Security-59306.120.7.tar.gz

[apple/security.git] / OSX / libsecurity_keychain / lib / SecPolicy.cpp

diff --git a/OSX/libsecurity_keychain/lib/SecPolicy.cpp b/OSX/libsecurity_keychain/lib/SecPolicy.cpp
index c34acf244b047f2c2fdbd74e3ecae196b4556e71..56aeaefdaefad9de403a4741e6df860767c356e5 100644 (file)
--- a/OSX/libsecurity_keychain/lib/SecPolicy.cpp
+++ b/OSX/libsecurity_keychain/lib/SecPolicy.cpp
@@ -1,3 +1,4 @@
+

 /*
  * Copyright (c) 2002-2015 Apple Inc. All Rights Reserved.
  *
 /*
  * Copyright (c) 2002-2015 Apple Inc. All Rights Reserved.
  *


@@ -40,67 +41,14 @@
 
 #define SEC_CONST_DECL(k,v) const CFStringRef k = CFSTR(v);
 
 
 #define SEC_CONST_DECL(k,v) const CFStringRef k = CFSTR(v);
 

-SEC_CONST_DECL (kSecPolicyAppleX509Basic, "1.2.840.113635.100.1.2");
-SEC_CONST_DECL (kSecPolicyAppleSSL, "1.2.840.113635.100.1.3");
-SEC_CONST_DECL (kSecPolicyAppleSMIME, "1.2.840.113635.100.1.8");
-SEC_CONST_DECL (kSecPolicyAppleEAP, "1.2.840.113635.100.1.9");
-SEC_CONST_DECL (kSecPolicyAppleSWUpdateSigning, "1.2.840.113635.100.1.10");
-SEC_CONST_DECL (kSecPolicyAppleIPsec, "1.2.840.113635.100.1.11");
+/* Some of these aren't defined in SecPolicy.c, but used here. */

 SEC_CONST_DECL (kSecPolicyAppleiChat, "1.2.840.113635.100.1.12");
 SEC_CONST_DECL (kSecPolicyAppleiChat, "1.2.840.113635.100.1.12");

-SEC_CONST_DECL (kSecPolicyApplePKINITClient, "1.2.840.113635.100.1.14");
-SEC_CONST_DECL (kSecPolicyApplePKINITServer, "1.2.840.113635.100.1.15");
-SEC_CONST_DECL (kSecPolicyAppleCodeSigning, "1.2.840.113635.100.1.16");
-SEC_CONST_DECL (kSecPolicyApplePackageSigning, "1.2.840.113635.100.1.17");
-SEC_CONST_DECL (kSecPolicyAppleIDValidation, "1.2.840.113635.100.1.18");
-SEC_CONST_DECL (kSecPolicyMacAppStoreReceipt, "1.2.840.113635.100.1.19");
-SEC_CONST_DECL (kSecPolicyAppleTimeStamping, "1.2.840.113635.100.1.20");
-SEC_CONST_DECL (kSecPolicyAppleRevocation, "1.2.840.113635.100.1.21");
-SEC_CONST_DECL (kSecPolicyApplePassbookSigning, "1.2.840.113635.100.1.22");
-SEC_CONST_DECL (kSecPolicyAppleMobileStore, "1.2.840.113635.100.1.23");
-SEC_CONST_DECL (kSecPolicyAppleEscrowService, "1.2.840.113635.100.1.24");
-SEC_CONST_DECL (kSecPolicyAppleProfileSigner, "1.2.840.113635.100.1.25");
-SEC_CONST_DECL (kSecPolicyAppleQAProfileSigner, "1.2.840.113635.100.1.26");
-SEC_CONST_DECL (kSecPolicyAppleTestMobileStore, "1.2.840.113635.100.1.27");
-#if TARGET_OS_IPHONE
-SEC_CONST_DECL (kSecPolicyAppleOTAPKISigner, "1.2.840.113635.100.1.28");
-SEC_CONST_DECL (kSecPolicyAppleTestOTAPKISigner, "1.2.840.113635.100.1.29");
-/* FIXME: this policy name should be deprecated and replaced with "kSecPolicyAppleIDValidationRecordSigning" */
-SEC_CONST_DECL (kSecPolicyAppleIDValidationRecordSigningPolicy, "1.2.840.113625.100.1.30");
-SEC_CONST_DECL (kSecPolicyAppleSMPEncryption, "1.2.840.113625.100.1.31");
-SEC_CONST_DECL (kSecPolicyAppleTestSMPEncryption, "1.2.840.113625.100.1.32");
-#endif
-SEC_CONST_DECL (kSecPolicyAppleServerAuthentication, "1.2.840.113635.100.1.33");
-SEC_CONST_DECL (kSecPolicyApplePCSEscrowService, "1.2.840.113635.100.1.34");
-SEC_CONST_DECL (kSecPolicyApplePPQSigning, "1.2.840.113625.100.1.35");
-SEC_CONST_DECL (kSecPolicyAppleTestPPQSigning, "1.2.840.113625.100.1.36");
-SEC_CONST_DECL (kSecPolicyAppleATVAppSigning, "1.2.840.113625.100.1.37");
-SEC_CONST_DECL (kSecPolicyAppleTestATVAppSigning, "1.2.840.113625.100.1.38");
-
-SEC_CONST_DECL (kSecPolicyOid, "SecPolicyOid");
-SEC_CONST_DECL (kSecPolicyName, "SecPolicyName");
-SEC_CONST_DECL (kSecPolicyClient, "SecPolicyClient");
-SEC_CONST_DECL (kSecPolicyRevocationFlags, "SecPolicyRevocationFlags");
-SEC_CONST_DECL (kSecPolicyTeamIdentifier, "SecPolicyTeamIdentifier");
-
-SEC_CONST_DECL (kSecPolicyKU_DigitalSignature, "CE_KU_DigitalSignature");
-SEC_CONST_DECL (kSecPolicyKU_NonRepudiation, "CE_KU_NonRepudiation");
-SEC_CONST_DECL (kSecPolicyKU_KeyEncipherment, "CE_KU_KeyEncipherment");
-SEC_CONST_DECL (kSecPolicyKU_DataEncipherment, "CE_KU_DataEncipherment");
-SEC_CONST_DECL (kSecPolicyKU_KeyAgreement, "CE_KU_KeyAgreement");
-SEC_CONST_DECL (kSecPolicyKU_KeyCertSign, "CE_KU_KeyCertSign");
-SEC_CONST_DECL (kSecPolicyKU_CRLSign, "CE_KU_CRLSign");
-SEC_CONST_DECL (kSecPolicyKU_EncipherOnly, "CE_KU_EncipherOnly");
-SEC_CONST_DECL (kSecPolicyKU_DecipherOnly, "CE_KU_DecipherOnly");

