Security-59754.60.13.tar.gz

[apple/security.git] / OSX / libsecurity_keychain / lib / SecPolicy.cpp

diff --git a/OSX/libsecurity_keychain/lib/SecPolicy.cpp b/OSX/libsecurity_keychain/lib/SecPolicy.cpp
index 273cfc294e5e1212bcd0568bafd0771573264e32..7f20d6260a3d9bdd4796ba8ada4bd25597abf164 100644 (file)
--- a/OSX/libsecurity_keychain/lib/SecPolicy.cpp
+++ b/OSX/libsecurity_keychain/lib/SecPolicy.cpp
@@ -80,60 +80,73 @@ typedef struct oidmap_entry_s oidmap_entry_t;
        static_cast<const CssmOid *>(&CSSMOID_APPLE_TP_APPLEID_SHARING),
        static_cast<const CssmOid *>(&CSSMOID_APPLE_TP_TIMESTAMPING),
 */
        static_cast<const CssmOid *>(&CSSMOID_APPLE_TP_APPLEID_SHARING),
        static_cast<const CssmOid *>(&CSSMOID_APPLE_TP_TIMESTAMPING),
 */

-const oidmap_entry_t oidmap[] = {
-       { kSecPolicyAppleX509Basic, &CSSMOID_APPLE_X509_BASIC },
-       { kSecPolicyAppleSSL, &CSSMOID_APPLE_TP_SSL },
-       { kSecPolicyAppleSMIME, &CSSMOID_APPLE_TP_SMIME },
-       { kSecPolicyAppleEAP, &CSSMOID_APPLE_TP_EAP },
-       { kSecPolicyAppleSWUpdateSigning, &CSSMOID_APPLE_TP_SW_UPDATE_SIGNING },
-       { kSecPolicyAppleIPsec, &CSSMOID_APPLE_TP_IP_SEC },
-       { kSecPolicyAppleiChat, &CSSMOID_APPLE_TP_ICHAT },
-       { kSecPolicyApplePKINITClient, &CSSMOID_APPLE_TP_PKINIT_CLIENT },
-       { kSecPolicyApplePKINITServer, &CSSMOID_APPLE_TP_PKINIT_SERVER },
-       { kSecPolicyAppleCodeSigning, &CSSMOID_APPLE_TP_CODE_SIGNING },
-       { kSecPolicyApplePackageSigning, &CSSMOID_APPLE_TP_PACKAGE_SIGNING },
-       { kSecPolicyAppleIDValidation, &CSSMOID_APPLE_TP_APPLEID_SHARING },
-       { kSecPolicyMacAppStoreReceipt, &CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT },
-       { kSecPolicyAppleTimeStamping, &CSSMOID_APPLE_TP_TIMESTAMPING },
-       { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION },
-       { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION_OCSP },
-       { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION_CRL },
-       { kSecPolicyApplePassbookSigning, &CSSMOID_APPLE_TP_PASSBOOK_SIGNING },
-       { kSecPolicyAppleMobileStore, &CSSMOID_APPLE_TP_MOBILE_STORE },
-       { kSecPolicyAppleEscrowService, &CSSMOID_APPLE_TP_ESCROW_SERVICE },
-       { kSecPolicyAppleProfileSigner, &CSSMOID_APPLE_TP_PROFILE_SIGNING },
-       { kSecPolicyAppleQAProfileSigner, &CSSMOID_APPLE_TP_QA_PROFILE_SIGNING },
-       { kSecPolicyAppleTestMobileStore, &CSSMOID_APPLE_TP_TEST_MOBILE_STORE },
-       { kSecPolicyApplePCSEscrowService, &CSSMOID_APPLE_TP_PCS_ESCROW_SERVICE },
-       { kSecPolicyAppleOSXProvisioningProfileSigning, &CSSMOID_APPLE_TP_PROVISIONING_PROFILE_SIGNING },
-};

 
 

