sec/Security/SecTrust.h

   1 /*
   2  * Copyright (c) 2002-2010,2012-2013 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*!
  25     @header SecTrust
  26     The functions and data types in SecTrust implement trust computation
  27     and allow the caller to apply trust decisions to the evaluation.
  28  */
  29
  30 #ifndef _SECURITY_SECTRUST_H_
  31 #define _SECURITY_SECTRUST_H_
  32
  33 #include <Security/SecBase.h>
  34 #include <CoreFoundation/CoreFoundation.h>
  35 #include <AvailabilityMacros.h>
  36
  37 __BEGIN_DECLS
  38
  39 /*!
  40     @typedef SecTrustResultType
  41     @abstract Specifies the trust result type.
  42     @discussion SecTrustResultType results have two dimensions.  They specify
  43     both whether evaluation suceeded and whether this is because of a user
  44     decision.  The commonly expected result is kSecTrustResultUnspecified,
  45     which indicates a positive result that wasn't decided by the user.  The
  46     common failure is kSecTrustResultRecoverableTrustFailure, which means a
  47     negative result.  kSecTrustResultProceed and kSecTrustResultDeny are the
  48     positive and negative result respectively when decided by the user.  User
  49     decisions are persisted through the use of SecTrustCopyExceptions() and
  50     SecTrustSetExceptions().  Finally, kSecTrustResultFatalTrustFailure is a
  51     negative result that must not be circumvented.
  52     @constant kSecTrustResultInvalid Indicates an invalid setting or result.
  53     This result usually means that SecTrustEvaluate has not yet been called.
  54     @constant kSecTrustResultProceed Indicates you may proceed.  This value
  55     may be returned by the SecTrustEvaluate function or stored as part of
  56     the user trust settings.
  57     @constant kSecTrustResultConfirm Indicates confirmation with the user
  58     is required before proceeding.  Important: this value is no longer returned
  59     or supported by SecTrustEvaluate or the SecTrustSettings API starting in
  60     OS X 10.5; its use is deprecated in OS X 10.9 and later, as well as in iOS.
  61     @constant kSecTrustResultDeny Indicates a user-configured deny; do not
  62     proceed. This value may be returned by the SecTrustEvaluate function
  63     or stored as part of the user trust settings.
  64     @constant kSecTrustResultUnspecified Indicates the evaluation succeeded
  65     and the certificate is implicitly trusted, but user intent was not
  66     explicitly specified.  This value may be returned by the SecTrustEvaluate
  67     function or stored as part of the user trust settings.
  68     @constant kSecTrustResultRecoverableTrustFailure Indicates a trust policy
  69     failure which can be overridden by the user.  This value may be returned
  70     by the SecTrustEvaluate function but not stored as part of the user
  71     trust settings.
  72     @constant kSecTrustResultFatalTrustFailure Indicates a trust failure
  73     which cannot be overridden by the user.  This value may be returned by the
  74     SecTrustEvaluate function but not stored as part of the user trust
  75     settings.
  76     @constant kSecTrustResultOtherError Indicates a failure other than that
  77     of trust evaluation. This value may be returned by the SecTrustEvaluate
  78     function but not stored as part of the user trust settings.
  79  */
  80 typedef uint32_t SecTrustResultType;
  81 enum {
  82     kSecTrustResultInvalid = 0,
  83     kSecTrustResultProceed = 1,
  84     kSecTrustResultConfirm SEC_DEPRECATED_ATTRIBUTE = 2,
  85     kSecTrustResultDeny = 3,
  86     kSecTrustResultUnspecified = 4,
  87     kSecTrustResultRecoverableTrustFailure = 5,
  88     kSecTrustResultFatalTrustFailure = 6,
  89     kSecTrustResultOtherError = 7
  90 };
  91
  92 /*!
  93     @typedef SecTrustRef
  94     @abstract CFType used for performing X.509 certificate trust evaluations.
  95  */
  96 typedef struct __SecTrust *SecTrustRef;
  97
  98 /*!
  99     @enum Trust Property Constants
 100     @discussion Predefined key constants used to obtain values in a
 101         per-certificate dictionary of trust evaluation results,
 102         as retrieved from a call to SecTrustCopyProperties.
