+/*
+ * Copyright (c) 2000-2014 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_LICENSE_HEADER_END@
+ *
+ * cssmapple.h -- CSSM features specific to Apple's Implementation
+ */
+
+#ifndef _CSSMAPPLE_H_
+#define _CSSMAPPLE_H_ 1
+
+#include <Security/cssmerr.h>
+#include <Security/cssmtype.h>
+#include <Security/x509defs.h> /* for CSSM_APPLE_TP_CERT_REQUEST fields */
+#include <Security/certextensions.h> /* ditto */
+#include <sys/types.h> /* for the BSD *_t types */
+#include <stdbool.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Guids for standard Apple addin modules. */
+
+/* CSSM itself: {87191ca0-0fc9-11d4-849a-000502b52122} */
+extern const CSSM_GUID gGuidCssm;
+
+/* File based DL (aka "Keychain DL"): {87191ca1-0fc9-11d4-849a-000502b52122} */
+extern const CSSM_GUID gGuidAppleFileDL;
+
+/* Core CSP (local space): {87191ca2-0fc9-11d4-849a-000502b52122} */
+extern const CSSM_GUID gGuidAppleCSP;
+
+/* Secure CSP/DL (aka "Keychain CSPDL): {87191ca3-0fc9-11d4-849a-000502b52122} */
+extern const CSSM_GUID gGuidAppleCSPDL;
+
+/* X509 Certificate CL: {87191ca4-0fc9-11d4-849a-000502b52122} */
+extern const CSSM_GUID gGuidAppleX509CL;
+
+/* X509 Certificate TP: {87191ca5-0fc9-11d4-849a-000502b52122} */
+extern const CSSM_GUID gGuidAppleX509TP;
+
+/* DLAP/OpenDirectory access DL: {87191ca6-0fc9-11d4-849a-000502b52122} */
+extern const CSSM_GUID gGuidAppleLDAPDL;
+
+/* TP for ".mac" related policies: {87191ca7-0fc9-11d4-849a-000502b52122} */
+extern const CSSM_GUID gGuidAppleDotMacTP;
+
+/* Smartcard CSP/DL: {87191ca8-0fc9-11d4-849a-000502b52122} */
+extern const CSSM_GUID gGuidAppleSdCSPDL;
+
+/* DL for ".mac" certificate access: {87191ca9-0fc9-11d4-849a-000502b52122} */
+extern const CSSM_GUID gGuidAppleDotMacDL;
+
+
+/* Apple defined WORDID values */
+enum
+{
+ CSSM_WORDID_KEYCHAIN_PROMPT = CSSM_WORDID_VENDOR_START,
+ CSSM_WORDID_KEYCHAIN_LOCK,
+ CSSM_WORDID_KEYCHAIN_CHANGE_LOCK,
+ CSSM_WORDID_PROCESS,
+ CSSM_WORDID__RESERVED_1, /* was used in 10.2 test seeds; no longer in use */
+ CSSM_WORDID_SYMMETRIC_KEY,
+ CSSM_WORDID_SYSTEM,
+ CSSM_WORDID_KEY,
+ CSSM_WORDID_PIN,
+ CSSM_WORDID_PREAUTH,
+ CSSM_WORDID_PREAUTH_SOURCE,
+ CSSM_WORDID_ASYMMETRIC_KEY,
+ CSSM_WORDID__FIRST_UNUSED
+};
+
+/* Apple defined ACL subject and credential types */
+enum
+{
+ CSSM_ACL_SUBJECT_TYPE_KEYCHAIN_PROMPT = CSSM_WORDID_KEYCHAIN_PROMPT,
+ CSSM_ACL_SUBJECT_TYPE_PROCESS = CSSM_WORDID_PROCESS,
+ CSSM_ACL_SUBJECT_TYPE_CODE_SIGNATURE = CSSM_WORDID_SIGNATURE,
+ CSSM_ACL_SUBJECT_TYPE_COMMENT = CSSM_WORDID_COMMENT,
+ CSSM_ACL_SUBJECT_TYPE_SYMMETRIC_KEY = CSSM_WORDID_SYMMETRIC_KEY,
+ CSSM_ACL_SUBJECT_TYPE_PREAUTH = CSSM_WORDID_PREAUTH,
+ CSSM_ACL_SUBJECT_TYPE_PREAUTH_SOURCE = CSSM_WORDID_PREAUTH_SOURCE,
+ CSSM_ACL_SUBJECT_TYPE_ASYMMETRIC_KEY = CSSM_WORDID_ASYMMETRIC_KEY
+};
+
+enum
+{
+ CSSM_SAMPLE_TYPE_KEYCHAIN_PROMPT = CSSM_WORDID_KEYCHAIN_PROMPT,
+ CSSM_SAMPLE_TYPE_KEYCHAIN_LOCK = CSSM_WORDID_KEYCHAIN_LOCK,
+ CSSM_SAMPLE_TYPE_KEYCHAIN_CHANGE_LOCK = CSSM_WORDID_KEYCHAIN_CHANGE_LOCK,
+ CSSM_SAMPLE_TYPE_PROCESS = CSSM_WORDID_PROCESS,
+ CSSM_SAMPLE_TYPE_COMMENT = CSSM_WORDID_COMMENT,
+ CSSM_SAMPLE_TYPE_RETRY_ID = CSSM_WORDID_PROPAGATE,
+ CSSM_SAMPLE_TYPE_SYMMETRIC_KEY = CSSM_WORDID_SYMMETRIC_KEY,
+ CSSM_SAMPLE_TYPE_PREAUTH = CSSM_WORDID_PREAUTH,
+ CSSM_SAMPLE_TYPE_ASYMMETRIC_KEY = CSSM_WORDID_ASYMMETRIC_KEY
+ // there is no CSSM_SAMPLE_TYPE_PREAUTH_SOURCE
+};
+
+
+/* Apple-defined ACL authorization tags */
+enum {
+ CSSM_ACL_AUTHORIZATION_CHANGE_ACL = CSSM_ACL_AUTHORIZATION_TAG_VENDOR_DEFINED_START,
+ CSSM_ACL_AUTHORIZATION_CHANGE_OWNER,
+
+ // the "pre-auth" tags form a contiguous range of (up to) 64K pre-authorizations
+ CSSM_ACL_AUTHORIZATION_PREAUTH_BASE =
+ CSSM_ACL_AUTHORIZATION_TAG_VENDOR_DEFINED_START + 0x1000000,
+ CSSM_ACL_AUTHORIZATION_PREAUTH_END = CSSM_ACL_AUTHORIZATION_PREAUTH_BASE + 0x10000
+};
+
+/* pre-authorization conversions (auth-tag to slot and back) */
+#define CSSM_ACL_AUTHORIZATION_PREAUTH(slot) \
+ (CSSM_ACL_AUTHORIZATION_PREAUTH_BASE + (slot))
+#define CSSM_ACL_AUTHORIZATION_PREAUTH_SLOT(auth) \
+ ((auth) - CSSM_ACL_AUTHORIZATION_PREAUTH_BASE)
+#define CSSM_ACL_AUTHORIZATION_IS_PREAUTH(auth) \
+ ((auth) >= CSSM_ACL_AUTHORIZATION_PREAUTH_BASE && \
+ (auth) < CSSM_ACL_AUTHORIZATION_PREAUTH_END)
+
+
+/* Parameters and structures for Apple-defined ACL subjects and samples */
+
+enum { /* types of code signatures - item 1 of CSSM_ACL_SUBJECT_TYPE_CODE_SIGNATURE subjects */
+ CSSM_ACL_CODE_SIGNATURE_INVALID = 0, /* standard OS X code signature */
+ CSSM_ACL_CODE_SIGNATURE_OSX = 1 /* standard OS X code signature */
+};
+
+/* ACL subjects of type PROCESS */
+
+enum { /* PROCESS_SUBJECT mask fields */
+ CSSM_ACL_MATCH_UID = 0x01, /* match userid against uid field */
+ CSSM_ACL_MATCH_GID = 0x02, /* match groupid against gid field */
+ CSSM_ACL_MATCH_HONOR_ROOT = 0x100, /* let root (uid 0) match any userid */
+ CSSM_ACL_MATCH_BITS = CSSM_ACL_MATCH_UID | CSSM_ACL_MATCH_GID
+};
+
+enum { /* PROCESS_SUBJECT structure version field */
+ CSSM_ACL_PROCESS_SELECTOR_CURRENT_VERSION = 0x101
+};
+
+typedef struct cssm_acl_process_subject_selector { /* PROCESS_SUBJECT selector */
+ uint16 version; /* version of this selector */