-const oidmap_entry_t oidmap_priv[] = {
-    { CFSTR("basicX509"), &CSSMOID_APPLE_X509_BASIC },
-    { CFSTR("sslServer"), &CSSMOID_APPLE_TP_SSL },
-    { CFSTR("sslClient"), &CSSMOID_APPLE_TP_SSL },
-    { CFSTR("SMIME"), &CSSMOID_APPLE_TP_SMIME },
-    { CFSTR("eapServer"), &CSSMOID_APPLE_TP_EAP },
-    { CFSTR("eapClient"), &CSSMOID_APPLE_TP_EAP },
-    { CFSTR("AppleSWUpdateSigning"), &CSSMOID_APPLE_TP_SW_UPDATE_SIGNING },
-    { CFSTR("ipsecServer"), &CSSMOID_APPLE_TP_IP_SEC },
-    { CFSTR("ipsecClient"), &CSSMOID_APPLE_TP_IP_SEC },
-    { CFSTR("CodeSigning"), &CSSMOID_APPLE_TP_CODE_SIGNING },
-    { CFSTR("PackageSigning"), &CSSMOID_APPLE_TP_PACKAGE_SIGNING },
-    { CFSTR("AppleIDAuthority"), &CSSMOID_APPLE_TP_APPLEID_SHARING },
-    { CFSTR("MacAppStoreReceipt"), &CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT },
-    { CFSTR("AppleTimeStamping"), &CSSMOID_APPLE_TP_TIMESTAMPING },
-    { CFSTR("revocation"), &CSSMOID_APPLE_TP_REVOCATION },
-    { CFSTR("ApplePassbook"), &CSSMOID_APPLE_TP_PASSBOOK_SIGNING },
-    { CFSTR("AppleMobileStore"), &CSSMOID_APPLE_TP_MOBILE_STORE },
-    { CFSTR("AppleEscrowService"), &CSSMOID_APPLE_TP_ESCROW_SERVICE },
-    { CFSTR("AppleProfileSigner"), &CSSMOID_APPLE_TP_PROFILE_SIGNING },
-    { CFSTR("AppleQAProfileSigner"), &CSSMOID_APPLE_TP_QA_PROFILE_SIGNING },
-    { CFSTR("AppleTestMobileStore"), &CSSMOID_APPLE_TP_TEST_MOBILE_STORE },
-    { CFSTR("ApplePCSEscrowService"), &CSSMOID_APPLE_TP_PCS_ESCROW_SERVICE },
-    { CFSTR("AppleOSXProvisioningProfileSigning"), &CSSMOID_APPLE_TP_PROVISIONING_PROFILE_SIGNING },
+static const size_t OIDMAP_LENGTH = 25;
+static const oidmap_entry_t* oidmap_f() {
+    static const oidmap_entry_t oidmap_array[] = {
+        { kSecPolicyAppleX509Basic, &CSSMOID_APPLE_X509_BASIC },
+        { kSecPolicyAppleSSL, &CSSMOID_APPLE_TP_SSL },
+        { kSecPolicyAppleSMIME, &CSSMOID_APPLE_TP_SMIME },
+        { kSecPolicyAppleEAP, &CSSMOID_APPLE_TP_EAP },
+        { kSecPolicyAppleSWUpdateSigning, &CSSMOID_APPLE_TP_SW_UPDATE_SIGNING },
+        { kSecPolicyAppleIPsec, &CSSMOID_APPLE_TP_IP_SEC },
+        { kSecPolicyAppleiChat, &CSSMOID_APPLE_TP_ICHAT },
+        { kSecPolicyApplePKINITClient, &CSSMOID_APPLE_TP_PKINIT_CLIENT },
+        { kSecPolicyApplePKINITServer, &CSSMOID_APPLE_TP_PKINIT_SERVER },
+        { kSecPolicyAppleCodeSigning, &CSSMOID_APPLE_TP_CODE_SIGNING },
+        { kSecPolicyApplePackageSigning, &CSSMOID_APPLE_TP_PACKAGE_SIGNING },
+        { kSecPolicyAppleIDValidation, &CSSMOID_APPLE_TP_APPLEID_SHARING },
+        { kSecPolicyMacAppStoreReceipt, &CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT },
+        { kSecPolicyAppleTimeStamping, &CSSMOID_APPLE_TP_TIMESTAMPING },
+        { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION },
+        { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION_OCSP },
+        { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION_CRL },
+        { kSecPolicyApplePassbookSigning, &CSSMOID_APPLE_TP_PASSBOOK_SIGNING },
+        { kSecPolicyAppleMobileStore, &CSSMOID_APPLE_TP_MOBILE_STORE },
+        { kSecPolicyAppleEscrowService, &CSSMOID_APPLE_TP_ESCROW_SERVICE },
+        { kSecPolicyAppleProfileSigner, &CSSMOID_APPLE_TP_PROFILE_SIGNING },
+        { kSecPolicyAppleQAProfileSigner, &CSSMOID_APPLE_TP_QA_PROFILE_SIGNING },
+        { kSecPolicyAppleTestMobileStore, &CSSMOID_APPLE_TP_TEST_MOBILE_STORE },
+        { kSecPolicyApplePCSEscrowService, &CSSMOID_APPLE_TP_PCS_ESCROW_SERVICE },
+        { kSecPolicyAppleOSXProvisioningProfileSigning, &CSSMOID_APPLE_TP_PROVISIONING_PROFILE_SIGNING },
+    };
+    static_assert(OIDMAP_LENGTH == (sizeof(oidmap_array)/sizeof(oidmap_entry_t)), "OIDMAP_LENGTH is incorrect; must match oidmap_array");
+
+    return oidmap_array;