 
 // Private functions
 
 extern "C" {
 
 // Private functions
 
 extern "C" {

-CFArrayRef SecPolicyCopyEscrowRootCertificates(void);
-#if SECTRUST_OSX
-CFStringRef SecPolicyGetOidString(SecPolicyRef policy);

 CFDictionaryRef SecPolicyGetOptions(SecPolicyRef policy);
 void SecPolicySetOptionsValue(SecPolicyRef policy, CFStringRef key, CFTypeRef value);
 CFDictionaryRef SecPolicyGetOptions(SecPolicyRef policy);
 void SecPolicySetOptionsValue(SecPolicyRef policy, CFStringRef key, CFTypeRef value);

-#endif

 }
 
 // String to CSSM_OID mapping
 }
 
 // String to CSSM_OID mapping


@@ -132,71 +80,72 @@ typedef struct oidmap_entry_s oidmap_entry_t;
        static_cast<const CssmOid *>(&CSSMOID_APPLE_TP_APPLEID_SHARING),
        static_cast<const CssmOid *>(&CSSMOID_APPLE_TP_TIMESTAMPING),
 */
        static_cast<const CssmOid *>(&CSSMOID_APPLE_TP_APPLEID_SHARING),
        static_cast<const CssmOid *>(&CSSMOID_APPLE_TP_TIMESTAMPING),
 */

-const oidmap_entry_t oidmap[] = {
-       { kSecPolicyAppleX509Basic, &CSSMOID_APPLE_X509_BASIC },
-       { kSecPolicyAppleSSL, &CSSMOID_APPLE_TP_SSL },
-       { kSecPolicyAppleSMIME, &CSSMOID_APPLE_TP_SMIME },
-       { kSecPolicyAppleEAP, &CSSMOID_APPLE_TP_EAP },
-       { kSecPolicyAppleSWUpdateSigning, &CSSMOID_APPLE_TP_SW_UPDATE_SIGNING },
-       { kSecPolicyAppleIPsec, &CSSMOID_APPLE_TP_IP_SEC },
-       { kSecPolicyAppleiChat, &CSSMOID_APPLE_TP_ICHAT },
-       { kSecPolicyApplePKINITClient, &CSSMOID_APPLE_TP_PKINIT_CLIENT },
-       { kSecPolicyApplePKINITServer, &CSSMOID_APPLE_TP_PKINIT_SERVER },
-       { kSecPolicyAppleCodeSigning, &CSSMOID_APPLE_TP_CODE_SIGNING },
-       { kSecPolicyApplePackageSigning, &CSSMOID_APPLE_TP_PACKAGE_SIGNING },
-       { kSecPolicyAppleIDValidation, &CSSMOID_APPLE_TP_APPLEID_SHARING },
-       { kSecPolicyMacAppStoreReceipt, &CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT },
-       { kSecPolicyAppleTimeStamping, &CSSMOID_APPLE_TP_TIMESTAMPING },
-       { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION },
-       { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION_OCSP },
-       { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION_CRL },
-       { kSecPolicyApplePassbookSigning, &CSSMOID_APPLE_TP_PASSBOOK_SIGNING },
-       { kSecPolicyAppleMobileStore, &CSSMOID_APPLE_TP_MOBILE_STORE },
-       { kSecPolicyAppleEscrowService, &CSSMOID_APPLE_TP_ESCROW_SERVICE },
-       { kSecPolicyAppleProfileSigner, &CSSMOID_APPLE_TP_PROFILE_SIGNING },
-       { kSecPolicyAppleQAProfileSigner, &CSSMOID_APPLE_TP_QA_PROFILE_SIGNING },
-       { kSecPolicyAppleTestMobileStore, &CSSMOID_APPLE_TP_TEST_MOBILE_STORE },
-       { kSecPolicyApplePCSEscrowService, &CSSMOID_APPLE_TP_PCS_ESCROW_SERVICE },
-};

 
 

-// TBD: have only one set of policy identifiers in SecPolicy.c so we can get rid of this
-const oidmap_entry_t oidmap_priv[] = {
-       { CFSTR("basicX509"), &CSSMOID_APPLE_X509_BASIC },
-       { CFSTR("sslServer"), &CSSMOID_APPLE_TP_SSL },
-       { CFSTR("sslClient"), &CSSMOID_APPLE_TP_SSL },
-       { CFSTR("SMIME"), &CSSMOID_APPLE_TP_SMIME },
-       { CFSTR("eapServer"), &CSSMOID_APPLE_TP_EAP },
-       { CFSTR("eapClient"), &CSSMOID_APPLE_TP_EAP },
-       { CFSTR("AppleSWUpdateSigning"), &CSSMOID_APPLE_TP_SW_UPDATE_SIGNING },
-       { CFSTR("ipsecServer"), &CSSMOID_APPLE_TP_IP_SEC },
-       { CFSTR("ipsecClient"), &CSSMOID_APPLE_TP_IP_SEC },
-       { CFSTR("CodeSigning"), &CSSMOID_APPLE_TP_CODE_SIGNING },
-       { CFSTR("PackageSigning"), &CSSMOID_APPLE_TP_PACKAGE_SIGNING },
-       { CFSTR("AppleIDAuthority"), &CSSMOID_APPLE_TP_APPLEID_SHARING },
-       { CFSTR("MacAppStoreReceipt"), &CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT },
-       { CFSTR("AppleTimeStamping"), &CSSMOID_APPLE_TP_TIMESTAMPING },
-       { CFSTR("revocation"), &CSSMOID_APPLE_TP_REVOCATION },
-       { CFSTR("ApplePassbook"), &CSSMOID_APPLE_TP_PASSBOOK_SIGNING },
-       { CFSTR("AppleMobileStore"), &CSSMOID_APPLE_TP_MOBILE_STORE },
-       { CFSTR("AppleEscrowService"), &CSSMOID_APPLE_TP_ESCROW_SERVICE },
-       { CFSTR("AppleProfileSigner"), &CSSMOID_APPLE_TP_PROFILE_SIGNING },
-       { CFSTR("AppleQAProfileSigner"), &CSSMOID_APPLE_TP_QA_PROFILE_SIGNING },
-       { CFSTR("AppleTestMobileStore"), &CSSMOID_APPLE_TP_TEST_MOBILE_STORE },
-       { CFSTR("ApplePCSEscrowService"), &CSSMOID_APPLE_TP_PCS_ESCROW_SERVICE },
+static const size_t OIDMAP_LENGTH = 25;
+static const oidmap_entry_t* oidmap_f() {
+    static const oidmap_entry_t oidmap_array[] = {
+        { kSecPolicyAppleX509Basic, &CSSMOID_APPLE_X509_BASIC },
+        { kSecPolicyAppleSSL, &CSSMOID_APPLE_TP_SSL },
+        { kSecPolicyAppleSMIME, &CSSMOID_APPLE_TP_SMIME },
+        { kSecPolicyAppleEAP, &CSSMOID_APPLE_TP_EAP },
+        { kSecPolicyAppleSWUpdateSigning, &CSSMOID_APPLE_TP_SW_UPDATE_SIGNING },
+        { kSecPolicyAppleIPsec, &CSSMOID_APPLE_TP_IP_SEC },
+        { kSecPolicyAppleiChat, &CSSMOID_APPLE_TP_ICHAT },
+        { kSecPolicyApplePKINITClient, &CSSMOID_APPLE_TP_PKINIT_CLIENT },
+        { kSecPolicyApplePKINITServer, &CSSMOID_APPLE_TP_PKINIT_SERVER },
+        { kSecPolicyAppleCodeSigning, &CSSMOID_APPLE_TP_CODE_SIGNING },
+        { kSecPolicyApplePackageSigning, &CSSMOID_APPLE_TP_PACKAGE_SIGNING },
+        { kSecPolicyAppleIDValidation, &CSSMOID_APPLE_TP_APPLEID_SHARING },
+        { kSecPolicyMacAppStoreReceipt, &CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT },
+        { kSecPolicyAppleTimeStamping, &CSSMOID_APPLE_TP_TIMESTAMPING },
+        { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION },
+        { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION_OCSP },
+        { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION_CRL },
+        { kSecPolicyApplePassbookSigning, &CSSMOID_APPLE_TP_PASSBOOK_SIGNING },
+        { kSecPolicyAppleMobileStore, &CSSMOID_APPLE_TP_MOBILE_STORE },
+        { kSecPolicyAppleEscrowService, &CSSMOID_APPLE_TP_ESCROW_SERVICE },
+        { kSecPolicyAppleProfileSigner, &CSSMOID_APPLE_TP_PROFILE_SIGNING },
+        { kSecPolicyAppleQAProfileSigner, &CSSMOID_APPLE_TP_QA_PROFILE_SIGNING },
+        { kSecPolicyAppleTestMobileStore, &CSSMOID_APPLE_TP_TEST_MOBILE_STORE },
+        { kSecPolicyApplePCSEscrowService, &CSSMOID_APPLE_TP_PCS_ESCROW_SERVICE },
+        { kSecPolicyAppleOSXProvisioningProfileSigning, &CSSMOID_APPLE_TP_PROVISIONING_PROFILE_SIGNING },
+    };
+    static_assert(OIDMAP_LENGTH == (sizeof(oidmap_array)/sizeof(oidmap_entry_t)), "OIDMAP_LENGTH is incorrect; must match oidmap_array");
+
+    return oidmap_array;

