X-Git-Url: https://git.saurik.com/apple/security.git/blobdiff_plain/822b670c6f91d089ccb51b77e24b6ac80406b337..67d61d2eddbf13b089421b1c08b0353e50c467d7:/OSX/libsecurity_keychain/lib/SecPolicy.cpp diff --git a/OSX/libsecurity_keychain/lib/SecPolicy.cpp b/OSX/libsecurity_keychain/lib/SecPolicy.cpp index 269db0b1..7f20d626 100644 --- a/OSX/libsecurity_keychain/lib/SecPolicy.cpp +++ b/OSX/libsecurity_keychain/lib/SecPolicy.cpp @@ -1,3 +1,4 @@ + /* * Copyright (c) 2002-2015 Apple Inc. All Rights Reserved. * @@ -40,69 +41,14 @@ #define SEC_CONST_DECL(k,v) const CFStringRef k = CFSTR(v); -SEC_CONST_DECL (kSecPolicyAppleX509Basic, "1.2.840.113635.100.1.2"); -SEC_CONST_DECL (kSecPolicyAppleSSL, "1.2.840.113635.100.1.3"); -SEC_CONST_DECL (kSecPolicyAppleSMIME, "1.2.840.113635.100.1.8"); -SEC_CONST_DECL (kSecPolicyAppleEAP, "1.2.840.113635.100.1.9"); -SEC_CONST_DECL (kSecPolicyAppleSWUpdateSigning, "1.2.840.113635.100.1.10"); -SEC_CONST_DECL (kSecPolicyAppleIPsec, "1.2.840.113635.100.1.11"); +/* Some of these aren't defined in SecPolicy.c, but used here. */ SEC_CONST_DECL (kSecPolicyAppleiChat, "1.2.840.113635.100.1.12"); -SEC_CONST_DECL (kSecPolicyApplePKINITClient, "1.2.840.113635.100.1.14"); -SEC_CONST_DECL (kSecPolicyApplePKINITServer, "1.2.840.113635.100.1.15"); -SEC_CONST_DECL (kSecPolicyAppleCodeSigning, "1.2.840.113635.100.1.16"); -SEC_CONST_DECL (kSecPolicyApplePackageSigning, "1.2.840.113635.100.1.17"); -SEC_CONST_DECL (kSecPolicyAppleIDValidation, "1.2.840.113635.100.1.18"); -SEC_CONST_DECL (kSecPolicyMacAppStoreReceipt, "1.2.840.113635.100.1.19"); -SEC_CONST_DECL (kSecPolicyAppleTimeStamping, "1.2.840.113635.100.1.20"); -SEC_CONST_DECL (kSecPolicyAppleRevocation, "1.2.840.113635.100.1.21"); -SEC_CONST_DECL (kSecPolicyApplePassbookSigning, "1.2.840.113635.100.1.22"); -SEC_CONST_DECL (kSecPolicyAppleMobileStore, "1.2.840.113635.100.1.23"); -SEC_CONST_DECL (kSecPolicyAppleEscrowService, "1.2.840.113635.100.1.24"); -SEC_CONST_DECL (kSecPolicyAppleProfileSigner, "1.2.840.113635.100.1.25"); -SEC_CONST_DECL (kSecPolicyAppleQAProfileSigner, "1.2.840.113635.100.1.26"); -SEC_CONST_DECL (kSecPolicyAppleTestMobileStore, "1.2.840.113635.100.1.27"); -#if TARGET_OS_IPHONE -SEC_CONST_DECL (kSecPolicyAppleOTAPKISigner, "1.2.840.113635.100.1.28"); -SEC_CONST_DECL (kSecPolicyAppleTestOTAPKISigner, "1.2.840.113635.100.1.29"); -/* FIXME: this policy name should be deprecated and replaced with "kSecPolicyAppleIDValidationRecordSigning" */ -SEC_CONST_DECL (kSecPolicyAppleIDValidationRecordSigningPolicy, "1.2.840.113625.100.1.30"); -SEC_CONST_DECL (kSecPolicyAppleSMPEncryption, "1.2.840.113625.100.1.31"); -SEC_CONST_DECL (kSecPolicyAppleTestSMPEncryption, "1.2.840.113625.100.1.32"); -#endif -SEC_CONST_DECL (kSecPolicyAppleServerAuthentication, "1.2.840.113635.100.1.33"); -SEC_CONST_DECL (kSecPolicyApplePCSEscrowService, "1.2.840.113635.100.1.34"); -SEC_CONST_DECL (kSecPolicyApplePPQSigning, "1.2.840.113625.100.1.35"); -SEC_CONST_DECL (kSecPolicyAppleTestPPQSigning, "1.2.840.113625.100.1.36"); -SEC_CONST_DECL (kSecPolicyAppleATVAppSigning, "1.2.840.113625.100.1.37"); -SEC_CONST_DECL (kSecPolicyAppleTestATVAppSigning, "1.2.840.113625.100.1.38"); -SEC_CONST_DECL (kSecPolicyApplePayIssuerEncryption, "1.2.840.113625.100.1.39"); -SEC_CONST_DECL (kSecPolicyAppleOSXProvisioningProfileSigning, "1.2.840.113625.100.1.40"); - -SEC_CONST_DECL (kSecPolicyOid, "SecPolicyOid"); -SEC_CONST_DECL (kSecPolicyName, "SecPolicyName"); -SEC_CONST_DECL (kSecPolicyClient, "SecPolicyClient"); -SEC_CONST_DECL (kSecPolicyRevocationFlags, "SecPolicyRevocationFlags"); -SEC_CONST_DECL (kSecPolicyTeamIdentifier, "SecPolicyTeamIdentifier"); - -SEC_CONST_DECL (kSecPolicyKU_DigitalSignature, "CE_KU_DigitalSignature"); -SEC_CONST_DECL (kSecPolicyKU_NonRepudiation, "CE_KU_NonRepudiation"); -SEC_CONST_DECL (kSecPolicyKU_KeyEncipherment, "CE_KU_KeyEncipherment"); -SEC_CONST_DECL (kSecPolicyKU_DataEncipherment, "CE_KU_DataEncipherment"); -SEC_CONST_DECL (kSecPolicyKU_KeyAgreement, "CE_KU_KeyAgreement"); -SEC_CONST_DECL (kSecPolicyKU_KeyCertSign, "CE_KU_KeyCertSign"); -SEC_CONST_DECL (kSecPolicyKU_CRLSign, "CE_KU_CRLSign"); -SEC_CONST_DECL (kSecPolicyKU_EncipherOnly, "CE_KU_EncipherOnly"); -SEC_CONST_DECL (kSecPolicyKU_DecipherOnly, "CE_KU_DecipherOnly"); // Private functions extern "C" { -CFArrayRef SecPolicyCopyEscrowRootCertificates(void); -#if SECTRUST_OSX -CFStringRef SecPolicyGetOidString(SecPolicyRef policy); CFDictionaryRef SecPolicyGetOptions(SecPolicyRef policy); void SecPolicySetOptionsValue(SecPolicyRef policy, CFStringRef key, CFTypeRef value); -#endif } // String to CSSM_OID mapping @@ -134,73 +80,72 @@ typedef struct oidmap_entry_s oidmap_entry_t; static_cast(&CSSMOID_APPLE_TP_APPLEID_SHARING), static_cast(&CSSMOID_APPLE_TP_TIMESTAMPING), */ -const oidmap_entry_t oidmap[] = { - { kSecPolicyAppleX509Basic, &CSSMOID_APPLE_X509_BASIC }, - { kSecPolicyAppleSSL, &CSSMOID_APPLE_TP_SSL }, - { kSecPolicyAppleSMIME, &CSSMOID_APPLE_TP_SMIME }, - { kSecPolicyAppleEAP, &CSSMOID_APPLE_TP_EAP }, - { kSecPolicyAppleSWUpdateSigning, &CSSMOID_APPLE_TP_SW_UPDATE_SIGNING }, - { kSecPolicyAppleIPsec, &CSSMOID_APPLE_TP_IP_SEC }, - { kSecPolicyAppleiChat, &CSSMOID_APPLE_TP_ICHAT }, - { kSecPolicyApplePKINITClient, &CSSMOID_APPLE_TP_PKINIT_CLIENT }, - { kSecPolicyApplePKINITServer, &CSSMOID_APPLE_TP_PKINIT_SERVER }, - { kSecPolicyAppleCodeSigning, &CSSMOID_APPLE_TP_CODE_SIGNING }, - { kSecPolicyApplePackageSigning, &CSSMOID_APPLE_TP_PACKAGE_SIGNING }, - { kSecPolicyAppleIDValidation, &CSSMOID_APPLE_TP_APPLEID_SHARING }, - { kSecPolicyMacAppStoreReceipt, &CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT }, - { kSecPolicyAppleTimeStamping, &CSSMOID_APPLE_TP_TIMESTAMPING }, - { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION }, - { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION_OCSP }, - { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION_CRL }, - { kSecPolicyApplePassbookSigning, &CSSMOID_APPLE_TP_PASSBOOK_SIGNING }, - { kSecPolicyAppleMobileStore, &CSSMOID_APPLE_TP_MOBILE_STORE }, - { kSecPolicyAppleEscrowService, &CSSMOID_APPLE_TP_ESCROW_SERVICE }, - { kSecPolicyAppleProfileSigner, &CSSMOID_APPLE_TP_PROFILE_SIGNING }, - { kSecPolicyAppleQAProfileSigner, &CSSMOID_APPLE_TP_QA_PROFILE_SIGNING }, - { kSecPolicyAppleTestMobileStore, &CSSMOID_APPLE_TP_TEST_MOBILE_STORE }, - { kSecPolicyApplePCSEscrowService, &CSSMOID_APPLE_TP_PCS_ESCROW_SERVICE }, - { kSecPolicyAppleOSXProvisioningProfileSigning, &CSSMOID_APPLE_TP_PROVISIONING_PROFILE_SIGNING }, -}; -// TBD: have only one set of policy identifiers in SecPolicy.c so we can get rid of this -const oidmap_entry_t oidmap_priv[] = { - { CFSTR("basicX509"), &CSSMOID_APPLE_X509_BASIC }, - { CFSTR("sslServer"), &CSSMOID_APPLE_TP_SSL }, - { CFSTR("sslClient"), &CSSMOID_APPLE_TP_SSL }, - { CFSTR("SMIME"), &CSSMOID_APPLE_TP_SMIME }, - { CFSTR("eapServer"), &CSSMOID_APPLE_TP_EAP }, - { CFSTR("eapClient"), &CSSMOID_APPLE_TP_EAP }, - { CFSTR("AppleSWUpdateSigning"), &CSSMOID_APPLE_TP_SW_UPDATE_SIGNING }, - { CFSTR("ipsecServer"), &CSSMOID_APPLE_TP_IP_SEC }, - { CFSTR("ipsecClient"), &CSSMOID_APPLE_TP_IP_SEC }, - { CFSTR("CodeSigning"), &CSSMOID_APPLE_TP_CODE_SIGNING }, - { CFSTR("PackageSigning"), &CSSMOID_APPLE_TP_PACKAGE_SIGNING }, - { CFSTR("AppleIDAuthority"), &CSSMOID_APPLE_TP_APPLEID_SHARING }, - { CFSTR("MacAppStoreReceipt"), &CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT }, - { CFSTR("AppleTimeStamping"), &CSSMOID_APPLE_TP_TIMESTAMPING }, - { CFSTR("revocation"), &CSSMOID_APPLE_TP_REVOCATION }, - { CFSTR("ApplePassbook"), &CSSMOID_APPLE_TP_PASSBOOK_SIGNING }, - { CFSTR("AppleMobileStore"), &CSSMOID_APPLE_TP_MOBILE_STORE }, - { CFSTR("AppleEscrowService"), &CSSMOID_APPLE_TP_ESCROW_SERVICE }, - { CFSTR("AppleProfileSigner"), &CSSMOID_APPLE_TP_PROFILE_SIGNING }, - { CFSTR("AppleQAProfileSigner"), &CSSMOID_APPLE_TP_QA_PROFILE_SIGNING }, - { CFSTR("AppleTestMobileStore"), &CSSMOID_APPLE_TP_TEST_MOBILE_STORE }, - { CFSTR("ApplePCSEscrowService"), &CSSMOID_APPLE_TP_PCS_ESCROW_SERVICE }, - { CFSTR("AppleOSXProvisioningProfileSigning"), &CSSMOID_APPLE_TP_PROVISIONING_PROFILE_SIGNING }, +static const size_t OIDMAP_LENGTH = 25; +static const oidmap_entry_t* oidmap_f() { + static const oidmap_entry_t oidmap_array[] = { + { kSecPolicyAppleX509Basic, &CSSMOID_APPLE_X509_BASIC }, + { kSecPolicyAppleSSL, &CSSMOID_APPLE_TP_SSL }, + { kSecPolicyAppleSMIME, &CSSMOID_APPLE_TP_SMIME }, + { kSecPolicyAppleEAP, &CSSMOID_APPLE_TP_EAP }, + { kSecPolicyAppleSWUpdateSigning, &CSSMOID_APPLE_TP_SW_UPDATE_SIGNING }, + { kSecPolicyAppleIPsec, &CSSMOID_APPLE_TP_IP_SEC }, + { kSecPolicyAppleiChat, &CSSMOID_APPLE_TP_ICHAT }, + { kSecPolicyApplePKINITClient, &CSSMOID_APPLE_TP_PKINIT_CLIENT }, + { kSecPolicyApplePKINITServer, &CSSMOID_APPLE_TP_PKINIT_SERVER }, + { kSecPolicyAppleCodeSigning, &CSSMOID_APPLE_TP_CODE_SIGNING }, + { kSecPolicyApplePackageSigning, &CSSMOID_APPLE_TP_PACKAGE_SIGNING }, + { kSecPolicyAppleIDValidation, &CSSMOID_APPLE_TP_APPLEID_SHARING }, + { kSecPolicyMacAppStoreReceipt, &CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT }, + { kSecPolicyAppleTimeStamping, &CSSMOID_APPLE_TP_TIMESTAMPING }, + { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION }, + { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION_OCSP }, + { kSecPolicyAppleRevocation, &CSSMOID_APPLE_TP_REVOCATION_CRL }, + { kSecPolicyApplePassbookSigning, &CSSMOID_APPLE_TP_PASSBOOK_SIGNING }, + { kSecPolicyAppleMobileStore, &CSSMOID_APPLE_TP_MOBILE_STORE }, + { kSecPolicyAppleEscrowService, &CSSMOID_APPLE_TP_ESCROW_SERVICE }, + { kSecPolicyAppleProfileSigner, &CSSMOID_APPLE_TP_PROFILE_SIGNING }, + { kSecPolicyAppleQAProfileSigner, &CSSMOID_APPLE_TP_QA_PROFILE_SIGNING }, + { kSecPolicyAppleTestMobileStore, &CSSMOID_APPLE_TP_TEST_MOBILE_STORE }, + { kSecPolicyApplePCSEscrowService, &CSSMOID_APPLE_TP_PCS_ESCROW_SERVICE }, + { kSecPolicyAppleOSXProvisioningProfileSigning, &CSSMOID_APPLE_TP_PROVISIONING_PROFILE_SIGNING }, + }; + static_assert(OIDMAP_LENGTH == (sizeof(oidmap_array)/sizeof(oidmap_entry_t)), "OIDMAP_LENGTH is incorrect; must match oidmap_array"); + + return oidmap_array; }; -// -// CF boilerplate -// -#if !SECTRUST_OSX -CFTypeID -SecPolicyGetTypeID(void) -{ - BEGIN_SECAPI - return gTypes().Policy.typeID; - END_SECAPI1(_kCFRuntimeNotATypeID) +static const size_t OIDMAP_PRIV_LENGTH = 23; +static const oidmap_entry_t* oidmap_priv_f() { + static const oidmap_entry_t oidmap_priv_array[] = { + { CFSTR("basicX509"), &CSSMOID_APPLE_X509_BASIC }, + { CFSTR("sslServer"), &CSSMOID_APPLE_TP_SSL }, + { CFSTR("sslClient"), &CSSMOID_APPLE_TP_SSL }, + { CFSTR("SMIME"), &CSSMOID_APPLE_TP_SMIME }, + { CFSTR("eapServer"), &CSSMOID_APPLE_TP_EAP }, + { CFSTR("eapClient"), &CSSMOID_APPLE_TP_EAP }, + { CFSTR("AppleSWUpdateSigning"), &CSSMOID_APPLE_TP_SW_UPDATE_SIGNING }, + { CFSTR("ipsecServer"), &CSSMOID_APPLE_TP_IP_SEC }, + { CFSTR("ipsecClient"), &CSSMOID_APPLE_TP_IP_SEC }, + { CFSTR("CodeSigning"), &CSSMOID_APPLE_TP_CODE_SIGNING }, + { CFSTR("PackageSigning"), &CSSMOID_APPLE_TP_PACKAGE_SIGNING }, + { CFSTR("AppleIDAuthority"), &CSSMOID_APPLE_TP_APPLEID_SHARING }, + { CFSTR("MacAppStoreReceipt"), &CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT }, + { CFSTR("AppleTimeStamping"), &CSSMOID_APPLE_TP_TIMESTAMPING }, + { CFSTR("revocation"), &CSSMOID_APPLE_TP_REVOCATION }, + { CFSTR("ApplePassbook"), &CSSMOID_APPLE_TP_PASSBOOK_SIGNING }, + { CFSTR("AppleMobileStore"), &CSSMOID_APPLE_TP_MOBILE_STORE }, + { CFSTR("AppleEscrowService"), &CSSMOID_APPLE_TP_ESCROW_SERVICE }, + { CFSTR("AppleProfileSigner"), &CSSMOID_APPLE_TP_PROFILE_SIGNING }, + { CFSTR("AppleQAProfileSigner"), &CSSMOID_APPLE_TP_QA_PROFILE_SIGNING }, + { CFSTR("AppleTestMobileStore"), &CSSMOID_APPLE_TP_TEST_MOBILE_STORE }, + { CFSTR("ApplePCSEscrowService"), &CSSMOID_APPLE_TP_PCS_ESCROW_SERVICE }, + { CFSTR("AppleOSXProvisioningProfileSigning"), &CSSMOID_APPLE_TP_PROVISIONING_PROFILE_SIGNING }, + }; + static_assert(OIDMAP_PRIV_LENGTH == (sizeof(oidmap_priv_array)/sizeof(oidmap_entry_t)), "OIDMAP_PRIV_LENGTH is incorrect; must match oidmap_priv_array"); + + return oidmap_priv_array; } -#endif // // Sec API bridge functions @@ -209,11 +154,6 @@ SecPolicyGetTypeID(void) OSStatus SecPolicyGetOID(SecPolicyRef policyRef, CSSM_OID* oid) { -#if !SECTRUST_OSX - BEGIN_SECAPI - Required(oid) = Policy::required(policyRef)->oid(); - END_SECAPI -#else /* bridge to support old functionality */ if (!policyRef) { return errSecParam; @@ -223,21 +163,21 @@ SecPolicyGetOID(SecPolicyRef policyRef, CSSM_OID* oid) return errSecParam; // bad policy ref? } CSSM_OID *oidptr = NULL; - unsigned int i, oidmaplen = sizeof(oidmap) / sizeof(oidmap_entry_t); - for (i=0; ivalue(); - END_SECAPI -#else /* bridge to support old functionality */ #if SECTRUST_DEPRECATION_WARNINGS syslog(LOG_ERR, "WARNING: SecPolicyGetValue was deprecated in 10.7. Please use SecPolicyCopyProperties instead."); @@ -357,7 +289,7 @@ SecPolicyGetValue(SecPolicyRef policyRef, CSSM_DATA* value) (const void **)&name) && name) { break; } - if (CFDictionaryGetValueIfPresent(options, CFSTR("email") /*kSecPolicyCheckEmail*/, + if (CFDictionaryGetValueIfPresent(options, CFSTR("Email") /*kSecPolicyCheckEmail*/, (const void **)&name) && name) { break; } @@ -374,39 +306,12 @@ SecPolicyGetValue(SecPolicyRef policyRef, CSSM_DATA* value) value->Length = 0; } return errSecSuccess; -#endif } -#if !SECTRUST_OSX -CFDictionaryRef -SecPolicyCopyProperties(SecPolicyRef policyRef) -{ - /* can't use SECAPI macros, since this function does not return OSStatus */ - CFDictionaryRef result = NULL; - try { - result = Policy::required(policyRef)->properties(); - } - catch (...) { - if (result) { - CFRelease(result); - result = NULL; - } - }; - return result; -} -#endif - /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */ OSStatus SecPolicySetValue(SecPolicyRef policyRef, const CSSM_DATA *value) { -#if !SECTRUST_OSX - BEGIN_SECAPI - Required(value); - const CssmData newValue(value->Data, value->Length); - Policy::required(policyRef)->setValue(newValue); - END_SECAPI -#else /* bridge to support old functionality */ #if SECTRUST_DEPRECATION_WARNINGS syslog(LOG_ERR, "WARNING: SecPolicySetValue was deprecated in 10.7. Please use SecPolicySetProperties instead."); @@ -417,7 +322,6 @@ SecPolicySetValue(SecPolicyRef policyRef, const CSSM_DATA *value) OSStatus status = errSecSuccess; CFDataRef data = NULL; CFStringRef name = NULL; - CFNumberRef cnum = NULL; CFStringRef oid = (CFStringRef) SecPolicyGetOidString(policyRef); if (!oid) { syslog(LOG_ERR, "SecPolicySetValue: unknown policy OID"); @@ -489,27 +393,27 @@ SecPolicySetValue(SecPolicyRef policyRef, const CSSM_DATA *value) CSSM_APPLE_TP_CRL_OPTIONS *opts = (CSSM_APPLE_TP_CRL_OPTIONS *)value->Data; if (opts->Version == CSSM_APPLE_TP_CRL_OPTS_VERSION) { CSSM_APPLE_TP_CRL_OPT_FLAGS crlFlags = opts->CrlFlags; - CFOptionFlags revocationFlags = 0; if ((crlFlags & CSSM_TP_ACTION_FETCH_CRL_FROM_NET) == 0) { /* disable network access */ - revocationFlags |= kSecRevocationNetworkAccessDisabled; + SecPolicySetOptionsValue(policyRef, CFSTR("NoNetworkAccess") /*kSecPolicyCheckNoNetworkAccess*/, kCFBooleanTrue); } if ((crlFlags & CSSM_TP_ACTION_CRL_SUFFICIENT) == 0) { - /* if OCSP method is not sufficient, must use CRL */ - revocationFlags |= (kSecRevocationCRLMethod | kSecRevocationPreferCRL); + /* if CRL method is not sufficient, must use OCSP */ + SecPolicySetOptionsValue(policyRef, CFSTR("Revocation") /*kSecPolicyCheckRevocation*/, + CFSTR("OCSP")/*kSecPolicyCheckRevocationOCSP*/); } else { /* either method is sufficient */ - revocationFlags |= kSecRevocationUseAnyAvailableMethod; + SecPolicySetOptionsValue(policyRef, CFSTR("Revocation") /*kSecPolicyCheckRevocation*/, + CFSTR("AnyRevocationMethod") /*kSecPolicyCheckRevocationAny*/); } + if ((crlFlags & CSSM_TP_ACTION_REQUIRE_CRL_PER_CERT) != 0) { /* require a response */ - revocationFlags |= kSecRevocationRequirePositiveResponse; - } - cnum = CFNumberCreate(kCFAllocatorDefault, kCFNumberCFIndexType, &revocationFlags); - if (cnum) { - SecPolicySetOptionsValue(policyRef, kSecPolicyRevocationFlags, cnum); + SecPolicySetOptionsValue(policyRef, + CFSTR("RevocationResponseRequired") /*kSecPolicyCheckRevocationResponseRequired*/, + kCFBooleanTrue); } - } + } } else { syslog(LOG_ERR, "SecPolicySetValue: unrecognized policy OID"); @@ -517,119 +421,28 @@ SecPolicySetValue(SecPolicyRef policyRef, const CSSM_DATA *value) } if (data) { CFRelease(data); } if (name) { CFRelease(name); } - if (cnum) { CFRelease(cnum); } return status; -#endif -} - -#if !SECTRUST_OSX -OSStatus -SecPolicySetProperties(SecPolicyRef policyRef, CFDictionaryRef properties) -{ - BEGIN_SECAPI - Policy::required(policyRef)->setProperties(properties); - END_SECAPI } -#endif /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_2, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */ OSStatus SecPolicyGetTPHandle(SecPolicyRef policyRef, CSSM_TP_HANDLE* tpHandle) { -#if !SECTRUST_OSX - BEGIN_SECAPI - Required(tpHandle) = Policy::required(policyRef)->tp()->handle(); - END_SECAPI -#else /* this function is unsupported in unified SecTrust */ #if SECTRUST_DEPRECATION_WARNINGS syslog(LOG_ERR, "WARNING: SecPolicyGetTPHandle was deprecated in 10.7, and does nothing in 10.11. Please stop using it."); #endif return errSecServiceNotAvailable; -#endif -} - -/* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_3, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */ -OSStatus -SecPolicyCopyAll(CSSM_CERT_TYPE certificateType, CFArrayRef* policies) -{ -#if !SECTRUST_OSX - BEGIN_SECAPI - Required(policies); - CFMutableArrayRef currPolicies = NULL; - currPolicies = CFArrayCreateMutable(NULL, 0, NULL); - if ( currPolicies ) - { - SecPointer cursor(new PolicyCursor(NULL, NULL)); - SecPointer policy; - while ( cursor->next(policy) ) /* copies the next policy */ - { - CFArrayAppendValue(currPolicies, policy->handle()); /* 'SecPolicyRef' appended */ - CFRelease(policy->handle()); /* refcount bumped up when appended to array */ - } - *policies = CFArrayCreateCopy(NULL, currPolicies); - CFRelease(currPolicies); - CFRelease(cursor->handle()); - } - END_SECAPI -#else - /* bridge to support old functionality */ -#if SECTRUST_DEPRECATION_WARNINGS - syslog(LOG_ERR, "WARNING: SecPolicyCopyAll was deprecated in 10.7. Please use SecPolicy creation functions instead."); -#endif - if (!policies) { - return errSecParam; - } - CFMutableArrayRef curPolicies = CFArrayCreateMutable(NULL, 0, NULL); - if (!curPolicies) { - return errSecAllocate; - } - /* build the subset of policies which were supported on OS X, - and which are also implemented on iOS */ - CFStringRef supportedPolicies[] = { - kSecPolicyAppleX509Basic, /* CSSMOID_APPLE_X509_BASIC */ - kSecPolicyAppleSSL, /* CSSMOID_APPLE_TP_SSL */ - kSecPolicyAppleSMIME, /* CSSMOID_APPLE_TP_SMIME */ - kSecPolicyAppleEAP, /*CSSMOID_APPLE_TP_EAP */ - kSecPolicyAppleSWUpdateSigning, /* CSSMOID_APPLE_TP_SW_UPDATE_SIGNING */ - kSecPolicyAppleIPsec, /* CSSMOID_APPLE_TP_IP_SEC */ - kSecPolicyAppleCodeSigning, /* CSSMOID_APPLE_TP_CODE_SIGNING */ - kSecPolicyMacAppStoreReceipt, /* CSSMOID_APPLE_TP_MACAPPSTORE_RECEIPT */ - kSecPolicyAppleIDValidation, /* CSSMOID_APPLE_TP_APPLEID_SHARING */ - kSecPolicyAppleTimeStamping, /* CSSMOID_APPLE_TP_TIMESTAMPING */ - kSecPolicyAppleRevocation, /* CSSMOID_APPLE_TP_REVOCATION_{CRL,OCSP} */ - NULL - }; - CFIndex ix = 0; - while (true) { - CFStringRef policyID = supportedPolicies[ix++]; - if (!policyID) { - break; - } - SecPolicyRef curPolicy = SecPolicyCreateWithProperties(policyID, NULL); - if (curPolicy) { - CFArrayAppendValue(curPolicies, curPolicy); - CFRelease(curPolicy); - } - } - *policies = CFArrayCreateCopy(NULL, curPolicies); - CFRelease(curPolicies); - return errSecSuccess; -#endif } /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_3, __MAC_10_7, __IPHONE_NA, __IPHONE_NA) */ OSStatus SecPolicyCopy(CSSM_CERT_TYPE certificateType, const CSSM_OID *policyOID, SecPolicyRef* policy) { -#if !SECTRUST_OSX - Required(policy); - Required(policyOID); -#else if (!policyOID || !policy) { return errSecParam; } -#endif + SecPolicySearchRef srchRef = NULL; OSStatus ortn; @@ -646,9 +459,6 @@ SecPolicyCopy(CSSM_CERT_TYPE certificateType, const CSSM_OID *policyOID, SecPoli SecPolicyRef SecPolicyCreateItemImplInstance(SecPolicyRef policy) { -#if !SECTRUST_OSX - return (SecPolicyRef)(policy ? CFRetain(policy) : NULL); -#else if (!policy) { return NULL; } @@ -672,87 +482,7 @@ SecPolicyCreateItemImplInstance(SecPolicyRef policy) CFRelease(properties); } return policyRef; -#endif -} - -#if !SECTRUST_OSX -/* new in 10.6 */ -SecPolicyRef -SecPolicyCreateBasicX509(void) -{ - // return a SecPolicyRef object for the X.509 Basic policy - SecPolicyRef policy = nil; - SecPolicySearchRef policySearch = nil; - OSStatus status = SecPolicySearchCreate(CSSM_CERT_X_509v3, &CSSMOID_APPLE_X509_BASIC, NULL, &policySearch); - if (!status) { - status = SecPolicySearchCopyNext(policySearch, &policy); - } - if (policySearch) { - CFRelease(policySearch); - } - return policy; -} -#endif - -#if !SECTRUST_OSX -/* new in 10.6 */ -SecPolicyRef -SecPolicyCreateSSL(Boolean server, CFStringRef hostname) -{ - // return a SecPolicyRef object for the SSL policy, given hostname and client options - SecPolicyRef policy = nil; - SecPolicySearchRef policySearch = nil; - OSStatus status = SecPolicySearchCreate(CSSM_CERT_X_509v3, &CSSMOID_APPLE_TP_SSL, NULL, &policySearch); - if (!status) { - status = SecPolicySearchCopyNext(policySearch, &policy); - } - if (!status && policy) { - // set options for client-side or server-side policy evaluation - char *strbuf = NULL; - const char *hostnamestr = NULL; - if (hostname) { - hostnamestr = CFStringGetCStringPtr(hostname, kCFStringEncodingUTF8); - if (hostnamestr == NULL) { - CFIndex maxLen = CFStringGetMaximumSizeForEncoding(CFStringGetLength(hostname), kCFStringEncodingUTF8) + 1; - strbuf = (char *)malloc(maxLen); - if (CFStringGetCString(hostname, strbuf, maxLen, kCFStringEncodingUTF8)) { - hostnamestr = strbuf; - } - } - } - uint32 hostnamelen = (hostnamestr) ? (uint32)strlen(hostnamestr) : 0; - uint32 flags = (!server) ? CSSM_APPLE_TP_SSL_CLIENT : 0; - CSSM_APPLE_TP_SSL_OPTIONS opts = {CSSM_APPLE_TP_SSL_OPTS_VERSION, hostnamelen, hostnamestr, flags}; - CSSM_DATA data = {sizeof(opts), (uint8*)&opts}; - SecPolicySetValue(policy, &data); - - if (strbuf) { - free(strbuf); - } - } - if (policySearch) { - CFRelease(policySearch); - } - return policy; -} -#endif - -#if !SECTRUST_OSX -/* not exported */ -static SecPolicyRef -SecPolicyCreateWithSecAsn1Oid(SecAsn1Oid *oidPtr) -{ - SecPolicyRef policy = NULL; - try { - SecPointer policyObj; - PolicyCursor::policy(oidPtr, policyObj); - policy = policyObj->handle(); - } - catch (...) {} - - return policy; } -#endif static SecPolicyRef _SecPolicyCreateWithOID(CFTypeRef policyOID) @@ -764,11 +494,11 @@ _SecPolicyCreateWithOID(CFTypeRef policyOID) if (!oidStr) { return policy; } - unsigned int i, oidmaplen = sizeof(oidmap) / sizeof(oidmap_entry_t); - for (i=0; i /* New in 10.10 */ @@ -955,52 +540,35 @@ SecPolicyRef SecPolicyCreateAppleSSLService(CFStringRef hostname) CFArrayRef SecPolicyCreateAppleTimeStampingAndRevocationPolicies(CFTypeRef policyOrArray) { -#if !SECTRUST_OSX - /* can't use SECAPI macros, since this function does not return OSStatus */ - CFArrayRef resultPolicyArray=NULL; - try { - // Set default policy - CFRef policyArray = cfArrayize(policyOrArray); - CFRef defaultPolicy = _SecPolicyCreateWithOID(kSecPolicyAppleTimeStamping); - CFRef appleTimeStampingPolicies = makeCFMutableArray(1,defaultPolicy.get()); - - // Parse the policy and add revocation related ones - CFIndex numPolicies = CFArrayGetCount(policyArray); - for(CFIndex dex=0; dex pol = Policy::required(SecPolicyRef(secPol)); - const CssmOid &oid = pol->oid(); - if ((oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION)) - || (oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_CRL)) - || (oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_OCSP))) - { - CFArrayAppendValue(appleTimeStampingPolicies, secPol); - } - } - // Transfer of ownership - resultPolicyArray=appleTimeStampingPolicies.yield(); - } - catch (...) { - syslog(LOG_ERR, "SecPolicyCreateAppleTimeStampingAndRevocationPolicies: unable to create policy array"); - CFReleaseNull(resultPolicyArray); - }; -#else - /* implement with unified SecPolicyRef instances */ - /* %%% FIXME revisit this since SecPolicyCreateWithOID is OSX-only; */ - /* should use SecPolicyCreateWithProperties instead */ - SecPolicyRef policy = NULL; CFMutableArrayRef resultPolicyArray = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks); - policy = SecPolicyCreateWithOID(kSecPolicyAppleTimeStamping); - if (policy) { - CFArrayAppendValue(resultPolicyArray, policy); - CFReleaseNull(policy); + if (!resultPolicyArray) { + return NULL; } - policy = SecPolicyCreateWithOID(kSecPolicyAppleRevocation); - if (policy) { - CFArrayAppendValue(resultPolicyArray, policy); - CFReleaseNull(policy); + SecPolicyRef tsPolicy = SecPolicyCreateWithProperties(kSecPolicyAppleTimeStamping, NULL); + if (tsPolicy) { + CFArrayAppendValue(resultPolicyArray, tsPolicy); + CFReleaseNull(tsPolicy); } -#endif + + /* check the provided argument for a revocation policy */ + CFMutableArrayRef policies = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks); + if (policies && policyOrArray) { + if (CFGetTypeID(policyOrArray) == SecPolicyGetTypeID()) { + CFArrayAppendValue(policies, policyOrArray); + } else if (CFGetTypeID(policyOrArray) == CFArrayGetTypeID()) { + CFIndex arrayLength = CFArrayGetCount((CFArrayRef)policyOrArray); + CFArrayAppendArray(policies, (CFArrayRef)policyOrArray, CFRangeMake(0, arrayLength)); + } + } + CFIndex numPolicies = (policies) ? CFArrayGetCount(policies) : 0; + for (CFIndex index=0; index