 };
 
 };
 

+static const size_t OIDMAP_PRIV_LENGTH = 23;
+static const oidmap_entry_t* oidmap_priv_f() {
+    static const oidmap_entry_t oidmap_priv_array[] = {
+        { CFSTR("basicX509"), &CSSMOID_APPLE_X509_BASIC },
+        { CFSTR("sslServer"), &CSSMOID_APPLE_TP_SSL },
+        { CFSTR("sslClient"), &CSSMOID_APPLE_TP_SSL },
+        { CFSTR("SMIME"), &CSSMOID_APPLE_TP_SMIME },
+        { CFSTR("eapServer"), &CSSMOID_APPLE_TP_EAP },
+        { CFSTR("eapClient"), &CSSMOID_APPLE_TP_EAP },
+        { CFSTR("AppleSWUpdateSigning"), &CSSMOID_APPLE_TP_SW_UPDATE_SIGNING },
+        { CFSTR("ipsecServer"), &CSSMOID_APPLE_TP_IP_SEC },
+        { CFSTR("ipsecClient"), &CSSMOID_APPLE_TP_IP_SEC },
+        { CFSTR("CodeSigning"), &CSSMOID_APPLE_TP_CODE_SIGNING },
+        { CFSTR("PackageSigning"), &CSSMOID_APPLE_TP_PACKAGE_SIGNING },
+        { CFSTR("AppleIDAuthority"), &CSSMOID_APPLE_TP_APPLEID_SHARING },
+        { CFSTR("MacAppStoreReceipt"), &CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT },
+        { CFSTR("AppleTimeStamping"), &CSSMOID_APPLE_TP_TIMESTAMPING },
+        { CFSTR("revocation"), &CSSMOID_APPLE_TP_REVOCATION },
+        { CFSTR("ApplePassbook"), &CSSMOID_APPLE_TP_PASSBOOK_SIGNING },
+        { CFSTR("AppleMobileStore"), &CSSMOID_APPLE_TP_MOBILE_STORE },
+        { CFSTR("AppleEscrowService"), &CSSMOID_APPLE_TP_ESCROW_SERVICE },
+        { CFSTR("AppleProfileSigner"), &CSSMOID_APPLE_TP_PROFILE_SIGNING },
+        { CFSTR("AppleQAProfileSigner"), &CSSMOID_APPLE_TP_QA_PROFILE_SIGNING },
+        { CFSTR("AppleTestMobileStore"), &CSSMOID_APPLE_TP_TEST_MOBILE_STORE },
+        { CFSTR("ApplePCSEscrowService"), &CSSMOID_APPLE_TP_PCS_ESCROW_SERVICE },
+        { CFSTR("AppleOSXProvisioningProfileSigning"), &CSSMOID_APPLE_TP_PROVISIONING_PROFILE_SIGNING },
+    };
+    static_assert(OIDMAP_PRIV_LENGTH == (sizeof(oidmap_priv_array)/sizeof(oidmap_entry_t)), "OIDMAP_PRIV_LENGTH is incorrect; must match oidmap_priv_array");
+
+    return oidmap_priv_array;
+}
+

