1  /*
  2   * Copyright (c) 2002-2004,2011-2012,2014-2017 Apple Inc. All Rights Reserved.
  3   *
  4   * @APPLE_LICENSE_HEADER_START@
  5   *
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. Please obtain a copy of the License at
 10   * http://www.opensource.apple.com/apsl/ and read it before using this
 11   * file.
 12   *
 13   * The Original Code and all software distributed under the License are
 14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 18   * Please see the License for the specific language governing rights and
 19   * limitations under the License.
 20   *
 21   * @APPLE_LICENSE_HEADER_END@
 22   */
 23  
 24  /*
 25  * TrustRevocation.cpp - private revocation policy manipulation
 26  */
 27  
 28  #include <security_keychain/Trust.h>
 29  #include <security_utilities/cfutilities.h>
 30  #include <security_utilities/simpleprefs.h>
 31  #include <CoreFoundation/CFData.h>
 32  #include "SecBridge.h"
 33  #include <Security/cssmapplePriv.h>
 34  #include <Security/oidsalg.h>
 35  
 36  /*
 37   * These may go into an SPI header for the SecTrust object.
 38   */
 39  typedef enum {
 40  	/* this revocation policy disabled */
 41  	kSecDisabled,
 42  	/* try, but tolerate inability to complete */
 43  	kSecBestAttempt,
 44  	/* require successful revocation check if certificate indicates
 45       * the policy is supported */
 46  	kSecRequireIfPresentInCertificate,
 47  	/* require for every cert */
 48  	kSecRequireForAllCertificates
 49  } SecRevocationPolicyStyle;
 50  
 51  using namespace KeychainCore;
 52  
 53  /*
 54   * Given an app-specified array of Policies, determine if at least one of them
 55   * matches the given policy OID.
 56   */
 57  bool Trust::policySpecified(CFArrayRef policies, const CSSM_OID &inOid)
 58  {
 59  	if(policies == NULL) {
 60  		return false;
 61  	}
 62  	CFIndex numPolicies = CFArrayGetCount(policies);
 63  	for(CFIndex dex=0; dex<numPolicies; dex++) {
 64  		SecPolicyRef secPol = (SecPolicyRef)CFArrayGetValueAtIndex(policies, dex);
 65  		SecPointer<Policy> pol = Policy::required(SecPolicyRef(secPol));
 66  		const CssmOid &oid = pol->oid();
 67  		if(oid == CssmOid::overlay(inOid)) {
 68  			return true;
 69  		}
 70  	}
 71  	return false;
 72  }
 73  
 74  /*
 75   * Given an app-specified array of Policies, determine if at least one of them
 76   * is an explicit revocation policy.
 77   */
 78  bool Trust::revocationPolicySpecified(CFArrayRef policies)
 79  {
 80  	if(policies == NULL) {
 81  		return false;
 82  	}
 83  	CFIndex numPolicies = CFArrayGetCount(policies);
 84  	for(CFIndex dex=0; dex<numPolicies; dex++) {
 85  		SecPolicyRef secPol = (SecPolicyRef)CFArrayGetValueAtIndex(policies, dex);
 86  		SecPointer<Policy> pol = Policy::required(SecPolicyRef(secPol));
 87  		const CssmOid &oid = pol->oid();
 88  		if(oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_CRL)) {
 89  			return true;
 90  		}
 91  		if(oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_OCSP)) {
 92  			return true;
 93  		}
 94  	}
 95  	return false;
 96  }
 97  
 98  /*
 99   * Replace a unified revocation policy instance in the mPolicies array
100   * with specific instances of the OCSP and/or CRL policies which the TP
101   * module understands. Returns a (possibly) modified copy of the mPolicies
102   * array, which the caller is responsible for releasing.
