1  /*
   2   * Copyright (c) 2006-2014 Apple Inc. All Rights Reserved.
   3   *
   4   * @APPLE_LICENSE_HEADER_START@
   5   * 
   6   * This file contains Original Code and/or Modifications of Original Code
   7   * as defined in and that are subject to the Apple Public Source License
   8   * Version 2.0 (the 'License'). You may not use this file except in
   9   * compliance with the License. Please obtain a copy of the License at
  10   * http://www.opensource.apple.com/apsl/ and read it before using this
  11   * file.
  12   * 
  13   * The Original Code and all software distributed under the License are
  14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18   * Please see the License for the specific language governing rights and
  19   * limitations under the License.
  20   * 
  21   * @APPLE_LICENSE_HEADER_END@
  22   */
  23  
  24  /*
  25   * CMSDecoder.cpp - Interface for decoding CMS messages.
  26   */
  27  
  28  #include <Security/CMSDecoder.h>
  29  #include <Security/CMSPrivate.h>
  30  #include "CMSUtils.h"
  31  #include <../libsecurity_codesigning/lib/csutilities.h>
  32  
  33  #include <Security/SecCmsDecoder.h>
  34  #include <Security/SecCmsEnvelopedData.h>
  35  #include <Security/SecCmsMessage.h>
  36  #include <Security/SecCmsSignedData.h>
  37  #include <Security/SecCmsSignerInfo.h>
  38  #include <Security/SecCmsContentInfo.h>
  39  #include <Security/SecCmsDigestContext.h>
  40  #include <Security/SecCertificate.h>
  41  #include <Security/SecSMIME.h>
  42  #include <Security/oidsattr.h>
  43  #include <Security/SecTrustPriv.h>
  44  #include <CoreFoundation/CFRuntime.h>
  45  #include <utilities/SecCFWrappers.h>
  46  #include <pthread.h>
  47  #include <syslog.h>
  48  #include <AssertMacros.h>
  49  
  50  #pragma mark --- Private types and definitions ---
  51  
  52  /*
  53   * Decoder state.
  54   */
  55  typedef enum {
  56  	DS_Init,		/* between CMSDecoderCreate and CMSDecoderUpdateMessage */
  57  	DS_Updating,	/* between first CMSDecoderUpdateMessage and CMSDecoderFinalizeMessage */
  58  	DS_Final		/* CMSDecoderFinalizeMessage has been called */
  59  } CMSDecoderState;
  60  
  61  /*
  62   * Caller's CMSDecoderRef points to one of these.
  63   */
  64  struct _CMSDecoder {
  65  	CFRuntimeBase		base;
  66  	CMSDecoderState		decState;
  67  	SecArenaPoolRef		arena;				/* the decoder's arena */
  68  	SecCmsDecoderRef	decoder;
  69  	CFDataRef			detachedContent;
  70  	CFTypeRef			keychainOrArray;	/* unused */
  71  	
  72  	/*
  73  	 * The following are valid (and quiescent) after CMSDecoderFinalizeMessage().
  74  	 */
  75  	SecCmsMessageRef	cmsMsg;
  76  	Boolean				wasEncrypted;	/* valid after CMSDecoderFinalizeMessage() */
  77  	SecCmsSignedDataRef	signedData;		/* if there is one... */
  78  	/* only non-NULL if we found a signedData */
  79  	size_t				numSigners;
  80  	CSSM_OID			*eContentType;
  81  	/* etc. */
  82  };
  83  
  84  static void cmsDecoderInit(CFTypeRef dec);
  85  static void cmsDecoderFinalize(CFTypeRef dec);
  86  
  87  static CFRuntimeClass cmsDecoderRuntimeClass =
  88  {
  89  	0,			/* version */
  90  	"CMSDecoder",
  91  	cmsDecoderInit,
  92  	NULL,		/* copy */
  93  	cmsDecoderFinalize,
  94  	NULL,		/* equal - just use pointer equality */
  95  	NULL,		/* hash, ditto */
  96  	NULL,		/* copyFormattingDesc */
  97  	NULL		/* copyDebugDesc */
  98  };
  99  
 100  #pragma mark --- Private Routines ---
 101  
 102  static CFTypeID cmsDecoderTypeID = _kCFRuntimeNotATypeID;
 103  
 104  /* one time only class init, called via pthread_once() in CMSDecoderGetTypeID() */
 105  static void cmsDecoderClassInitialize(void)
 106  {
 107  	cmsDecoderTypeID =
 108      _CFRuntimeRegisterClass((const CFRuntimeClass * const)&cmsDecoderRuntimeClass);
 109  }
 110  
 111  /* init called out from _CFRuntimeCreateInstance() */
 112  static void cmsDecoderInit(CFTypeRef dec)
 113  {
 114  	char *start = ((char *)dec) + sizeof(CFRuntimeBase);
 115  	memset(start, 0, sizeof(struct _CMSDecoder) - sizeof(CFRuntimeBase));
 116  }
 117  
 118  /*
 119   * Dispose of a CMSDecoder. Called out from CFRelease().
 120   */
 121  static void cmsDecoderFinalize(
 122                                 CFTypeRef		dec)
 123  {
 124  	CMSDecoderRef cmsDecoder = (CMSDecoderRef)dec;
 125  	if(cmsDecoder == NULL) {
 126  		return;
 127  	}
 128  	if(cmsDecoder->decoder != NULL) {
 129  		/*
 130  		 * Normally this gets freed in SecCmsDecoderFinish - this is
 131  		 * an error case. Unlike Finish, this calls SecCmsMessageDestroy.
 132  		 */
 133  		SecCmsDecoderDestroy(cmsDecoder->decoder);
 134  		cmsDecoder->cmsMsg = NULL;
 135  	}
 136  	CFRELEASE(cmsDecoder->detachedContent);
 137  	CFRELEASE(cmsDecoder->keychainOrArray);
 138  	if(cmsDecoder->cmsMsg != NULL) {
 139  		SecCmsMessageDestroy(cmsDecoder->cmsMsg);
 140  		cmsDecoder->cmsMsg = NULL;
 141  	}
 142  	if(cmsDecoder->arena != NULL) {
 143  		SecArenaPoolFree(cmsDecoder->arena, false);
 144  		cmsDecoder->arena = NULL;
 145  	}
 146  }
 147  
 148  
 149  /*
 150   * Given detached content and a valid (decoded) SignedData, digest the detached
 151   * content. This occurs at the later of {CMSDecoderFinalizeMessage() finding a
 152   * SignedData when already have detachedContent, or CMSDecoderSetDetachedContent()
 153   * when we already have a SignedData).