+ uint16 mask; /* active fields mask */
+ uint32 uid; /* effective user id match */
+ uint32 gid; /* effective group id match */
+} CSSM_ACL_PROCESS_SUBJECT_SELECTOR;
+
+/* ACL subjects of type KEYCHAIN_PROMPT */
+
+enum { /* KEYCHAIN_PROMPT structure version field */
+ CSSM_ACL_KEYCHAIN_PROMPT_CURRENT_VERSION = 0x101
+};
+
+enum { /* KEYCHAIN_PROMPT operational flags */
+ CSSM_ACL_KEYCHAIN_PROMPT_REQUIRE_PASSPHRASE = 0x0001, /* require re-entering of passphrase */
+ /* the following bits are ignored by 10.4 and earlier */
+ CSSM_ACL_KEYCHAIN_PROMPT_UNSIGNED = 0x0010, /* prompt for unsigned clients */
+ CSSM_ACL_KEYCHAIN_PROMPT_UNSIGNED_ACT = 0x0020, /* UNSIGNED bit overrides system default */
+ CSSM_ACL_KEYCHAIN_PROMPT_INVALID = 0x0040, /* prompt for invalid signed clients */
+ CSSM_ACL_KEYCHAIN_PROMPT_INVALID_ACT = 0x0080, /* INVALID bit overrides system default */
+};
+
+typedef struct cssm_acl_keychain_prompt_selector { /* KEYCHAIN_PROMPT selector */
+ uint16 version; /* version of this selector */
+ uint16 flags; /* flag bits */
+} CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR;
+
+/* ACL subjects of type CSSM_ACL_SUBJECT_TYPE_PREAUTH_SOURCE */
+typedef uint32 CSSM_ACL_PREAUTH_TRACKING_STATE;
+enum { /* preauth tracking state */
+ CSSM_ACL_PREAUTH_TRACKING_COUNT_MASK = 0xff, /* mask for count status */
+ CSSM_ACL_PREAUTH_TRACKING_BLOCKED = 0, /* retries exhausted; the slot is blocked */
+ /* 0 .. 255 is a count of (re)tries remaining */
+
+ /* bits or'ed into any count given */
+ CSSM_ACL_PREAUTH_TRACKING_UNKNOWN = 0x40000000, /* status of slot is unknown (ignore count) */
+ CSSM_ACL_PREAUTH_TRACKING_AUTHORIZED = 0x80000000 /* the slot is currently authorized (or'ed in) */
+};
+
+
+/* Apple defined values of a CSSM_DB_ACCESS_TYPE */
+enum {
+ CSSM_DB_ACCESS_RESET = 0x10000 /* clear pre-authentications (or'ed bit) */
+};
+
+
+/* Apple defined algorithm IDs */
+enum
+{
+ CSSM_ALGID_APPLE_YARROW = CSSM_ALGID_VENDOR_DEFINED,
+ CSSM_ALGID_AES, /* RijnDael */
+ CSSM_ALGID_FEE, /* FEE Key Generation */
+ CSSM_ALGID_FEE_MD5, /* FEE/ElGamal signature w/ MD5 hash */
+ CSSM_ALGID_FEE_SHA1, /* FEE/ElGamal signature w/ SHA1 hash */
+ CSSM_ALGID_FEED, /* 1:1 FEE asymmetric encryption */
+ CSSM_ALGID_FEEDEXP, /* 2:1 FEE asymmetric encryption */
+ CSSM_ALGID_ASC, /* Apple Secure Compression */
+ CSSM_ALGID_SHA1HMAC_LEGACY, /* HMAC/SHA1, legacy compatible */
+ CSSM_ALGID_KEYCHAIN_KEY, /* derive or manipulate keychain master keys */
+ CSSM_ALGID_PKCS12_PBE_ENCR, /* PKCS12, encrypt/decrypt key */
+ CSSM_ALGID_PKCS12_PBE_MAC, /* PKCS12, MAC key */
+ CSSM_ALGID_SECURE_PASSPHRASE, /* passphrase acquired by SecurityServer */
+ CSSM_ALGID_PBE_OPENSSL_MD5, /* traditional openssl key derivation */
+ CSSM_ALGID_SHA256, /* 256-bit SHA2 */
+ CSSM_ALGID_SHA384, /* 384-bit SHA2 */
+ CSSM_ALGID_SHA512, /* 512-bit SHA2 */
+ CSSM_ALGID_ENTROPY_DEFAULT, /* default entropy source of (CSP) device, if any */
+ CSSM_ALGID_SHA224, /* SHA2, 224 bit */
+ CSSM_ALGID_SHA224WithRSA, /* RSA signature on SHA224 digest */
+ CSSM_ALGID_SHA256WithRSA, /* RSA signature on SHA256 digest */
+ CSSM_ALGID_SHA384WithRSA, /* RSA signature on SHA384 digest */
+ CSSM_ALGID_SHA512WithRSA, /* RSA signature on SHA512 digest */
+ CSSM_ALGID_OPENSSH1, /* OpenSSH v1 RSA key wrapping */
+ CSSM_ALGID_SHA224WithECDSA, /* ECDSA signature on SHA224 digest */
+ CSSM_ALGID_SHA256WithECDSA, /* ECDSA signature on SHA256 digest */
+ CSSM_ALGID_SHA384WithECDSA, /* ECDSA signature on SHA384 digest */
+ CSSM_ALGID_SHA512WithECDSA, /* ECDSA signature on SHA512 digest */
+ CSSM_ALGID_ECDSA_SPECIFIED, /* ECDSA with separate digest algorithm specifier */
+ CSSM_ALGID_ECDH_X963_KDF, /* ECDH with X9.63 key derivation */
+ CSSM_ALGID__FIRST_UNUSED
+};
+
+/* Apple defined padding */
+enum
+{
+ /* RFC 2246 section E.2 for SSLv2 rollback detection */
+ CSSM_PADDING_APPLE_SSLv2 = CSSM_PADDING_VENDOR_DEFINED
+};
+
+
+/* Apple defined keyblob formats */
+enum {
+ CSSM_KEYBLOB_RAW_FORMAT_VENDOR_DEFINED = 0x80000000
+};
+enum {
+ /* X509 SubjectPublicKeyInfo */
+ CSSM_KEYBLOB_RAW_FORMAT_X509 = CSSM_KEYBLOB_RAW_FORMAT_VENDOR_DEFINED,
+ /* OpenSSH v1 */
+ CSSM_KEYBLOB_RAW_FORMAT_OPENSSH,
+ /* openssl-style DSA private key */
+ CSSM_KEYBLOB_RAW_FORMAT_OPENSSL,
+ /* OpenSSH v2 */
+ CSSM_KEYBLOB_RAW_FORMAT_OPENSSH2
+};
+
+/* Apple adds some "common" error codes. CDSA does not define an official start value for this. */
+enum
+{
+ CSSM_CUSTOM_COMMON_ERROR_EXTENT = 0x00e0,
+
+ CSSM_ERRCODE_NO_USER_INTERACTION = 0x00e0,
+ CSSM_ERRCODE_USER_CANCELED = 0x00e1,
+ CSSM_ERRCODE_SERVICE_NOT_AVAILABLE = 0x00e2,
+ CSSM_ERRCODE_INSUFFICIENT_CLIENT_IDENTIFICATION = 0x00e3,
+ CSSM_ERRCODE_DEVICE_RESET = 0x00e4,
+ CSSM_ERRCODE_DEVICE_FAILED = 0x00e5,
+ CSSM_ERRCODE_IN_DARK_WAKE = 0x00e6
+};
+
+enum {
+ CSSMERR_CSSM_NO_USER_INTERACTION = CSSM_CSSM_BASE_ERROR + CSSM_ERRCODE_NO_USER_INTERACTION,
+ CSSMERR_AC_NO_USER_INTERACTION = CSSM_AC_BASE_ERROR + CSSM_ERRCODE_NO_USER_INTERACTION,
+ CSSMERR_CSP_NO_USER_INTERACTION = CSSM_CSP_BASE_ERROR + CSSM_ERRCODE_NO_USER_INTERACTION,
+ CSSMERR_CL_NO_USER_INTERACTION = CSSM_CL_BASE_ERROR + CSSM_ERRCODE_NO_USER_INTERACTION,
+ CSSMERR_DL_NO_USER_INTERACTION = CSSM_DL_BASE_ERROR + CSSM_ERRCODE_NO_USER_INTERACTION,