103   */
104  CFMutableArrayRef Trust::convertRevocationPolicy(
105  	uint32 &numAdded,
106  	Allocator &alloc)
107  {
108  	numAdded = 0;
109  	if (!mPolicies) {
110  		return NULL;
111  	}
112  	CFIndex numPolicies = CFArrayGetCount(mPolicies);
113  	CFAllocatorRef allocator = CFGetAllocator(mPolicies);
114  	CFMutableArrayRef policies = CFArrayCreateMutableCopy(allocator, numPolicies, mPolicies);
115  	SecPolicyRef revPolicy = NULL;
116  	for(CFIndex dex=0; dex<numPolicies; dex++) {
117  		SecPolicyRef secPol = (SecPolicyRef)CFArrayGetValueAtIndex(policies, dex);
118  		SecPointer<Policy> pol = Policy::required(SecPolicyRef(secPol));
119  		const CssmOid &oid = pol->oid();
120  		if(oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION)) {
121  			CFRetain(secPol);
122  			if (revPolicy)
123  				CFRelease(revPolicy);
124  			revPolicy = secPol;
125  			CFArrayRemoveValueAtIndex(policies, dex--);
126  			numPolicies--;
127  		}
128  	}
129  	if(!revPolicy) {
130  		CFRelease(policies);
131  		return NULL;
132  	}
133  
134  	SecPointer<Policy> ocspPolicy;
135  	SecPointer<Policy> crlPolicy;
136  
137  	// fetch policy value
138  	CFOptionFlags policyFlags = kSecRevocationUseAnyAvailableMethod;
139  	CSSM_DATA policyValue = { 0, NULL };
140  	try {
141  		policyValue = Policy::required(revPolicy)->value();
142  	}
143  	catch (...) {
144  		policyValue.Data = NULL;
145  	}
146  	if (policyValue.Data) {
147  		policyFlags = (CFOptionFlags) *((CFOptionFlags*)policyValue.Data);
148  	}
149  	if (mNetworkPolicy == useNetworkDisabled) {
150  		policyFlags = 0 | kSecRevocationNetworkAccessDisabled;
151  	}
152  	CFRelease(revPolicy); // all done with this policy reference
153  
154  	if (policyFlags & kSecRevocationOCSPMethod) {
155  		/* cook up a new Policy object */
156  		ocspPolicy = new Policy(mTP, CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_OCSP));
157  		CSSM_APPLE_TP_OCSP_OPT_FLAGS ocspFlags = CSSM_TP_ACTION_OCSP_SUFFICIENT;
158  		if (policyFlags & kSecRevocationRequirePositiveResponse) {
159  			ocspFlags |= CSSM_TP_ACTION_OCSP_REQUIRE_IF_RESP_PRESENT;
160  		}
161  		CSSM_APPLE_TP_OCSP_OPTIONS opts;
162  		memset(&opts, 0, sizeof(opts));
163  		opts.Version = CSSM_APPLE_TP_OCSP_OPTS_VERSION;
164  		opts.Flags = ocspFlags;
165  
166  		/* Policy manages its own copy of this data */
167  		CSSM_DATA optData = {sizeof(opts), (uint8 *)&opts};
168  		ocspPolicy->value() = optData;
169  
170  		/* Policies array retains the Policy object */
171  		CFArrayAppendValue(policies, ocspPolicy->handle(false));
172  		numAdded++;
173  	}
174  	if (policyFlags & kSecRevocationCRLMethod) {
175  		/* cook up a new Policy object */
176  		crlPolicy = new Policy(mTP, CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_CRL));
177  		CSSM_APPLE_TP_CRL_OPT_FLAGS crlFlags = 0;
178  		if (policyFlags & kSecRevocationRequirePositiveResponse) {
179  			crlFlags |= CSSM_TP_ACTION_REQUIRE_CRL_IF_PRESENT;
180  		}
181  		CSSM_APPLE_TP_CRL_OPTIONS opts;
182  		memset(&opts, 0, sizeof(opts));
183  		opts.Version = CSSM_APPLE_TP_CRL_OPTS_VERSION;
184  		opts.CrlFlags = crlFlags;
185  
186  		/* Policy manages its own copy of this data */
187  		CSSM_DATA optData = {sizeof(opts), (uint8 *)&opts};
188  		crlPolicy->value() = optData;
189  
190  		/* Policies array retains the Policy object */
191  		CFArrayAppendValue(policies, crlPolicy->handle(false));
192  		numAdded++;
193  	}
194  	return policies;
195  }
196  
197  static SecRevocationPolicyStyle parseRevStyle(CFStringRef val)
198  {
199  	if(CFEqual(val, kSecRevocationOff)) {
200  		return kSecDisabled;
201  	}
202  	else if(CFEqual(val, kSecRevocationBestAttempt)) {
203  		return kSecBestAttempt;
