486 CSSMERR_APPLETP_CRL_NOT_TRUSTED = -2147408878,
487 /* CRL verified to untrusted root */
488 CSSMERR_APPLETP_CRL_INVALID_ANCHOR_CERT = -2147408877,
489 /* CRL failed policy verification */
490 CSSMERR_APPLETP_CRL_POLICY_FAIL = -2147408876,
491 /* IssuingDistributionPoint extension violation */
492 CSSMERR_APPLETP_IDP_FAIL = -2147408875,
493 /* Cert not found at specified issuerAltName */
494 CSSMERR_APPLETP_CERT_NOT_FOUND_FROM_ISSUER = -2147408874,
495 /* Bad cert obtained from specified issuerAltName */
496 CSSMERR_APPLETP_BAD_CERT_FROM_ISSUER = -2147408873,
497 /* S/MIME Email address mismatch */
498 CSSMERR_APPLETP_SMIME_EMAIL_ADDRS_NOT_FOUND = -2147408872,
499 /* Appropriate S/MIME ExtendedKeyUsage not found */
500 CSSMERR_APPLETP_SMIME_BAD_EXT_KEY_USE = -2147408871,
501 /* S/MIME KeyUsage incompatibility */
502 CSSMERR_APPLETP_SMIME_BAD_KEY_USE = -2147408870,
503 /* S/MIME, cert with KeyUsage flagged !critical */
504 CSSMERR_APPLETP_SMIME_KEYUSAGE_NOT_CRITICAL = -2147408869,
505 /* S/MIME, leaf with empty subject name and no email addrs
506 in SubjectAltName */
507 CSSMERR_APPLETP_SMIME_NO_EMAIL_ADDRS = -2147408868,
508 /* S/MIME, leaf with empty subject name, SubjectAltName
509 not critical */
510 CSSMERR_APPLETP_SMIME_SUBJ_ALT_NAME_NOT_CRIT = -2147408867,
511 /* Appropriate SSL ExtendedKeyUsage not found */
512 CSSMERR_APPLETP_SSL_BAD_EXT_KEY_USE = -2147408866,
513 /* unparseable OCSP response */
514 CSSMERR_APPLETP_OCSP_BAD_RESPONSE = -2147408865,
515 /* unparseable OCSP request */
516 CSSMERR_APPLETP_OCSP_BAD_REQUEST = -2147408864,
517 /* OCSP service unavailable */
518 CSSMERR_APPLETP_OCSP_UNAVAILABLE = -2147408863,
519 /* OCSP status: cert unrecognized */
520 CSSMERR_APPLETP_OCSP_STATUS_UNRECOGNIZED = -2147408862,
521 /* revocation check not successful for each cert */
522 CSSMERR_APPLETP_INCOMPLETE_REVOCATION_CHECK = -2147408861,
523 /* general network error */
524 CSSMERR_APPLETP_NETWORK_FAILURE = -2147408860,
525 /* OCSP response not verifiable to anchor or root */
526 CSSMERR_APPLETP_OCSP_NOT_TRUSTED = -2147408859,
527 /* OCSP response verified to untrusted root */
528 CSSMERR_APPLETP_OCSP_INVALID_ANCHOR_CERT = -2147408858,
529 /* OCSP response signature error */
530 CSSMERR_APPLETP_OCSP_SIG_ERROR = -2147408857,
531 /* No signer for OCSP response found */
532 CSSMERR_APPLETP_OCSP_NO_SIGNER = -2147408856,
533 /* OCSP responder status: malformed request */
534 CSSMERR_APPLETP_OCSP_RESP_MALFORMED_REQ = -2147408855,
535 /* OCSP responder status: internal error */
536 CSSMERR_APPLETP_OCSP_RESP_INTERNAL_ERR = -2147408854,
537 /* OCSP responder status: try later */
538 CSSMERR_APPLETP_OCSP_RESP_TRY_LATER = -2147408853,
539 /* OCSP responder status: signature required */
540 CSSMERR_APPLETP_OCSP_RESP_SIG_REQUIRED = -2147408852,
541 /* OCSP responder status: unauthorized */
542 CSSMERR_APPLETP_OCSP_RESP_UNAUTHORIZED = -2147408851,
543 /* OCSP response nonce did not match request */
544 CSSMERR_APPLETP_OCSP_NONCE_MISMATCH = -2147408850,
545 /* Illegal cert chain length for Code Signing */
546 CSSMERR_APPLETP_CS_BAD_CERT_CHAIN_LENGTH = -2147408849,
547 /* Missing Basic Constraints for Code Signing */
548 CSSMERR_APPLETP_CS_NO_BASIC_CONSTRAINTS = -2147408848,
549 /* Bad PathLengthConstraint for Code Signing */
550 CSSMERR_APPLETP_CS_BAD_PATH_LENGTH = -2147408847,
551 /* Missing ExtendedKeyUsage for Code Signing */
552 CSSMERR_APPLETP_CS_NO_EXTENDED_KEY_USAGE = -2147408846,
553 /* Development style Code Signing Cert Detected */