 103     @constant kSecPropertyTypeTitle Specifies a key whose value is a
 104         CFStringRef containing the title (display name) of this certificate.
 105     @constant kSecPropertyTypeError Specifies a key whose value is a
 106         CFStringRef containing the reason for a trust evaluation failure.
 107  */
 108 extern CFTypeRef kSecPropertyTypeTitle
 109     __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_7_0);
 110 extern CFTypeRef kSecPropertyTypeError
 111     __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_7_0);
 112
 113 /*!
 114     @enum Trust Result Constants
 115     @discussion Predefined key constants used to obtain values in a
 116         dictionary of trust evaluation results for a certificate chain,
 117         as retrieved from a call to SecTrustCopyResult.
 118     @constant kSecTrustEvaluationDate
 119         This key will be present if a trust evaluation has been performed
 120         and results are available. Its value is a CFDateRef representing
 121         when the evaluation for this trust object took place.
 122     @constant kSecTrustExtendedValidation
 123         This key will be present and have a value of kCFBooleanTrue
 124         if this chain was validated for EV.
 125     @constant kSecTrustOrganizationName
 126         Organization name field of subject of leaf certificate. This
 127         field is meant to be displayed to the user as the validated
 128         name of the company or entity that owns the certificate if the
 129         kSecTrustExtendedValidation key is present.
 130     @constant kSecTrustResultValue
 131         This key will be present if a trust evaluation has been performed.
 132         Its value is a CFNumberRef representing the SecTrustResultType result
 133         for the evaluation.
 134     @constant kSecTrustRevocationChecked
 135         This key will be present iff this chain had its revocation checked.
 136         The value will be a kCFBooleanTrue if revocation checking was
 137         successful and none of the certificates in the chain were revoked.
 138         The value will be kCFBooleanFalse if no current revocation status
 139         could be obtained for one or more certificates in the chain due
 140         to connection problems or timeouts.  This is a hint to a client
 141         to retry revocation checking at a later time.
 142     @constant kSecTrustRevocationValidUntilDate
 143         This key will be present iff kSecTrustRevocationChecked has a
 144         value of kCFBooleanTrue. The value will be a CFDateRef representing
 145         the earliest date at which the revocation info for one of the
 146         certificates in this chain might change.
 147  */
 148 extern CFTypeRef kSecTrustEvaluationDate
 149     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
 150 extern CFTypeRef kSecTrustExtendedValidation
 151     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
 152 extern CFTypeRef kSecTrustOrganizationName
 153     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
 154 extern CFTypeRef kSecTrustResultValue
 155     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
 156 extern CFTypeRef kSecTrustRevocationChecked
 157     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
 158 extern CFTypeRef kSecTrustRevocationValidUntilDate
 159     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
 160
 161 #ifdef __BLOCKS__
 162 /*!
 163     @typedef SecTrustCallback
 164     @abstract Delivers the result from an asynchronous trust evaluation.
 165     @param trustRef A reference to the trust object which has been evaluated.
 166     @param trustResult The trust result of the evaluation. Additional status
 167     information can be obtained by calling SecTrustCopyProperties().
 168  */
 169 typedef void (^SecTrustCallback)(SecTrustRef trustRef, SecTrustResultType trustResult);
 170 #endif /* __BLOCKS__ */
 171
 172
 173 /*!
 174     @function SecTrustGetTypeID
 175     @abstract Returns the type identifier of SecTrust instances.
 176     @result The CFTypeID of SecTrust instances.
 177  */
 178 CFTypeID SecTrustGetTypeID(void)
 179     __OSX_AVAILABLE_STARTING(__MAC_10_3, __IPHONE_2_0);
 180
 181 /*!
 182     @function SecTrustCreateWithCertificates
 183     @abstract Creates a trust object based on the given certificates and
 184     policies.
 185     @param certificates The group of certificates to verify.  This can either
 186     be a CFArrayRef of SecCertificateRef objects or a single SecCertificateRef
 187     @param policies An array of one or more policies. You may pass a
 188     SecPolicyRef to represent a single policy.
 189     @param trust On return, a pointer to the trust management reference.
 190     @result A result code.  See "Security Error Codes" (SecBase.h).