 };
 
 };
 

-//
-// CF boilerplate
-//
-#if !SECTRUST_OSX
-CFTypeID
-SecPolicyGetTypeID(void)
-{
-       BEGIN_SECAPI
-       return gTypes().Policy.typeID;
-       END_SECAPI1(_kCFRuntimeNotATypeID)
+static const size_t OIDMAP_PRIV_LENGTH = 23;
+static const oidmap_entry_t* oidmap_priv_f() {
+    static const oidmap_entry_t oidmap_priv_array[] = {
+        { CFSTR("basicX509"), &CSSMOID_APPLE_X509_BASIC },
+        { CFSTR("sslServer"), &CSSMOID_APPLE_TP_SSL },
+        { CFSTR("sslClient"), &CSSMOID_APPLE_TP_SSL },
+        { CFSTR("SMIME"), &CSSMOID_APPLE_TP_SMIME },
+        { CFSTR("eapServer"), &CSSMOID_APPLE_TP_EAP },
+        { CFSTR("eapClient"), &CSSMOID_APPLE_TP_EAP },
+        { CFSTR("AppleSWUpdateSigning"), &CSSMOID_APPLE_TP_SW_UPDATE_SIGNING },
+        { CFSTR("ipsecServer"), &CSSMOID_APPLE_TP_IP_SEC },
+        { CFSTR("ipsecClient"), &CSSMOID_APPLE_TP_IP_SEC },
+        { CFSTR("CodeSigning"), &CSSMOID_APPLE_TP_CODE_SIGNING },
+        { CFSTR("PackageSigning"), &CSSMOID_APPLE_TP_PACKAGE_SIGNING },
+        { CFSTR("AppleIDAuthority"), &CSSMOID_APPLE_TP_APPLEID_SHARING },
+        { CFSTR("MacAppStoreReceipt"), &CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT },
+        { CFSTR("AppleTimeStamping"), &CSSMOID_APPLE_TP_TIMESTAMPING },
+        { CFSTR("revocation"), &CSSMOID_APPLE_TP_REVOCATION },
+        { CFSTR("ApplePassbook"), &CSSMOID_APPLE_TP_PASSBOOK_SIGNING },
+        { CFSTR("AppleMobileStore"), &CSSMOID_APPLE_TP_MOBILE_STORE },
+        { CFSTR("AppleEscrowService"), &CSSMOID_APPLE_TP_ESCROW_SERVICE },
+        { CFSTR("AppleProfileSigner"), &CSSMOID_APPLE_TP_PROFILE_SIGNING },
+        { CFSTR("AppleQAProfileSigner"), &CSSMOID_APPLE_TP_QA_PROFILE_SIGNING },
+        { CFSTR("AppleTestMobileStore"), &CSSMOID_APPLE_TP_TEST_MOBILE_STORE },
+        { CFSTR("ApplePCSEscrowService"), &CSSMOID_APPLE_TP_PCS_ESCROW_SERVICE },
+        { CFSTR("AppleOSXProvisioningProfileSigning"), &CSSMOID_APPLE_TP_PROVISIONING_PROFILE_SIGNING },
+    };
+    static_assert(OIDMAP_PRIV_LENGTH == (sizeof(oidmap_priv_array)/sizeof(oidmap_entry_t)), "OIDMAP_PRIV_LENGTH is incorrect; must match oidmap_priv_array");
+
+    return oidmap_priv_array;

 }
 }

-#endif

 
 //
 // Sec API bridge functions
 
 //
 // Sec API bridge functions


@@ -205,11 +154,6 @@ SecPolicyGetTypeID(void)
 OSStatus
 SecPolicyGetOID(SecPolicyRef policyRef, CSSM_OID* oid)
 {
 OSStatus
 SecPolicyGetOID(SecPolicyRef policyRef, CSSM_OID* oid)
 {

-#if !SECTRUST_OSX
-       BEGIN_SECAPI
-       Required(oid) = Policy::required(policyRef)->oid();
-       END_SECAPI
-#else

        /* bridge to support old functionality */
        if (!policyRef) {
                return errSecParam;
        /* bridge to support old functionality */
        if (!policyRef) {
                return errSecParam;