554 CSSMERR_APPLETP_CODE_SIGN_DEVELOPMENT = -2147408845,
555 /* Illegal cert chain length for Resource Signing */
556 CSSMERR_APPLETP_RS_BAD_CERT_CHAIN_LENGTH = -2147408844,
557 /* Bad extended key usage for Resource Signing */
558 CSSMERR_APPLETP_RS_BAD_EXTENDED_KEY_USAGE = -2147408843,
559 /* Trust Setting: deny */
560 CSSMERR_APPLETP_TRUST_SETTING_DENY = -2147408842,
561 /* Invalid empty SubjectName */
562 CSSMERR_APPLETP_INVALID_EMPTY_SUBJECT = -2147408841,
563 /* Unknown critical Qualified Cert Statement ID */
564 CSSMERR_APPLETP_UNKNOWN_QUAL_CERT_STATEMENT = -2147408840,
565 /* Missing required extension */
566 CSSMERR_APPLETP_MISSING_REQUIRED_EXTENSION = -2147408839,
567 /* Extended key usage not marked critical */
568 CSSMERR_APPLETP_EXT_KEYUSAGE_NOT_CRITICAL = -2147408838,
569 /* Required name or identifier not present */
570 CSSMERR_APPLETP_IDENTIFIER_MISSING = -2147408837,
571 /* Certificate authority pinning mismatch */
572 CSSMERR_APPLETP_CA_PIN_MISMATCH = -2147408836,
573 /* Leaf pinning mismatch */
574 CSSMERR_APPLETP_LEAF_PIN_MISMATCH = -2147408835,
575 };
576
577 /* Apple .mac TP private error codes. */
578 enum
579 {
580 /* cert request queued */
581 CSSMERR_APPLE_DOTMAC_REQ_QUEUED = -2147408796,
582 /* cert request redirected */
583 CSSMERR_APPLE_DOTMAC_REQ_REDIRECT = -2147408795,
584 /* general server-reported error */
585 CSSMERR_APPLE_DOTMAC_REQ_SERVER_ERR = -2147408794,
586 /* server-reported parameter error */
587 CSSMERR_APPLE_DOTMAC_REQ_SERVER_PARAM = -2147408793,
588 /* server-reported authorization error */
589 CSSMERR_APPLE_DOTMAC_REQ_SERVER_AUTH = -2147408792,
590 /* server-reported unimplemented */
591 CSSMERR_APPLE_DOTMAC_REQ_SERVER_UNIMPL = -2147408791,
592 /* server-reported not available */
593 CSSMERR_APPLE_DOTMAC_REQ_SERVER_NOT_AVAIL = -2147408790,
594 /* server-reported already exists */
595 CSSMERR_APPLE_DOTMAC_REQ_SERVER_ALREADY_EXIST = -2147408789,
596 /* server-reported service error */
597 CSSMERR_APPLE_DOTMAC_REQ_SERVER_SERVICE_ERROR = -2147408788,
598 /* request already pending for specified user */
599 CSSMERR_APPLE_DOTMAC_REQ_IS_PENDING = -2147408787,
600 /* no request pending for specified user */
601 CSSMERR_APPLE_DOTMAC_NO_REQ_PENDING = -2147408786,
602 /* CSR failed to verify */
603 CSSMERR_APPLE_DOTMAC_CSR_VERIFY_FAIL = -2147408785,
604 /* server reported failed consistency check */
605 CSSMERR_APPLE_DOTMAC_FAILED_CONSISTENCY_CHECK = -2147408784,
606 };
607
608 enum
609 {
610 CSSM_APPLEDL_OPEN_PARAMETERS_VERSION = 1u
611 };
612
613 enum cssm_appledl_open_parameters_mask
614 {
615 kCSSM_APPLEDL_MASK_MODE = (1 << 0)
616 };
617
618 /* Pass a CSSM_APPLEDL_OPEN_PARAMETERS_PTR as the OpenParameters argument to
619 CSSM_DL_DbCreate or CSSM_DL_DbOpen. When using this struct, you must zero
620 out the entire struct before setting any additional parameters to ensure
621 forward compatibility. */
622 typedef struct cssm_appledl_open_parameters
623 {
624 uint32 length; /* Should be sizeof(CSSM_APPLEDL_OPEN_PARAMETERS). */
625 uint32 version; /* Should be CSSM_APPLEDL_OPEN_PARAMETERS_VERSION. */
626
627 /* If no OpenParameters are specified, autoCommit is on (!CSSM_FALSE) by default.
628 When autoCommit is on (!CSSM_FALSE), changes made to the Db are written to disk
629 before returning from each function.
630 When autoCommit is off (CSSM_FALSE), changes made to the database are not guaranteed
631 to be written to disk until the Db is closed. This is useful for bulk writes.
