1  /*
  2   * Copyright (c) 2008-2019 Apple Inc. All Rights Reserved.
  3   *
  4   * @APPLE_LICENSE_HEADER_START@
  5   *
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. Please obtain a copy of the License at
 10   * http://www.opensource.apple.com/apsl/ and read it before using this
 11   * file.
 12   *
 13   * The Original Code and all software distributed under the License are
 14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 18   * Please see the License for the specific language governing rights and
 19   * limitations under the License.
 20   *
 21   * @APPLE_LICENSE_HEADER_END@
 22   */
 23  
 24  /*
 25   * SecPolicyLeafCallbacks.c - Callbacks for SecPolicy for verifying leafs
 26   */
 27  
 28  #include <AssertMacros.h>
 29  #include <CoreFoundation/CFDictionary.h>
 30  #include <Security/SecPolicyPriv.h>
 31  #include <Security/SecPolicyInternal.h>
 32  #include <Security/SecCertificateInternal.h>
 33  #include <Security/SecFramework.h>
 34  #include <utilities/SecCFWrappers.h>
 35  #include <utilities/SecInternalReleasePriv.h>
 36  #include <wctype.h>
 37  #include <dlfcn.h>
 38  #include <libDER/oids.h>
 39  
 40  /*
 41   * MARK: SecPolicyCheckCert Functions
 42   * All SecPolicyCheckCert* return false if the cert fails the check and true if it succeeds.
 43   */
 44  
 45  typedef bool (*SecPolicyCheckCertFunction)(SecCertificateRef cert, CFTypeRef pvcValue);
 46  
 47  /* This one is different from SecPolicyCheckCriticalExtensions because
 48   that one is an empty stub. The CriticalExtensions check is done in
 49   SecPolicyCheckBasicCertificateProcessing. */
 50  bool SecPolicyCheckCertCriticalExtensions(SecCertificateRef cert, CFTypeRef __unused pvcValue) {
 51      if (SecCertificateHasUnknownCriticalExtension(cert)) {
 52          /* Certificate contains one or more unknown critical extensions. */
 53          return false;
 54      }
 55      return true;
 56  }
 57  
 58  static bool keyusage_allows(SecKeyUsage keyUsage, CFTypeRef xku) {
 59      if (!xku || CFGetTypeID(xku) != CFNumberGetTypeID())
 60          return false;
 61  
 62      SInt32 dku;
 63      CFNumberGetValue((CFNumberRef)xku, kCFNumberSInt32Type, &dku);
 64      SecKeyUsage ku = (SecKeyUsage)dku;
 65      /* kSecKeyUsageUnspecified is a special sentinel for allowing a missing KU extension */
 66      if (ku == kSecKeyUsageUnspecified) {
 67          return (keyUsage == ku);
 68      }
 69      return (keyUsage & ku) == ku;
 70  }
 71  
 72  bool SecPolicyCheckCertKeyUsage(SecCertificateRef cert, CFTypeRef pvcValue) {
 73      SecKeyUsage keyUsage = SecCertificateGetKeyUsage(cert);
 74      bool match = false;
 75      CFTypeRef xku = pvcValue;
 76      if (isArray(xku)) {
 77          CFIndex ix, count = CFArrayGetCount(xku);
 78          for (ix = 0; ix < count; ++ix) {
 79              CFTypeRef ku = CFArrayGetValueAtIndex(xku, ix);
 80              if (keyusage_allows(keyUsage, ku)) {
 81                  match = true;
 82                  break;
 83              }
 84          }
 85      } else {
 86          match = keyusage_allows(keyUsage, xku);
 87      }
 88      return match;
 89  }
 90  
 91  static bool extendedkeyusage_allows(CFArrayRef extendedKeyUsage,
 92                                      CFDataRef xeku) {
 93      if (!xeku)
 94          return false;
 95      if (extendedKeyUsage) {
 96          CFRange all = { 0, CFArrayGetCount(extendedKeyUsage) };
 97          return CFArrayContainsValue(extendedKeyUsage, all, xeku);
 98      } else {
 99          /* Certificate has no extended key usage, only a match if the policy
100           contains a 0 length CFDataRef. */
101          return CFDataGetLength((CFDataRef)xeku) == 0;
102      }
103  }
104  
105  static bool isExtendedKeyUsageAllowed(CFArrayRef extendedKeyUsage,
106                                        CFTypeRef xeku) {
107      if (!xeku) {
108          return false;
109      }
110      if(CFGetTypeID(xeku) == CFDataGetTypeID()) {
111          return extendedkeyusage_allows(extendedKeyUsage, xeku);
112      } else if (CFGetTypeID(xeku) == CFStringGetTypeID()) {
113          CFDataRef eku = SecCertificateCreateOidDataFromString(NULL, xeku);
114          if (eku) {
115              bool result = extendedkeyusage_allows(extendedKeyUsage, eku);
116              CFRelease(eku);
117              return result;
118          }