@@ -219,21 +163,21 @@ SecPolicyGetOID(SecPolicyRef policyRef, CSSM_OID* oid)
                return errSecParam; // bad policy ref?
        }
        CSSM_OID *oidptr = NULL;
                return errSecParam; // bad policy ref?
        }
        CSSM_OID *oidptr = NULL;

-       unsigned int i, oidmaplen = sizeof(oidmap) / sizeof(oidmap_entry_t);
-       for (i=0; i<oidmaplen; i++) {
-               CFStringRef str = (CFStringRef) oidmap[i].oidstr;
+    unsigned int i;
+       for (i=0; i<OIDMAP_LENGTH; i++) {
+               CFStringRef str = (CFStringRef) oidmap_f()[i].oidstr;

                if (CFStringCompare(str, oidStr, 0) == kCFCompareEqualTo) {
                if (CFStringCompare(str, oidStr, 0) == kCFCompareEqualTo) {

-                       oidptr = (CSSM_OID*)oidmap[i].oidptr;
+                       oidptr = (CSSM_OID*)oidmap_f()[i].oidptr;

                        break;
                }
        }
        if (!oidptr) {
                // Check private iOS policy names.
                        break;
                }
        }
        if (!oidptr) {
                // Check private iOS policy names.

-               oidmaplen = sizeof(oidmap_priv) / sizeof(oidmap_entry_t);
-               for (i=0; i<oidmaplen; i++) {
-                       CFStringRef str = (CFStringRef) oidmap_priv[i].oidstr;
+
+               for (i=0; i<OIDMAP_PRIV_LENGTH; i++) {
+                       CFStringRef str = (CFStringRef) oidmap_priv_f()[i].oidstr;

                        if (CFStringCompare(str, oidStr, 0) == kCFCompareEqualTo) {
                        if (CFStringCompare(str, oidStr, 0) == kCFCompareEqualTo) {

-                               oidptr = (CSSM_OID*)oidmap_priv[i].oidptr;
+                               oidptr = (CSSM_OID*)oidmap_priv_f()[i].oidptr;

                                break;
                        }
                }
                                break;
                        }
                }


@@ -246,7 +190,6 @@ SecPolicyGetOID(SecPolicyRef policyRef, CSSM_OID* oid)
     CFShow(oidStr);
        syslog(LOG_ERR, "WARNING: SecPolicyGetOID failed to return an OID. This function was deprecated in 10.7. Please use SecPolicyCopyProperties instead.");
        return errSecServiceNotAvailable;
     CFShow(oidStr);
        syslog(LOG_ERR, "WARNING: SecPolicyGetOID failed to return an OID. This function was deprecated in 10.7. Please use SecPolicyCopyProperties instead.");
        return errSecServiceNotAvailable;

-#endif

 }
 
 // TODO: use a version of this function from a utility library
 }
 
 // TODO: use a version of this function from a utility library


@@ -275,17 +218,16 @@ CFStringRef SecPolicyGetStringForOID(CSSM_OID* oid)
                return NULL;
        }
        // given a CSSM_OID pointer, return corresponding string in oidmap
                return NULL;
        }
        // given a CSSM_OID pointer, return corresponding string in oidmap

-       unsigned int i, oidmaplen = sizeof(oidmap) / sizeof(oidmap_entry_t);
-       for (i=0; i<oidmaplen; i++) {
-               CSSM_OID* oidptr = (CSSM_OID*)oidmap[i].oidptr;
+    unsigned int i;
+       for (i=0; i<OIDMAP_LENGTH; i++) {
+               CSSM_OID* oidptr = (CSSM_OID*)oidmap_f()[i].oidptr;

                if (compareOids(oid, oidptr)) {
                if (compareOids(oid, oidptr)) {

-                       return (CFStringRef) oidmap[i].oidstr;
+                       return (CFStringRef) oidmap_f()[i].oidstr;

                }
        }
        return NULL;
 }
 
                }
        }
        return NULL;
 }
 

-#if SECTRUST_OSX

 static bool SecPolicyGetCSSMDataValueForString(SecPolicyRef policyRef, CFStringRef stringRef, CSSM_DATA* value)
 {
        // Old API expects to vend a pointer and length for a policy value.
 static bool SecPolicyGetCSSMDataValueForString(SecPolicyRef policyRef, CFStringRef stringRef, CSSM_DATA* value)
 {
        // Old API expects to vend a pointer and length for a policy value.


@@ -313,25 +255,19 @@ static bool SecPolicyGetCSSMDataValueForString(SecPolicyRef policyRef, CFStringR
                // stash this in a place where it will be released when the policy is destroyed
                if (policyRef) {
                        SecPolicySetOptionsValue(policyRef, CFSTR("policy_data"), data);
                // stash this in a place where it will be released when the policy is destroyed
                if (policyRef) {
                        SecPolicySetOptionsValue(policyRef, CFSTR("policy_data"), data);

-                       CFRelease(data);

                }
                else {
                        syslog(LOG_ERR, "WARNING: policy dictionary not found to store returned data; will leak!");
                }
        }
                }
                else {
                        syslog(LOG_ERR, "WARNING: policy dictionary not found to store returned data; will leak!");
                }
        }

+    CFReleaseNull(data);

        return true;
 }
        return true;
 }

-#endif

 
 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
 OSStatus
 SecPolicyGetValue(SecPolicyRef policyRef, CSSM_DATA* value)
 {
 
 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
 OSStatus
 SecPolicyGetValue(SecPolicyRef policyRef, CSSM_DATA* value)
 {

-#if !SECTRUST_OSX
-       BEGIN_SECAPI
-       Required(value) = Policy::required(policyRef)->value();
-       END_SECAPI
-#else

        /* bridge to support old functionality */
 #if SECTRUST_DEPRECATION_WARNINGS
     syslog(LOG_ERR, "WARNING: SecPolicyGetValue was deprecated in 10.7. Please use SecPolicyCopyProperties instead.");
        /* bridge to support old functionality */
 #if SECTRUST_DEPRECATION_WARNINGS
     syslog(LOG_ERR, "WARNING: SecPolicyGetValue was deprecated in 10.7. Please use SecPolicyCopyProperties instead.");


@@ -353,7 +289,7 @@ SecPolicyGetValue(SecPolicyRef policyRef, CSSM_DATA* value)
                        (const void **)&name) && name) {
                        break;
                }
                        (const void **)&name) && name) {
                        break;
                }

-               if (CFDictionaryGetValueIfPresent(options, CFSTR("email") /*kSecPolicyCheckEmail*/,
+               if (CFDictionaryGetValueIfPresent(options, CFSTR("Email") /*kSecPolicyCheckEmail*/,

                        (const void **)&name) && name) {
                        break;
                }
                        (const void **)&name) && name) {
                        break;
                }