 //
 // Sec API bridge functions
 //
 //
 // Sec API bridge functions
 //


@@ -150,21 +163,21 @@ SecPolicyGetOID(SecPolicyRef policyRef, CSSM_OID* oid)
                return errSecParam; // bad policy ref?
        }
        CSSM_OID *oidptr = NULL;
                return errSecParam; // bad policy ref?
        }
        CSSM_OID *oidptr = NULL;

-       unsigned int i, oidmaplen = sizeof(oidmap) / sizeof(oidmap_entry_t);
-       for (i=0; i<oidmaplen; i++) {
-               CFStringRef str = (CFStringRef) oidmap[i].oidstr;
+    unsigned int i;
+       for (i=0; i<OIDMAP_LENGTH; i++) {
+               CFStringRef str = (CFStringRef) oidmap_f()[i].oidstr;

                if (CFStringCompare(str, oidStr, 0) == kCFCompareEqualTo) {
                if (CFStringCompare(str, oidStr, 0) == kCFCompareEqualTo) {

-                       oidptr = (CSSM_OID*)oidmap[i].oidptr;
+                       oidptr = (CSSM_OID*)oidmap_f()[i].oidptr;

                        break;
                }
        }
        if (!oidptr) {
                // Check private iOS policy names.
                        break;
                }
        }
        if (!oidptr) {
                // Check private iOS policy names.

-               oidmaplen = sizeof(oidmap_priv) / sizeof(oidmap_entry_t);
-               for (i=0; i<oidmaplen; i++) {
-                       CFStringRef str = (CFStringRef) oidmap_priv[i].oidstr;
+
+               for (i=0; i<OIDMAP_PRIV_LENGTH; i++) {
+                       CFStringRef str = (CFStringRef) oidmap_priv_f()[i].oidstr;

                        if (CFStringCompare(str, oidStr, 0) == kCFCompareEqualTo) {
                        if (CFStringCompare(str, oidStr, 0) == kCFCompareEqualTo) {

-                               oidptr = (CSSM_OID*)oidmap_priv[i].oidptr;
+                               oidptr = (CSSM_OID*)oidmap_priv_f()[i].oidptr;

                                break;
                        }
                }
                                break;
                        }
                }


@@ -205,11 +218,11 @@ CFStringRef SecPolicyGetStringForOID(CSSM_OID* oid)
                return NULL;
        }
        // given a CSSM_OID pointer, return corresponding string in oidmap
                return NULL;
        }
        // given a CSSM_OID pointer, return corresponding string in oidmap

-       unsigned int i, oidmaplen = sizeof(oidmap) / sizeof(oidmap_entry_t);
-       for (i=0; i<oidmaplen; i++) {
-               CSSM_OID* oidptr = (CSSM_OID*)oidmap[i].oidptr;
+    unsigned int i;
+       for (i=0; i<OIDMAP_LENGTH; i++) {
+               CSSM_OID* oidptr = (CSSM_OID*)oidmap_f()[i].oidptr;

                if (compareOids(oid, oidptr)) {
                if (compareOids(oid, oidptr)) {

-                       return (CFStringRef) oidmap[i].oidstr;
+                       return (CFStringRef) oidmap_f()[i].oidstr;

                }
        }
        return NULL;
                }
        }
        return NULL;


@@ -242,12 +255,12 @@ static bool SecPolicyGetCSSMDataValueForString(SecPolicyRef policyRef, CFStringR
                // stash this in a place where it will be released when the policy is destroyed
                if (policyRef) {
                        SecPolicySetOptionsValue(policyRef, CFSTR("policy_data"), data);
                // stash this in a place where it will be released when the policy is destroyed
                if (policyRef) {
                        SecPolicySetOptionsValue(policyRef, CFSTR("policy_data"), data);