119      }
120      return false;
121  }
122  
123  bool SecPolicyCheckCertExtendedKeyUsage(SecCertificateRef cert, CFTypeRef pvcValue) {
124      CFArrayRef certExtendedKeyUsage = SecCertificateCopyExtendedKeyUsage(cert);
125      bool match = false;
126      CFTypeRef xeku = pvcValue;
127      if (isArray(xeku)) {
128          CFIndex ix, count = CFArrayGetCount(xeku);
129          for (ix = 0; ix < count; ix++) {
130              CFTypeRef eku = CFArrayGetValueAtIndex(xeku, ix);
131              if (isExtendedKeyUsageAllowed(certExtendedKeyUsage, eku)) {
132                  match = true;
133                  break;
134              }
135          }
136      } else {
137          match = isExtendedKeyUsageAllowed(certExtendedKeyUsage, xeku);
138      }
139      CFReleaseSafe(certExtendedKeyUsage);
140      return match;
141  }
142  
143  bool SecPolicyCheckCertNonEmptySubject(SecCertificateRef cert, CFTypeRef __unused pvcValue) {
144      /* If the certificate has a subject, or
145       if it doesn't, and it's the leaf and not a CA,
146       and also has a critical subjectAltName extension it's valid. */
147      if (!SecCertificateHasSubject(cert)) {
148          if (SecCertificateIsCA(cert)) {
149              /* CA certificate has empty subject. */
150              return false;
151          } else {
152              if (!SecCertificateHasCriticalSubjectAltName(cert)) {
153                  /* Leaf certificate with empty subject does not have
154                   a critical subject alt name extension. */
155                  return false;
156              }
157          }
158      }
159      return true;
160  }
161  
162  /* We have a wildcard reference identifier that looks like "*." followed by 2 or
163     more labels. Use CFNetwork's function for determining if those labels comprise
164     a top-level domain. We need to dlopen since CFNetwork is a client of ours. */
165  typedef bool (*CFNIsTLD_f)(CFStringRef domain);
166  bool SecDNSIsTLD(CFStringRef reference) {
167      bool result = false; /* fail open for allocation and symbol lookup failures */
168      static CFNIsTLD_f CFNIsDomainTopLevelFunctionPtr = NULL;
169      static dispatch_once_t onceToken;
170      CFStringRef presentedDomain = NULL;
171  
172      dispatch_once(&onceToken, ^{
173          void *framework = dlopen("/System/Library/Frameworks/CFNetwork.framework/CFNetwork", RTLD_LAZY);
174          if (framework) {
175              CFNIsDomainTopLevelFunctionPtr = dlsym(framework, "_CFHostIsDomainTopLevelForCertificatePolicy");
176          }
177      });
178  
179      require_quiet(CFNIsDomainTopLevelFunctionPtr, out);
180      CFIndex referenceLen = CFStringGetLength(reference);
181  
182      /* reference identifier is too short, we should fail it */
183      require_action_quiet(referenceLen > 2, out, result = true);
184  
185      require_quiet(presentedDomain = CFStringCreateWithSubstring(NULL, reference,
186                                                                  CFRangeMake(2, referenceLen - 2)),
187                    out);
188      result = CFNIsDomainTopLevelFunctionPtr(presentedDomain);
189  
190  out:
191      CFReleaseNull(presentedDomain);
192      return result;
193  }
194  
195  /* Compare hostname, to a server name obtained from the server's cert
196   Obtained from the SubjectAltName or the CommonName entry in the Subject.
197   Limited wildcard checking is performed here as outlined in RFC 6125
198   Section 6.4.3.
199  
200   We adhere to the (SHOULD NOT) guidance in rules 1 and 2, and we choose
201   never to accept partial-label wildcards even though they are allowed by
202   rule 3.
203  
204   We use the language from RFC 6125, particularly the following definitions:
205  
206   presented identifier:  An identifier that is presented by a server to
207   a client within a PKIX certificate when the client attempts to
208   establish secure communication with the server; the certificate
209   can include one or more presented identifiers of different types,
210   and if the server hosts more than one domain then the certificate
211   might present distinct identifiers for each domain.
212  
213   reference identifier:  An identifier, constructed from a source
214   domain and optionally an application service type, used by the
215   client for matching purposes when examining presented identifiers.