@@ -370,39 +306,12 @@ SecPolicyGetValue(SecPolicyRef policyRef, CSSM_DATA* value)
                value->Length = 0;
        }
        return errSecSuccess;
                value->Length = 0;
        }
        return errSecSuccess;

-#endif
-}
-
-#if !SECTRUST_OSX
-CFDictionaryRef
-SecPolicyCopyProperties(SecPolicyRef policyRef)
-{
-       /* can't use SECAPI macros, since this function does not return OSStatus */
-       CFDictionaryRef result = NULL;
-       try {
-               result = Policy::required(policyRef)->properties();
-       }
-       catch (...) {
-               if (result) {
-                       CFRelease(result);
-                       result = NULL;
-               }
-       };
-       return result;

 }
 }

-#endif

 
 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
 OSStatus
 SecPolicySetValue(SecPolicyRef policyRef, const CSSM_DATA *value)
 {
 
 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
 OSStatus
 SecPolicySetValue(SecPolicyRef policyRef, const CSSM_DATA *value)
 {

-#if !SECTRUST_OSX
-       BEGIN_SECAPI
-       Required(value);
-       const CssmData newValue(value->Data, value->Length);
-       Policy::required(policyRef)->setValue(newValue);
-       END_SECAPI
-#else

        /* bridge to support old functionality */
 #if SECTRUST_DEPRECATION_WARNINGS
     syslog(LOG_ERR, "WARNING: SecPolicySetValue was deprecated in 10.7. Please use SecPolicySetProperties instead.");
        /* bridge to support old functionality */
 #if SECTRUST_DEPRECATION_WARNINGS
     syslog(LOG_ERR, "WARNING: SecPolicySetValue was deprecated in 10.7. Please use SecPolicySetProperties instead.");


@@ -413,7 +322,6 @@ SecPolicySetValue(SecPolicyRef policyRef, const CSSM_DATA *value)
        OSStatus status = errSecSuccess;
        CFDataRef data = NULL;
        CFStringRef name = NULL;
        OSStatus status = errSecSuccess;
        CFDataRef data = NULL;
        CFStringRef name = NULL;

-       CFNumberRef cnum = NULL;

        CFStringRef oid = (CFStringRef) SecPolicyGetOidString(policyRef);
        if (!oid) {
                syslog(LOG_ERR, "SecPolicySetValue: unknown policy OID");
        CFStringRef oid = (CFStringRef) SecPolicyGetOidString(policyRef);
        if (!oid) {
                syslog(LOG_ERR, "SecPolicySetValue: unknown policy OID");


@@ -485,27 +393,27 @@ SecPolicySetValue(SecPolicyRef policyRef, const CSSM_DATA *value)
                CSSM_APPLE_TP_CRL_OPTIONS *opts = (CSSM_APPLE_TP_CRL_OPTIONS *)value->Data;
                if (opts->Version == CSSM_APPLE_TP_CRL_OPTS_VERSION) {
                        CSSM_APPLE_TP_CRL_OPT_FLAGS crlFlags = opts->CrlFlags;
                CSSM_APPLE_TP_CRL_OPTIONS *opts = (CSSM_APPLE_TP_CRL_OPTIONS *)value->Data;
                if (opts->Version == CSSM_APPLE_TP_CRL_OPTS_VERSION) {
                        CSSM_APPLE_TP_CRL_OPT_FLAGS crlFlags = opts->CrlFlags;

-                       CFOptionFlags revocationFlags = 0;

                        if ((crlFlags & CSSM_TP_ACTION_FETCH_CRL_FROM_NET) == 0) {
                                /* disable network access */
                        if ((crlFlags & CSSM_TP_ACTION_FETCH_CRL_FROM_NET) == 0) {
                                /* disable network access */

-                               revocationFlags |= kSecRevocationNetworkAccessDisabled;
+                               SecPolicySetOptionsValue(policyRef, CFSTR("NoNetworkAccess") /*kSecPolicyCheckNoNetworkAccess*/, kCFBooleanTrue);

                        }
                        if ((crlFlags & CSSM_TP_ACTION_CRL_SUFFICIENT) == 0) {
                        }
                        if ((crlFlags & CSSM_TP_ACTION_CRL_SUFFICIENT) == 0) {

-                               /* if OCSP method is not sufficient, must use CRL */
-                               revocationFlags |= (kSecRevocationCRLMethod | kSecRevocationPreferCRL);
+                               /* if CRL method is not sufficient, must use OCSP */
+                               SecPolicySetOptionsValue(policyRef, CFSTR("Revocation") /*kSecPolicyCheckRevocation*/,
+                                         CFSTR("OCSP")/*kSecPolicyCheckRevocationOCSP*/);

                        } else {
                                /* either method is sufficient */
                        } else {
                                /* either method is sufficient */

-                               revocationFlags |= kSecRevocationUseAnyAvailableMethod;
+                               SecPolicySetOptionsValue(policyRef, CFSTR("Revocation") /*kSecPolicyCheckRevocation*/,
+                                         CFSTR("AnyRevocationMethod") /*kSecPolicyCheckRevocationAny*/);

                        }
                        }

+

                        if ((crlFlags & CSSM_TP_ACTION_REQUIRE_CRL_PER_CERT) != 0) {
                                /* require a response */
                        if ((crlFlags & CSSM_TP_ACTION_REQUIRE_CRL_PER_CERT) != 0) {
                                /* require a response */

-                               revocationFlags |= kSecRevocationRequirePositiveResponse;
-                       }
-                       cnum = CFNumberCreate(kCFAllocatorDefault, kCFNumberCFIndexType, &revocationFlags);
-                       if (cnum) {
-                               SecPolicySetOptionsValue(policyRef, kSecPolicyRevocationFlags, cnum);
+                               SecPolicySetOptionsValue(policyRef,
+                                                                                CFSTR("RevocationResponseRequired") /*kSecPolicyCheckRevocationResponseRequired*/,
+                                                                                kCFBooleanTrue);

                        }
                        }

-               }
+        }

        }
        else {
                syslog(LOG_ERR, "SecPolicySetValue: unrecognized policy OID");
        }
        else {
                syslog(LOG_ERR, "SecPolicySetValue: unrecognized policy OID");


@@ -513,62 +421,24 @@ SecPolicySetValue(SecPolicyRef policyRef, const CSSM_DATA *value)
        }
        if (data) { CFRelease(data); }
        if (name) { CFRelease(name); }
        }
        if (data) { CFRelease(data); }
        if (name) { CFRelease(name); }

-       if (cnum) { CFRelease(cnum); }

        return status;
        return status;

-#endif

 }
 
 }
 

-#if !SECTRUST_OSX
-OSStatus
-SecPolicySetProperties(SecPolicyRef policyRef, CFDictionaryRef properties)
-{
-       BEGIN_SECAPI
-       Policy::required(policyRef)->setProperties(properties);
-       END_SECAPI
-}
-#endif
-