 154   */
 155  static OSStatus cmsDigestDetachedContent(
 156                                           CMSDecoderRef cmsDecoder)
 157  {
 158  	ASSERT((cmsDecoder->signedData != NULL) && (cmsDecoder->detachedContent != NULL));
 159  	
 160  	SECAlgorithmID **digestAlgorithms = SecCmsSignedDataGetDigestAlgs(cmsDecoder->signedData);
 161  	if(digestAlgorithms == NULL) {
 162  		return errSecUnknownFormat;
 163  	}
 164  	SecCmsDigestContextRef digcx = SecCmsDigestContextStartMultiple(digestAlgorithms);
 165  	if(digcx == NULL) {
 166  		return errSecAllocate;
 167  	}
 168  	CSSM_DATA **digests = NULL;
 169  	
 170  	SecCmsDigestContextUpdate(digcx, CFDataGetBytePtr(cmsDecoder->detachedContent),
 171                                CFDataGetLength(cmsDecoder->detachedContent));
 172  	/* note this frees the digest content regardless */
 173  	OSStatus ortn = SecCmsDigestContextFinishMultiple(digcx, cmsDecoder->arena, &digests);
 174  	if(ortn) {
 175  		ortn = cmsRtnToOSStatus(ortn);
 176  		CSSM_PERROR("SecCmsDigestContextFinishMultiple", ortn);
 177  		return ortn;
 178  	}
 179  	ortn = SecCmsSignedDataSetDigests(cmsDecoder->signedData, digestAlgorithms, digests);
 180  	if(ortn) {
 181  		ortn = cmsRtnToOSStatus(ortn);
 182  		CSSM_PERROR("SecCmsSignedDataSetDigests", ortn);
 183  	}
 184  	return ortn;
 185  }
 186  
 187  #pragma mark --- Start of Public API ---
 188  
 189  CFTypeID CMSDecoderGetTypeID(void)
 190  {
 191  	static pthread_once_t once = PTHREAD_ONCE_INIT;
 192  	
 193  	if(cmsDecoderTypeID == _kCFRuntimeNotATypeID) {
 194  		pthread_once(&once, &cmsDecoderClassInitialize);
 195  	}
 196  	return cmsDecoderTypeID;
 197  }
 198  
 199  /*
 200   * Create a CMSDecoder. Result must eventually be freed via CFRelease().
 201   */
 202  OSStatus CMSDecoderCreate(
 203                            CMSDecoderRef		*cmsDecoderOut)	/* RETURNED */
 204  {
 205  	CMSDecoderRef cmsDecoder = NULL;
 206      
 207  	uint32_t extra = sizeof(*cmsDecoder) - sizeof(cmsDecoder->base);
 208  	cmsDecoder = (CMSDecoderRef)_CFRuntimeCreateInstance(NULL, CMSDecoderGetTypeID(),
 209                                                           extra, NULL);
 210  	if(cmsDecoder == NULL) {
 211  		return errSecAllocate;
 212  	}
 213  	cmsDecoder->decState = DS_Init;
 214  	*cmsDecoderOut = cmsDecoder;
 215  	return errSecSuccess;
 216  }
 217  
 218  /*
 219   * Feed raw bytes of the message to be decoded into the decoder. Can be called
 220   * multiple times.
 221   */
 222  OSStatus CMSDecoderUpdateMessage(
 223                                   CMSDecoderRef		cmsDecoder,
 224                                   const void			*msgBytes,
 225                                   size_t				msgBytesLen)
 226  {
 227  	if(cmsDecoder == NULL) {
 228  		return errSecParam;
 229  	}
 230  	
 231  	OSStatus ortn;
 232  	switch(cmsDecoder->decState) {
 233  		case DS_Init:
 234  			/* First time through; set up */
 235  			ASSERT(cmsDecoder->decoder == NULL);
 236  			ASSERT(cmsDecoder->arena == NULL);
 237  			ortn = SecArenaPoolCreate(1024, &cmsDecoder->arena);
 238  			if(ortn) {
 239  				return cmsRtnToOSStatus(ortn);
 240  			}
 241  			ortn = SecCmsDecoderCreate(cmsDecoder->arena,
 242                                         NULL, NULL, NULL, NULL, NULL, NULL, &cmsDecoder->decoder);
 243  			if(ortn) {
 244  				ortn = cmsRtnToOSStatus(ortn);
 245  				CSSM_PERROR("SecCmsDecoderCreate", ortn);
 246  				return ortn;
 247  			}
 248  			cmsDecoder->decState = DS_Updating;
 249  			break;
 250              
 251  		case DS_Updating:
 252  			ASSERT(cmsDecoder->decoder != NULL);
 253  			break;
 254  			
 255  		case DS_Final:
 256  			/* Too late for another update */
 257  			return errSecParam;
 258  			
 259  		default:
 260  			dprintf("CMSDecoderUpdateMessage: bad decState\n");
 261  			return errSecInternalComponent;
 262  	}
 263  	
 264  	/* FIXME - CFIndex same size as size_t on 64bit? */
 265  	ortn = SecCmsDecoderUpdate(cmsDecoder->decoder, msgBytes, (CFIndex)msgBytesLen);
 266  	if(ortn) {
 267  		ortn = cmsRtnToOSStatus(ortn, errSecUnknownFormat);
 268  		CSSM_PERROR("SecCmsDecoderUpdate", ortn);
 269  	}
 270  	return ortn;
 271  }
 272  
 273  /*
 274   * Indicate that no more CMSDecoderUpdateMessage() calls are forthcoming;
 275   * finish decoding the message. We parse the message as best we can, up to
 276   * but not including verifying individual signerInfos.