-                       CFRelease(data);

                }
                else {
                        syslog(LOG_ERR, "WARNING: policy dictionary not found to store returned data; will leak!");
                }
        }
                }
                else {
                        syslog(LOG_ERR, "WARNING: policy dictionary not found to store returned data; will leak!");
                }
        }

+    CFReleaseNull(data);

        return true;
 }
 
        return true;
 }
 


@@ -276,7 +289,7 @@ SecPolicyGetValue(SecPolicyRef policyRef, CSSM_DATA* value)
                        (const void **)&name) && name) {
                        break;
                }
                        (const void **)&name) && name) {
                        break;
                }

-               if (CFDictionaryGetValueIfPresent(options, CFSTR("email") /*kSecPolicyCheckEmail*/,
+               if (CFDictionaryGetValueIfPresent(options, CFSTR("Email") /*kSecPolicyCheckEmail*/,

                        (const void **)&name) && name) {
                        break;
                }
                        (const void **)&name) && name) {
                        break;
                }


@@ -422,54 +435,6 @@ SecPolicyGetTPHandle(SecPolicyRef policyRef, CSSM_TP_HANDLE* tpHandle)
        return errSecServiceNotAvailable;
 }
 
        return errSecServiceNotAvailable;
 }
 

-/* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_3, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
-OSStatus
-SecPolicyCopyAll(CSSM_CERT_TYPE certificateType, CFArrayRef* policies)
-{
-       /* bridge to support old functionality */
-#if SECTRUST_DEPRECATION_WARNINGS
-    syslog(LOG_ERR, "WARNING: SecPolicyCopyAll was deprecated in 10.7. Please use SecPolicy creation functions instead.");
-#endif
-    if (!policies) {
-               return errSecParam;
-       }
-       CFMutableArrayRef curPolicies = CFArrayCreateMutable(NULL, 0, NULL);
-       if (!curPolicies) {
-               return errSecAllocate;
-       }
-       /* build the subset of policies which were supported on OS X,
-          and which are also implemented on iOS */
-       CFStringRef supportedPolicies[] = {
-               kSecPolicyAppleX509Basic, /* CSSMOID_APPLE_X509_BASIC */
-               kSecPolicyAppleSSL, /* CSSMOID_APPLE_TP_SSL */
-               kSecPolicyAppleSMIME, /* CSSMOID_APPLE_TP_SMIME */
-               kSecPolicyAppleEAP, /*CSSMOID_APPLE_TP_EAP */
-               kSecPolicyAppleSWUpdateSigning, /* CSSMOID_APPLE_TP_SW_UPDATE_SIGNING */
-               kSecPolicyAppleIPsec, /* CSSMOID_APPLE_TP_IP_SEC */
-               kSecPolicyAppleCodeSigning, /* CSSMOID_APPLE_TP_CODE_SIGNING */
-               kSecPolicyMacAppStoreReceipt, /* CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT */
-               kSecPolicyAppleIDValidation, /* CSSMOID_APPLE_TP_APPLEID_SHARING */
-               kSecPolicyAppleTimeStamping, /* CSSMOID_APPLE_TP_TIMESTAMPING */
-               kSecPolicyAppleRevocation, /* CSSMOID_APPLE_TP_REVOCATION_{CRL,OCSP} */
-               NULL
-       };
-       CFIndex ix = 0;
-       while (true) {
-               CFStringRef policyID = supportedPolicies[ix++];
-               if (!policyID) {
-                       break;
-               }
-               SecPolicyRef curPolicy = SecPolicyCreateWithProperties(policyID, NULL);
-               if (curPolicy) {
-                       CFArrayAppendValue(curPolicies, curPolicy);
-                       CFRelease(curPolicy);
-               }
-       }
-       *policies = CFArrayCreateCopy(NULL, curPolicies);
-       CFRelease(curPolicies);
-       return errSecSuccess;
-}
-