 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
 OSStatus
 SecPolicyGetTPHandle(SecPolicyRef policyRef, CSSM_TP_HANDLE* tpHandle)
 {
 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
 OSStatus
 SecPolicyGetTPHandle(SecPolicyRef policyRef, CSSM_TP_HANDLE* tpHandle)
 {

-#if !SECTRUST_OSX
-       BEGIN_SECAPI
-       Required(tpHandle) = Policy::required(policyRef)->tp()->handle();
-       END_SECAPI
-#else

        /* this function is unsupported in unified SecTrust */
 #if SECTRUST_DEPRECATION_WARNINGS
        syslog(LOG_ERR, "WARNING: SecPolicyGetTPHandle was deprecated in 10.7, and does nothing in 10.11. Please stop using it.");
 #endif
        return errSecServiceNotAvailable;
        /* this function is unsupported in unified SecTrust */
 #if SECTRUST_DEPRECATION_WARNINGS
        syslog(LOG_ERR, "WARNING: SecPolicyGetTPHandle was deprecated in 10.7, and does nothing in 10.11. Please stop using it.");
 #endif
        return errSecServiceNotAvailable;

-#endif

 }
 
 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_3, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
 OSStatus
 SecPolicyCopyAll(CSSM_CERT_TYPE certificateType, CFArrayRef* policies)
 {
 }
 
 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_3, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
 OSStatus
 SecPolicyCopyAll(CSSM_CERT_TYPE certificateType, CFArrayRef* policies)
 {

-#if !SECTRUST_OSX
-       BEGIN_SECAPI
-       Required(policies);
-       CFMutableArrayRef currPolicies = NULL;
-       currPolicies = CFArrayCreateMutable(NULL, 0, NULL);
-       if ( currPolicies )
-       {
-               SecPointer<PolicyCursor> cursor(new PolicyCursor(NULL, NULL));
-               SecPointer<Policy> policy;
-               while ( cursor->next(policy) ) /* copies the next policy */
-               {
-                       CFArrayAppendValue(currPolicies, policy->handle());  /* 'SecPolicyRef' appended */
-                       CFRelease(policy->handle()); /* refcount bumped up when appended to array */
-               }
-               *policies = CFArrayCreateCopy(NULL, currPolicies);
-               CFRelease(currPolicies);
-               CFRelease(cursor->handle());
-       }
-       END_SECAPI
-#else

        /* bridge to support old functionality */
 #if SECTRUST_DEPRECATION_WARNINGS
     syslog(LOG_ERR, "WARNING: SecPolicyCopyAll was deprecated in 10.7. Please use SecPolicy creation functions instead.");
        /* bridge to support old functionality */
 #if SECTRUST_DEPRECATION_WARNINGS
     syslog(LOG_ERR, "WARNING: SecPolicyCopyAll was deprecated in 10.7. Please use SecPolicy creation functions instead.");


@@ -611,21 +481,16 @@ SecPolicyCopyAll(CSSM_CERT_TYPE certificateType, CFArrayRef* policies)
        *policies = CFArrayCreateCopy(NULL, curPolicies);
        CFRelease(curPolicies);
        return errSecSuccess;
        *policies = CFArrayCreateCopy(NULL, curPolicies);
        CFRelease(curPolicies);
        return errSecSuccess;

-#endif

 }
 
 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_3, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
 OSStatus
 SecPolicyCopy(CSSM_CERT_TYPE certificateType, const CSSM_OID *policyOID, SecPolicyRef* policy)
 {
 }
 
 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_3, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
 OSStatus
 SecPolicyCopy(CSSM_CERT_TYPE certificateType, const CSSM_OID *policyOID, SecPolicyRef* policy)
 {

-#if !SECTRUST_OSX
-       Required(policy);
-       Required(policyOID);
-#else

        if (!policyOID || !policy) {
                return errSecParam;
        }
        if (!policyOID || !policy) {
                return errSecParam;
        }

-#endif
+

        SecPolicySearchRef srchRef = NULL;
        OSStatus ortn;
 
        SecPolicySearchRef srchRef = NULL;
        OSStatus ortn;
 


@@ -642,9 +507,6 @@ SecPolicyCopy(CSSM_CERT_TYPE certificateType, const CSSM_OID *policyOID, SecPoli
 SecPolicyRef
 SecPolicyCreateItemImplInstance(SecPolicyRef policy)
 {
 SecPolicyRef
 SecPolicyCreateItemImplInstance(SecPolicyRef policy)
 {

-#if !SECTRUST_OSX
-    return (SecPolicyRef)(policy ? CFRetain(policy) : NULL);
-#else

        if (!policy) {
                return NULL;
        }
        if (!policy) {
                return NULL;
        }


@@ -668,91 +530,10 @@ SecPolicyCreateItemImplInstance(SecPolicyRef policy)
                CFRelease(properties);
        }
        return policyRef;
                CFRelease(properties);
        }
        return policyRef;

-#endif
-}
-
-#if !SECTRUST_OSX
-/* new in 10.6 */
-SecPolicyRef
-SecPolicyCreateBasicX509(void)
-{
-       // return a SecPolicyRef object for the X.509 Basic policy
-       SecPolicyRef policy = nil;
-       SecPolicySearchRef policySearch = nil;
-       OSStatus status = SecPolicySearchCreate(CSSM_CERT_X_509v3, &CSSMOID_APPLE_X509_BASIC, NULL, &policySearch);
-       if (!status) {
-               status = SecPolicySearchCopyNext(policySearch, &policy);
-       }
-       if (policySearch) {
-               CFRelease(policySearch);
-       }
-       return policy;

 }
 }

-#endif

 
 

-#if !SECTRUST_OSX
-/* new in 10.6 */
-SecPolicyRef
-SecPolicyCreateSSL(Boolean server, CFStringRef hostname)
-{
-       // return a SecPolicyRef object for the SSL policy, given hostname and client options
-       SecPolicyRef policy = nil;
-       SecPolicySearchRef policySearch = nil;
-       OSStatus status = SecPolicySearchCreate(CSSM_CERT_X_509v3, &CSSMOID_APPLE_TP_SSL, NULL, &policySearch);
-       if (!status) {
-               status = SecPolicySearchCopyNext(policySearch, &policy);
-       }
-       if (!status && policy) {
-               // set options for client-side or server-side policy evaluation
-               char *strbuf = NULL;
-               const char *hostnamestr = NULL;
-               if (hostname) {
-                       hostnamestr = CFStringGetCStringPtr(hostname, kCFStringEncodingUTF8);
-                       if (hostnamestr == NULL) {
-                CFIndex maxLen = CFStringGetMaximumSizeForEncoding(CFStringGetLength(hostname), kCFStringEncodingUTF8) + 1;
-                               strbuf = (char *)malloc(maxLen);
-                               if (CFStringGetCString(hostname, strbuf, maxLen, kCFStringEncodingUTF8)) {
-                                       hostnamestr = strbuf;
-                               }
-                       }
-               }
-        uint32 hostnamelen = (hostnamestr) ? (uint32)strlen(hostnamestr) : 0;
-        uint32 flags = (!server) ? CSSM_APPLE_TP_SSL_CLIENT : 0;
-        CSSM_APPLE_TP_SSL_OPTIONS opts = {CSSM_APPLE_TP_SSL_OPTS_VERSION, hostnamelen, hostnamestr, flags};
-        CSSM_DATA data = {sizeof(opts), (uint8*)&opts};
-        SecPolicySetValue(policy, &data);
-
-               if (strbuf) {
-                       free(strbuf);
-               }
-    }
-       if (policySearch) {
-               CFRelease(policySearch);
-       }
-       return policy;
-}
-#endif
-
-#if !SECTRUST_OSX
-/* not exported */