632 Be aware that if autoCommit is off, changes made in previous calls to the DL might
633 get rolled back if a new modification operation fails. */
634 CSSM_BOOL autoCommit;
635
636 /* Mask marking which of the following fields are to be used. */
637 uint32 mask;
638
639 /* When calling DbCreate, the initial mode to create the database file with; ignored on DbOpen. You must set the kCSSM_APPLEDL_MASK_MODE bit in mask or mode is ignored. */
640 mode_t mode;
641 } CSSM_APPLEDL_OPEN_PARAMETERS, *CSSM_APPLEDL_OPEN_PARAMETERS_PTR;
642
643
644 /* AppleCSPDL passthough ids */
645 enum
646 {
647 /* Tell the SecurityServer to lock the database specified by the DLDBHandle argument.
648 The InputParams and OutputParams arguments are ignored. */
649 CSSM_APPLECSPDL_DB_LOCK = 0,
650
651 /* Tell the SecurityServer to unlock the database specified by the DLDBHandle argument.
652 The InputParameters argument is a CSSM_DATA_PTR containing the password, or NULL if
653 the SecurityServer should prompt for the password.
654 The OutputParams argument is ignored.
655 The SecurityServer will put up UI (though the SecurityAgent) when this function is called
656 iff InputParameters is NULL. */
657 CSSM_APPLECSPDL_DB_UNLOCK = 1,
658
659 /* Ask the SecurityServer to get the db settings specified for the database
660 specified by the DLDBHandle argument. The settings are returned in the OutputParameters argument.
661 The OutputParameters argument is a pointer to a CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS_PTR.
662 Upon successful completion, the AppleCSPDL will have allocated a
663 CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS structure using the application-specified
664 allocators for the DL attachment specified by the DLDBHandle argument. The structure will contain
665 the current database settings for the specified database. The client should free the
666 CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS_PTR after it has finished using it.
667 The InputParameters argument is ignored.
668 The SecurityServer might put up UI (though the SecurityAgent) when this function is called. */
669 CSSM_APPLECSPDL_DB_GET_SETTINGS = 2,
670
671 /* Tell the SecurityServer to set the db settings specified in InputParameters on the database
672 specified by the DLDBHandle argument.
673 The InputParameters argument is a const CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS * containing
674 the new settings for the specified database.
675 The OutputParams argument is ignored.
676 The SecurityServer might put up UI (though the SecurityAgent) when this function is called. */
677 CSSM_APPLECSPDL_DB_SET_SETTINGS = 3,
678
679 /* Ask the SecurityServer whether the database specified by the DLDBHandle argument is locked.
680 The InputParameters argument is ignored.
681 The OutputParameters argument is a pointer to a CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS_PTR.
682 Upon successful completion, the AppleCSPDL will have allocated a
683 CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS structure using the application-specified
684 allocators for the DL attachment specified by the DLDBHandle argument. The structure will contain
685 the current lock status for the specified database. The client should free the
686 CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS_PTR after it has finished using it.
687 The SecurityServer will put up UI (though the SecurityAgent) when this function is called. */
688 CSSM_APPLECSPDL_DB_IS_LOCKED = 4,
689
690 /* Tell the SecurityServer to change the password for the database specified by
691 the DLDBHandle.
692
693 The InputParameters argument is a const CSSM_APPLECSPDL_DB_CHANGE_PASSWORD_PARAMETERS * containing
694 a CSSM_ACCESS_CREDENTIALS * which determines how the password will be changed. If the
695 accessCredentials are NULL, the SecurityAgent will prompt for the old and the new password for the
696 specified database. If credentials are specified, there should be 2 entries:
697 1. a 3-element list containing:
698 CSSM_WORDID_KEYCHAIN_LOCK, CSSM_SAMPLE_TYPE_PASSWORD, and the old password.
699 2. a 3-element list containing:
700 CSSM_WORDID_KEYCHAIN_CHANGE_LOCK, CSSM_SAMPLE_TYPE_PASSWORD, and the new password.
701
702 The OutputParams argument is ignored.
703 The SecurityServer might put up UI (though the SecurityAgent) when this function is called. */
704 CSSM_APPLECSPDL_DB_CHANGE_PASSWORD =5,
705
706 /* Return the SecurityServer database handle for the database specified by the DLDBHandle */
707 CSSM_APPLECSPDL_DB_GET_HANDLE = 6,
708
709 /* Given a CSSM_KEY for the CSPDL, return the SecurityServer key handle */
710 CSSM_APPLESCPDL_CSP_GET_KEYHANDLE = 7,
711
712 CSSM_APPLE_PRIVATE_CSPDL_CODE_8 = 8,
713 CSSM_APPLE_PRIVATE_CSPDL_CODE_9 = 9,
714 CSSM_APPLE_PRIVATE_CSPDL_CODE_10 = 10,
715 CSSM_APPLE_PRIVATE_CSPDL_CODE_11 = 11,
716 CSSM_APPLE_PRIVATE_CSPDL_CODE_12 = 12,
717 CSSM_APPLE_PRIVATE_CSPDL_CODE_13 = 13,
718 CSSM_APPLE_PRIVATE_CSPDL_CODE_14 = 14,
719 CSSM_APPLE_PRIVATE_CSPDL_CODE_15 = 15,
720 CSSM_APPLE_PRIVATE_CSPDL_CODE_16 = 16,
721 CSSM_APPLE_PRIVATE_CSPDL_CODE_17 = 17,
722 CSSM_APPLE_PRIVATE_CSPDL_CODE_18 = 18,
723 CSSM_APPLE_PRIVATE_CSPDL_CODE_19 = 19,
724 CSSM_APPLE_PRIVATE_CSPDL_CODE_20 = 20,
725 CSSM_APPLE_PRIVATE_CSPDL_CODE_21 = 21,
726 CSSM_APPLE_PRIVATE_CSPDL_CODE_22 = 22,
727 CSSM_APPLE_PRIVATE_CSPDL_CODE_23 = 23,
728 CSSM_APPLE_PRIVATE_CSPDL_CODE_24 = 24,
729 CSSM_APPLE_PRIVATE_CSPDL_CODE_25 = 25,
730 CSSM_APPLE_PRIVATE_CSPDL_CODE_26 = 26,
731 CSSM_APPLE_PRIVATE_CSPDL_CODE_27 = 27,
732
733 /* Given a CSSM_KEY_PTR in any format, obtain the SHA-1 hash of the
734 * associated key blob.
735 * Key is specified in CSSM_CSP_CreatePassThroughContext.
736 * Hash is allocated bythe CSP, in the App's memory, and returned
737 * in *outData. */
738 CSSM_APPLECSP_KEYDIGEST = 0x100
739 };
740
741
742
743 /* AppleCSPDL passthough parameters */
744 typedef struct cssm_applecspdl_db_settings_parameters
745 {
746 uint32 idleTimeout; // seconds idle timeout lock
747 uint8 lockOnSleep; // lock database when system sleeps
748 } CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS, *CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS_PTR;
749
750 /* AppleCSPDL passthough parameters */
751 typedef struct cssm_applecspdl_db_is_locked_parameters
752 {
753 uint8 isLocked; // True iff the database is locked
754 } CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS, *CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS_PTR;
755
756 /* AppleCSPDL passthough parameters */
757 typedef struct cssm_applecspdl_db_change_password_parameters
758 {
759 CSSM_ACCESS_CREDENTIALS *accessCredentials;
760 } CSSM_APPLECSPDL_DB_CHANGE_PASSWORD_PARAMETERS, *CSSM_APPLECSPDL_DB_CHANGE_PASSWORD_PARAMETERS_PTR;
761
762 /* Custom wrapped key formats */
763 enum {
764 CSSM_KEYBLOB_WRAPPED_FORMAT_APPLE_CUSTOM = 100,
765 CSSM_KEYBLOB_WRAPPED_FORMAT_OPENSSL, // traditional openssl
766 CSSM_KEYBLOB_WRAPPED_FORMAT_OPENSSH1 // OpenSSH v1
767 };
768
769 /*
770 * Custom context attributes for AppleCSP.
771 */
772 enum {
773 CSSM_ATTRIBUTE_VENDOR_DEFINED = 0x800000
774 };
775
776 enum {
777 /*
778 * Public Key attribute for use with CSSM_ALGID_FEED.
779 */
780 CSSM_ATTRIBUTE_PUBLIC_KEY =
781 (CSSM_ATTRIBUTE_DATA_KEY | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 0)),
782
783 /*
784 * FEE key attributes.
785 * See CSSM_FEE_PRIME_TYPE_xxx, CSSM_FEE_CURVE_TYPE_xxx enums, below.
786 */
787 CSSM_ATTRIBUTE_FEE_PRIME_TYPE =
788 (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 1)),
789 CSSM_ATTRIBUTE_FEE_CURVE_TYPE =
790 (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 2)),
791
792 /*
793 * Apple Secure Compression (ComCryption) optimization.
794 * See CSSM_ASC_OPTIMIZE_xxx, enums, below.
795 */
796 CSSM_ATTRIBUTE_ASC_OPTIMIZATION =
797 (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 3)),
798
799 /*
800 * RSA blinding. Value is integer, nonzero (blinding on) or zero.
801 */
802 CSSM_ATTRIBUTE_RSA_BLINDING =
803 (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 4)),
804
805 /*
806 * Additional public key from which to obtain algorithm-specific
807 * parameters.
808 */
809 CSSM_ATTRIBUTE_PARAM_KEY =
810 (CSSM_ATTRIBUTE_DATA_KEY | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 5)),
811
812 /*
813 * Prompt string for CSSM_ALGID_SECURE_PASSPHRASE key acquisition.
814 * Data is a UTF8-encoded external representation of a CFString.
815 */
816 CSSM_ATTRIBUTE_PROMPT =
817 (CSSM_ATTRIBUTE_DATA_CSSM_DATA | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 6)),
818
819 /*
820 * Alert panel title for CSSM_ALGID_SECURE_PASSPHRASE key acquisition.
821 * Data is a UTF8-encoded external representation of a CFString.