204  	}
205  	else if(CFEqual(val, kSecRevocationRequireIfPresent)) {
206  		return kSecRequireIfPresentInCertificate;
207  	}
208  	else if(CFEqual(val, kSecRevocationRequireForAll)) {
209  		return kSecRequireForAllCertificates;
210  	}
211  	else {
212  		return kSecDisabled;
213  	}
214  }
215  
216  CFDictionaryRef Trust::defaultRevocationSettings()
217  {
218      /*
219          defaults read ~/Library/Preferences/com.apple.security.revocation
220          {
221              CRLStyle = BestAttempt;
222              CRLSufficientPerCert = 1;
223              OCSPStyle = BestAttempt;
224              OCSPSufficientPerCert = 1;
225              RevocationFirst = OCSP;
226          }
227      */
228      const void *keys[] = {
229  		kSecRevocationCrlStyle,
230          kSecRevocationCRLSufficientPerCert,
231          kSecRevocationOcspStyle,
232          kSecRevocationOCSPSufficientPerCert,
233          kSecRevocationWhichFirst
234  	};
235  	const void *values[] = {
236  		kSecRevocationBestAttempt,
237  		kCFBooleanTrue,
238  		kSecRevocationBestAttempt,
239  		kCFBooleanTrue,
240  		kSecRevocationOcspFirst
241  	};
242  
243      return CFDictionaryCreate(kCFAllocatorDefault, keys,
244  		values, sizeof(keys) / sizeof(*keys),
245  		&kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
246  }
247  
248  CFMutableArrayRef Trust::addPreferenceRevocationPolicies(
249  	bool ocspEnabledOnBestAttempt,
250  	bool crlEnabledOnBestAttempt,
251  	uint32 &numAdded,
252  	Allocator &alloc)
253  {
254  	numAdded = 0;
255  
256  	Dictionary* pd = NULL;
257  	CFDictionaryRef tempDict = defaultRevocationSettings();
258  	if (tempDict == NULL) {
259  		return NULL;
260  	}
261  	pd = new Dictionary(tempDict);
262  	CFRelease(tempDict);
263  
264  	unique_ptr<Dictionary> prefsDict(pd);
265  
266  	bool doOcsp = false;
267  	bool doCrl = false;
268  	CFStringRef val;
269  	SecRevocationPolicyStyle ocspStyle = kSecBestAttempt;
270  	SecRevocationPolicyStyle crlStyle = kSecBestAttempt;
271  	SecPointer<Policy> ocspPolicy;
272  	SecPointer<Policy> crlPolicy;
273  
274  	/* Are any revocation policies enabled? */
275  	val = prefsDict->getStringValue(kSecRevocationOcspStyle);
276  	if(val != NULL) {
277  		ocspStyle = parseRevStyle(val);
278  		if(ocspStyle != kSecDisabled) {
279  			doOcsp = true;
280  		}
281  		if(ocspStyle == kSecBestAttempt) {
282  			doOcsp = ocspEnabledOnBestAttempt;
283  		}
284  	}
285  	val = prefsDict->getStringValue(kSecRevocationCrlStyle);
286  	if(val != NULL) {
287  		crlStyle = parseRevStyle(val);
288  		if(crlStyle != kSecDisabled) {
289  			doCrl = true;
290  		}
291  		if(crlStyle == kSecBestAttempt) {
292  			doCrl = crlEnabledOnBestAttempt;
293  		}
294  	}
295  
296  	if(!doCrl && !doOcsp) {
297  		return NULL;
298  	}
299  
300  	/* which policy first? */
301  	bool ocspFirst = true;		// default if both present
302  	if(doCrl && doOcsp) {
303  		val = prefsDict->getStringValue(kSecRevocationWhichFirst);
304  		if((val != NULL) && CFEqual(val, kSecRevocationCrlFirst)) {
305  			ocspFirst = false;
306  		}
307  	}
308  
309  	/* Must have at least one caller-specified policy
310  	 * (if they didn't specify any, it's a no-op evaluation, and if they wanted
311  	 * revocation checking only, that policy would already be in mPolicies) */
312  	if (!mPolicies || !CFArrayGetCount(mPolicies))
313  		return NULL;
314  
315  	/* We're adding something to mPolicies, so make a copy we can work with */
316  	CFMutableArrayRef policies = CFArrayCreateMutableCopy(NULL, 0, mPolicies);
317  	if(policies == NULL) {
318  		throw std::bad_alloc();
319  	}
320  
321  	if(doOcsp) {
322  		/* Cook up a new Policy object */