 static SecPolicyRef
 static SecPolicyRef

-SecPolicyCreateWithSecAsn1Oid(SecAsn1Oid *oidPtr)
-{
-       SecPolicyRef policy = NULL;
-       try {
-               SecPointer<Policy> policyObj;
-               PolicyCursor::policy(oidPtr, policyObj);
-               policy = policyObj->handle();
-       }
-       catch (...) {}
-
-       return policy;
-}
-#endif
-
-/* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_7, __MAC_10_9, __IPHONE_NA, __IPHONE_NA) */
-SecPolicyRef
-SecPolicyCreateWithOID(CFTypeRef policyOID)
+_SecPolicyCreateWithOID(CFTypeRef policyOID)

 {
        // for now, we only accept the policy constants that are defined in SecPolicy.h
        CFStringRef oidStr = (CFStringRef)policyOID;
 {
        // for now, we only accept the policy constants that are defined in SecPolicy.h
        CFStringRef oidStr = (CFStringRef)policyOID;


@@ -761,11 +542,11 @@ SecPolicyCreateWithOID(CFTypeRef policyOID)
        if (!oidStr) {
                return policy;
        }
        if (!oidStr) {
                return policy;
        }

-       unsigned int i, oidmaplen = sizeof(oidmap) / sizeof(oidmap_entry_t);
-       for (i=0; i<oidmaplen; i++) {
-               CFStringRef str = (CFStringRef) oidmap[i].oidstr;
+    unsigned int i;
+       for (i=0; i<OIDMAP_LENGTH; i++) {
+               CFStringRef str = (CFStringRef) oidmap_f()[i].oidstr;

                if (CFStringCompare(str, oidStr, 0) == kCFCompareEqualTo) {
                if (CFStringCompare(str, oidStr, 0) == kCFCompareEqualTo) {

-                       oidPtr = (CSSM_OID*)oidmap[i].oidptr;
+                       oidPtr = (CSSM_OID*)oidmap_f()[i].oidptr;

                        break;
                }
        }
                        break;
                }
        }


@@ -777,136 +558,28 @@ SecPolicyCreateWithOID(CFTypeRef policyOID)
                OSStatus status = SecPolicySearchCreate(CSSM_CERT_X_509v3, oidPtr, NULL, &policySearch);
                if (!status && policySearch) {
                        status = SecPolicySearchCopyNext(policySearch, &policy);
                OSStatus status = SecPolicySearchCreate(CSSM_CERT_X_509v3, oidPtr, NULL, &policySearch);
                if (!status && policySearch) {
                        status = SecPolicySearchCopyNext(policySearch, &policy);

+                       if (status != errSecSuccess) {
+                               policy = NULL;
+                       }

                        CFRelease(policySearch);
                }
                if (!policy && CFEqual(policyOID, kSecPolicyAppleRevocation)) {
                        policy = SecPolicyCreateRevocation(kSecRevocationUseAnyAvailableMethod);
                }
                        CFRelease(policySearch);
                }
                if (!policy && CFEqual(policyOID, kSecPolicyAppleRevocation)) {
                        policy = SecPolicyCreateRevocation(kSecRevocationUseAnyAvailableMethod);
                }

-#if !SECTRUST_OSX
-               if (!policy) {
-                       policy = SecPolicyCreateWithSecAsn1Oid((SecAsn1Oid*)oidPtr);
-               }
-#endif
-       }
-       if (!policy) {
-               syslog(LOG_ERR, "WARNING: SecPolicyCreateWithOID was unable to return the requested policy. This function was deprecated in 10.9. Please use supported SecPolicy creation functions instead.");

        }
        return policy;
 }
 
        }
        return policy;
 }
 

-#if !SECTRUST_OSX
-/* new in 10.9 */
-SecPolicyRef
-SecPolicyCreateWithProperties(CFTypeRef policyIdentifier, CFDictionaryRef properties)
-{
-       SecPolicyRef policy = SecPolicyCreateWithOID(policyIdentifier);
-       SecPolicySetProperties(policy, properties);
-
-       return policy;
-}
-#endif
-
-#if !SECTRUST_OSX
-/* new in 10.9 */
+/* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_7, __MAC_10_9, __IPHONE_NA, __IPHONE_NA) */

 SecPolicyRef
 SecPolicyRef

-SecPolicyCreateRevocation(CFOptionFlags revocationFlags)
-{
-       // return a SecPolicyRef object for the unified revocation policy
-       SecAsn1Oid *oidPtr = (SecAsn1Oid*)&CSSMOID_APPLE_TP_REVOCATION;
-       SecPolicyRef policy = SecPolicyCreateWithSecAsn1Oid(oidPtr);
-       if (policy) {
-               CSSM_DATA policyData = { (CSSM_SIZE)sizeof(CFOptionFlags), (uint8*)&revocationFlags };
-               SecPolicySetValue(policy, &policyData);
-       }
-       return policy;
-}
-#endif
-
-/* OS X only: deprecated SPI entry point */
-/* new in 10.9 ***FIXME*** TO BE REMOVED */
-CFArrayRef SecPolicyCopyEscrowRootCertificates(void)
-{
-       return SecCertificateCopyEscrowRoots(kSecCertificateProductionEscrowRoot);
-}
-
-SecPolicyRef SecPolicyCreateAppleIDSService(CFStringRef hostname)
-{
-    return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateAppleIDSServiceContext(CFStringRef hostname, CFDictionaryRef __unused context)
-{
-    return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateApplePushService(CFStringRef hostname, CFDictionaryRef __unused context)
-{
-    return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateApplePushServiceLegacy(CFStringRef hostname)
-{
-    return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateAppleMMCSService(CFStringRef hostname, CFDictionaryRef __unused context)
-{
-    return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateAppleGSService(CFStringRef hostname, CFDictionaryRef __unused context)
-{
-    return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateApplePPQService(CFStringRef hostname, CFDictionaryRef __unused context)
-{
-    return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateAppleATVAppSigning(void)
-{
-    return SecPolicyCreateWithOID(kSecPolicyAppleX509Basic);
-}
-
-SecPolicyRef SecPolicyCreateTestAppleATVAppSigning(void)
-{
-    return SecPolicyCreateWithOID(kSecPolicyAppleX509Basic);
-}
-
-SecPolicyRef SecPolicyCreateApplePayIssuerEncryption(void)
-{
-    return SecPolicyCreateWithOID(kSecPolicyAppleX509Basic);
-}
-
-#if !SECTRUST_OSX
-SecPolicyRef SecPolicyCreateAppleSSLService(CFStringRef hostname)
+SecPolicyCreateWithOID(CFTypeRef policyOID)