 191     @discussion If multiple policies are passed in, all policies must verify
 192     for the chain to be considered valid.
 193  */
 194 OSStatus SecTrustCreateWithCertificates(CFTypeRef certificates,
 195     CFTypeRef policies, SecTrustRef *trust)
 196     __OSX_AVAILABLE_STARTING(__MAC_10_3, __IPHONE_2_0);
 197
 198 /*!
 199     @function SecTrustSetPolicies
 200     @abstract Set the policies for which trust should be verified.
 201     @param trust A trust reference.
 202     @param policies An array of one or more policies. You may pass a
 203     SecPolicyRef to represent a single policy.
 204     @result A result code. See "Security Error Codes" (SecBase.h).
 205     @discussion This function will invalidate the existing trust result,
 206     requiring a fresh evaluation for the newly-set policies.
 207  */
 208 OSStatus SecTrustSetPolicies(SecTrustRef trust, CFTypeRef policies)
 209     __OSX_AVAILABLE_STARTING(__MAC_10_3, __IPHONE_6_0);
 210
 211 /*!
 212     @function SecTrustCopyPolicies
 213     @abstract Returns an array of policies used for this evaluation.
 214     @param trust  A reference to a trust object.
 215     @param policies On return, an array of policies used by this trust.
 216     Call the CFRelease function to release this reference.
 217     @result A result code. See "Security Error Codes" (SecBase.h).
 218  */
 219 OSStatus SecTrustCopyPolicies(SecTrustRef trust, CFArrayRef *policies)
 220     __OSX_AVAILABLE_STARTING(__MAC_10_3, __IPHONE_7_0);
 221
 222 /*!
 223     @function SecTrustSetNetworkFetchAllowed
 224     @abstract Specifies whether a trust evaluation is permitted to fetch missing
 225     intermediate certificates from the network.
 226     @param trust A trust reference.
 227     @param allowFetch If true, and a certificate's issuer is not present in the
 228     trust reference but its network location is known, the evaluation is permitted
 229     to attempt to download it automatically. Pass false to disable network fetch
 230     for this trust evaluation.
 231     @result A result code. See "Security Error Codes" (SecBase.h).
 232     @discussion By default, network fetch of missing certificates is enabled if
 233     the trust evaluation includes the SSL policy, otherwise it is disabled.
 234  */
 235 OSStatus SecTrustSetNetworkFetchAllowed(SecTrustRef trust,
 236     Boolean allowFetch)
 237     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
 238
 239 /*!
 240     @function SecTrustGetNetworkFetchAllowed
 241     @abstract Returns whether a trust evaluation is permitted to fetch missing
 242     intermediate certificates from the network.
 243     @param trust A trust reference.
 244     @param allowFetch On return, the boolean pointed to by this parameter is
 245     set to true if the evaluation is permitted to download missing certificates.
 246     @result A result code. See "Security Error Codes" (SecBase.h).
 247     @discussion By default, network fetch of missing certificates is enabled if
 248     the trust evaluation includes the SSL policy, otherwise it is disabled.
 249  */
 250 OSStatus SecTrustGetNetworkFetchAllowed(SecTrustRef trust,
 251     Boolean *allowFetch)
 252     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
 253
 254 /*!
 255     @function SecTrustSetAnchorCertificates
 256     @abstract Sets the anchor certificates for a given trust.
 257     @param trust A reference to a trust object.
 258     @param anchorCertificates An array of anchor certificates.
 259     @result A result code.  See "Security Error Codes" (SecBase.h).
 260     @discussion Calling this function without also calling
 261     SecTrustSetAnchorCertificatesOnly() will disable trusting any
 262     anchors other than the ones in anchorCertificates.
 263  */
 264 OSStatus SecTrustSetAnchorCertificates(SecTrustRef trust,
 265     CFArrayRef anchorCertificates)
 266     __OSX_AVAILABLE_STARTING(__MAC_10_3, __IPHONE_2_0);
 267
 268 /*!
 269     @function SecTrustSetAnchorCertificatesOnly
 270     @abstract Reenables trusting anchor certificates in addition to those
 271     passed in via the SecTrustSetAnchorCertificates API.
 272     @param trust A reference to a trust object.