+ CSSMERR_TP_NO_USER_INTERACTION = CSSM_TP_BASE_ERROR + CSSM_ERRCODE_NO_USER_INTERACTION,
+
+ CSSMERR_CSSM_USER_CANCELED = CSSM_CSSM_BASE_ERROR + CSSM_ERRCODE_USER_CANCELED,
+ CSSMERR_AC_USER_CANCELED = CSSM_AC_BASE_ERROR + CSSM_ERRCODE_USER_CANCELED,
+ CSSMERR_CSP_USER_CANCELED = CSSM_CSP_BASE_ERROR + CSSM_ERRCODE_USER_CANCELED,
+ CSSMERR_CL_USER_CANCELED = CSSM_CL_BASE_ERROR + CSSM_ERRCODE_USER_CANCELED,
+ CSSMERR_DL_USER_CANCELED = CSSM_DL_BASE_ERROR + CSSM_ERRCODE_USER_CANCELED,
+ CSSMERR_TP_USER_CANCELED = CSSM_TP_BASE_ERROR + CSSM_ERRCODE_USER_CANCELED,
+
+ CSSMERR_CSSM_SERVICE_NOT_AVAILABLE = CSSM_CSSM_BASE_ERROR + CSSM_ERRCODE_SERVICE_NOT_AVAILABLE,
+ CSSMERR_AC_SERVICE_NOT_AVAILABLE = CSSM_AC_BASE_ERROR + CSSM_ERRCODE_SERVICE_NOT_AVAILABLE,
+ CSSMERR_CSP_SERVICE_NOT_AVAILABLE = CSSM_CSP_BASE_ERROR + CSSM_ERRCODE_SERVICE_NOT_AVAILABLE,
+ CSSMERR_CL_SERVICE_NOT_AVAILABLE = CSSM_CL_BASE_ERROR + CSSM_ERRCODE_SERVICE_NOT_AVAILABLE,
+ CSSMERR_DL_SERVICE_NOT_AVAILABLE = CSSM_DL_BASE_ERROR + CSSM_ERRCODE_SERVICE_NOT_AVAILABLE,
+ CSSMERR_TP_SERVICE_NOT_AVAILABLE = CSSM_TP_BASE_ERROR + CSSM_ERRCODE_SERVICE_NOT_AVAILABLE,
+
+ CSSMERR_CSSM_INSUFFICIENT_CLIENT_IDENTIFICATION = CSSM_CSSM_BASE_ERROR + CSSM_ERRCODE_INSUFFICIENT_CLIENT_IDENTIFICATION,
+ CSSMERR_AC_INSUFFICIENT_CLIENT_IDENTIFICATION = CSSM_AC_BASE_ERROR + CSSM_ERRCODE_INSUFFICIENT_CLIENT_IDENTIFICATION,
+ CSSMERR_CSP_INSUFFICIENT_CLIENT_IDENTIFICATION = CSSM_CSP_BASE_ERROR + CSSM_ERRCODE_INSUFFICIENT_CLIENT_IDENTIFICATION,
+ CSSMERR_CL_INSUFFICIENT_CLIENT_IDENTIFICATION = CSSM_CL_BASE_ERROR + CSSM_ERRCODE_INSUFFICIENT_CLIENT_IDENTIFICATION,
+ CSSMERR_DL_INSUFFICIENT_CLIENT_IDENTIFICATION = CSSM_DL_BASE_ERROR + CSSM_ERRCODE_INSUFFICIENT_CLIENT_IDENTIFICATION,
+ CSSMERR_TP_INSUFFICIENT_CLIENT_IDENTIFICATION = CSSM_TP_BASE_ERROR + CSSM_ERRCODE_INSUFFICIENT_CLIENT_IDENTIFICATION,
+
+ CSSMERR_CSSM_DEVICE_RESET = CSSM_CSSM_BASE_ERROR + CSSM_ERRCODE_DEVICE_RESET,
+ CSSMERR_AC_DEVICE_RESET = CSSM_AC_BASE_ERROR + CSSM_ERRCODE_DEVICE_RESET,
+ CSSMERR_CSP_DEVICE_RESET = CSSM_CSP_BASE_ERROR + CSSM_ERRCODE_DEVICE_RESET,
+ CSSMERR_CL_DEVICE_RESET = CSSM_CL_BASE_ERROR + CSSM_ERRCODE_DEVICE_RESET,
+ CSSMERR_DL_DEVICE_RESET = CSSM_DL_BASE_ERROR + CSSM_ERRCODE_DEVICE_RESET,
+ CSSMERR_TP_DEVICE_RESET = CSSM_TP_BASE_ERROR + CSSM_ERRCODE_DEVICE_RESET,
+
+ CSSMERR_CSSM_DEVICE_FAILED = CSSM_CSSM_BASE_ERROR + CSSM_ERRCODE_DEVICE_FAILED,
+ CSSMERR_AC_DEVICE_FAILED = CSSM_AC_BASE_ERROR + CSSM_ERRCODE_DEVICE_FAILED,
+ CSSMERR_CSP_DEVICE_FAILED = CSSM_CSP_BASE_ERROR + CSSM_ERRCODE_DEVICE_FAILED,
+ CSSMERR_CL_DEVICE_FAILED = CSSM_CL_BASE_ERROR + CSSM_ERRCODE_DEVICE_FAILED,
+ CSSMERR_DL_DEVICE_FAILED = CSSM_DL_BASE_ERROR + CSSM_ERRCODE_DEVICE_FAILED,
+ CSSMERR_TP_DEVICE_FAILED = CSSM_TP_BASE_ERROR + CSSM_ERRCODE_DEVICE_FAILED,
+
+ CSSMERR_CSSM_IN_DARK_WAKE = CSSM_CSSM_BASE_ERROR + CSSM_ERRCODE_IN_DARK_WAKE,
+ CSSMERR_AC_IN_DARK_WAKE = CSSM_AC_BASE_ERROR + CSSM_ERRCODE_IN_DARK_WAKE,
+ CSSMERR_CSP_IN_DARK_WAKE = CSSM_CSP_BASE_ERROR + CSSM_ERRCODE_IN_DARK_WAKE,
+ CSSMERR_CL_IN_DARK_WAKE = CSSM_CL_BASE_ERROR + CSSM_ERRCODE_IN_DARK_WAKE,
+ CSSMERR_DL_IN_DARK_WAKE = CSSM_DL_BASE_ERROR + CSSM_ERRCODE_IN_DARK_WAKE,
+ CSSMERR_TP_IN_DARK_WAKE = CSSM_TP_BASE_ERROR + CSSM_ERRCODE_IN_DARK_WAKE
+};
+
+/* AppleCSPDL, AppleCSP private error codes. */
+enum {
+ CSSMERR_CSP_APPLE_ADD_APPLICATION_ACL_SUBJECT = CSSM_CSP_PRIVATE_ERROR + 0,
+ /*
+ * An attempt was made to use a public key which is incomplete due to
+ * the lack of algorithm-specific parameters.
+ */
+ CSSMERR_CSP_APPLE_PUBLIC_KEY_INCOMPLETE = CSSM_CSP_PRIVATE_ERROR + 1,
+
+ /* a code signature match failed */
+ CSSMERR_CSP_APPLE_SIGNATURE_MISMATCH = CSSM_CSP_PRIVATE_ERROR + 2,
+
+ /* Key StartDate/EndDate invalid */
+ CSSMERR_CSP_APPLE_INVALID_KEY_START_DATE = CSSM_CSP_PRIVATE_ERROR + 3,
+ CSSMERR_CSP_APPLE_INVALID_KEY_END_DATE = CSSM_CSP_PRIVATE_ERROR + 4,
+
+ /* Keychain Syncing error codes */
+ CSSMERR_CSPDL_APPLE_DL_CONVERSION_ERROR = CSSM_CSP_PRIVATE_ERROR + 5,
+
+ /* SSLv2 padding check: rollback attack detected */
+ CSSMERR_CSP_APPLE_SSLv2_ROLLBACK = CSSM_CSP_PRIVATE_ERROR + 6
+};
+
+
+/* AppleFileDL record types. */
+enum
+{
+ CSSM_DL_DB_RECORD_GENERIC_PASSWORD = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 0,
+ CSSM_DL_DB_RECORD_INTERNET_PASSWORD = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 1,
+ CSSM_DL_DB_RECORD_APPLESHARE_PASSWORD = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 2,
+
+ CSSM_DL_DB_RECORD_X509_CERTIFICATE = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 0x1000,
+ CSSM_DL_DB_RECORD_USER_TRUST,
+ CSSM_DL_DB_RECORD_X509_CRL,
+ CSSM_DL_DB_RECORD_UNLOCK_REFERRAL,
+ CSSM_DL_DB_RECORD_EXTENDED_ATTRIBUTE,
+ CSSM_DL_DB_RECORD_METADATA = CSSM_DB_RECORDTYPE_APP_DEFINED_START + 0x8000
+};
+
+/* AppleFileDL extentions: passthrough ids */
+enum {
+ // Toggle whether or not to autocommit after modifying the database.
+ // The input parameter is a CSSM_BOOL, where TRUE turns autocommit on
+ // and FALSE turns it off.
+ CSSM_APPLEFILEDL_TOGGLE_AUTOCOMMIT,
+
+ // Commit any pending changes to the database.
+ CSSM_APPLEFILEDL_COMMIT,
+
+ // Rollback and discard any pending changes to the database.