 277   */
 278  OSStatus CMSDecoderFinalizeMessage(
 279                                     CMSDecoderRef		cmsDecoder)
 280  {
 281  	if(cmsDecoder == NULL) {
 282  		return errSecParam;
 283  	}
 284  	if(cmsDecoder->decState != DS_Updating) {
 285  		return errSecParam;
 286  	}
 287  	ASSERT(cmsDecoder->decoder != NULL);
 288  	OSStatus ortn = SecCmsDecoderFinish(cmsDecoder->decoder, &cmsDecoder->cmsMsg);
 289  	cmsDecoder->decState = DS_Final;
 290  	
 291  	/* SecCmsDecoderFinish destroyed the decoder even on failure */
 292  	cmsDecoder->decoder = NULL;
 293  	
 294  	if(ortn) {
 295  		ortn = cmsRtnToOSStatus(ortn, errSecUnknownFormat);
 296  		CSSM_PERROR("SecCmsDecoderFinish", ortn);
 297  		return ortn;
 298  	}
 299  	
 300  	ASSERT(cmsDecoder->cmsMsg != NULL);
 301  	cmsDecoder->wasEncrypted = SecCmsMessageIsEncrypted(cmsDecoder->cmsMsg);
 302  	
 303  	/* Look for a SignedData */
 304  	int numContentInfos = SecCmsMessageContentLevelCount(cmsDecoder->cmsMsg);
 305  	int dex;
 306  	for(dex=0; dex<numContentInfos; dex++) {
 307  		SecCmsContentInfoRef ci = SecCmsMessageContentLevel(cmsDecoder->cmsMsg, dex);
 308  		SECOidTag tag = SecCmsContentInfoGetContentTypeTag(ci);
 309  		switch(tag) {
 310  			case SEC_OID_PKCS7_SIGNED_DATA:
 311  				cmsDecoder->signedData =
 312                  (SecCmsSignedDataRef)SecCmsContentInfoGetContent(ci);
 313  				/* dig down one more layer for eContentType */
 314  				ci = SecCmsSignedDataGetContentInfo(cmsDecoder->signedData);
 315  				if (ci) {
 316  					cmsDecoder->eContentType = SecCmsContentInfoGetContentTypeOID(ci);
 317  				}
 318  				break;
 319  			default:
 320  				break;
 321  		}
 322  		if(cmsDecoder->signedData != NULL) {
 323  			break;
 324  		}
 325          
 326  	}
 327  	
 328  	/* minimal processing of optional signedData... */
 329  	if(cmsDecoder->signedData != NULL) {
 330  		cmsDecoder->numSigners = (size_t)
 331          SecCmsSignedDataSignerInfoCount(cmsDecoder->signedData);
 332  		if(cmsDecoder->detachedContent != NULL) {
 333  			/* time to calculate digests from detached content */
 334  			ortn = cmsDigestDetachedContent(cmsDecoder);
 335  		}
 336  	}
 337  	return ortn;
 338  }
 339  
 340  /*
 341   * A signed CMS message optionally includes the data which was signed. If the
 342   * message does not include the signed data, caller specifies the signed data
 343   * (the "detached content") here.
 344   *
 345   * This can be called either before or after the actual decoding of the message
 346   * (via CMSDecoderUpdateMessage() and CMSDecoderFinalizeMessage()); the only
 347   * restriction is that, if detached content is required, this function must
 348   * be called befoere successfully ascertaining the signature status via
 349   * CMSDecoderCopySignerStatus().
 350   */
 351  OSStatus CMSDecoderSetDetachedContent(
 352                                        CMSDecoderRef		cmsDecoder,
 353                                        CFDataRef			detachedContent)
 354  {
 355  	if((cmsDecoder == NULL) || (detachedContent == NULL)) {
 356  		return errSecParam;
 357  	}
 358  	cmsDecoder->detachedContent = detachedContent;
 359  	CFRetain(detachedContent);
 360  	
 361  	if(cmsDecoder->signedData != NULL) {
 362  		/* time to calculate digests from detached content */
 363  		ASSERT(cmsDecoder->decState == DS_Final);
 364  		return cmsDigestDetachedContent(cmsDecoder);
 365  	}
 366  	return errSecSuccess;
 367  }
 368  
 369  /*
 370   * Obtain the detached content specified in CMSDecoderSetDetachedContent().
 371   * Returns a NULL detachedContent if no detached content has been specified.
 372   * Caller must CFRelease() the result.
 373   */
 374  OSStatus CMSDecoderCopyDetachedContent(
 375                                         CMSDecoderRef		cmsDecoder,
 376                                         CFDataRef			*detachedContent)		/* RETURNED */
 377  {
 378  	if((cmsDecoder == NULL) || (detachedContent == NULL)) {
 379  		return errSecParam;
 380  	}
 381  	if(cmsDecoder->detachedContent != NULL) {
 382  		CFRetain(cmsDecoder->detachedContent);
 383  	}
 384  	*detachedContent = cmsDecoder->detachedContent;
 385  	return errSecSuccess;
 386  }
 387  
 388  /*
 389   * Beginning in 10.12, this function stopped affecting the behavior of the
 390   * CMS Decoder. Its only use was in SecTrustSetKeychains which is a no-op.
 391   * Please discontinue use.
 392   */
 393  OSStatus CMSDecoderSetSearchKeychain(
 394                                       CMSDecoderRef		cmsDecoder,
 395                                       CFTypeRef			keychainOrArray)
 396  {
 397  	return errSecSuccess;
 398  }
 399  
 400  /*
 401   * Obtain the number of signers of a message. A result of zero indicates that
 402   * the message was not signed.
 403   */
 404  OSStatus CMSDecoderGetNumSigners(
 405                                   CMSDecoderRef		cmsDecoder,
 406                                   size_t				*numSigners)			/* RETURNED */
 407  {
 408  	if((cmsDecoder == NULL) || (numSigners == NULL)) {
 409  		return errSecParam;
 410  	}
 411  	if(cmsDecoder->decState != DS_Final) {
 412  		return errSecParam;
 413  	}
 414  	*numSigners = cmsDecoder->numSigners;
 415  	return errSecSuccess;
 416  }
 417  
 418  /*
 419   * Obtain the status of a CMS message's signature. A CMS message can
 420   * be signed my multiple signers; this function returns the status
 421   * associated with signer 'n' as indicated by the signerIndex parameter.