 {
 {

-       // SSL server, pinned to an Apple intermediate
-       SecPolicyRef policy = SecPolicyCreateSSL(true, hostname);
-       if (policy) {
-               // change options for policy evaluation
-               char *strbuf = NULL;
-               const char *hostnamestr = NULL;
-               if (hostname) {
-                       hostnamestr = CFStringGetCStringPtr(hostname, kCFStringEncodingUTF8);
-                       if (hostnamestr == NULL) {
-                               CFIndex maxLen = CFStringGetMaximumSizeForEncoding(CFStringGetLength(hostname), kCFStringEncodingUTF8) + 1;
-                               strbuf = (char *)malloc(maxLen);
-                               if (CFStringGetCString(hostname, strbuf, maxLen, kCFStringEncodingUTF8)) {
-                                       hostnamestr = strbuf;
-                               }
-                       }
-               }
-               uint32 hostnamelen = (hostnamestr) ? (uint32)strlen(hostnamestr) : 0;
-               uint32 flags = 0x00000002; // 2nd-lowest bit set to require Apple intermediate pin
-               CSSM_APPLE_TP_SSL_OPTIONS opts = {CSSM_APPLE_TP_SSL_OPTS_VERSION, hostnamelen, hostnamestr, flags};
-               CSSM_DATA data = {sizeof(opts), (uint8*)&opts};
-               SecPolicySetValue(policy, &data);
+       SecPolicyRef policy = _SecPolicyCreateWithOID(policyOID);
+       if (!policy) {
+               syslog(LOG_ERR, "WARNING: SecPolicyCreateWithOID was unable to return the requested policy. This function was deprecated in 10.9. Please use supported SecPolicy creation functions instead.");

        }
        return policy;
 }
        }
        return policy;
 }

-#endif

 
 /* OS X only: TBD */
 #include <security_utilities/cfutilities.h>
 
 /* OS X only: TBD */
 #include <security_utilities/cfutilities.h>


@@ -915,49 +588,35 @@ SecPolicyRef SecPolicyCreateAppleSSLService(CFStringRef hostname)
 CFArrayRef
 SecPolicyCreateAppleTimeStampingAndRevocationPolicies(CFTypeRef policyOrArray)
 {
 CFArrayRef
 SecPolicyCreateAppleTimeStampingAndRevocationPolicies(CFTypeRef policyOrArray)
 {

-#if !SECTRUST_OSX
-    /* can't use SECAPI macros, since this function does not return OSStatus */
-    CFArrayRef resultPolicyArray=NULL;
-    try {
-        // Set default policy
-        CFRef<CFArrayRef> policyArray = cfArrayize(policyOrArray);
-        CFRef<SecPolicyRef> defaultPolicy = SecPolicyCreateWithOID(kSecPolicyAppleTimeStamping);
-        CFRef<CFMutableArrayRef> appleTimeStampingPolicies = makeCFMutableArray(1,defaultPolicy.get());
-
-        // Parse the policy and add revocation related ones
-        CFIndex numPolicies = CFArrayGetCount(policyArray);
-        for(CFIndex dex=0; dex<numPolicies; dex++) {
-            SecPolicyRef secPol = (SecPolicyRef)CFArrayGetValueAtIndex(policyArray, dex);
-            SecPointer<Policy> pol = Policy::required(SecPolicyRef(secPol));
-            const CssmOid &oid = pol->oid();
-            if ((oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION))
-                || (oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_CRL))
-                || (oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_OCSP)))
-            {
-                CFArrayAppendValue(appleTimeStampingPolicies, secPol);
-            }
-        }
-        // Transfer of ownership
-        resultPolicyArray=appleTimeStampingPolicies.yield();
-    }
-    catch (...) {
-        CFReleaseNull(resultPolicyArray);
-    };
-#else
-    /* implement with unified SecPolicyRef instances */
-    SecPolicyRef policy = NULL;

     CFMutableArrayRef resultPolicyArray = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
     CFMutableArrayRef resultPolicyArray = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);

-    policy = SecPolicyCreateWithOID(kSecPolicyAppleTimeStamping);
-    if (policy) {
-        CFArrayAppendValue(resultPolicyArray, policy);
-        CFReleaseNull(policy);
+    if (!resultPolicyArray) {
+        return NULL;

     }
     }

-    policy = SecPolicyCreateWithOID(kSecPolicyAppleRevocation);
-    if (policy) {
-        CFArrayAppendValue(resultPolicyArray, policy);
-        CFReleaseNull(policy);
+    SecPolicyRef tsPolicy = SecPolicyCreateWithProperties(kSecPolicyAppleTimeStamping, NULL);
+    if (tsPolicy) {
+        CFArrayAppendValue(resultPolicyArray, tsPolicy);
+        CFReleaseNull(tsPolicy);

     }
     }

-#endif
+
+    /* check the provided argument for a revocation policy */
+    CFMutableArrayRef policies = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
+    if (policies && policyOrArray) {
+        if (CFGetTypeID(policyOrArray) == SecPolicyGetTypeID()) {
+            CFArrayAppendValue(policies, policyOrArray);
+        } else if (CFGetTypeID(policyOrArray) == CFArrayGetTypeID()) {
+            CFIndex arrayLength = CFArrayGetCount((CFArrayRef)policyOrArray);
+            CFArrayAppendArray(policies, (CFArrayRef)policyOrArray, CFRangeMake(0, arrayLength));
+        }
+    }
+    CFIndex numPolicies = (policies) ? CFArrayGetCount(policies) : 0;
+    for (CFIndex index=0; index<numPolicies; index++) {
+        SecPolicyRef policy = (SecPolicyRef)CFArrayGetValueAtIndex(policies, index);
+        CFStringRef policyName = (policy) ? SecPolicyGetName(policy) : NULL;
+        if (policyName && CFEqual(CFSTR("revocation"), policyName)) {
+            CFArrayAppendValue(resultPolicyArray, policy);
+        }
+    }
+    CFReleaseNull(policies);

     return resultPolicyArray;
 }
 
     return resultPolicyArray;
 }