323  		ocspPolicy = new Policy(mTP, CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_OCSP));
324  		CSSM_APPLE_TP_OCSP_OPTIONS opts;
325  		memset(&opts, 0, sizeof(opts));
326  		opts.Version = CSSM_APPLE_TP_OCSP_OPTS_VERSION;
327  
328  		/* Now fill in the OCSP-related blanks */
329  		switch(ocspStyle) {
330  			case kSecDisabled:
331  				assert(0);
332  				break;
333  			case kSecBestAttempt:
334  				/* default, nothing to set */
335  				break;
336  			case kSecRequireIfPresentInCertificate:
337  				opts.Flags |= CSSM_TP_ACTION_OCSP_REQUIRE_IF_RESP_PRESENT;
338  				break;
339  			case kSecRequireForAllCertificates:
340  				opts.Flags |= CSSM_TP_ACTION_OCSP_REQUIRE_PER_CERT;
341  				break;
342  		}
343  
344  		if(prefsDict->getBoolValue(kSecRevocationOCSPSufficientPerCert)) {
345  			opts.Flags |= CSSM_TP_ACTION_OCSP_SUFFICIENT;
346  		}
347  
348  		val = prefsDict->getStringValue(kSecOCSPLocalResponder);
349  		if(val != NULL) {
350  			CFDataRef cfData = CFStringCreateExternalRepresentation(NULL,
351  				val, kCFStringEncodingUTF8, 0);
352  			CFIndex len = CFDataGetLength(cfData);
353  			opts.LocalResponder = (CSSM_DATA_PTR)alloc.malloc(sizeof(CSSM_DATA));
354  			opts.LocalResponder->Data = (uint8 *)alloc.malloc(len);
355  			opts.LocalResponder->Length = len;
356  			memmove(opts.LocalResponder->Data, CFDataGetBytePtr(cfData), len);
357  			CFRelease(cfData);
358  		}
359  
360  		/* Policy manages its own copy of this data */
361  		CSSM_DATA optData = {sizeof(opts), (uint8 *)&opts};
362  		ocspPolicy->value() = optData;
363  		numAdded++;
364  	}
365  
366  	if(doCrl) {
367  		/* Cook up a new Policy object */
368  		crlPolicy = new Policy(mTP, CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_CRL));
369  		CSSM_APPLE_TP_CRL_OPTIONS opts;
370  		memset(&opts, 0, sizeof(opts));
371  		opts.Version = CSSM_APPLE_TP_CRL_OPTS_VERSION;
372  
373  		/* Now fill in the CRL-related blanks */
374  		opts.CrlFlags = CSSM_TP_ACTION_FETCH_CRL_FROM_NET;	// default true
375  		switch(crlStyle) {
376  			case kSecDisabled:
377  				assert(0);
378  				break;
379  			case kSecBestAttempt:
380  				/* default, nothing to set */
381  				break;
382  			case kSecRequireIfPresentInCertificate:
383  				opts.CrlFlags |= CSSM_TP_ACTION_REQUIRE_CRL_IF_PRESENT;
384  				break;
385  			case kSecRequireForAllCertificates:
386  				opts.CrlFlags |= CSSM_TP_ACTION_REQUIRE_CRL_PER_CERT;
387  				break;
388  		}
389  		if(prefsDict->getBoolValue(kSecRevocationCRLSufficientPerCert)) {
390  			opts.CrlFlags |= CSSM_TP_ACTION_CRL_SUFFICIENT;
391  		}
392  
393  		/* Policy manages its own copy of this data */
394  		CSSM_DATA optData = {sizeof(opts), (uint8 *)&opts};
395  		crlPolicy->value() = optData;
396  		numAdded++;
397  	}
398  
399  	/* append in order */
400  	if(doOcsp) {
401  		if(doCrl) {
402  			if(ocspFirst) {
403  				/* these SecCFObject go away when the policies array does */
404  				CFArrayAppendValue(policies, ocspPolicy->handle(false));
405  				CFArrayAppendValue(policies, crlPolicy->handle(false));
406  			}
407  			else {
408  				CFArrayAppendValue(policies, crlPolicy->handle(false));
409  				CFArrayAppendValue(policies, ocspPolicy->handle(false));
410  			}
411  		}
412  		else {
413  			CFArrayAppendValue(policies, ocspPolicy->handle(false));
414  		}
415  
416  	}
417  	else if(doCrl) {
418  		CFArrayAppendValue(policies, crlPolicy->handle(false));
419  	}
420  	return policies;
421  }
422  
423  /*
424   * Called when we created the last numAdded Policies in the specified Policy array
425   * (only frees the policy data associated with the extra policies that we inserted;
426   * this does not free the policies array itself.)