 273     @param anchorCertificatesOnly If true, disables trusting any anchors other
 274     than the ones passed in via SecTrustSetAnchorCertificates().  If false,
 275     the built in anchor certificates are also trusted.
 276     @result A result code.  See "Security Error Codes" (SecBase.h).
 277  */
 278 OSStatus SecTrustSetAnchorCertificatesOnly(SecTrustRef trust,
 279     Boolean anchorCertificatesOnly)
 280     __OSX_AVAILABLE_STARTING(__MAC_10_6, __IPHONE_2_0);
 281
 282 /*!
 283     @function SecTrustCopyCustomAnchorCertificates
 284     @abstract Returns an array of custom anchor certificates used by a given
 285     trust, as set by a prior call to SecTrustSetAnchorCertificates, or NULL if
 286     no custom anchors have been specified.
 287     @param trust  A reference to a trust object.
 288     @param anchors On return, an array of custom anchor certificates (roots)
 289     used by this trust, or NULL if no custom anchors have been specified. Call
 290     the CFRelease function to release this reference.
 291     @result A result code. See "Security Error Codes" (SecBase.h).
 292  */
 293 OSStatus SecTrustCopyCustomAnchorCertificates(SecTrustRef trust,
 294     CFArrayRef *anchors)
 295     __OSX_AVAILABLE_STARTING(__MAC_10_5, __IPHONE_7_0);
 296
 297 /*!
 298     @function SecTrustSetVerifyDate
 299     @abstract Set the date for which the trust should be verified.
 300     @param trust A reference to a trust object.
 301     @param verifyDate The date for which to verify trust.
 302     @result A result code.  See "Security Error Codes" (SecBase.h).
 303     @discussion This function lets you evaluate certificate validity for a
 304     given date (for example, to determine if a signature was valid on the date
 305     it was signed, even if the certificate has since expired.) If this function
 306     is not called, the time at which SecTrustEvaluate() is called is used
 307     implicitly as the verification time.
 308  */
 309 OSStatus SecTrustSetVerifyDate(SecTrustRef trust, CFDateRef verifyDate)
 310     __OSX_AVAILABLE_STARTING(__MAC_10_3, __IPHONE_2_0);
 311
 312 /*!
 313     @function SecTrustGetVerifyTime
 314     @abstract Returns the verify time.
 315     @param trust A reference to the trust object being verified.
 316     @result A CFAbsoluteTime value representing the time at which certificates
 317     should be checked for validity.
 318     @discussion This function retrieves the verification time for the given
 319     trust reference, as set by a prior call to SecTrustSetVerifyDate(). If the
 320     verification time has not been set, this function returns a value of 0,
 321     indicating that the current date/time is implicitly used for verification.
 322  */
 323 CFAbsoluteTime SecTrustGetVerifyTime(SecTrustRef trust)
 324     __OSX_AVAILABLE_STARTING(__MAC_10_6, __IPHONE_2_0);
 325
 326 /*!
 327     @function SecTrustEvaluate
 328     @abstract Evaluates a trust reference synchronously.
 329     @param trust A reference to the trust object to evaluate.
 330     @param result A pointer to a result type.
 331     @result A result code. See "Security Error Codes" (SecBase.h).
 332     @discussion This function will completely evaluate trust before returning,
 333     possibly including network access to fetch intermediate certificates or to
 334     perform revocation checking. Since this function can block during those
 335     operations, you should call it from within a function that is placed on a
 336     dispatch queue, or in a separate thread from your application's main
 337     run loop. Alternatively, you can use the SecTrustEvaluateAsync function.
 338  */
 339 OSStatus SecTrustEvaluate(SecTrustRef trust, SecTrustResultType *result)
 340     __OSX_AVAILABLE_STARTING(__MAC_10_3, __IPHONE_2_0);
 341
 342 #ifdef __BLOCKS__
 343 /*!
 344     @function SecTrustEvaluateAsync
 345     @abstract Evaluates a trust reference asynchronously.
 346     @param trust A reference to the trust object to evaluate.
 347     @param queue A dispatch queue on which the result callback should be
 348     executed. Pass NULL to use the current dispatch queue.
 349     @param result A SecTrustCallback block which will be executed when the
 350     trust evaluation is complete.
