AppleX509TP/rootCerts.h

   1 /*
   2  * Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
   3  *
   4  * The contents of this file constitute Original Code as defined in and are
   5  * subject to the Apple Public Source License Version 1.2 (the 'License').
   6  * You may not use this file except in compliance with the License. Please obtain
   7  * a copy of the License at http://www.apple.com/publicsource and read it before
   8  * using this file.
   9  *
  10  * This Original Code and all software distributed under the License are
  11  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
  12  * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
  13  * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
  14  * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
  15  * specific language governing rights and limitations under the License.
  16  */
  17
  18
  19 /*
  20         File:           rootCerts.h
  21
  22         Contains:       Interface to local cache of system-wide trusted root certs
  23
  24         Written by:     Doug Mitchell.
  25
  26         Copyright:      Copyright 1999 by Apple Computer, Inc., all rights reserved.
  27
  28 */
  29
  30 #ifndef _TP_ROOT_CERTS_H_
  31 #define _TP_ROOT_CERTS_H_
  32
  33 /*
  34  * As of 3/18/02, use of the built-in root certs is disabled by default.
  35  * Their use is enabled at in CSSM_TP_CertGroupVerify by the use of the
  36  * CSSM_TP_USE_INTERNAL_ROOT_CERTS bit in
  37  * CSSM_APPLE_TP_ACTION_DATA.ActionFlags.  The presence of the root certs
  38  * at all (at compile time) is controlled TP_ROOT_CERT_ENABLE.
  39  */
  40 #define TP_ROOT_CERT_ENABLE             0
  41
  42 #if             TP_ROOT_CERT_ENABLE
  43
  44 #include <Security/cssmtype.h>
  45 #include <Security/globalizer.h>
  46 #include <Security/threading.h>
  47 #include "TPCertInfo.h"
  48
  49 /*
  50  * Each one of these represents one known root cert.
  51  */
  52 typedef struct {
  53         CSSM_DATA       subjectName;    // normalized and DER-encoded
  54         CSSM_DATA       publicKey;              // DER-encoded
  55         uint32          keySize;
  56 } tpRootCert;
  57
  58 /* One of these per process which caches the roots in tpRootCert format */
  59 class TPRootStore
  60 {
  61 public:
  62         TPRootStore() : mRootCerts(NULL), mNumRootCerts(0) { }
  63         ~TPRootStore();
  64         const tpRootCert *rootCerts(
  65                 CSSM_CL_HANDLE clHand,
  66                 unsigned &numRootCerts);
  67         static ModuleNexus<TPRootStore> tpGlobalRoots;
  68
  69 private:
  70         tpRootCert *mRootCerts;
  71         unsigned mNumRootCerts;
  72         Mutex mLock;
  73 };
  74
  75
  76 /*
  77  * Compare a root cert to a list of known embedded roots.
  78  */
  79 extern "C" {
  80
  81 CSSM_BOOL tp_isKnownRootCert(
  82         TPCertInfo              *rootCert,                      // raw cert to compare
  83         CSSM_CL_HANDLE  clHand);
  84
  85 CSSM_BOOL tp_verifyWithKnownRoots(
  86         CSSM_CL_HANDLE  clHand,
  87         CSSM_CSP_HANDLE cspHand,
  88         TPCertInfo              *certToVfy);            // last in chain, not root
  89
  90 }
  91
  92 #endif  /* TP_ROOT_CERT_ENABLE */
  93
  94 #endif  /* _TP_ROOT_CERTS_H_ */