427   */
428  void Trust::freeAddedRevocationPolicyData(
429  	CFArrayRef policies,
430  	uint32 numAdded,
431  	Allocator &alloc)
432  {
433  	uint32 numPolicies = (uint32)CFArrayGetCount(policies);
434  	if(numPolicies < numAdded) {
435  		/* should never happen - throw? */
436  		assert(0);
437  		return;
438  	}
439  	for(unsigned dex=numPolicies-numAdded; dex<numPolicies; dex++) {
440  		SecPolicyRef secPol = (SecPolicyRef)CFArrayGetValueAtIndex(policies, dex);
441  		//SecPointer<Policy> pol = Policy::required(SecPolicyRef(secPol));
442  		Policy *pol = Policy::required(secPol);
443  		const CssmOid &oid = pol->oid();		// required
444  		const CssmData &optData = pol->value();	// optional
445  
446  		if(optData.Data) {
447  			if(oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_CRL)) {
448  				/* currently no CRL-specific policy data */
449  			}
450  			else if(oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_OCSP)) {
451  				CSSM_APPLE_TP_OCSP_OPTIONS *opts = (CSSM_APPLE_TP_OCSP_OPTIONS *)optData.Data;
452  				if(opts->LocalResponder != NULL) {
453  				   if(opts->LocalResponder->Data != NULL) {
454  						alloc.free(opts->LocalResponder->Data);
455  					}
456  					alloc.free(opts->LocalResponder);
457  				}
458  			}
459  			// managed by Policy alloc.free(optData.Data);
460  		}
461  	}
462  }
463  
464  /*
465   * Comparator function to correctly order revocation policies.
466   */
467  static CFComparisonResult compareRevocationPolicies(
468  	const void *policy1,
469  	const void *policy2,
470  	void *context)
471  {
472  	SecPointer<Policy> pol1 = Policy::required(SecPolicyRef(policy1));
473  	SecPointer<Policy> pol2 = Policy::required(SecPolicyRef(policy2));
474  	const CssmOid &oid1 = pol1->oid();
475  	const CssmOid &oid2 = pol2->oid();
476  	if(oid1 == oid2) {
477  		return kCFCompareEqualTo;
478  	}
479  	bool ocspFirst = true;
480  	if(context != NULL && CFEqual((CFBooleanRef)context, kCFBooleanFalse)) {
481  		ocspFirst = false;
482  	}
483  	const CssmOid lastRevocationOid = (ocspFirst) ?
484  		CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_CRL) :
485  		CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_OCSP);
486  	const CssmOid firstRevocationOid = (ocspFirst) ?
487  		CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_OCSP) :
488  		CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_CRL);
489  	if(oid1 == lastRevocationOid) {
490  		/* should be ordered last, after all other policies */
491  		return kCFCompareGreaterThan;
492  	}
493  	if(oid1 == firstRevocationOid) {
494  		/* should be ordered after any policy except lastRevocationOid */
495  		if(oid2 == lastRevocationOid) {
496  			return kCFCompareLessThan;
497  		}
498  		return kCFCompareGreaterThan;
499  	}
500  	/* normal policy in first position, anything else in second position */
501  	return kCFCompareLessThan;
502  }
503  
504  /*
505   * This method reorders any revocation policies which may be present
506   * in the provided array so they are at the end and evaluated last.