 351     @result A result code. See "Security Error Codes" (SecBase.h).
 352  */
 353 OSStatus SecTrustEvaluateAsync(SecTrustRef trust,
 354     dispatch_queue_t queue, SecTrustCallback result)
 355     __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_7_0);
 356 #endif
 357
 358 /*!
 359     @function SecTrustGetTrustResult
 360     @param trust A reference to a trust object.
 361     @param result A pointer to the result from the most recent call to
 362     SecTrustEvaluate for this trust reference. If SecTrustEvaluate has not been
 363     called or trust parameters have changed, the result is kSecTrustResultInvalid.
 364     @result A result code. See "Security Error Codes" (SecBase.h).
 365     @discussion This function replaces SecTrustGetResult for the purpose of
 366     obtaining the current evaluation result of a given trust reference.
 367  */
 368 OSStatus SecTrustGetTrustResult(SecTrustRef trust,
 369     SecTrustResultType *result)
 370     __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_7_0);
 371
 372 /*!
 373     @function SecTrustCopyPublicKey
 374     @abstract Return the public key for a leaf certificate after it has
 375     been evaluated.
 376     @param trust A reference to the trust object which has been evaluated.
 377     @result The certificate's public key, or NULL if it the public key could
 378     not be extracted (this can happen with DSA certificate chains if the
 379     parameters in the chain cannot be found).  The caller is responsible
 380     for calling CFRelease on the returned key when it is no longer needed.
 381  */
 382 SecKeyRef SecTrustCopyPublicKey(SecTrustRef trust)
 383     __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_2_0);
 384
 385 /*!
 386     @function SecTrustGetCertificateCount
 387     @abstract Returns the number of certificates in an evaluated certificate
 388     chain.
 389     @param trust A reference to a trust object.
 390     @result The number of certificates in the trust chain, including the anchor.
 391     @discussion Important: if the trust reference has not yet been evaluated,
 392     this function will evaluate it first before returning. If speed is critical,
 393     you may want to call SecTrustGetTrustResult first to make sure that a
 394     result other than kSecTrustResultInvalid is present for the trust object.
 395  */
 396 CFIndex SecTrustGetCertificateCount(SecTrustRef trust)
 397     __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_2_0);
 398
 399 /*!
 400     @function SecTrustGetCertificateAtIndex
 401     @abstract Returns a certificate from the trust chain.
 402     @param trust Reference to a trust object.
 403     @param ix The index of the requested certificate.  Indices run from 0
 404     (leaf) to the anchor (or last certificate found if no anchor was found).
 405     The leaf cert (index 0) is always present regardless of whether the trust
 406     reference has been evaluated or not.
 407     @result A SecCertificateRef for the requested certificate.
 408  */
 409 SecCertificateRef SecTrustGetCertificateAtIndex(SecTrustRef trust, CFIndex ix)
 410     __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_2_0);
 411
 412 /*!
 413     @function SecTrustCopyExceptions
 414     @abstract Returns an opaque cookie which will allow future evaluations
 415     of the current certificate to succeed.
 416     @param trust A reference to an evaluated trust object.
 417     @result An opaque cookie which when passed to SecTrustSetExceptions() will
 418     cause a call to SecTrustEvaluate() return kSecTrustResultProceed.  This
 419     will happen upon subsequent evaluation of the current certificate unless
 420     some new error starts happening that wasn't being reported when the cookie
 421     was returned from this function (for example, if the certificate expires
 422     then evaluation will start failing again until a new cookie is obtained.)
 423     @discussion Normally this API should only be called once the errors have
 424     been presented to the user and the user decided to trust the current
 425     certificate chain regardless of the errors being presented, for the
 426     current application/server/protocol combination.
 427  */
 428 CFDataRef SecTrustCopyExceptions(SecTrustRef trust)
 429     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_4_0);
 430
 431 /*!
 432     @function SecTrustSetExceptions
 433     @abstract Set a trust cookie to be used for evaluating this certificate chain.
 434     @param trust A reference to a trust object.
 435     @param exceptions An exceptions cookie as returned by a call to
 436     SecTrustCopyExceptions() in the past.
 437     @result Upon calling SecTrustEvaluate(), any failures that where present at the
 438     time the exceptions object was created are ignored, and instead of returning
 439     kSecTrustResultRecoverableTrustFailure, kSecTrustResultProceed will be returned
 440     (if the certificate for which exceptions was created matches the current leaf
 441     certificate).