 422   */
 423  OSStatus CMSDecoderCopySignerStatus(
 424                                      CMSDecoderRef		cmsDecoder,
 425                                      size_t				signerIndex,
 426                                      CFTypeRef			policyOrArray,
 427                                      Boolean				evaluateSecTrust,
 428                                      CMSSignerStatus		*signerStatus,			/* optional; RETURNED */
 429                                      SecTrustRef			*secTrust,				/* optional; RETURNED */
 430                                      OSStatus			*certVerifyResultCode)	/* optional; RETURNED */
 431  {
 432  	if((cmsDecoder == NULL) || (cmsDecoder->decState != DS_Final) || (!policyOrArray) || !signerStatus) {
 433  		return errSecParam;
 434  	}
 435  	
 436  	/* initialize return values */
 437  	if(signerStatus) {
 438  		*signerStatus = kCMSSignerUnsigned;
 439  	}
 440  	if(secTrust) {
 441  		*secTrust = NULL;
 442  	}
 443  	if(certVerifyResultCode) {
 444  		*certVerifyResultCode = 0;
 445  	}
 446  	
 447  	if(cmsDecoder->signedData == NULL) {
 448  		*signerStatus = kCMSSignerUnsigned;	/* redundant, I know, but explicit */
 449  		return errSecSuccess;
 450  	}
 451  	ASSERT(cmsDecoder->numSigners > 0);
 452  	if(signerIndex >= cmsDecoder->numSigners) {
 453  		*signerStatus = kCMSSignerInvalidIndex;
 454  		return errSecSuccess;
 455  	}
 456  	if(!SecCmsSignedDataHasDigests(cmsDecoder->signedData)) {
 457  		*signerStatus = kCMSSignerNeedsDetachedContent;
 458  		return errSecSuccess;
 459  	}
 460  	
 461  	/*
 462  	 * OK, we should be able to verify this signerInfo.
 463  	 * I think we have to do the SecCmsSignedDataVerifySignerInfo first
 464  	 * in order get all the cert pieces into place before returning them
 465  	 * to the caller.
 466  	 */
 467  	SecTrustRef theTrust = NULL;
 468  	OSStatus vfyRtn = SecCmsSignedDataVerifySignerInfo(cmsDecoder->signedData,
 469                                                         (int)signerIndex,
 470                                                         NULL,
 471                                                         policyOrArray,
 472                                                         &theTrust);
 473  
 474  #if SECTRUST_VERBOSE_DEBUG
 475  	syslog(LOG_ERR, "CMSDecoderCopySignerStatus: SecCmsSignedDataVerifySignerInfo returned %d", (int)vfyRtn);
 476  	if (policyOrArray) CFShow(policyOrArray);
 477  	if (theTrust) CFShow(theTrust);
 478  #endif
 479  
 480      /* Subsequent errors to errOut: */
 481      
 482  	/*
 483  	 * NOTE the smime lib did NOT evaluate that SecTrust - it only does
 484  	 * SecTrustEvaluate() if we don't ask for a copy.
 485  	 *
 486  	 * FIXME deal with multitudes of status returns here...for now, proceed with
 487  	 * obtaining components the caller wants and assume that a nonzero vfyRtn
 488  	 * means "bad signature".
 489  	 */
 490  	OSStatus ortn = errSecSuccess;
 491  	SecTrustResultType secTrustResult;
 492  	CSSM_RETURN tpVfyStatus = CSSM_OK;
 493  	OSStatus evalRtn;
 494  	
 495  	if(secTrust != NULL) {
 496  		*secTrust = theTrust;
 497  		/* we'll release our reference at the end */
 498  		CFRetainSafe(theTrust);
 499  	}
 500  	SecCmsSignerInfoRef signerInfo =
 501      SecCmsSignedDataGetSignerInfo(cmsDecoder->signedData, (int)signerIndex);
 502  	if(signerInfo == NULL) {
 503  		/* should never happen */
 504  		ASSERT(0);
 505  		dprintf("CMSDecoderCopySignerStatus: no signerInfo\n");
 506  		ortn = errSecInternalComponent;
 507  		goto errOut;
 508  	}
 509      
 510  	/* now do the actual cert verify */
 511  	if(evaluateSecTrust) {
 512  		evalRtn = SecTrustEvaluate(theTrust, &secTrustResult);
 513  		if(evalRtn) {
 514  			/* should never happen */
 515  			CSSM_PERROR("SecTrustEvaluate", evalRtn);
 516  			dprintf("CMSDecoderCopySignerStatus: SecTrustEvaluate error\n");
 517  			ortn = errSecInternalComponent;
 518  			goto errOut;
 519  		}
 520  		switch(secTrustResult) {
 521  			case kSecTrustResultUnspecified:
 522  				/* cert chain valid, no special UserTrust assignments */
 523  			case kSecTrustResultProceed:
 524  				/* cert chain valid AND user explicitly trusts this */
 525  				break;
 526  			case kSecTrustResultDeny:
 527  				tpVfyStatus = CSSMERR_APPLETP_TRUST_SETTING_DENY;
 528  				break;
 529  			default:
 530  			{
 531  				/* get low-level TP error */
 532  				OSStatus tpStatus;
 533  				ortn = SecTrustGetCssmResultCode(theTrust, &tpStatus);
 534  				if(ortn) {
 535  					CSSM_PERROR("SecTrustGetCssmResultCode", ortn);
 536  				}
 537  				else {
 538  					tpVfyStatus = tpStatus;
 539  				}
 540  				CSSM_PERROR("TP status after SecTrustEvaluate", tpVfyStatus);
 541  				break;
 542  			}
 543  		} 	/* switch(secTrustResult) */
 544  	}		/* evaluateSecTrust true */
 545  	if(certVerifyResultCode != NULL) {
 546  		*certVerifyResultCode = tpVfyStatus;
 547  	}
 548  	
 549  	/* cook up global status based on vfyRtn and tpVfyStatus */
 550  	if(signerStatus != NULL) {
 551  		if((vfyRtn == errSecSuccess) && (tpVfyStatus == CSSM_OK))  {
 552  			*signerStatus = kCMSSignerValid;
 553  		}
 554  		else if(vfyRtn != errSecSuccess) {
 555  			/* this could mean other things, but for now... */
 556  			*signerStatus = kCMSSignerInvalidSignature;
 557  		}
 558  		else {
 559  			*signerStatus = kCMSSignerInvalidCert;
 560  		}
 561  	}
 562  errOut:
 563  	CFRELEASE(theTrust);
 564  	return ortn;
 565  }
 566  
 567  /*
 568   * Obtain the email address of signer 'signerIndex' of a CMS message, if
 569   * present.
 570   *
 571   * This cannot be called until after CMSDecoderFinalizeMessage() is called.