+ CSSM_APPLEFILEDL_ROLLBACK
+};
+
+/* UNLOCK_REFERRAL "type" attribute values */
+enum {
+ CSSM_APPLE_UNLOCK_TYPE_KEY_DIRECT = 1, // master secret key stored directly
+ CSSM_APPLE_UNLOCK_TYPE_WRAPPED_PRIVATE = 2 // master key wrapped by public key
+};
+
+/* Apple DL private error codes. */
+enum
+{
+ /* The OpenParameters argument passed to CSSM_DL_DbCreate or CSSM_DL_DbOpen
+ was neither NULL nor a pointer to a valid CSSM_APPLEDL_OPEN_PARAMETERS
+ structure. */
+ CSSMERR_APPLEDL_INVALID_OPEN_PARAMETERS = CSSM_DL_PRIVATE_ERROR + 0,
+
+ /* an operation failed because the disk was full */
+ CSSMERR_APPLEDL_DISK_FULL = CSSM_DL_PRIVATE_ERROR + 1,
+
+ /* an operation failed because a disk quota was exceeded */
+ CSSMERR_APPLEDL_QUOTA_EXCEEDED = CSSM_DL_PRIVATE_ERROR + 2,
+
+ /* an operation failed because a file was too large */
+ CSSMERR_APPLEDL_FILE_TOO_BIG = CSSM_DL_PRIVATE_ERROR + 3,
+
+ /* a keychain database's internal information ("blob") is invalid */
+ CSSMERR_APPLEDL_INVALID_DATABASE_BLOB = CSSM_DL_PRIVATE_ERROR + 4,
+ CSSMERR_APPLEDL_INVALID_KEY_BLOB = CSSM_DL_PRIVATE_ERROR + 5,
+
+ /* the internal data format version for a database's internal information ("blob") is invalid */
+ CSSMERR_APPLEDL_INCOMPATIBLE_DATABASE_BLOB = CSSM_DL_PRIVATE_ERROR + 6,
+ CSSMERR_APPLEDL_INCOMPATIBLE_KEY_BLOB = CSSM_DL_PRIVATE_ERROR + 7,
+};
+
+/* Apple X509TP private error codes. */
+enum
+{
+ /* Host name mismatch */
+ CSSMERR_APPLETP_HOSTNAME_MISMATCH = CSSM_TP_PRIVATE_ERROR + 0,
+ /* Non-understood extension with Critical flag true */
+ CSSMERR_APPLETP_UNKNOWN_CRITICAL_EXTEN = CSSM_TP_PRIVATE_ERROR + 1,
+ /* Basic Constraints extension required per policy, but not present */
+ CSSMERR_APPLETP_NO_BASIC_CONSTRAINTS = CSSM_TP_PRIVATE_ERROR + 2,
+ /* Invalid BasicConstraints.CA */
+ CSSMERR_APPLETP_INVALID_CA = CSSM_TP_PRIVATE_ERROR + 3,
+ /* Invalid Authority Key ID */
+ CSSMERR_APPLETP_INVALID_AUTHORITY_ID = CSSM_TP_PRIVATE_ERROR + 4,
+ /* Invalid Subject Key ID */
+ CSSMERR_APPLETP_INVALID_SUBJECT_ID = CSSM_TP_PRIVATE_ERROR + 5,
+ /* Invalid Key Usage for policy */
+ CSSMERR_APPLETP_INVALID_KEY_USAGE = CSSM_TP_PRIVATE_ERROR + 6,
+ /* Invalid Extended Key Usage for policy */
+ CSSMERR_APPLETP_INVALID_EXTENDED_KEY_USAGE = CSSM_TP_PRIVATE_ERROR + 7,
+ /* Invalid Subject/Authority Key ID Linkage */
+ CSSMERR_APPLETP_INVALID_ID_LINKAGE = CSSM_TP_PRIVATE_ERROR + 8,
+ /* PathLengthConstraint exceeded */
+ CSSMERR_APPLETP_PATH_LEN_CONSTRAINT = CSSM_TP_PRIVATE_ERROR + 9,
+ /* Cert group terminated at a root cert which did not self-verify */
+ CSSMERR_APPLETP_INVALID_ROOT = CSSM_TP_PRIVATE_ERROR + 10,
+ /* CRL expired/not valid yet */
+ CSSMERR_APPLETP_CRL_EXPIRED = CSSM_TP_PRIVATE_ERROR + 11,
+ CSSMERR_APPLETP_CRL_NOT_VALID_YET = CSSM_TP_PRIVATE_ERROR + 12,
+ /* Cannot find appropriate CRL */
+ CSSMERR_APPLETP_CRL_NOT_FOUND = CSSM_TP_PRIVATE_ERROR + 13,
+ /* specified CRL server down */
+ CSSMERR_APPLETP_CRL_SERVER_DOWN = CSSM_TP_PRIVATE_ERROR + 14,
+ /* illegible CRL distribution point URL */
+ CSSMERR_APPLETP_CRL_BAD_URI = CSSM_TP_PRIVATE_ERROR + 15,
+ /* Unknown critical cert/CRL extension */
+ CSSMERR_APPLETP_UNKNOWN_CERT_EXTEN = CSSM_TP_PRIVATE_ERROR + 16,
+ CSSMERR_APPLETP_UNKNOWN_CRL_EXTEN = CSSM_TP_PRIVATE_ERROR + 17,
+ /* CRL not verifiable to anchor or root */
+ CSSMERR_APPLETP_CRL_NOT_TRUSTED = CSSM_TP_PRIVATE_ERROR + 18,
+ /* CRL verified to untrusted root */
+ CSSMERR_APPLETP_CRL_INVALID_ANCHOR_CERT = CSSM_TP_PRIVATE_ERROR + 19,
+ /* CRL failed policy verification */
+ CSSMERR_APPLETP_CRL_POLICY_FAIL = CSSM_TP_PRIVATE_ERROR + 20,
+ /* IssuingDistributionPoint extension violation */
+ CSSMERR_APPLETP_IDP_FAIL = CSSM_TP_PRIVATE_ERROR + 21,
+ /* Cert not found at specified issuerAltName */
+ CSSMERR_APPLETP_CERT_NOT_FOUND_FROM_ISSUER = CSSM_TP_PRIVATE_ERROR + 22,
+ /* Bad cert obtained from specified issuerAltName */
+ CSSMERR_APPLETP_BAD_CERT_FROM_ISSUER = CSSM_TP_PRIVATE_ERROR + 23,
+ /* S/MIME Email address mismatch */
+ CSSMERR_APPLETP_SMIME_EMAIL_ADDRS_NOT_FOUND = CSSM_TP_PRIVATE_ERROR + 24,
+ /* Appropriate S/MIME ExtendedKeyUsage not found */
+ CSSMERR_APPLETP_SMIME_BAD_EXT_KEY_USE = CSSM_TP_PRIVATE_ERROR + 25,
+ /* S/MIME KeyUsage incompatibility */
+ CSSMERR_APPLETP_SMIME_BAD_KEY_USE = CSSM_TP_PRIVATE_ERROR + 26,
+ /* S/MIME, cert with KeyUsage flagged !critical */
+ CSSMERR_APPLETP_SMIME_KEYUSAGE_NOT_CRITICAL = CSSM_TP_PRIVATE_ERROR + 27,
+ /* S/MIME, leaf with empty subject name and no email addrs
+ * in SubjectAltName */
+ CSSMERR_APPLETP_SMIME_NO_EMAIL_ADDRS = CSSM_TP_PRIVATE_ERROR + 28,
+ /* S/MIME, leaf with empty subject name, SubjectAltName
+ * not critical */
+ CSSMERR_APPLETP_SMIME_SUBJ_ALT_NAME_NOT_CRIT = CSSM_TP_PRIVATE_ERROR + 29,
+ /* Appropriate SSL ExtendedKeyUsage not found */
+ CSSMERR_APPLETP_SSL_BAD_EXT_KEY_USE = CSSM_TP_PRIVATE_ERROR + 30,
+ /* unparseable OCSP response */
+ CSSMERR_APPLETP_OCSP_BAD_RESPONSE = CSSM_TP_PRIVATE_ERROR + 31,
+ /* unparseable OCSP request */
+ CSSMERR_APPLETP_OCSP_BAD_REQUEST = CSSM_TP_PRIVATE_ERROR + 32,
+ /* OCSP service unavailable */
+ CSSMERR_APPLETP_OCSP_UNAVAILABLE = CSSM_TP_PRIVATE_ERROR + 33,
+ /* OCSP status: cert unrecognized */
+ CSSMERR_APPLETP_OCSP_STATUS_UNRECOGNIZED = CSSM_TP_PRIVATE_ERROR + 34,
+ /* revocation check not successful for each cert */
+ CSSMERR_APPLETP_INCOMPLETE_REVOCATION_CHECK = CSSM_TP_PRIVATE_ERROR + 35,
+ /* general network error */
+ CSSMERR_APPLETP_NETWORK_FAILURE = CSSM_TP_PRIVATE_ERROR + 36,
+ /* OCSP response not verifiable to anchor or root */
+ CSSMERR_APPLETP_OCSP_NOT_TRUSTED = CSSM_TP_PRIVATE_ERROR + 37,
+ /* OCSP response verified to untrusted root */
+ CSSMERR_APPLETP_OCSP_INVALID_ANCHOR_CERT = CSSM_TP_PRIVATE_ERROR + 38,
+ /* OCSP response signature error */