822 */
823 CSSM_ATTRIBUTE_ALERT_TITLE =
824 (CSSM_ATTRIBUTE_DATA_CSSM_DATA | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 7)),
825
826 /*
827 * Boolean to specify whether secure passphrase is being used to encrypt or to
828 * recover data. In the former case the user will be prompted to enter the
829 * passphrase twice. Value is integer, nonzero (verify passphrase) or zero.
830 */
831 CSSM_ATTRIBUTE_VERIFY_PASSPHRASE =
832 (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 8))
833
834 };
835
836 /*
837 * FEE key pair prime modulus types.
838 */
839 enum {
840 CSSM_FEE_PRIME_TYPE_DEFAULT = 0, /* default per key size */
841 CSSM_FEE_PRIME_TYPE_MERSENNE, /* (2 ** q) - 1Ê*/
842 CSSM_FEE_PRIME_TYPE_FEE, /* (2 ** q) - k */
843 CSSM_FEE_PRIME_TYPE_GENERAL /* random prime */
844 };
845
846 /*
847 * FEE curve types. Comments refer to equation
848 *
849 * y**2 = x**3 + c(x**2) + ax + b
850 */
851 enum {
852 CSSM_FEE_CURVE_TYPE_DEFAULT = 0, /* default per key size */
853 CSSM_FEE_CURVE_TYPE_MONTGOMERY, /* a==1, b==0 */
854 CSSM_FEE_CURVE_TYPE_WEIERSTRASS, /* c==0. IEEE P1363 compliant. */
855 CSSM_FEE_CURVE_TYPE_ANSI_X9_62 /* ANSI X9.62 compatible */
856 };
857
858 /*
859 * Apple Secure Compression (ComCryption) optimization attributes.
860 */
861 enum {
862 CSSM_ASC_OPTIMIZE_DEFAULT = 0,
863 CSSM_ASC_OPTIMIZE_SIZE, /* max compression (currently the default) */
864 CSSM_ASC_OPTIMIZE_SECURITY, /* currently not implemented */
865 CSSM_ASC_OPTIMIZE_TIME, /* min runtime */
866 CSSM_ASC_OPTIMIZE_TIME_SIZE, /* implies loss of security */
867 CSSM_ASC_OPTIMIZE_ASCII, /* optimized for ASCC text, not implemented */
868 };
869
870 /*
871 * Apple custom CSSM_KEYATTR_FLAGS.
872 */
873 enum {
874 /*
875 * When set, indicates a public key which is incomplete (though
876 * still valid) due to the lack of algorithm-specific parameters.
877 */
878 CSSM_KEYATTR_PARTIAL = 0x00010000,
879
880 /*
881 * When set, public keys are stored encrypted. Default is to store
882 * public keys in the clear. AppleCSPDL only.
883 */
884 CSSM_KEYATTR_PUBLIC_KEY_ENCRYPT = 0x00020000
885 };
886
887 /*
888 * Name/OID pair used in CSSM_APPLE_TP_CERT_REQUEST
889 */
890 typedef struct {
891 const char *string;
892 const CSSM_OID *oid;
893 } CSSM_APPLE_TP_NAME_OID;
894
895 /*
896 * Certificate request passed to CSSM_TP_SubmitCredRequest() in the
897 * CSSM_TP_AUTHORITY_REQUEST_TYPE.Requests field. Used for requesting
898 * both locally-generated certs (CSSMOID_APPLE_TP_LOCAL_CERT_GEN) and
899 * cert signing requests (CSSMOID_APPLE_TP_CSR_GEN).
900 */
901 typedef struct {
902 CSSM_CSP_HANDLE cspHand; // sign with this CSP
903 CSSM_CL_HANDLE clHand; // and this CL
904 uint32 serialNumber;
905 uint32 numSubjectNames;// size subjectNames[]
906 CSSM_APPLE_TP_NAME_OID *subjectNames;
907
908 /*
909 * Issuer name can be expressed in the simplified CSSM_APPLE_TP_NAME_OID
910 * array, as is the subject name, or as an CSSM_X509_NAME, which is
911 * typically obtained from a signing cert.
912 * Exactly one of {issuerNames, issuerNameX509} must be non-NULL.
913 */
914 uint32 numIssuerNames; // size issuerNames[]
915 CSSM_APPLE_TP_NAME_OID *issuerNames; // optional; NULL implies root
916 // (signer == subject)
917 CSSM_X509_NAME_PTR issuerNameX509;
918 const CSSM_KEY *certPublicKey;
919 const CSSM_KEY *issuerPrivateKey;
920
921 /* Unfortunately there is no practical way to map any algorithm
922 * to its appropriate OID, and we need both.... */
923 CSSM_ALGORITHMS signatureAlg; // e.g., CSSM_ALGID_SHA1WithRSA
924 CSSM_OID signatureOid; // e.g., CSSMOID_SHA1WithRSA
925 uint32 notBefore; // relative to "now"
926 uint32 notAfter;
927 uint32 numExtensions;
928 CE_DataAndType *extensions; // optional
929
930 /*
931 * Optional challenge string for CSSMOID_APPLE_TP_CSR_GEN.