 572   */
 573  OSStatus CMSDecoderCopySignerEmailAddress(
 574                                            CMSDecoderRef		cmsDecoder,
 575                                            size_t				signerIndex,
 576                                            CFStringRef			*signerEmailAddress)	/* RETURNED */
 577  {
 578  	if((cmsDecoder == NULL) ||
 579  	   (signerEmailAddress == NULL) ||
 580  	   (cmsDecoder->signedData == NULL) ||			/* not signed */
 581  	   (signerIndex >= cmsDecoder->numSigners) ||	/* index out of range */
 582  	   (cmsDecoder->decState != DS_Final)) {
 583  		return errSecParam;
 584  	}
 585  	
 586  	SecCmsSignerInfoRef signerInfo =
 587      SecCmsSignedDataGetSignerInfo(cmsDecoder->signedData, (int)signerIndex);
 588  	if(signerInfo == NULL) {
 589  		/* should never happen */
 590  		ASSERT(0);
 591  		dprintf("CMSDecoderCopySignerEmailAddress: no signerInfo\n");
 592  		return errSecInternalComponent;
 593  	}
 594  	
 595  	/*
 596  	 * This is leaking memory in libsecurityKeychain per Radar 4412699.
 597  	 */
 598  	*signerEmailAddress = SecCmsSignerInfoGetSignerEmailAddress(signerInfo);
 599  	return errSecSuccess;
 600  }
 601  
 602  /*
 603   * Obtain the certificate of signer 'signerIndex' of a CMS message, if
 604   * present.
 605   *
 606   * This cannot be called until after CMSDecoderFinalizeMessage() is called.
 607   */
 608  OSStatus CMSDecoderCopySignerCert(
 609                                    CMSDecoderRef		cmsDecoder,
 610                                    size_t				signerIndex,
 611                                    SecCertificateRef	*signerCert)			/* RETURNED */
 612  {
 613  	if((cmsDecoder == NULL) ||
 614  	   (signerCert == NULL) ||
 615  	   (cmsDecoder->signedData == NULL) ||			/* not signed */
 616  	   (signerIndex >= cmsDecoder->numSigners) ||	/* index out of range */
 617  	   (cmsDecoder->decState != DS_Final)) {
 618  		return errSecParam;
 619  	}
 620      
 621  	SecCmsSignerInfoRef signerInfo =
 622      SecCmsSignedDataGetSignerInfo(cmsDecoder->signedData, (int)signerIndex);
 623  	if(signerInfo == NULL) {
 624  		/* should never happen */
 625  		ASSERT(0);
 626  		dprintf("CMSDecoderCopySignerCertificate: no signerInfo\n");
 627  		return errSecInternalComponent;
 628  	}
 629  	*signerCert = SecCmsSignerInfoGetSigningCertificate(signerInfo, NULL);
 630  	/* libsecurity_smime does NOT retain that */
 631  	if(*signerCert == NULL) {
 632  		/* should never happen */
 633  		ASSERT(0);
 634  		dprintf("CMSDecoderCopySignerCertificate: no signerCert\n");
 635  		return errSecInternalComponent;
 636  	}
 637  	CFRetain(*signerCert);
 638  	return errSecSuccess;
 639  }
 640  
 641  /*
 642   * Determine whether a CMS message was encrypted, and if so, whether we were
 643   * able to decrypt it.
 644   */
 645  OSStatus CMSDecoderIsContentEncrypted(
 646                                        CMSDecoderRef	cmsDecoder,
 647                                        Boolean			*wasEncrypted)
 648  {
 649  	if((cmsDecoder == NULL) || (wasEncrypted == NULL)) {
 650  		return errSecParam;
 651  	}
 652  	if(cmsDecoder->decState != DS_Final) {
 653  		return errSecParam;
 654  	}
 655  	*wasEncrypted = cmsDecoder->wasEncrypted;
 656  	return errSecSuccess;
 657  }
 658  
 659  /*
 660   * Obtain the eContentType OID for a SignedData's EncapsulatedContentType, if
 661   * present.
 662   */
 663  OSStatus CMSDecoderCopyEncapsulatedContentType(
 664                                                 CMSDecoderRef		cmsDecoder,
 665                                                 CFDataRef			*eContentType)		/* RETURNED */
 666  {
 667  	if((cmsDecoder == NULL) || (eContentType == NULL)) {
 668  		return errSecParam;
 669  	}
 670  	if(cmsDecoder->decState != DS_Final) {
 671  		return errSecParam;
 672  	}
 673  	if(cmsDecoder->signedData == NULL) {
 674  		*eContentType = NULL;
 675  	}
 676  	else {
 677  		CSSM_OID *ecOid = cmsDecoder->eContentType;
 678  		*eContentType = CFDataCreate(NULL, ecOid->Data, ecOid->Length);
 679  	}
 680  	return errSecSuccess;
 681  }
 682  
 683  /*
 684   * Obtain an array of all of the certificates in a message. Elements of the
 685   * returned array are SecCertificateRefs. The caller must CFRelease the returned
 686   * array.
 687   * This cannot be called until after CMSDecoderFinalizeMessage() is called.
 688   */
 689  OSStatus CMSDecoderCopyAllCerts(
 690                                  CMSDecoderRef		cmsDecoder,
 691                                  CFArrayRef			*certs)					/* RETURNED */
 692  {
 693  	if((cmsDecoder == NULL) || (certs == NULL)) {
 694  		return errSecParam;
 695  	}
 696  	if(cmsDecoder->decState != DS_Final) {
 697  		return errSecParam;
 698  	}
 699  	if(cmsDecoder->signedData == NULL) {
 700  		/* message wasn't signed */
 701  		*certs = NULL;
 702  		return errSecSuccess;
 703  	}
 704  	
 705  	/* NULL_terminated array of CSSM_DATA ptrs */
 706  	CSSM_DATA_PTR *cssmCerts = SecCmsSignedDataGetCertificateList(cmsDecoder->signedData);
 707  	if((cssmCerts == NULL) || (*cssmCerts == NULL)) {
 708  		*certs = NULL;
 709  		return errSecSuccess;
 710  	}
 711  	
 712  	CFMutableArrayRef allCerts = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
 713  	CSSM_DATA_PTR *cssmCert;
 714  	for(cssmCert=cssmCerts; *cssmCert!=NULL; cssmCert++) {
 715  		OSStatus ortn;
 716  		SecCertificateRef cfCert;
 717  		ortn = SecCertificateCreateFromData(*cssmCert,
 718                                              CSSM_CERT_X_509v3, CSSM_CERT_ENCODING_DER,
 719                                              &cfCert);
 720  		if(ortn) {
 721  			CFRelease(allCerts);
 722  			return ortn;
 723  		}
 724  		CFArrayAppendValue(allCerts, cfCert);
 725  		/* the array holds the only needed refcount */
 726  		CFRelease(cfCert);
 727  	}
 728  	*certs = allCerts;
 729  	return errSecSuccess;
 730  }
 731  
 732  /*
 733   * Obtain the actual message content (payload), if any. If the message was
 734   * signed with detached content this will return NULL.