 442     @result Returns true if the exceptions cookies was valid and matches the current
 443     leaf certificate, false otherwise.  This function will invalidate the existing
 444     trust result, requiring a subsequent evaluation for the newly-set exceptions.
 445     Note that this function returning true doesn't mean the caller can skip calling
 446     SecTrustEvaluate, as there may be new errors since the exceptions cookie was
 447     created (for example, a certificate may have subsequently expired.)
 448     @discussion Clients of this interface will need to establish the context of this
 449     exception to later decide when this exception cookie is to be used.
 450     Examples of this context would be the server we are connecting to, the ssid
 451     of the wireless network for which this cert is needed, the account for which
 452     this cert should be considered valid, and so on.
 453  */
 454 bool SecTrustSetExceptions(SecTrustRef trust, CFDataRef exceptions)
 455     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_4_0);
 456
 457 /*!
 458     @function SecTrustCopyProperties
 459     @abstract Return a property array for this trust evaluation.
 460     @param trust A reference to a trust object. If the trust has not been
 461     evaluated, the returned property array will be empty.
 462     @result A property array. It is the caller's responsibility to CFRelease
 463     the returned array when it is no longer needed.
 464     @discussion This function returns an ordered array of CFDictionaryRef
 465     instances for each certificate in the chain. Indices run from 0 (leaf) to
 466     the anchor (or last certificate found if no anchor was found.) See the
 467     "Trust Property Constants" section for a list of currently defined keys.
 468  */
 469 CFArrayRef SecTrustCopyProperties(SecTrustRef trust)
 470     __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_2_0);
 471
 472 /*!
 473     @function SecTrustCopyResult
 474     @abstract Returns a dictionary containing information about the
 475     evaluated certificate chain for use by clients.
 476     @param trust A reference to a trust object.
 477     @result A dictionary with various fields that can be displayed to the user,
 478     or NULL if no additional info is available or the trust has not yet been
 479     validated.  The caller is responsible for calling CFRelease on the value
 480     returned when it is no longer needed.
 481     @discussion Returns a dictionary for the overall trust evaluation. See the
 482     "Trust Result Constants" section for a list of currently defined keys.
 483  */
 484 CFDictionaryRef SecTrustCopyResult(SecTrustRef trust)
 485     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
 486
 487 /*!
 488     @function SecTrustSetOCSPResponse
 489     @abstract Attach OCSPResponse data to a trust object.
 490     @param trust A reference to a trust object.
 491     @param responseData This may be either a CFData object containing a single
 492     DER-encoded OCSPResponse (per RFC 2560), or a CFArray of these.
 493     @result A result code. See "Security Error Codes" (SecBase.h).
 494     @discussion Allows the caller to provide OCSPResponse data (which may be
 495     obtained during a TLS/SSL handshake, per RFC 3546) as input to a trust
 496     evaluation. If this data is available, it can obviate the need to contact
 497     an OCSP server for current revocation information.
 498  */
 499 OSStatus SecTrustSetOCSPResponse(SecTrustRef trust, CFTypeRef responseData)
 500     __OSX_AVAILABLE_STARTING(__MAC_10_9, __IPHONE_7_0);
 501
 502
 503 /*
 504  *  Legacy functions (OS X only)
 505  */
 506 #if TARGET_OS_MAC && !TARGET_OS_IPHONE
 507 #include <Security/cssmtype.h>
 508 #include <Security/cssmapple.h>
 509
 510 /*!
 511     @typedef SecTrustUserSetting
 512     @abstract Specifies a user-specified trust setting value.
 513     @discussion Deprecated in OS X 10.9. User trust settings are managed by
 514     functions in SecTrustSettings.h (starting with OS X 10.5), and by the
 515     SecTrustCopyExceptions and SecTrustSetExceptions functions (starting with
 516     iOS 4 and OS X 10.9). The latter two functions are recommended for both OS X
 517     and iOS, as they avoid the need to explicitly specify these values.