932 */
933 const char *challengeString;
934 } CSSM_APPLE_TP_CERT_REQUEST;
935
936 /*
937 * Options for X509TP's CSSM_TP_CertGroupVerify for policy CSSMOID_APPLE_TP_SSL.
938 * A pointer to, and length of, one of these is optionally placed in
939 * CSSM_TP_VERIFY_CONTEXT.Cred->Policy.PolicyIds[n].FieldValue.
940 */
941 #define CSSM_APPLE_TP_SSL_OPTS_VERSION 1
942
943 /*
944 * Values for CSSM_APPLE_TP_SSL_OPTIONS.flags.
945 *
946 * Set this flag when evaluating a client cert.
947 */
948 #define CSSM_APPLE_TP_SSL_CLIENT 0x00000001
949
950 typedef struct {
951 uint32 Version; // CSSM_APPLE_TP_SSL_OPTS_VERSION
952
953 /*
954 * The domain name of the server (e.g., "store.apple.com".) In the
955 * SSL and TLS protocols, this must match the common name of the
956 * subject cert. Expressed as a C string, optionally NULL terminated
957 * if it is NULL terminated, the length field should include the NULL).
958 */
959 uint32 ServerNameLen;
960 const char *ServerName; // optional
961
962 /* new fields for struct version 1 */
963 uint32 Flags;
964 } CSSM_APPLE_TP_SSL_OPTIONS;
965
966 /*
967 * Options for X509TP's CSSM_TP_CertGroupVerify for policy
968 * CSSMOID_APPLE_TP_REVOCATION_CRL. A pointer to, and length of, one
969 * of these is optionally placed in
970 * CSSM_TP_VERIFY_CONTEXT.Cred->Policy.PolicyIds[n].FieldValue.
971 */
972 #define CSSM_APPLE_TP_CRL_OPTS_VERSION 0
973
974 typedef uint32 CSSM_APPLE_TP_CRL_OPT_FLAGS;
975 enum {
976 // require CRL verification for each cert; default is "try"
977 CSSM_TP_ACTION_REQUIRE_CRL_PER_CERT = 0x00000001,
978 // enable fetch from network
979 CSSM_TP_ACTION_FETCH_CRL_FROM_NET = 0x00000002,
980 // if set and positive CRL verify for given cert, no further revocation
981 // checking need be done on that cert
982 CSSM_TP_ACTION_CRL_SUFFICIENT = 0x00000004,
983 // require CRL verification for certs which claim a CRL provider
984 CSSM_TP_ACTION_REQUIRE_CRL_IF_PRESENT = 0x00000008
985 };
986
987 typedef struct {
988 uint32 Version; // CSSM_APPLE_TP_CRL_OPTS_VERSION
989 CSSM_APPLE_TP_CRL_OPT_FLAGS CrlFlags;
990
991 /*
992 * When non-NULL, store CRLs fetched from net here.
993 * This is most likely a pointer to one of the
994 * CSSM_TP_CALLERAUTH_CONTEXT.DBList entries but that
995 * is not a strict requirement.
996 */
997 CSSM_DL_DB_HANDLE_PTR crlStore;
998 } CSSM_APPLE_TP_CRL_OPTIONS;
999
1000 /*
1001 * Options for X509TP's CSSM_TP_CertGroupVerify for policy
1002 * CSSMOID_APPLE_TP_SMIME. A pointer to, and length of, one
1003 * of these is optionally placed in
1004 * CSSM_TP_VERIFY_CONTEXT.Cred->Policy.PolicyIds[n].FieldValue.
1005 */
1006 #define CSSM_APPLE_TP_SMIME_OPTS_VERSION 0
1007 typedef struct {
1008 uint32 Version; // CSSM_APPLE_TP_SMIME_OPTS_VERSION
1009
1010 /*
1011 * Intended usage of the leaf cert. The cert's KeyUsage extension,
1012 * if present, must be a superset of this.
1013 */
1014 CE_KeyUsage IntendedUsage;
1015
1016 /*
1017 * The email address of the sender. If there is an email address
1018 * in the sender's cert, that email address must match this one.
1019 * Both (email address in the cert, and this one) are optional.
1020 * Expressed as a C string, optionally NULL terminated (i.e.,
1021 * SenderEmail[SenderEmailLen - 1] may or may not be NULL).
1022 */
1023 uint32 SenderEmailLen;
1024 const char *SenderEmail; // optional
1025 } CSSM_APPLE_TP_SMIME_OPTIONS;
1026
1027
1028 /*
1029 * Optional ActionData for all X509TP CertGroupVerify policies.
1030 * A pointer to, and length of, one of these is optionally placed in
1031 * CSSM_TP_VERIFY_CONTEXT.ActionData.