 735   * Caller must CFRelease the result.
 736   */
 737  OSStatus CMSDecoderCopyContent(
 738                                 CMSDecoderRef		cmsDecoder,
 739                                 CFDataRef			*content)				/* RETURNED */
 740  {
 741  	if((cmsDecoder == NULL) || (content == NULL)) {
 742  		return errSecParam;
 743  	}
 744  	if(cmsDecoder->decState != DS_Final) {
 745  		return errSecParam;
 746  	}
 747  	if(cmsDecoder->cmsMsg == NULL) {
 748  		/* Hmmm....looks like the finalize call failed */
 749  		return errSecParam;
 750  	}
 751  	CSSM_DATA_PTR odata = SecCmsMessageGetContent(cmsDecoder->cmsMsg);
 752  	if((odata == NULL) || (odata->Length == 0)) {
 753  		/* i.e., detached content */
 754  		*content = NULL;
 755  		return errSecSuccess;
 756  	}
 757  	*content = CFDataCreate(NULL, (const UInt8 *)odata->Data, odata->Length);
 758  	return errSecSuccess;
 759  }
 760  
 761  #pragma mark --- SPI declared in CMSPrivate.h ---
 762  
 763  /*
 764   * Obtain the SecCmsMessageRef associated with a CMSDecoderRef. Intended
 765   * to be called after decoding the message (i.e., after
 766   * CMSDecoderFinalizeMessage() to gain finer access to the contents of the
 767   * SecCmsMessageRef than is otherwise available via the CMSDecoder interface.
 768   * Returns a NULL SecCmsMessageRef if CMSDecoderFinalizeMessage() has not been
 769   * called.
 770   *
 771   * The CMSDecoder retains ownership of the returned SecCmsMessageRef.
 772   */
 773  OSStatus CMSDecoderGetCmsMessage(
 774                                   CMSDecoderRef		cmsDecoder,
 775                                   SecCmsMessageRef	*cmsMessage)		/* RETURNED */
 776  {
 777  	if((cmsDecoder == NULL) || (cmsMessage == NULL)) {
 778  		return errSecParam;
 779  	}
 780  	/* any state, whether we have a msg or not is OK */
 781  	*cmsMessage = cmsDecoder->cmsMsg;
 782  	return errSecSuccess;
 783  }
 784  
 785  /*
 786   * Optionally specify a SecCmsDecoderRef to use with a CMSDecoderRef.
 787   * If this is called, it must be called before the first call to
 788   * CMSDecoderUpdateMessage(). The CMSDecoderRef takes ownership of the
 789   * incoming SecCmsDecoderRef.
 790   */
 791  OSStatus CMSDecoderSetDecoder(
 792                                CMSDecoderRef		cmsDecoder,
 793                                SecCmsDecoderRef	decoder)
 794  {
 795  	if((cmsDecoder == NULL) || (decoder == NULL)) {
 796  		return errSecParam;
 797  	}
 798  	switch(cmsDecoder->decState) {
 799  		case DS_Init:
 800  			ASSERT(cmsDecoder->decoder == NULL);
 801  			cmsDecoder->decoder = decoder;
 802  			cmsDecoder->decState = DS_Updating;
 803  			return errSecSuccess;
 804  		case DS_Updating:
 805  		case DS_Final:
 806  			return errSecParam;
 807  	}
 808  	return errSecSuccess;
 809  }
 810  
 811  /*
 812   * Obtain the SecCmsDecoderRef associated with a CMSDecoderRef.
 813   * Returns a NULL SecCmsDecoderRef if neither CMSDecoderSetDecoder() nor
 814   * CMSDecoderUpdateMessage() has been called.
 815   * The CMSDecoderRef retains ownership of the SecCmsDecoderRef.
 816   */
 817  OSStatus CMSDecoderGetDecoder(
 818                                CMSDecoderRef		cmsDecoder,
 819                                SecCmsDecoderRef	*decoder)			/* RETURNED */
 820  {
 821  	if((cmsDecoder == NULL) || (decoder == NULL)) {
 822  		return errSecParam;
 823  	}
 824  	/* any state, whether we have a decoder or not is OK */
 825  	*decoder = cmsDecoder->decoder;
 826  	return errSecSuccess;
 827  }
 828  
 829  /*
 830   * Obtain the signing time of signer 'signerIndex' of a CMS message, if
 831   * present. This is an unauthenticate time, although it is part of the
 832   * signed attributes of the message.
 833   *
 834   * Returns errSecParam if the CMS message was not signed or if signerIndex
 835   * is greater than the number of signers of the message minus one.
 836   *
 837   * This cannot be called until after CMSDecoderFinalizeMessage() is called.
 838   */
 839  OSStatus CMSDecoderCopySignerSigningTime(
 840                                           CMSDecoderRef		cmsDecoder,
 841                                           size_t				signerIndex,            /* usually 0 */
 842                                           CFAbsoluteTime      *signingTime)			/* RETURNED */
 843  {
 844      OSStatus status = errSecParam;
 845  	SecCmsMessageRef cmsg;
 846  	SecCmsSignedDataRef signedData = NULL;
 847      int numContentInfos = 0;
 848      
 849      require(cmsDecoder && signingTime, xit);
 850  	require_noerr(CMSDecoderGetCmsMessage(cmsDecoder, &cmsg), xit);
 851      numContentInfos = SecCmsMessageContentLevelCount(cmsg);
 852      for (int dex = 0; !signedData && dex < numContentInfos; dex++)
 853      {
 854          SecCmsContentInfoRef ci = SecCmsMessageContentLevel(cmsg, dex);
 855          SECOidTag tag = SecCmsContentInfoGetContentTypeTag(ci);
 856          if (tag == SEC_OID_PKCS7_SIGNED_DATA)
 857              if ((signedData = SecCmsSignedDataRef(SecCmsContentInfoGetContent(ci))))
 858                  if (SecCmsSignerInfoRef signerInfo = SecCmsSignedDataGetSignerInfo(signedData, (int)signerIndex))
 859                  {
 860                      status = SecCmsSignerInfoGetSigningTime(signerInfo, signingTime);
 861                      break;
 862                  }
 863      }
 864  xit:
 865      return status;
 866  }
 867  
 868  /*
 869   * Obtain the timestamp of signer 'signerIndex' of a CMS message, if
 870   * present. This timestamp is an authenticated timestamp provided by
 871   * a timestamping authority.
