-#if !SECTRUST_OSX
-/* new in 10.9 */
-SecPolicyRef
-SecPolicyCreateWithProperties(CFTypeRef policyIdentifier, CFDictionaryRef properties)
-{
- SecPolicyRef policy = _SecPolicyCreateWithOID(policyIdentifier);
- SecPolicySetProperties(policy, properties);
-
- return policy;
-}
-#endif
-
-#if !SECTRUST_OSX
-/* new in 10.9 */
-SecPolicyRef
-SecPolicyCreateRevocation(CFOptionFlags revocationFlags)
-{
- // return a SecPolicyRef object for the unified revocation policy
- SecAsn1Oid *oidPtr = (SecAsn1Oid*)&CSSMOID_APPLE_TP_REVOCATION;
- SecPolicyRef policy = SecPolicyCreateWithSecAsn1Oid(oidPtr);
- if (policy) {
- CSSM_DATA policyData = { (CSSM_SIZE)sizeof(CFOptionFlags), (uint8*)&revocationFlags };
- SecPolicySetValue(policy, &policyData);
- }
- return policy;
-}
-#endif
-
-/* OS X only: deprecated SPI entry point */
-/* new in 10.9 ***FIXME*** TO BE REMOVED */
-CFArrayRef SecPolicyCopyEscrowRootCertificates(void)
-{
- return SecCertificateCopyEscrowRoots(kSecCertificateProductionEscrowRoot);
-}
-
-SecPolicyRef SecPolicyCreateAppleIDSService(CFStringRef hostname)
-{
- return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateAppleIDSServiceContext(CFStringRef hostname, CFDictionaryRef __unused context)
-{
- return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateApplePushService(CFStringRef hostname, CFDictionaryRef __unused context)
-{
- return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateApplePushServiceLegacy(CFStringRef hostname)
-{
- return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateAppleMMCSService(CFStringRef hostname, CFDictionaryRef __unused context)
-{
- return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateAppleGSService(CFStringRef hostname, CFDictionaryRef __unused context)
-{
- return SecPolicyCreateSSL(true, hostname);
-}
-
-SecPolicyRef SecPolicyCreateApplePPQService(CFStringRef hostname, CFDictionaryRef __unused context)
-{
- return SecPolicyCreateSSL(true, hostname);
-}
-
-#if !SECTRUST_OSX
-/* new in 10.11 */
-SecPolicyRef SecPolicyCreateAppleATVAppSigning(void)
-{
- return _SecPolicyCreateWithOID(kSecPolicyAppleX509Basic);
-}
-#endif
-
-#if !SECTRUST_OSX
-/* new in 10.11 */
-SecPolicyRef SecPolicyCreateTestAppleATVAppSigning(void)
-{
- return _SecPolicyCreateWithOID(kSecPolicyAppleX509Basic);
-}
-#endif
-
-#if !SECTRUST_OSX
-/* new in 10.11 */
-SecPolicyRef SecPolicyCreateApplePayIssuerEncryption(void)
-{
- return _SecPolicyCreateWithOID(kSecPolicyAppleX509Basic);
-}
-#endif
-
-#if !SECTRUST_OSX
-/* new in 10.11 */
-SecPolicyRef SecPolicyCreateOSXProvisioningProfileSigning(void)
-{
- return _SecPolicyCreateWithOID(kSecPolicyAppleOSXProvisioningProfileSigning);
-}
-#endif
-
-
-#if !SECTRUST_OSX
-/* new in 10.11 */
-SecPolicyRef SecPolicyCreateAppleATVVPNProfileSigning(void)
-{
- return _SecPolicyCreateWithOID(kSecPolicyAppleX509Basic);
-}
-#endif
-
-#if !SECTRUST_OSX
-SecPolicyRef SecPolicyCreateAppleSSLService(CFStringRef hostname)
-{
- // SSL server, pinned to an Apple intermediate
- SecPolicyRef policy = SecPolicyCreateSSL(true, hostname);
- if (policy) {
- // change options for policy evaluation
- char *strbuf = NULL;
- const char *hostnamestr = NULL;
- if (hostname) {
- hostnamestr = CFStringGetCStringPtr(hostname, kCFStringEncodingUTF8);
- if (hostnamestr == NULL) {
- CFIndex maxLen = CFStringGetMaximumSizeForEncoding(CFStringGetLength(hostname), kCFStringEncodingUTF8) + 1;
- strbuf = (char *)malloc(maxLen);
- if (CFStringGetCString(hostname, strbuf, maxLen, kCFStringEncodingUTF8)) {
- hostnamestr = strbuf;
- }
- }
- }
- uint32 hostnamelen = (hostnamestr) ? (uint32)strlen(hostnamestr) : 0;
- uint32 flags = 0x00000002; // 2nd-lowest bit set to require Apple intermediate pin
- CSSM_APPLE_TP_SSL_OPTIONS opts = {CSSM_APPLE_TP_SSL_OPTS_VERSION, hostnamelen, hostnamestr, flags};
- CSSM_DATA data = {sizeof(opts), (uint8*)&opts};
- SecPolicySetValue(policy, &data);
- }
- return policy;
-}
-#endif
-
projects / apple / security.git / blobdiff