+ CSSMERR_APPLETP_OCSP_SIG_ERROR = CSSM_TP_PRIVATE_ERROR + 39,
+ /* No signer for OCSP response found */
+ CSSMERR_APPLETP_OCSP_NO_SIGNER = CSSM_TP_PRIVATE_ERROR + 40,
+ /* OCSP responder status: malformed request */
+ CSSMERR_APPLETP_OCSP_RESP_MALFORMED_REQ = CSSM_TP_PRIVATE_ERROR + 41,
+ /* OCSP responder status: internal error */
+ CSSMERR_APPLETP_OCSP_RESP_INTERNAL_ERR = CSSM_TP_PRIVATE_ERROR + 42,
+ /* OCSP responder status: try later */
+ CSSMERR_APPLETP_OCSP_RESP_TRY_LATER = CSSM_TP_PRIVATE_ERROR + 43,
+ /* OCSP responder status: signature required */
+ CSSMERR_APPLETP_OCSP_RESP_SIG_REQUIRED = CSSM_TP_PRIVATE_ERROR + 44,
+ /* OCSP responder status: unauthorized */
+ CSSMERR_APPLETP_OCSP_RESP_UNAUTHORIZED = CSSM_TP_PRIVATE_ERROR + 45,
+ /* OCSP response nonce did not match request */
+ CSSMERR_APPLETP_OCSP_NONCE_MISMATCH = CSSM_TP_PRIVATE_ERROR + 46,
+ /* Illegal cert chain length for Code Signing */
+ CSSMERR_APPLETP_CS_BAD_CERT_CHAIN_LENGTH = CSSM_TP_PRIVATE_ERROR + 47,
+ /* Missing Basic Constraints for Code Signing */
+ CSSMERR_APPLETP_CS_NO_BASIC_CONSTRAINTS = CSSM_TP_PRIVATE_ERROR + 48,
+ /* Bad PathLengthConstraint for Code Signing */
+ CSSMERR_APPLETP_CS_BAD_PATH_LENGTH = CSSM_TP_PRIVATE_ERROR + 49,
+ /* Missing ExtendedKeyUsage for Code Signing */
+ CSSMERR_APPLETP_CS_NO_EXTENDED_KEY_USAGE = CSSM_TP_PRIVATE_ERROR + 50,
+ /* Development style Code Signing Cert Detected */
+ CSSMERR_APPLETP_CODE_SIGN_DEVELOPMENT = CSSM_TP_PRIVATE_ERROR + 51,
+ /* Illegal cert chain length for Resource Signing */
+ CSSMERR_APPLETP_RS_BAD_CERT_CHAIN_LENGTH = CSSM_TP_PRIVATE_ERROR + 52,
+ /* Bad extended key usage for Resource Signing */
+ CSSMERR_APPLETP_RS_BAD_EXTENDED_KEY_USAGE = CSSM_TP_PRIVATE_ERROR + 53,
+ /* Trust Setting: deny */
+ CSSMERR_APPLETP_TRUST_SETTING_DENY = CSSM_TP_PRIVATE_ERROR + 54,
+ /* Invalid empty SubjectName */
+ CSSMERR_APPLETP_INVALID_EMPTY_SUBJECT = CSSM_TP_PRIVATE_ERROR + 55,
+ /* Unknown critical Qualified Cert Statement ID */
+ CSSMERR_APPLETP_UNKNOWN_QUAL_CERT_STATEMENT = CSSM_TP_PRIVATE_ERROR + 56,
+ /* Missing required extension */
+ CSSMERR_APPLETP_MISSING_REQUIRED_EXTENSION = CSSM_TP_PRIVATE_ERROR + 57,
+ /* Extended key usage not marked critical */
+ CSSMERR_APPLETP_EXT_KEYUSAGE_NOT_CRITICAL = CSSM_TP_PRIVATE_ERROR + 58,
+ /* Required name or identifier not present */
+ CSSMERR_APPLETP_IDENTIFIER_MISSING = CSSM_TP_PRIVATE_ERROR + 59,
+ /* Certificate authority pinning mismatch */
+ CSSMERR_APPLETP_CA_PIN_MISMATCH = CSSM_TP_PRIVATE_ERROR + 60
+};
+
+/* Apple .mac TP private error codes. */
+enum
+{
+ /* cert request queued */
+ CSSMERR_APPLE_DOTMAC_REQ_QUEUED = CSSM_TP_PRIVATE_ERROR + 100,
+ /* cert request redirected */
+ CSSMERR_APPLE_DOTMAC_REQ_REDIRECT = CSSM_TP_PRIVATE_ERROR + 101,
+ /* general server-reported error */
+ CSSMERR_APPLE_DOTMAC_REQ_SERVER_ERR = CSSM_TP_PRIVATE_ERROR + 102,
+ /* server-reported parameter error */
+ CSSMERR_APPLE_DOTMAC_REQ_SERVER_PARAM = CSSM_TP_PRIVATE_ERROR + 103,
+ /* server-reported authorization error */
+ CSSMERR_APPLE_DOTMAC_REQ_SERVER_AUTH = CSSM_TP_PRIVATE_ERROR + 104,
+ /* server-reported unimplemented */
+ CSSMERR_APPLE_DOTMAC_REQ_SERVER_UNIMPL = CSSM_TP_PRIVATE_ERROR + 105,
+ /* server-reported not available */
+ CSSMERR_APPLE_DOTMAC_REQ_SERVER_NOT_AVAIL = CSSM_TP_PRIVATE_ERROR + 106,
+ /* server-reported already exists */
+ CSSMERR_APPLE_DOTMAC_REQ_SERVER_ALREADY_EXIST = CSSM_TP_PRIVATE_ERROR + 107,
+ /* server-reported service error */
+ CSSMERR_APPLE_DOTMAC_REQ_SERVER_SERVICE_ERROR = CSSM_TP_PRIVATE_ERROR + 108,
+ /* request already pending for specified user */
+ CSSMERR_APPLE_DOTMAC_REQ_IS_PENDING = CSSM_TP_PRIVATE_ERROR + 109,
+ /* no request pending for specified user */
+ CSSMERR_APPLE_DOTMAC_NO_REQ_PENDING = CSSM_TP_PRIVATE_ERROR + 110,
+ /* CSR failed to verify */
+ CSSMERR_APPLE_DOTMAC_CSR_VERIFY_FAIL = CSSM_TP_PRIVATE_ERROR + 111,
+ /* server reported failed consistency check */
+ CSSMERR_APPLE_DOTMAC_FAILED_CONSISTENCY_CHECK = CSSM_TP_PRIVATE_ERROR + 112
+};
+
+enum
+{
+ CSSM_APPLEDL_OPEN_PARAMETERS_VERSION = 1
+};
+
+enum cssm_appledl_open_parameters_mask
+{
+ kCSSM_APPLEDL_MASK_MODE = (1 << 0)
+};
+
+/* Pass a CSSM_APPLEDL_OPEN_PARAMETERS_PTR as the OpenParameters argument to
+ CSSM_DL_DbCreate or CSSM_DL_DbOpen. When using this struct, you must zero
+ out the entire struct before setting any additional parameters to ensure
+ forward compatibility. */
+typedef struct cssm_appledl_open_parameters
+{
+ uint32 length; /* Should be sizeof(CSSM_APPLEDL_OPEN_PARAMETERS). */
+ uint32 version; /* Should be CSSM_APPLEDL_OPEN_PARAMETERS_VERSION. */
+
+ /* If no OpenParameters are specified, autoCommit is on (!CSSM_FALSE) by default.
+ When autoCommit is on (!CSSM_FALSE), changes made to the Db are written to disk
+ before returning from each function.
+ When autoCommit is off (CSSM_FALSE), changes made to the database are not guaranteed
+ to be written to disk until the Db is closed. This is useful for bulk writes.
+ Be aware that if autoCommit is off, changes made in previous calls to the DL might
+ get rolled back if a new modification operation fails. */
+ CSSM_BOOL autoCommit;
+
+ /* Mask marking which of the following fields are to be used. */
+ uint32 mask;
+
+ /* When calling DbCreate, the initial mode to create the database file with; ignored on DbOpen. You must set the kCSSM_APPLEDL_MASK_MODE bit in mask or mode is ignored. */
+ mode_t mode;
+} CSSM_APPLEDL_OPEN_PARAMETERS, *CSSM_APPLEDL_OPEN_PARAMETERS_PTR;
+
+
+/* AppleCSPDL passthough ids */
+enum
+{
+ /* Tell the SecurityServer to lock the database specified by the DLDBHandle argument.
+ The InputParams and OutputParams arguments are ignored. */
+ CSSM_APPLECSPDL_DB_LOCK = 0,
+
+ /* Tell the SecurityServer to unlock the database specified by the DLDBHandle argument.