507   */
508  void Trust::orderRevocationPolicies(
509  	CFMutableArrayRef policies)
510  {
511  	if(!policies || CFGetTypeID(policies) != CFArrayGetTypeID()) {
512  		return;
513  	}
514  	/* check revocation prefs to determine which policy goes first */
515  	CFBooleanRef ocspFirst = kCFBooleanTrue;
516  #if POLICIES_DEBUG
517  	CFShow(policies); // before sort
518  	CFArraySortValues(policies, CFRangeMake(0, CFArrayGetCount(policies)), compareRevocationPolicies, (void*)ocspFirst);
519  	CFShow(policies); // after sort, to see what changed
520  	// check that policy order is what we expect
521  	CFIndex numPolicies = CFArrayGetCount(policies);
522  	for(CFIndex dex=0; dex<numPolicies; dex++) {
523  		SecPolicyRef secPol = (SecPolicyRef)CFArrayGetValueAtIndex(policies, dex);
524  		SecPointer<Policy> pol = Policy::required(SecPolicyRef(secPol));
525  		const CssmOid &oid = pol->oid();
526  		if(oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_OCSP)) {
527  			CFStringRef s = CFStringCreateWithFormat(NULL, NULL, CFSTR("idx %d = OCSP"), dex);
528  			CFShow(s);
529  			CFRelease(s);
530  		}
531  		else if(oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_CRL)) {
532  			CFStringRef s = CFStringCreateWithFormat(NULL, NULL, CFSTR("idx %d = CRL"), dex);
533  			CFShow(s);
534  			CFRelease(s);
535  		}
536  		else {
537  			CFStringRef s = CFStringCreateWithFormat(NULL, NULL, CFSTR("idx %d = normal"), dex);
538  			CFShow(s);
539  			CFRelease(s);
540  		}
541  	}
542  #else
543  	CFArraySortValues(policies, CFRangeMake(0, CFArrayGetCount(policies)), compareRevocationPolicies, (void*)ocspFirst);
544  #endif
545  }
546  
547  /*
548   * This method returns a copy of the mPolicies array which ensures that
549   * revocation checking (preferably OCSP, otherwise CRL) will be attempted.
550   *
551   * If OCSP is already in the mPolicies array, this makes sure the
552   * CSSM_TP_ACTION_OCSP_REQUIRE_IF_RESP_PRESENT and CSSM_TP_ACTION_OCSP_SUFFICIENT
553   * flags are set. If it's not already in the array, a new policy object is added.
554   *
555   * If CRL is already in the mPolicies array, this makes sure the
556   * CSSM_TP_ACTION_FETCH_CRL_FROM_NET and CSSM_TP_ACTION_CRL_SUFFICIENT flags are
557   * set. If it's not already in the array, a new policy object is added.
558   *
559   * Caller is responsible for releasing the returned policies array.