 518  */
 519 typedef SecTrustResultType SecTrustUserSetting
 520     __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_9, __IPHONE_NA, __IPHONE_NA);
 521
 522 /*!
 523     @typedef SecTrustOptionFlags
 524     @abstract Options for customizing trust evaluation.
 525     @constant kSecTrustOptionAllowExpired Allow expired certificates.
 526     @constant kSecTrustOptionLeafIsCA Allow CA as leaf certificate.
 527     @constant kSecTrustOptionFetchIssuerFromNet Allow network fetch of CA cert.
 528     @constant kSecTrustOptionAllowExpiredRoot Allow expired roots.
 529     @constant kSecTrustOptionRequireRevPerCert Require positive revocation
 530     check per certificate.
 531     @constant kSecTrustOptionUseTrustSettings Use TrustSettings instead of
 532     anchors.
 533     @constant kSecTrustOptionImplicitAnchors Properly self-signed certs are
 534     treated as anchors implicitly.
 535  */
 536 typedef uint32_t SecTrustOptionFlags;
 537 enum {
 538     kSecTrustOptionAllowExpired       = 0x00000001,
 539     kSecTrustOptionLeafIsCA           = 0x00000002,
 540     kSecTrustOptionFetchIssuerFromNet = 0x00000004,
 541     kSecTrustOptionAllowExpiredRoot   = 0x00000008,
 542     kSecTrustOptionRequireRevPerCert  = 0x00000010,
 543     kSecTrustOptionUseTrustSettings   = 0x00000020,
 544     kSecTrustOptionImplicitAnchors    = 0x00000040
 545 };
 546
 547 /*!
 548     @function SecTrustSetOptions
 549     @abstract Sets optional flags for customizing a trust evaluation.
 550     @param trustRef A trust reference.
 551     @param options Flags to change evaluation behavior for this trust.
 552     @result A result code. See "Security Error Codes" (SecBase.h).
 553     @discussion This function is not available on iOS. Use SecTrustSetExceptions
 554     and SecTrustCopyExceptions to modify default trust results, and
 555     SecTrustSetNetworkFetchAllowed to specify whether missing CA certificates
 556     can be fetched from the network.
 557  */
 558 OSStatus SecTrustSetOptions(SecTrustRef trustRef, SecTrustOptionFlags options)
 559     __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA);
 560
 561 /*!
 562     @function SecTrustSetParameters
 563     @abstract Sets the action and action data for a trust object.
 564     @param trustRef The reference to the trust to change.
 565     @param action A trust action.
 566     @param actionData A reference to data associated with this action.
 567     @result A result code. See "Security Error Codes" (SecBase.h).
 568     @discussion This function is deprecated in OS X 10.7 and later, where it
 569     was replaced by SecTrustSetOptions, and is not available on iOS. Your code
 570     should use SecTrustSetExceptions and SecTrustCopyExceptions to modify default
 571     trust results, and SecTrustSetNetworkFetchAllowed to specify whether missing
 572     CA certificates can be fetched from the network.
 573  */
 574 OSStatus SecTrustSetParameters(SecTrustRef trustRef,
 575     CSSM_TP_ACTION action, CFDataRef actionData)
 576     __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA);
 577
 578 /*!
 579     @function SecTrustSetKeychains
 580     @abstract Sets the keychains for a given trust object.
 581     @param trust A reference to a trust object.
 582     @param keychainOrArray A reference to an array of keychains to search, a
 583     single keychain, or NULL to use the default keychain search list.
 584     @result A result code. See "Security Error Codes" (SecBase.h).
 585     @discussion By default, the user's keychain search list and the system
 586     anchors keychain are searched for certificates to complete the chain. You
 587     can specify a zero-element array if you do not want any keychains searched.
 588     Note: this function is not applicable to iOS.
 589  */
 590 OSStatus SecTrustSetKeychains(SecTrustRef trust, CFTypeRef keychainOrArray)
 591     __OSX_AVAILABLE_STARTING(__MAC_10_3, __IPHONE_NA);
 592
 593 /*!
 594     @function SecTrustGetResult
 595     @abstract Returns detailed information on the outcome of an evaluation.
 596     @param trustRef A reference to a trust object.
 597     @param result A pointer to the result from the call to SecTrustEvaluate.