+ The InputParameters argument is a CSSM_DATA_PTR containing the password, or NULL if
+ the SecurityServer should prompt for the password.
+ The OutputParams argument is ignored.
+ The SecurityServer will put up UI (though the SecurityAgent) when this function is called
+ iff InputParameters is NULL. */
+ CSSM_APPLECSPDL_DB_UNLOCK = 1,
+
+ /* Ask the SecurityServer to get the db settings specified for the database
+ specified by the DLDBHandle argument. The settings are returned in the OutputParameters argument.
+ The OutputParameters argument is a pointer to a CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS_PTR.
+ Upon successful completion, the AppleCSPDL will have allocated a
+ CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS structure using the application-specified
+ allocators for the DL attachment specified by the DLDBHandle argument. The structure will contain
+ the current database settings for the specified database. The client should free the
+ CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS_PTR after it has finished using it.
+ The InputParameters argument is ignored.
+ The SecurityServer might put up UI (though the SecurityAgent) when this function is called. */
+ CSSM_APPLECSPDL_DB_GET_SETTINGS = 2,
+
+ /* Tell the SecurityServer to set the db settings specified in InputParameters on the database
+ specified by the DLDBHandle argument.
+ The InputParameters argument is a const CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS * containing
+ the new settings for the specified database.
+ The OutputParams argument is ignored.
+ The SecurityServer might put up UI (though the SecurityAgent) when this function is called. */
+ CSSM_APPLECSPDL_DB_SET_SETTINGS = 3,
+
+ /* Ask the SecurityServer whether the database specified by the DLDBHandle argument is locked.
+ The InputParameters argument is ignored.
+ The OutputParameters argument is a pointer to a CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS_PTR.
+ Upon successful completion, the AppleCSPDL will have allocated a
+ CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS structure using the application-specified
+ allocators for the DL attachment specified by the DLDBHandle argument. The structure will contain
+ the current lock status for the specified database. The client should free the
+ CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS_PTR after it has finished using it.
+ The SecurityServer will put up UI (though the SecurityAgent) when this function is called. */
+ CSSM_APPLECSPDL_DB_IS_LOCKED = 4,
+
+ /* Tell the SecurityServer to change the password for the database specified by
+ the DLDBHandle.
+
+ The InputParameters argument is a const CSSM_APPLECSPDL_DB_CHANGE_PASSWORD_PARAMETERS * containing
+ a CSSM_ACCESS_CREDENTIALS * which determines how the password will be changed. If the
+ accessCredentials are NULL, the SecurityAgent will prompt for the old and the new password for the
+ specified database. If credentials are specified, there should be 2 entries:
+ 1. a 3-element list containing:
+ CSSM_WORDID_KEYCHAIN_LOCK, CSSM_SAMPLE_TYPE_PASSWORD, and the old password.
+ 2. a 3-element list containing:
+ CSSM_WORDID_KEYCHAIN_CHANGE_LOCK, CSSM_SAMPLE_TYPE_PASSWORD, and the new password.
+
+ The OutputParams argument is ignored.
+ The SecurityServer might put up UI (though the SecurityAgent) when this function is called. */
+ CSSM_APPLECSPDL_DB_CHANGE_PASSWORD =5,
+
+ /* Return the SecurityServer database handle for the database specified by the DLDBHandle */
+ CSSM_APPLECSPDL_DB_GET_HANDLE = 6,
+
+ /* Given a CSSM_KEY for the CSPDL, return the SecurityServer key handle */
+ CSSM_APPLESCPDL_CSP_GET_KEYHANDLE = 7,
+
+ CSSM_APPLE_PRIVATE_CSPDL_CODE_8 = 8,
+ CSSM_APPLE_PRIVATE_CSPDL_CODE_9 = 9,
+ CSSM_APPLE_PRIVATE_CSPDL_CODE_10 = 10,
+ CSSM_APPLE_PRIVATE_CSPDL_CODE_11 = 11,
+ CSSM_APPLE_PRIVATE_CSPDL_CODE_12 = 12,
+ CSSM_APPLE_PRIVATE_CSPDL_CODE_13 = 13,
+ CSSM_APPLE_PRIVATE_CSPDL_CODE_14 = 14,
+ CSSM_APPLE_PRIVATE_CSPDL_CODE_15 = 15,
+ CSSM_APPLE_PRIVATE_CSPDL_CODE_16 = 16,
+ CSSM_APPLE_PRIVATE_CSPDL_CODE_17 = 17,
+ CSSM_APPLE_PRIVATE_CSPDL_CODE_18 = 18,
+
+ /* Given a CSSM_KEY_PTR in any format, obtain the SHA-1 hash of the
+ * associated key blob.
+ * Key is specified in CSSM_CSP_CreatePassThroughContext.
+ * Hash is allocated bythe CSP, in the App's memory, and returned
+ * in *outData. */
+ CSSM_APPLECSP_KEYDIGEST = 0x100
+};
+
+
+
+/* AppleCSPDL passthough parameters */
+typedef struct cssm_applecspdl_db_settings_parameters
+{
+ uint32 idleTimeout; // seconds idle timeout lock
+ uint8 lockOnSleep; // lock database when system sleeps
+} CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS, *CSSM_APPLECSPDL_DB_SETTINGS_PARAMETERS_PTR;
+
+/* AppleCSPDL passthough parameters */
+typedef struct cssm_applecspdl_db_is_locked_parameters
+{
+ uint8 isLocked; // True iff the database is locked
+} CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS, *CSSM_APPLECSPDL_DB_IS_LOCKED_PARAMETERS_PTR;
+
+/* AppleCSPDL passthough parameters */
+typedef struct cssm_applecspdl_db_change_password_parameters
+{
+ CSSM_ACCESS_CREDENTIALS *accessCredentials;
+} CSSM_APPLECSPDL_DB_CHANGE_PASSWORD_PARAMETERS, *CSSM_APPLECSPDL_DB_CHANGE_PASSWORD_PARAMETERS_PTR;
+
+/* Custom wrapped key formats */
+enum {
+ CSSM_KEYBLOB_WRAPPED_FORMAT_APPLE_CUSTOM = 100,
+ CSSM_KEYBLOB_WRAPPED_FORMAT_OPENSSL, // traditional openssl
+ CSSM_KEYBLOB_WRAPPED_FORMAT_OPENSSH1 // OpenSSH v1
+};
+
+/*
+ * Custom context attributes for AppleCSP.
+ */
+enum {
+ CSSM_ATTRIBUTE_VENDOR_DEFINED = 0x800000
+};
+
+enum {
+ /*
+ * Public Key attribute for use with CSSM_ALGID_FEED.
+ */
+ CSSM_ATTRIBUTE_PUBLIC_KEY =
+ (CSSM_ATTRIBUTE_DATA_KEY | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 0)),
+
+ /*
+ * FEE key attributes.
+ * See CSSM_FEE_PRIME_TYPE_xxx, CSSM_FEE_CURVE_TYPE_xxx enums, below.
+ */
+ CSSM_ATTRIBUTE_FEE_PRIME_TYPE =
+ (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 1)),
+ CSSM_ATTRIBUTE_FEE_CURVE_TYPE =
+ (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 2)),
+
+ /*
+ * Apple Secure Compression (ComCryption) optimization.
+ * See CSSM_ASC_OPTIMIZE_xxx, enums, below.
+ */
+ CSSM_ATTRIBUTE_ASC_OPTIMIZATION =
+ (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 3)),
+
+ /*
+ * RSA blinding. Value is integer, nonzero (blinding on) or zero.
+ */
+ CSSM_ATTRIBUTE_RSA_BLINDING =
+ (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 4)),
+
+ /*
+ * Additional public key from which to obtain algorithm-specific
+ * parameters.
+ */
+ CSSM_ATTRIBUTE_PARAM_KEY =
+ (CSSM_ATTRIBUTE_DATA_KEY | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 5)),
+
+ /*
+ * Prompt string for CSSM_ALGID_SECURE_PASSPHRASE key acquisition.
+ * Data is a UTF8-encoded external representation of a CFString.
+ */
+ CSSM_ATTRIBUTE_PROMPT =
+ (CSSM_ATTRIBUTE_DATA_CSSM_DATA | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 6)),
+
+ /*
+ * Alert panel title for CSSM_ALGID_SECURE_PASSPHRASE key acquisition.
+ * Data is a UTF8-encoded external representation of a CFString.
+ */
+ CSSM_ATTRIBUTE_ALERT_TITLE =
+ (CSSM_ATTRIBUTE_DATA_CSSM_DATA | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 7)),
+
+ /*
+ * Boolean to specify whether secure passphrase is being used to encrypt or to
+ * recover data. In the former case the user will be prompted to enter the
+ * passphrase twice. Value is integer, nonzero (verify passphrase) or zero.
