-#ifndef _CERT_VERIFY_H_
-#define _CERT_VERIFY_H_
-
-#include <clAppUtils/BlobList.h>
-#include <Security/cssmtype.h>
-#include <Security/cssmapple.h>
-
-/* must be C++ since we use BlobList */
-extern "C" {
-
-/* Display verify results */
-void dumpVfyResult(
- const CSSM_TP_VERIFY_CONTEXT_RESULT *vfyResult);
-
-typedef enum {
- CVP_Basic = 0,
- CVP_SSL,
- CVP_SMIME,
- CVP_SWUpdateSign, // was CVP_CodeSigning
- CVP_ResourceSigning,
- CVP_iChat,
- CVP_IPSec,
- CVP_PKINIT_Server,
- CVP_PKINIT_Client,
- CVP_AppleCodeSigning, // the Leopard version
- CVP_PackageSigning
-} CertVerifyPolicy;
-
-typedef enum {
- CRP_None = 0,
- CRP_CRL,
- CRP_OCSP,
- CRP_CRL_OCSP
-} CertRevokePolicy;
-
-/*
- * Since I never stop adding args to certVerify(), most of which have reasonable
- * defaults, the inputs are now expressed like so.
- */
-#define CERT_VFY_ARGS_VERS 5 /* increment every time you change this struct */
-typedef struct {
- int version; /* must be CERT_VFY_ARGS_VERS */
- CSSM_TP_HANDLE tpHand;
- CSSM_CL_HANDLE clHand;
- CSSM_CSP_HANDLE cspHand;
- BlobList *certs;
- BlobList *roots;
- BlobList *crls;
- char *vfyTime;
-
- CSSM_BOOL certNetFetchEnable;
- CSSM_BOOL useSystemAnchors;
- CSSM_BOOL useTrustSettings;
- CSSM_BOOL leafCertIsCA;
- CSSM_BOOL allowExpiredRoot;
- CSSM_BOOL implicitAnchors;
- CSSM_DL_DB_LIST_PTR dlDbList; // optional
- CertVerifyPolicy vfyPolicy;
-
- const char *sslHost; // optional; SSL policy
- CSSM_BOOL sslClient; // normally server side
- const char *senderEmail; // optional, SMIME
- CE_KeyUsage intendedKeyUse; // optional, SMIME only
-
- /* revocation options */
- CertRevokePolicy revokePolicy;
- CSSM_BOOL allowUnverified; // if false, at least one must succeed
-
- /* CRL options */
- CSSM_BOOL requireCrlIfPresent;
- CSSM_BOOL requireCrlForAll;
- CSSM_BOOL crlNetFetchEnable;
- CSSM_DL_DB_HANDLE_PTR crlDlDb; // obsolete: write CRLs here
-
- /* OCSP options */
- const char *responderURI; // optional, OCSP only
- const unsigned char *responderCert; // optional, OCSP only
- unsigned responderCertLen;// optional, OCSP only
- CSSM_BOOL disableCache; // both r and w for now
- CSSM_BOOL disableOcspNet;
- CSSM_BOOL requireOcspIfPresent;
- CSSM_BOOL requireOcspForAll;
- CSSM_BOOL generateOcspNonce;
- CSSM_BOOL requireOcspRespNonce;
-
- const char *expectedErrStr;// e.g.,
- // "CSSMERR_APPLETP_CRL_NOT_TRUSTED"
-
- /*
- * expected per-cert errors
- * format is certNum:errorString
- * e.g., "1:CSSMERR_APPLETP_CRL_NOT_TRUSTED"
- */
- unsigned numCertErrors;
- const char **certErrors; // per-cert status
-
- /*
- * Expected per-cert status (CSSM_TP_APPLE_EVIDENCE_INFO.StatusBits)
- * format is certNum:status_in_hex
- * e.g., "1:0x18", leading 0x optional
- */
- unsigned numCertStatus;
- const char **certStatus;
- CSSM_BOOL quiet;
- CSSM_BOOL verbose;
-
-} CertVerifyArgs;
-
-/* perform one cert/crl verification */
-int certVerify(CertVerifyArgs *args);
-
-/*
- * A slightly simplified version of certVerify:
- * -- no CRLs
- * -- no DlDbs
- * -- no net fetch
- * -- time = now
- * -- no trust settings
- */
-int certVerifySimple(
- CSSM_TP_HANDLE tpHand,
- CSSM_CL_HANDLE clHand,
- CSSM_CSP_HANDLE cspHand,
- BlobList &certs,
- BlobList &roots,
- CSSM_BOOL useSystemAnchors,
- CSSM_BOOL leafCertIsCA,
- CSSM_BOOL allowExpiredRoot,
- CertVerifyPolicy vfyPolicy,
- const char *sslHost, // optional, SSL policy
- CSSM_BOOL sslClient, // normally server side
- const char *senderEmail, // optional, SMIME
- CE_KeyUsage intendedKeyUse, // optional, SMIME only
- const char *expectedErrStr,// e.g.,
- unsigned numCertErrors,
- const char **certErrors, // per-cert status
- unsigned numCertStatus,
- const char **certStatus,
- CSSM_BOOL useTrustSettings,
- CSSM_BOOL quiet,
- CSSM_BOOL verbose);
-
-/* convert ASCII string in hex to unsigned */
-unsigned hexToBin(const char *hex);
-
-} /* extern "C" */
-
-#endif /* _DO_VERIFY_H_ */
projects / apple / security.git / blobdiff