 598     @param certChain On return, a pointer to the certificate chain used to
 599     validate the input certificate. Call the CFRelease function to release
 600     this pointer.
 601     @param statusChain On return, a pointer to the status of the certificate
 602     chain. Do not attempt to free this pointer; it remains valid until the
 603     trust is destroyed or the next call to SecTrustEvaluate.
 604     @result A result code. See "Security Error Codes" (SecBase.h).
 605     @discussion This function is deprecated in OS X 10.7 and later,
 606     and is not available on iOS.
 607     To get the complete certificate chain, use SecTrustGetCertificateCount and
 608     SecTrustGetCertificateAtIndex. To get detailed status information for each
 609     certificate, use SecTrustCopyProperties. To get the overall trust result
 610     for the evaluation, use SecTrustGetTrustResult.
 611  */
 612 OSStatus SecTrustGetResult(SecTrustRef trustRef, SecTrustResultType *result,
 613     CFArrayRef *certChain, CSSM_TP_APPLE_EVIDENCE_INFO **statusChain)
 614     __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA);
 615
 616 /*!
 617     @function SecTrustGetCssmResult
 618     @abstract Gets the CSSM trust result.
 619     @param trust A reference to a trust.
 620     @param result On return, a pointer to the CSSM trust result.
 621     @result A result code. See "Security Error Codes" (SecBase.h).
 622     @discussion This function is deprecated in OS X 10.7 and later,
 623     and is not available on iOS.
 624     To get detailed status information for each certificate, use
 625     SecTrustCopyProperties. To get the overall trust result for the evaluation,
 626     use SecTrustGetTrustResult.
 627  */
 628 OSStatus SecTrustGetCssmResult(SecTrustRef trust,
 629     CSSM_TP_VERIFY_CONTEXT_RESULT_PTR *result)
 630     __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA);
 631
 632 /*!
 633     @function SecTrustGetCssmResultCode
 634     @abstract Gets the result code from the most recent call to SecTrustEvaluate
 635     for the specified trust.
 636     @param trust A reference to a trust.
 637     @param resultCode On return, the result code produced by the most recent
 638     evaluation of the given trust (cssmerr.h). The value of resultCode is
 639     undefined if SecTrustEvaluate has not been called.
 640     @result A result code. See "Security Error Codes" (SecBase.h). Returns
 641     errSecTrustNotAvailable if SecTrustEvaluate has not been called for the
 642     specified trust.
 643     @discussion This function is deprecated in OS X 10.7 and later,
 644     and is not available on iOS.
 645     To get detailed status information for each certificate, use
 646     SecTrustCopyProperties. To get the overall trust result for the evaluation,
 647     use SecTrustGetTrustResult.
 648  */
 649 OSStatus SecTrustGetCssmResultCode(SecTrustRef trust, OSStatus *resultCode)
 650     __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA);
 651
 652 /*!
 653     @function SecTrustGetTPHandle
 654     @abstract Gets the CSSM trust handle
 655     @param trust A reference to a trust.
 656     @param handle On return, a CSSM trust handle.
 657     @result A result code. See "Security Error Codes" (SecBase.h).
 658     @discussion This function is deprecated in OS X 10.7 and later.
 659  */
 660 OSStatus SecTrustGetTPHandle(SecTrustRef trust, CSSM_TP_HANDLE *handle)
 661     __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA);
 662
 663 /*!
 664     @function SecTrustCopyAnchorCertificates
 665     @abstract Returns an array of default anchor (root) certificates used by
 666     the system.
 667     @param anchors On return, an array containing the system's default anchors
 668     (roots). Call the CFRelease function to release this pointer.
 669     @result A result code. See "Security Error Codes" (SecBase.h).
 670     @discussion This function is not available on iOS, as certificate data
 671     for system-trusted roots is currently unavailable on that platform.
 672  */
 673 OSStatus SecTrustCopyAnchorCertificates(CFArrayRef *anchors)
 674     __OSX_AVAILABLE_STARTING(__MAC_10_3, __IPHONE_NA);
 675
 676 #endif /* TARGET_OS_MAC && !TARGET_OS_IPHONE */
 677
 678
 679 __END_DECLS
 680
 681 #endif /* !_SECURITY_SECTRUST_H_ */