+ */
+ CSSM_ATTRIBUTE_VERIFY_PASSPHRASE =
+ (CSSM_ATTRIBUTE_DATA_UINT32 | (CSSM_ATTRIBUTE_VENDOR_DEFINED + 8))
+
+};
+
+/*
+ * FEE key pair prime modulus types.
+ */
+enum {
+ CSSM_FEE_PRIME_TYPE_DEFAULT = 0, /* default per key size */
+ CSSM_FEE_PRIME_TYPE_MERSENNE, /* (2 ** q) - 1Ê*/
+ CSSM_FEE_PRIME_TYPE_FEE, /* (2 ** q) - k */
+ CSSM_FEE_PRIME_TYPE_GENERAL /* random prime */
+};
+
+/*
+ * FEE curve types. Comments refer to equation
+ *
+ * y**2 = x**3 + c(x**2) + ax + b
+ */
+enum {
+ CSSM_FEE_CURVE_TYPE_DEFAULT = 0, /* default per key size */
+ CSSM_FEE_CURVE_TYPE_MONTGOMERY, /* a==1, b==0 */
+ CSSM_FEE_CURVE_TYPE_WEIERSTRASS, /* c==0. IEEE P1363 compliant. */
+ CSSM_FEE_CURVE_TYPE_ANSI_X9_62 /* ANSI X9.62 compatible */
+};
+
+/*
+ * Apple Secure Compression (ComCryption) optimization attributes.
+ */
+enum {
+ CSSM_ASC_OPTIMIZE_DEFAULT = 0,
+ CSSM_ASC_OPTIMIZE_SIZE, /* max compression (currently the default) */
+ CSSM_ASC_OPTIMIZE_SECURITY, /* currently not implemented */
+ CSSM_ASC_OPTIMIZE_TIME, /* min runtime */
+ CSSM_ASC_OPTIMIZE_TIME_SIZE, /* implies loss of security */
+ CSSM_ASC_OPTIMIZE_ASCII, /* optimized for ASCC text, not implemented */
+};
+
+/*
+ * Apple custom CSSM_KEYATTR_FLAGS.
+ */
+enum {
+ /*
+ * When set, indicates a public key which is incomplete (though
+ * still valid) due to the lack of algorithm-specific parameters.
+ */
+ CSSM_KEYATTR_PARTIAL = 0x00010000,
+
+ /*
+ * When set, public keys are stored encrypted. Default is to store
+ * public keys in the clear. AppleCSPDL only.
+ */
+ CSSM_KEYATTR_PUBLIC_KEY_ENCRYPT = 0x00020000
+};
+
+/*
+ * Name/OID pair used in CSSM_APPLE_TP_CERT_REQUEST
+ */
+typedef struct {
+ const char *string;
+ const CSSM_OID *oid;
+} CSSM_APPLE_TP_NAME_OID;
+
+/*
+ * Certificate request passed to CSSM_TP_SubmitCredRequest() in the
+ * CSSM_TP_AUTHORITY_REQUEST_TYPE.Requests field. Used for requesting
+ * both locally-generated certs (CSSMOID_APPLE_TP_LOCAL_CERT_GEN) and
+ * cert signing requests (CSSMOID_APPLE_TP_CSR_GEN).
+ */
+typedef struct {
+ CSSM_CSP_HANDLE cspHand; // sign with this CSP
+ CSSM_CL_HANDLE clHand; // and this CL
+ uint32 serialNumber;
+ uint32 numSubjectNames;// size subjectNames[]
+ CSSM_APPLE_TP_NAME_OID *subjectNames;
+
+ /*
+ * Issuer name can be expressed in the simplified CSSM_APPLE_TP_NAME_OID
+ * array, as is the subject name, or as an CSSM_X509_NAME, which is
+ * typically obtained from a signing cert.
+ * Exactly one of {issuerNames, issuerNameX509} must be non-NULL.
+ */
+ uint32 numIssuerNames; // size issuerNames[]
+ CSSM_APPLE_TP_NAME_OID *issuerNames; // optional; NULL implies root
+ // (signer == subject)
+ CSSM_X509_NAME_PTR issuerNameX509;
+ const CSSM_KEY *certPublicKey;
+ const CSSM_KEY *issuerPrivateKey;
+
+ /* Unfortunately there is no practical way to map any algorithm
+ * to its appropriate OID, and we need both.... */
+ CSSM_ALGORITHMS signatureAlg; // e.g., CSSM_ALGID_SHA1WithRSA
+ CSSM_OID signatureOid; // e.g., CSSMOID_SHA1WithRSA
+ uint32 notBefore; // relative to "now"
+ uint32 notAfter;
+ uint32 numExtensions;
+ CE_DataAndType *extensions; // optional
+
+ /*
+ * Optional challenge string for CSSMOID_APPLE_TP_CSR_GEN.
+ */
+ const char *challengeString;
+} CSSM_APPLE_TP_CERT_REQUEST;
+
+/*
+ * Options for X509TP's CSSM_TP_CertGroupVerify for policy CSSMOID_APPLE_TP_SSL.
+ * A pointer to, and length of, one of these is optionally placed in
+ * CSSM_TP_VERIFY_CONTEXT.Cred->Policy.PolicyIds[n].FieldValue.
+ */
+#define CSSM_APPLE_TP_SSL_OPTS_VERSION 1
+
+/*
+ * Values for CSSM_APPLE_TP_SSL_OPTIONS.flags.
+ *
+ * Set this flag when evaluating a client cert.
+ */
+#define CSSM_APPLE_TP_SSL_CLIENT 0x00000001
+
+typedef struct {
+ uint32 Version; // CSSM_APPLE_TP_SSL_OPTS_VERSION
+
+ /*
+ * The domain name of the server (e.g., "store.apple.com".) In the
+ * SSL and TLS protocols, this must match the common name of the
+ * subject cert. Expressed as a C string, optionally NULL terminated
+ * if it is NULL terminated, the length field should include the NULL).
+ */
+ uint32 ServerNameLen;
+ const char *ServerName; // optional
+
+ /* new fields for struct version 1 */
+ uint32 Flags;
+} CSSM_APPLE_TP_SSL_OPTIONS;
+
+/*
+ * Options for X509TP's CSSM_TP_CertGroupVerify for policy
+ * CSSMOID_APPLE_TP_REVOCATION_CRL. A pointer to, and length of, one
+ * of these is optionally placed in
+ * CSSM_TP_VERIFY_CONTEXT.Cred->Policy.PolicyIds[n].FieldValue.
+ */
+#define CSSM_APPLE_TP_CRL_OPTS_VERSION 0
+
+typedef uint32 CSSM_APPLE_TP_CRL_OPT_FLAGS;
+enum {
+ // require CRL verification for each cert; default is "try"
+ CSSM_TP_ACTION_REQUIRE_CRL_PER_CERT = 0x00000001,
+ // enable fetch from network
+ CSSM_TP_ACTION_FETCH_CRL_FROM_NET = 0x00000002,
+ // if set and positive OCSP verify for given cert, no further revocation
+ // checking need be done on that cert
+ CSSM_TP_ACTION_CRL_SUFFICIENT = 0x00000004,
+ // require CRL verification for certs which claim a CRL provider
+ CSSM_TP_ACTION_REQUIRE_CRL_IF_PRESENT = 0x00000008
+};
+
+typedef struct {
+ uint32 Version; // CSSM_APPLE_TP_CRL_OPTS_VERSION
+ CSSM_APPLE_TP_CRL_OPT_FLAGS CrlFlags;
+
+ /*
+ * When non-NULL, store CRLs fetched from net here.
+ * This is most likely a pointer to one of the
+ * CSSM_TP_CALLERAUTH_CONTEXT.DBList entries but that
+ * is not a strict requirement.
+ */
+ CSSM_DL_DB_HANDLE_PTR crlStore;
+} CSSM_APPLE_TP_CRL_OPTIONS;
+
+/*
+ * Options for X509TP's CSSM_TP_CertGroupVerify for policy
+ * CSSMOID_APPLE_TP_SMIME. A pointer to, and length of, one
+ * of these is optionally placed in
+ * CSSM_TP_VERIFY_CONTEXT.Cred->Policy.PolicyIds[n].FieldValue.
+ */
+#define CSSM_APPLE_TP_SMIME_OPTS_VERSION 0
+typedef struct {
+ uint32 Version; // CSSM_APPLE_TP_SMIME_OPTS_VERSION
+
+ /*
+ * Intended usage of the leaf cert. The cert's KeyUsage extension,
+ * if present, must be a superset of this.
+ */
+ CE_KeyUsage IntendedUsage;
+
+ /*
+ * The email address of the sender. If there is an email address
+ * in the sender's cert, that email address must match this one.
+ * Both (email address in the cert, and this one) are optional.
+ * Expressed as a C string, optionally NULL terminated (i.e.,
+ * SenderEmail[SenderEmailLen - 1] may or may not be NULL).
+ */
+ uint32 SenderEmailLen;
+ const char *SenderEmail; // optional
+} CSSM_APPLE_TP_SMIME_OPTIONS;
+
+
+/*
+ * Optional ActionData for all X509TP CertGroupVerify policies.