 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_3, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
 OSStatus
 SecPolicyCopy(CSSM_CERT_TYPE certificateType, const CSSM_OID *policyOID, SecPolicyRef* policy)
 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_3, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */
 OSStatus
 SecPolicyCopy(CSSM_CERT_TYPE certificateType, const CSSM_OID *policyOID, SecPolicyRef* policy)


@@ -529,11 +494,11 @@ _SecPolicyCreateWithOID(CFTypeRef policyOID)
        if (!oidStr) {
                return policy;
        }
        if (!oidStr) {
                return policy;
        }

-       unsigned int i, oidmaplen = sizeof(oidmap) / sizeof(oidmap_entry_t);
-       for (i=0; i<oidmaplen; i++) {
-               CFStringRef str = (CFStringRef) oidmap[i].oidstr;
+    unsigned int i;
+       for (i=0; i<OIDMAP_LENGTH; i++) {
+               CFStringRef str = (CFStringRef) oidmap_f()[i].oidstr;

                if (CFStringCompare(str, oidStr, 0) == kCFCompareEqualTo) {
                if (CFStringCompare(str, oidStr, 0) == kCFCompareEqualTo) {

-                       oidPtr = (CSSM_OID*)oidmap[i].oidptr;
+                       oidPtr = (CSSM_OID*)oidmap_f()[i].oidptr;

                        break;
                }
        }
                        break;
                }
        }


@@ -575,22 +540,35 @@ SecPolicyCreateWithOID(CFTypeRef policyOID)
 CFArrayRef
 SecPolicyCreateAppleTimeStampingAndRevocationPolicies(CFTypeRef policyOrArray)
 {
 CFArrayRef
 SecPolicyCreateAppleTimeStampingAndRevocationPolicies(CFTypeRef policyOrArray)
 {

-    /* implement with unified SecPolicyRef instances */
-    SecPolicyRef policy = NULL;

     CFMutableArrayRef resultPolicyArray = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
     if (!resultPolicyArray) {
         return NULL;
     }
     CFMutableArrayRef resultPolicyArray = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
     if (!resultPolicyArray) {
         return NULL;
     }

-    policy = SecPolicyCreateWithProperties(kSecPolicyAppleTimeStamping, NULL);
-    if (policy) {
-        CFArrayAppendValue(resultPolicyArray, policy);
-        CFReleaseNull(policy);
+    SecPolicyRef tsPolicy = SecPolicyCreateWithProperties(kSecPolicyAppleTimeStamping, NULL);
+    if (tsPolicy) {
+        CFArrayAppendValue(resultPolicyArray, tsPolicy);
+        CFReleaseNull(tsPolicy);
+    }
+
+    /* check the provided argument for a revocation policy */
+    CFMutableArrayRef policies = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
+    if (policies && policyOrArray) {
+        if (CFGetTypeID(policyOrArray) == SecPolicyGetTypeID()) {
+            CFArrayAppendValue(policies, policyOrArray);
+        } else if (CFGetTypeID(policyOrArray) == CFArrayGetTypeID()) {
+            CFIndex arrayLength = CFArrayGetCount((CFArrayRef)policyOrArray);
+            CFArrayAppendArray(policies, (CFArrayRef)policyOrArray, CFRangeMake(0, arrayLength));
+        }

     }
     }

-    policy = SecPolicyCreateWithProperties(kSecPolicyAppleRevocation, NULL);
-    if (policy) {
-        CFArrayAppendValue(resultPolicyArray, policy);
-        CFReleaseNull(policy);
+    CFIndex numPolicies = (policies) ? CFArrayGetCount(policies) : 0;
+    for (CFIndex index=0; index<numPolicies; index++) {
+        SecPolicyRef policy = (SecPolicyRef)CFArrayGetValueAtIndex(policies, index);
+        CFStringRef policyName = (policy) ? SecPolicyGetName(policy) : NULL;
+        if (policyName && CFEqual(CFSTR("revocation"), policyName)) {
+            CFArrayAppendValue(resultPolicyArray, policy);
+        }

     }
     }

+    CFReleaseNull(policies);

     return resultPolicyArray;
 }
 
     return resultPolicyArray;
 }