1032 */
1033 typedef uint32 CSSM_APPLE_TP_ACTION_FLAGS;
1034 enum {
1035 CSSM_TP_ACTION_ALLOW_EXPIRED = 0x00000001, // allow expired certs
1036 CSSM_TP_ACTION_LEAF_IS_CA = 0x00000002, // first cert is a CA
1037 CSSM_TP_ACTION_FETCH_CERT_FROM_NET = 0x00000004, // enable net fetch of CA cert
1038 CSSM_TP_ACTION_ALLOW_EXPIRED_ROOT = 0x00000008, // allow expired roots
1039 CSSM_TP_ACTION_REQUIRE_REV_PER_CERT = 0x00000010, // require positive revocation
1040 // check per cert
1041 CSSM_TP_ACTION_TRUST_SETTINGS = 0x00000020, // use TrustSettings instead of
1042 // anchors
1043 CSSM_TP_ACTION_IMPLICIT_ANCHORS = 0x00000040 // properly self-signed certs are
1044 // treated as anchors implicitly
1045 };
1046
1047 #define CSSM_APPLE_TP_ACTION_VERSION 0
1048 typedef struct {
1049 uint32 Version; // CSSM_APPLE_TP_ACTION_VERSION
1050 CSSM_APPLE_TP_ACTION_FLAGS ActionFlags; // CSSM_TP_ACTION_ALLOW_EXPIRED, etc.
1051 } CSSM_APPLE_TP_ACTION_DATA;
1052
1053 /*
1054 * Per-cert evidence returned from CSSM_TP_CertGroupVerify.
1055 * An array of these is presented in CSSM_TP_VERIFY_CONTEXT_RESULT.Evidence[2].
1056 * Same number of these as in the cert group in Evidence[1].
1057 */
1058
1059 #endif /* SEC_OS_OSX */
1060
1061 /* First, an array of bits indicating various status of the cert. */
1062 typedef uint32 CSSM_TP_APPLE_CERT_STATUS;
1063 enum
1064 {
1065 CSSM_CERT_STATUS_EXPIRED = 0x00000001,
1066 CSSM_CERT_STATUS_NOT_VALID_YET = 0x00000002,
1067 CSSM_CERT_STATUS_IS_IN_INPUT_CERTS = 0x00000004,
1068 CSSM_CERT_STATUS_IS_IN_ANCHORS = 0x00000008,
1069 CSSM_CERT_STATUS_IS_ROOT = 0x00000010,
1070 CSSM_CERT_STATUS_IS_FROM_NET = 0x00000020,
1071 /* settings found in per-user Trust Settings */
1072 CSSM_CERT_STATUS_TRUST_SETTINGS_FOUND_USER = 0x00000040,
1073 /* settings found in Admin Trust Settings */
1074 CSSM_CERT_STATUS_TRUST_SETTINGS_FOUND_ADMIN = 0x00000080,
1075 /* settings found in System Trust Settings */
1076 CSSM_CERT_STATUS_TRUST_SETTINGS_FOUND_SYSTEM = 0x00000100,
1077 /* Trust Settings result = Trust */
1078 CSSM_CERT_STATUS_TRUST_SETTINGS_TRUST = 0x00000200,
1079 /* Trust Settings result = Deny */
1080 CSSM_CERT_STATUS_TRUST_SETTINGS_DENY = 0x00000400,
1081 /* Per-cert error ignored due to Trust Settings */
1082 CSSM_CERT_STATUS_TRUST_SETTINGS_IGNORED_ERROR = 0x00000800
1083 };
1084
1085 typedef struct DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER {
1086 CSSM_TP_APPLE_CERT_STATUS StatusBits;
1087 uint32 NumStatusCodes;
1088 CSSM_RETURN *StatusCodes;
1089
1090 /* index into raw cert group or AnchorCerts depending on IS_IN_ANCHORS */
1091 uint32 Index;
1092
1093 /* nonzero if cert came from a DLDB */
1094 CSSM_DL_DB_HANDLE DlDbHandle;
1095 CSSM_DB_UNIQUE_RECORD_PTR UniqueRecord;
1096
1097 #if SEC_OS_IPHONE
1098 /* CRLReason code if cert is revoked */
1099 sint32 CrlReason;
1100 #endif /* SEC_OS_IPHONE */
1101 } CSSM_TP_APPLE_EVIDENCE_INFO DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER;
1102
1103 #if SEC_OS_OSX
1104
1105 /*
1106 * CSSM_TP_VERIFY_CONTEXT_RESULT.Evidence[0], basically defines which version/flavor
1107 * of remaining evidence is.