560   */
561  CFMutableArrayRef Trust::forceRevocationPolicies(
562  	bool ocspEnabled,
563  	bool crlEnabled,
564  	uint32 &numAdded,
565  	Allocator &alloc,
566  	bool requirePerCert)
567  {
568  	SecPointer<Policy> ocspPolicy;
569  	SecPointer<Policy> crlPolicy;
570  	CSSM_APPLE_TP_OCSP_OPT_FLAGS ocspFlags;
571  	CSSM_APPLE_TP_CRL_OPT_FLAGS crlFlags;
572  	bool hasOcspPolicy = false;
573  	bool hasCrlPolicy = false;
574  	numAdded = 0;
575  
576  	ocspFlags = CSSM_TP_ACTION_OCSP_SUFFICIENT;
577  	crlFlags = CSSM_TP_ACTION_FETCH_CRL_FROM_NET | CSSM_TP_ACTION_CRL_SUFFICIENT;
578  	if (requirePerCert) {
579  		ocspFlags |= CSSM_TP_ACTION_OCSP_REQUIRE_IF_RESP_PRESENT;
580  		crlFlags |= CSSM_TP_ACTION_REQUIRE_CRL_IF_PRESENT;
581  	}
582  
583  	CFIndex numPolicies = (mPolicies) ? CFArrayGetCount(mPolicies) : 0;
584  	for(CFIndex dex=0; dex<numPolicies; dex++) {
585  		SecPolicyRef secPol = (SecPolicyRef)CFArrayGetValueAtIndex(mPolicies, dex);
586  		SecPointer<Policy> pol = Policy::required(SecPolicyRef(secPol));
587  		const CssmOid &oid = pol->oid();
588  		const CssmData &optData = pol->value();
589  		if(oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_OCSP)) {
590  			// make sure OCSP options are set correctly
591  			CSSM_APPLE_TP_OCSP_OPTIONS *opts = (CSSM_APPLE_TP_OCSP_OPTIONS *)optData.Data;
592  			if (opts) {
593  				opts->Flags |= ocspFlags;
594  			} else {
595  				CSSM_APPLE_TP_OCSP_OPTIONS newOpts;
596  				memset(&newOpts, 0, sizeof(newOpts));
597  				newOpts.Version = CSSM_APPLE_TP_OCSP_OPTS_VERSION;
598  				newOpts.Flags = ocspFlags;
599  				CSSM_DATA optData = {sizeof(newOpts), (uint8 *)&newOpts};
600  				pol->value() = optData;
601  			}
602  			hasOcspPolicy = true;
603  		}
604  		else if(oid == CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_CRL)) {
605  			// make sure CRL options are set correctly
606  			CSSM_APPLE_TP_CRL_OPTIONS *opts = (CSSM_APPLE_TP_CRL_OPTIONS *)optData.Data;
607  			if (opts) {
608  				opts->CrlFlags |= crlFlags;
609  			} else {
610  				CSSM_APPLE_TP_CRL_OPTIONS newOpts;
611  				memset(&newOpts, 0, sizeof(newOpts));
612  				newOpts.Version = CSSM_APPLE_TP_CRL_OPTS_VERSION;
613  				newOpts.CrlFlags = crlFlags;
614  				CSSM_DATA optData = {sizeof(newOpts), (uint8 *)&newOpts};
615  				pol->value() = optData;
616  			}
617  			hasCrlPolicy = true;
618  		}
619  	}
620  
621  	/* We're potentially adding something to mPolicies, so make a copy we can work with */
622  	CFMutableArrayRef policies = CFArrayCreateMutableCopy(NULL, 0, mPolicies);
623  	if(policies == NULL) {
624  		throw std::bad_alloc();
625  	}
626  
627  	if(!hasOcspPolicy && ocspEnabled) {
628  		/* Cook up a new Policy object */
629  		ocspPolicy = new Policy(mTP, CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_OCSP));
630  		CSSM_APPLE_TP_OCSP_OPTIONS opts;
631  		memset(&opts, 0, sizeof(opts));
632  		opts.Version = CSSM_APPLE_TP_OCSP_OPTS_VERSION;
633  		opts.Flags = ocspFlags;
634  
635  		/* Policy manages its own copy of the options data */
636  		CSSM_DATA optData = {sizeof(opts), (uint8 *)&opts};
637  		ocspPolicy->value() = optData;
638  
639  		/* Policies array retains the Policy object */
640  		CFArrayAppendValue(policies, ocspPolicy->handle(false));
641  		numAdded++;
642  	}
643  
644  	if(!hasCrlPolicy && crlEnabled) {
645  		/* Cook up a new Policy object */
646  		crlPolicy = new Policy(mTP, CssmOid::overlay(CSSMOID_APPLE_TP_REVOCATION_CRL));
647  		CSSM_APPLE_TP_CRL_OPTIONS opts;
648  		memset(&opts, 0, sizeof(opts));
649  		opts.Version = CSSM_APPLE_TP_CRL_OPTS_VERSION;
650  		opts.CrlFlags = crlFlags;
651  
652  		/* Policy manages its own copy of this data */
653  		CSSM_DATA optData = {sizeof(opts), (uint8 *)&opts};
654  		crlPolicy->value() = optData;
655  
656  		/* Policies array retains the Policy object */
657  		CFArrayAppendValue(policies, crlPolicy->handle(false));
658  		numAdded++;
659  	}
660  
661  	return policies;
662  }