+ * A pointer to, and length of, one of these is optionally placed in
+ * CSSM_TP_VERIFY_CONTEXT.ActionData.
+ */
+typedef uint32 CSSM_APPLE_TP_ACTION_FLAGS;
+enum {
+ CSSM_TP_ACTION_ALLOW_EXPIRED = 0x00000001, // allow expired certs
+ CSSM_TP_ACTION_LEAF_IS_CA = 0x00000002, // first cert is a CA
+ CSSM_TP_ACTION_FETCH_CERT_FROM_NET = 0x00000004, // enable net fetch of CA cert
+ CSSM_TP_ACTION_ALLOW_EXPIRED_ROOT = 0x00000008, // allow expired roots
+ CSSM_TP_ACTION_REQUIRE_REV_PER_CERT = 0x00000010, // require positive revocation
+ // check per cert
+ CSSM_TP_ACTION_TRUST_SETTINGS = 0x00000020, // use TrustSettings instead of
+ // anchors
+ CSSM_TP_ACTION_IMPLICIT_ANCHORS = 0x00000040 // properly self-signed certs are
+ // treated as anchors implicitly
+};
+
+#define CSSM_APPLE_TP_ACTION_VERSION 0
+typedef struct {
+ uint32 Version; // CSSM_APPLE_TP_ACTION_VERSION
+ CSSM_APPLE_TP_ACTION_FLAGS ActionFlags; // CSSM_TP_ACTION_ALLOW_EXPIRED, etc.
+} CSSM_APPLE_TP_ACTION_DATA;
+
+/*
+ * Per-cert evidence returned from CSSM_TP_CertGroupVerify.
+ * An array of these is presented in CSSM_TP_VERIFY_CONTEXT_RESULT.Evidence[2].
+ * Same number of these as in the cert group in Evidence[1].
+ */
+
+/* First, an array of bits indicating various status of the cert. */
+typedef uint32 CSSM_TP_APPLE_CERT_STATUS;
+enum
+{
+ CSSM_CERT_STATUS_EXPIRED = 0x00000001,
+ CSSM_CERT_STATUS_NOT_VALID_YET = 0x00000002,
+ CSSM_CERT_STATUS_IS_IN_INPUT_CERTS = 0x00000004,
+ CSSM_CERT_STATUS_IS_IN_ANCHORS = 0x00000008,
+ CSSM_CERT_STATUS_IS_ROOT = 0x00000010,
+ CSSM_CERT_STATUS_IS_FROM_NET = 0x00000020,
+ /* settings found in per-user Trust Settings */
+ CSSM_CERT_STATUS_TRUST_SETTINGS_FOUND_USER = 0x00000040,
+ /* settings found in Admin Trust Settings */
+ CSSM_CERT_STATUS_TRUST_SETTINGS_FOUND_ADMIN = 0x00000080,
+ /* settings found in System Trust Settings */
+ CSSM_CERT_STATUS_TRUST_SETTINGS_FOUND_SYSTEM = 0x00000100,
+ /* Trust Settings result = Trust */
+ CSSM_CERT_STATUS_TRUST_SETTINGS_TRUST = 0x00000200,
+ /* Trust Settings result = Deny */
+ CSSM_CERT_STATUS_TRUST_SETTINGS_DENY = 0x00000400,
+ /* Per-cert error ignored due to Trust Settings */
+ CSSM_CERT_STATUS_TRUST_SETTINGS_IGNORED_ERROR = 0x00000800
+};
+
+typedef struct {
+ CSSM_TP_APPLE_CERT_STATUS StatusBits;
+ uint32 NumStatusCodes;
+ CSSM_RETURN *StatusCodes;
+
+ /* index into raw cert group or AnchorCerts depending on IS_IN_ANCHORS */
+ uint32 Index;
+
+ /* nonzero if cert came from a DLDB */
+ CSSM_DL_DB_HANDLE DlDbHandle;
+ CSSM_DB_UNIQUE_RECORD_PTR UniqueRecord;
+} CSSM_TP_APPLE_EVIDENCE_INFO;
+
+/*
+ * CSSM_TP_VERIFY_CONTEXT_RESULT.Evidence[0], basically defines which version/flavor
+ * of remaining evidence is.
+ */
+#define CSSM_TP_APPLE_EVIDENCE_VERSION 0
+typedef struct
+{
+ uint32 Version;
+} CSSM_TP_APPLE_EVIDENCE_HEADER;
+
+
+/*
+ * Apple-specific CSSM_EVIDENCE_FORM values
+ *
+ * The form of the evidence returns from CSSM_TP_CertGroupVerify is:
+ *
+ * EvidenceForm contents of *Evidence
+ * ------------ ---------------------
+ * CSSM_EVIDENCE_FORM_APPLE_HEADER CSSM_TP_APPLE_EVIDENCE_HEADER
+ * CSSM_EVIDENCE_FORM_APPLE_CERTGROUP CSSM_CERTGROUP
+ * CSSM_EVIDENCE_FORM_APPLE_CERT_INFO array of CSSM_TP_APPLE_EVIDENCE_INFO, size
+ * CSSM_CERTGROUP.NumCerts
+ */
+
+#define CSSM_EVIDENCE_FORM_APPLE_CUSTOM 0x80000000
+enum
+{
+ CSSM_EVIDENCE_FORM_APPLE_HEADER = CSSM_EVIDENCE_FORM_APPLE_CUSTOM + 0,
+ CSSM_EVIDENCE_FORM_APPLE_CERTGROUP = CSSM_EVIDENCE_FORM_APPLE_CUSTOM + 1,
+ CSSM_EVIDENCE_FORM_APPLE_CERT_INFO = CSSM_EVIDENCE_FORM_APPLE_CUSTOM + 2
+};
+
+/* AppleX509CL extensions: passthrough ids */
+enum {
+ /*
+ * Obtain a signed Certificate Signing Request.
+ * Input = CSSM_APPLE_CL_CSR_REQUEST
+ * Output = allocated CSSM_DATA which points to a DER-encoded CSR.
+ */
+ CSSM_APPLEX509CL_OBTAIN_CSR,
+
+ /*
+ * Perform signature verify of a CSR.
+ * Input: CSSM_DATA referring to a DER-encoded CSR.
+ * Output: Nothing, returns CSSMERR_CL_VERIFICATION_FAILURE on
+ * on failure.
+ */
+ CSSM_APPLEX509CL_VERIFY_CSR
+};
+
+/*
+ * Used in CL's CSSM_APPLEX509_OBTAIN_CSR Passthrough. This is the
+ * input; the output is a CSSM_DATA * containing the signed and
+ * DER-encoded CSR.
+ */
+typedef struct {
+ CSSM_X509_NAME_PTR subjectNameX509;
+
+ /* Unfortunately there is no practical way to map any algorithm
+ * to its appropriate OID, and we need both.... */
+ CSSM_ALGORITHMS signatureAlg; // e.g., CSSM_ALGID_SHA1WithRSA
+ CSSM_OID signatureOid; // e.g., CSSMOID_SHA1WithRSA
+
+ CSSM_CSP_HANDLE cspHand; // sign with this CSP
+ const CSSM_KEY *subjectPublicKey;
+ const CSSM_KEY *subjectPrivateKey;
+
+ /*
+ * Optional challenge string.
+ */
+ const char *challengeString;
+} CSSM_APPLE_CL_CSR_REQUEST;
+
+/*
+ * When a CRL with no NextUpdate field is encountered, we use this time
+ * as the NextUpdate attribute when storing in a DB. It represents the
+ * virtual end of time in CSSM_TIMESTRING form.
+ */
+#define CSSM_APPLE_CRL_END_OF_TIME "99991231235959"
+
+/*
+ * Default filesystem names and locations for SecurityServer features
+ * (included here for lack of a better place)
+ */
+#define kKeychainSuffix ".keychain"
+#define kSystemKeychainName "System.keychain"
+#define kSystemKeychainDir "/Library/Keychains/"
+#define kSystemUnlockFile "/var/db/SystemKey"
+
+
+void cssmPerror(const char *how, CSSM_RETURN error);
+
+/* Convert between CSSM_OID and CSSM_ALGORITHMS */
+bool cssmOidToAlg(const CSSM_OID *oid, CSSM_ALGORITHMS *alg);
+const CSSM_OID *cssmAlgToOid(CSSM_ALGORITHMS algId);
+
+/*
+ * The MacOS OSStatus space has an embedding for UNIX errno values, similar to
+ * the way we embed CSSM_RETURN values in OSStatus. These are the base and limit
+ * values for this embedding.
+ */
+#define errSecErrnoBase 100000
+#define errSecErrnoLimit 100255
+
+#ifdef __cplusplus
+}
+#endif // __cplusplus
+
+#endif /* _CSSMAPPLE_H_ */
projects / apple / security.git / blobdiff