1108 */
1109 #define CSSM_TP_APPLE_EVIDENCE_VERSION 0
1110 typedef struct
1111 {
1112 uint32 Version;
1113 } CSSM_TP_APPLE_EVIDENCE_HEADER;
1114
1115
1116 /*
1117 * Apple-specific CSSM_EVIDENCE_FORM values
1118 *
1119 * The form of the evidence returns from CSSM_TP_CertGroupVerify is:
1120 *
1121 * EvidenceForm contents of *Evidence
1122 * ------------ ---------------------
1123 * CSSM_EVIDENCE_FORM_APPLE_HEADER CSSM_TP_APPLE_EVIDENCE_HEADER
1124 * CSSM_EVIDENCE_FORM_APPLE_CERTGROUP CSSM_CERTGROUP
1125 * CSSM_EVIDENCE_FORM_APPLE_CERT_INFO array of CSSM_TP_APPLE_EVIDENCE_INFO, size
1126 * CSSM_CERTGROUP.NumCerts
1127 */
1128
1129 #define CSSM_EVIDENCE_FORM_APPLE_CUSTOM 0x80000000
1130 enum
1131 {
1132 CSSM_EVIDENCE_FORM_APPLE_HEADER = CSSM_EVIDENCE_FORM_APPLE_CUSTOM + 0,
1133 CSSM_EVIDENCE_FORM_APPLE_CERTGROUP = CSSM_EVIDENCE_FORM_APPLE_CUSTOM + 1,
1134 CSSM_EVIDENCE_FORM_APPLE_CERT_INFO = CSSM_EVIDENCE_FORM_APPLE_CUSTOM + 2
1135 };
1136
1137 /* AppleX509CL extensions: passthrough ids */
1138 enum {
1139 /*
1140 * Obtain a signed Certificate Signing Request.
1141 * Input = CSSM_APPLE_CL_CSR_REQUEST
1142 * Output = allocated CSSM_DATA which points to a DER-encoded CSR.
1143 */
1144 CSSM_APPLEX509CL_OBTAIN_CSR,
1145
1146 /*
1147 * Perform signature verify of a CSR.
1148 * Input: CSSM_DATA referring to a DER-encoded CSR.
1149 * Output: Nothing, returns CSSMERR_CL_VERIFICATION_FAILURE on
1150 * on failure.
1151 */
1152 CSSM_APPLEX509CL_VERIFY_CSR
1153 };
1154
1155 /*
1156 * Used in CL's CSSM_APPLEX509_OBTAIN_CSR Passthrough. This is the
1157 * input; the output is a CSSM_DATA * containing the signed and
1158 * DER-encoded CSR.
1159 */
1160 typedef struct {
1161 CSSM_X509_NAME_PTR subjectNameX509;
1162
1163 /* Unfortunately there is no practical way to map any algorithm
1164 * to its appropriate OID, and we need both.... */
1165 CSSM_ALGORITHMS signatureAlg; // e.g., CSSM_ALGID_SHA1WithRSA
1166 CSSM_OID signatureOid; // e.g., CSSMOID_SHA1WithRSA
1167
1168 CSSM_CSP_HANDLE cspHand; // sign with this CSP
1169 const CSSM_KEY *subjectPublicKey;
1170 const CSSM_KEY *subjectPrivateKey;
1171
1172 /*
1173 * Optional challenge string.
1174 */
1175 const char *challengeString;
1176 } CSSM_APPLE_CL_CSR_REQUEST;
1177
1178 /*
1179 * When a CRL with no NextUpdate field is encountered, we use this time
1180 * as the NextUpdate attribute when storing in a DB. It represents the
1181 * virtual end of time in CSSM_TIMESTRING form.
1182 */
1183 #define CSSM_APPLE_CRL_END_OF_TIME "99991231235959"
1184
1185 /*
1186 * Default filesystem names and locations for SecurityServer features
1187 * (included here for lack of a better place)
1188 */
1189 #define kKeychainSuffix ".keychain"
1190 #define kKeychainDbSuffix ".keychain-db"
1191 #define kSystemKeychainName "System.keychain"
1192 #define kSystemKeychainDir "/Library/Keychains/"
1193 #define kSystemUnlockFile "/var/db/SystemKey"
1194
1195 #define kSystemKeychainPath kSystemKeychainDir kSystemKeychainName
1196
1197 /*
1198 * CSSM ACL tags used to store partition/integrity data in ACLs
1199 */
1200 #define CSSM_APPLE_ACL_TAG_PARTITION_ID "___PARTITION___"
1201 #define CSSM_APPLE_ACL_TAG_INTEGRITY "___INTEGRITY___"
1202
1203
1204 void cssmPerror(const char *how, CSSM_RETURN error);
1205
1206 /* Convert between CSSM_OID and CSSM_ALGORITHMS */
1207 bool cssmOidToAlg(const CSSM_OID *oid, CSSM_ALGORITHMS *alg);
1208 const CSSM_OID *cssmAlgToOid(CSSM_ALGORITHMS algId);
1209
1210 /*
1211 * The MacOS OSStatus space has an embedding for UNIX errno values, similar to
1212 * the way we embed CSSM_RETURN values in OSStatus. These are the base and limit
1213 * values for this embedding.
1214 */
1215 #define errSecErrnoBase 100000
1216 #define errSecErrnoLimit 100255
1217
1218 #endif /* SEC_OS_OSX */
1219
1220 #pragma clang diagnostic pop
1221
1222 #ifdef __cplusplus
1223 }
1224 #endif // __cplusplus
1225
1226 #endif /* _CSSMAPPLE_H_ */
mirror of Security