 872   *
 873   * Returns errSecParam if the CMS message was not signed or if signerIndex
 874   * is greater than the number of signers of the message minus one.
 875   *
 876   * This cannot be called until after CMSDecoderFinalizeMessage() is called.
 877   */
 878  
 879  OSStatus CMSDecoderCopySignerTimestamp(
 880                                         CMSDecoderRef		cmsDecoder,
 881                                         size_t				signerIndex,        /* usually 0 */
 882                                         CFAbsoluteTime      *timestamp)			/* RETURNED */
 883  {
 884      return CMSDecoderCopySignerTimestampWithPolicy(cmsDecoder, NULL, signerIndex, timestamp);
 885  }
 886  
 887  OSStatus CMSDecoderCopySignerTimestampWithPolicy(
 888                                         CMSDecoderRef		cmsDecoder,
 889                                         CFTypeRef            timeStampPolicy,
 890                                         size_t				signerIndex,        /* usually 0 */
 891                                         CFAbsoluteTime      *timestamp)			/* RETURNED */
 892  {
 893      OSStatus status = errSecParam;
 894  	SecCmsMessageRef cmsg;
 895  	SecCmsSignedDataRef signedData = NULL;
 896      int numContentInfos = 0;
 897      
 898      require(cmsDecoder && timestamp, xit);
 899  	require_noerr(CMSDecoderGetCmsMessage(cmsDecoder, &cmsg), xit);
 900      numContentInfos = SecCmsMessageContentLevelCount(cmsg);
 901      for (int dex = 0; !signedData && dex < numContentInfos; dex++)
 902      {
 903          SecCmsContentInfoRef ci = SecCmsMessageContentLevel(cmsg, dex);
 904          SECOidTag tag = SecCmsContentInfoGetContentTypeTag(ci);
 905          if (tag == SEC_OID_PKCS7_SIGNED_DATA)
 906              if ((signedData = SecCmsSignedDataRef(SecCmsContentInfoGetContent(ci))))
 907                  if (SecCmsSignerInfoRef signerInfo = SecCmsSignedDataGetSignerInfo(signedData, (int)signerIndex))
 908                  {
 909                      status = SecCmsSignerInfoGetTimestampTimeWithPolicy(signerInfo, timeStampPolicy, timestamp);
 910                      break;
 911                  }
 912      }
 913      
 914  xit:
 915      return status;
 916  }
 917  
 918  /*
 919   * Obtain an array of the certificates in a timestamp response. Elements of the
 920   * returned array are SecCertificateRefs. The caller must CFRelease the returned
 921   * array. This timestamp is an authenticated timestamp provided by
 922   * a timestamping authority.
 923   *
 924   * Returns errSecParam if the CMS message was not signed or if signerIndex
 925   * is greater than the number of signers of the message minus one. It returns
 926   * errSecItemNotFound if no certificates were found.
 927   *
 928   * This cannot be called until after CMSDecoderFinalizeMessage() is called. 
 929   */
 930  OSStatus CMSDecoderCopySignerTimestampCertificates(
 931                                                     CMSDecoderRef		cmsDecoder,
 932                                                     size_t				signerIndex,            /* usually 0 */
 933                                                     CFArrayRef          *certificateRefs)       /* RETURNED */
 934  {
 935      OSStatus status = errSecParam;
 936  	SecCmsMessageRef cmsg = NULL;
 937  	SecCmsSignedDataRef signedData = NULL;
 938      int numContentInfos = 0;
 939      CFIndex tsn = 0;
 940      bool good = false;
 941      
 942      require(cmsDecoder && certificateRefs, xit);
 943  	require_noerr(CMSDecoderGetCmsMessage(cmsDecoder, &cmsg), xit);
 944      numContentInfos = SecCmsMessageContentLevelCount(cmsg);
 945      for (int dex = 0; !signedData && dex < numContentInfos; dex++)
 946      {
 947          SecCmsContentInfoRef ci = SecCmsMessageContentLevel(cmsg, dex);
 948          SECOidTag tag = SecCmsContentInfoGetContentTypeTag(ci);
 949          if (tag == SEC_OID_PKCS7_SIGNED_DATA)
 950              if ((signedData = SecCmsSignedDataRef(SecCmsContentInfoGetContent(ci))))
 951                  if (SecCmsSignerInfoRef signerInfo = SecCmsSignedDataGetSignerInfo(signedData, (int)signerIndex))
 952                  {
 953                      CFArrayRef certList = SecCmsSignerInfoGetTimestampCertList(signerInfo);
 954                      require_action(certList, xit, status = errSecItemNotFound);
 955                      CFMutableArrayRef certs = CFArrayCreateMutableCopy(kCFAllocatorDefault, CFArrayGetCount(certList), certList);
 956                      
 957                      if(certs){
 958                          //reorder certificates:
 959                          tsn = CFArrayGetCount(certs);
 960                          good = tsn > 0 && Security::CodeSigning::isAppleCA(SecCertificateRef(CFArrayGetValueAtIndex(certs, tsn-1)));
 961                          
 962                          if ( good == false )
 963                          {
 964                              //change TS certificate ordering.
 965                              for (CFIndex n = 0; n < tsn; n++)
 966                              {
 967                                  if (SecCertificateRef tsRoot = SecCertificateRef(CFArrayGetValueAtIndex(certs, n)))
 968                                      if ((good = Security::CodeSigning::isAppleCA(tsRoot))) {
 969                                          CFArrayExchangeValuesAtIndices(certs, n, tsn-1);
 970                                          break;
 971                                      }
 972                              }
 973                          }
 974                          
 975                          *certificateRefs = CFArrayCreateCopy(kCFAllocatorDefault, certs);
 976                          CFRelease(certs);
 977                          status = errSecSuccess;
 978                      }
 979                      break;
 980                  }
 981      }
 982      
 983      
 984      xit:
 985          return status;
 986      }
 987  
 988  /*
 989   * Obtain the Hash Agility attribute value of signer 'signerIndex'
 990   * of a CMS message, if present.
 991   *
 992   * Returns errSecParam if the CMS message was not signed or if signerIndex
 993   * is greater than the number of signers of the message minus one.
 994   *
 995   * This cannot be called until after CMSDecoderFinalizeMessage() is called.
 996   */
 997  OSStatus CMSDecoderCopySignerAppleCodesigningHashAgility(
 998      CMSDecoderRef		cmsDecoder,
 999      size_t				signerIndex,            /* usually 0 */
1000      CFDataRef  CF_RETURNS_RETAINED *hashAgilityAttrValue)			/* RETURNED */
1001  {
1002      OSStatus status = errSecParam;
1003      SecCmsMessageRef cmsg;
1004      SecCmsSignedDataRef signedData = NULL;
1005      int numContentInfos = 0;
1006      CFDataRef returnedValue = NULL;
1007  
1008      require(cmsDecoder && hashAgilityAttrValue, exit);
1009      require_noerr(CMSDecoderGetCmsMessage(cmsDecoder, &cmsg), exit);
1010      numContentInfos = SecCmsMessageContentLevelCount(cmsg);
1011      for (int dex = 0; !signedData && dex < numContentInfos; dex++)
1012      {
1013          SecCmsContentInfoRef ci = SecCmsMessageContentLevel(cmsg, dex);
1014          SECOidTag tag = SecCmsContentInfoGetContentTypeTag(ci);
1015          if (tag == SEC_OID_PKCS7_SIGNED_DATA)
1016              if ((signedData = SecCmsSignedDataRef(SecCmsContentInfoGetContent(ci))))
1017                  if (SecCmsSignerInfoRef signerInfo = SecCmsSignedDataGetSignerInfo(signedData, (int)signerIndex))
1018                  {
1019                      status = SecCmsSignerInfoGetAppleCodesigningHashAgility(signerInfo, &returnedValue);
1020                      break;
1021                  }
1022      }
1023  exit:
1024      if (status == errSecSuccess && returnedValue) {
1025          *hashAgilityAttrValue = (CFDataRef) CFRetain(returnedValue);
1026      } else {
1027          *hashAgilityAttrValue = NULL;
1028      }
1029      return status;
1030  }
1031  
1032  /*
1033   * Obtain the Hash Agility V2 attribute value of signer 'signerIndex'
1034   * of a CMS message, if present.
1035   *
1036   * Returns errSecParam if the CMS message was not signed or if signerIndex
1037   * is greater than the number of signers of the message minus one.
1038   *
1039   * This cannot be called until after CMSDecoderFinalizeMessage() is called.
1040   */
1041  OSStatus CMSDecoderCopySignerAppleCodesigningHashAgilityV2(
1042      CMSDecoderRef        cmsDecoder,
1043      size_t                signerIndex,            /* usually 0 */
1044      CFDictionaryRef  CF_RETURNS_RETAINED *hashAgilityV2AttrValues)            /* RETURNED */
1045  {
1046      OSStatus status = errSecParam;
1047      SecCmsMessageRef cmsg;
1048      SecCmsSignedDataRef signedData = NULL;
1049      int numContentInfos = 0;
1050      CFDictionaryRef returnedValue = NULL;
1051  
1052      require(cmsDecoder && hashAgilityV2AttrValues, exit);
1053      require_noerr(CMSDecoderGetCmsMessage(cmsDecoder, &cmsg), exit);
1054      numContentInfos = SecCmsMessageContentLevelCount(cmsg);
1055      for (int dex = 0; !signedData && dex < numContentInfos; dex++)
1056      {
1057          SecCmsContentInfoRef ci = SecCmsMessageContentLevel(cmsg, dex);
1058          SECOidTag tag = SecCmsContentInfoGetContentTypeTag(ci);
1059          if (tag == SEC_OID_PKCS7_SIGNED_DATA)
1060              if ((signedData = (SecCmsSignedDataRef)SecCmsContentInfoGetContent(ci))) {
1061                  SecCmsSignerInfoRef signerInfo = SecCmsSignedDataGetSignerInfo(signedData, (int)signerIndex);
1062                  if (signerInfo)
1063                  {
1064                      status = SecCmsSignerInfoGetAppleCodesigningHashAgilityV2(signerInfo, &returnedValue);
1065                      break;
1066                  }
1067              }
1068      }
1069  exit:
1070      if (status == errSecSuccess && returnedValue) {
1071          *hashAgilityV2AttrValues = (CFDictionaryRef) CFRetain(returnedValue);
1072      } else {
1073          *hashAgilityV2AttrValues = NULL;
1074      }
1075      return status;
1076  }
1077  
1078  /*
1079   * Obtain the expiration time of signer 'signerIndex' of a CMS message, if
1080   * present. This is part of the signed attributes of the message.
1081   *
1082   * Returns errSecParam if the CMS message was not signed or if signerIndex
1083   * is greater than the number of signers of the message minus one.
1084   *
1085   * This cannot be called until after CMSDecoderFinalizeMessage() is called.
1086   */
1087  OSStatus CMSDecoderCopySignerAppleExpirationTime(
1088      CMSDecoderRef      cmsDecoder,
1089      size_t             signerIndex,
1090      CFAbsoluteTime     *expirationTime)            /* RETURNED */
1091  {
1092      OSStatus status = errSecParam;
1093      SecCmsMessageRef cmsg = NULL;
1094      int numContentInfos  = 0;
1095      SecCmsSignedDataRef signedData = NULL;
1096  
1097      require(cmsDecoder && expirationTime, xit);
1098      require_noerr(CMSDecoderGetCmsMessage(cmsDecoder, &cmsg), xit);
1099      numContentInfos = SecCmsMessageContentLevelCount(cmsg);
1100      for (int dex = 0; !signedData && dex < numContentInfos; dex++) {
1101          SecCmsContentInfoRef ci = SecCmsMessageContentLevel(cmsg, dex);
1102          SECOidTag tag = SecCmsContentInfoGetContentTypeTag(ci);
1103          if (tag == SEC_OID_PKCS7_SIGNED_DATA) {
1104              if ((signedData = (SecCmsSignedDataRef)SecCmsContentInfoGetContent(ci))) {
1105                  SecCmsSignerInfoRef signerInfo = SecCmsSignedDataGetSignerInfo(signedData, (int)signerIndex);
1106                  if (signerInfo) {
1107                      status = SecCmsSignerInfoGetAppleExpirationTime(signerInfo, expirationTime);
1108                      break;
1109                  }
1110              }
1111          }
1112      }
1113  xit:
1114      return status;
1115  }