216  
217   */
218  static bool SecDNSMatch(CFStringRef reference, CFStringRef presented) {
219      CFArrayRef referenceLabels = NULL, presentedLabels = NULL;
220      bool result = false;
221  
222      /* A trailing '.' in the reference identifier is allowed as a mechanism
223       to force TLS renegotiation. Strip it before parsing labels. */
224      CFIndex referenceLen = CFStringGetLength(reference);
225      require_quiet(referenceLen > 0, noMatch);
226      if ('.' == CFStringGetCharacterAtIndex(reference, referenceLen - 1)) {
227          CFStringRef truncatedReference = CFStringCreateWithSubstring(NULL, reference,
228                                                                       CFRangeMake(0, referenceLen - 1));
229          referenceLabels = CFStringCreateArrayBySeparatingStrings(NULL, truncatedReference, CFSTR("."));
230          CFReleaseNull(truncatedReference);
231          require_quiet(referenceLabels, noMatch);
232      } else {
233      require_quiet(referenceLabels = CFStringCreateArrayBySeparatingStrings(NULL, reference, CFSTR(".")),
234                    noMatch);
235      }
236  
237      require_quiet(presentedLabels = CFStringCreateArrayBySeparatingStrings(NULL, presented, CFSTR(".")),
238                    noMatch);
239  
240      /* Reference Identifier and Presented Identifier must have the same number of labels
241         because a wildcard in the presented identifier can only match a single label in the
242         reference identifier. */
243      require_quiet(CFArrayGetCount(referenceLabels) == CFArrayGetCount(presentedLabels), noMatch);
244  
245      CFIndex ix, count = CFArrayGetCount(referenceLabels);
246      for (ix = count - 1; ix >= 0; ix--) {
247          CFStringRef rlabel = NULL, plabel = NULL;
248          require_quiet(rlabel = CFArrayGetValueAtIndex(referenceLabels, ix), noMatch);
249          require_quiet(plabel = CFArrayGetValueAtIndex(presentedLabels, ix), noMatch);
250          if (CFEqual(plabel, CFSTR("*"))) {
251              /* must only occur in left-most label */
252              require_quiet(ix == 0, noMatch);
253  
254              /* must not occur before single-label TLD */
255              require_quiet(count > 2 && ix != count - 2, noMatch);
256  
257              /* must not occur before a multi-label gTLD */
258              require_quiet(!SecDNSIsTLD(presented), noMatch);
259          } else {
260              /* partial-label wildcards are disallowed */
261              CFRange partialRange = CFStringFind(plabel, CFSTR("*"), 0);
262              require_quiet(partialRange.location == kCFNotFound && partialRange.length == 0 ,
263                            noMatch);
264  
265              /* not a wildcard, so labels must match exactly */
266              require_quiet(CFStringCompare(rlabel, plabel, kCFCompareCaseInsensitive) == kCFCompareEqualTo, noMatch);
267          }
268      }
269  
270      result = true;
271  
272  noMatch:
273      CFReleaseNull(referenceLabels);
274      CFReleaseNull(presentedLabels);
275      return result;
276  }
277  
278  bool SecPolicyCheckCertSSLHostname(SecCertificateRef cert, CFTypeRef pvcValue) {
279      /* @@@ Consider what to do if the caller passes in no hostname.  Should
280       we then still fail if the leaf has no dnsNames or IPAddresses at all? */
281      CFStringRef hostName = pvcValue;
282      if (!isString(hostName)) {
283          /* @@@ We can't return an error here and making the evaluation fail
284           won't help much either. */
285          return false;
286      }
287  
288      bool dnsMatch = false;
289      CFArrayRef dnsNames = SecCertificateCopyDNSNamesFromSAN(cert);
290      if (dnsNames) {
291          CFIndex ix, count = CFArrayGetCount(dnsNames);
292          for (ix = 0; ix < count; ++ix) {
293              CFStringRef dns = (CFStringRef)CFArrayGetValueAtIndex(dnsNames, ix);
294              if (SecDNSMatch(hostName, dns)) {
295                  dnsMatch = true;
296                  break;
297              }
298          }
299          CFRelease(dnsNames);
300      }
301  
302      if (!dnsMatch) {
303          /* Check whether hostname is an IPv4 or IPv6 address */
304          CFDataRef hostIPData = SecFrameworkCopyIPAddressData(hostName);
305          if (hostIPData) {
306              /* Check address against IP addresses in the SAN extension,
307                 obtained by SecCertificateCopyIPAddresses. Comparisons
308                 must always use the canonical data representation of the
309                 address, since string notation may omit zeros, etc. */
310              CFArrayRef ipAddresses = SecCertificateCopyIPAddressDatas(cert);
311              CFIndex ix, count = (ipAddresses) ? CFArrayGetCount(ipAddresses) : 0;
312              for (ix = 0; ix < count && !dnsMatch; ++ix) {
313                  CFDataRef ipAddress = (CFDataRef)CFArrayGetValueAtIndex(ipAddresses, ix);
314                  if (CFEqualSafe(hostIPData, ipAddress)) {
315                      dnsMatch = true;
316                  }
317              }
318              CFReleaseSafe(ipAddresses);
319              CFReleaseSafe(hostIPData);
320          }
321      }
322  
323      return dnsMatch;
324  }
325  
326  bool SecPolicyCheckCertEmail(SecCertificateRef cert, CFTypeRef pvcValue) {
327      CFStringRef email = pvcValue;
328      bool match = false;
329      if (!isString(email)) {
330          /* We can't return an error here and making the evaluation fail
331           won't help much either. */
332          return false;
333      }
334  
335      CFArrayRef addrs = SecCertificateCopyRFC822Names(cert);
336      if (addrs) {
337          CFIndex ix, count = CFArrayGetCount(addrs);
338          for (ix = 0; ix < count; ++ix) {
339              CFStringRef addr = (CFStringRef)CFArrayGetValueAtIndex(addrs, ix);
340              if (!CFStringCompare(email, addr, kCFCompareCaseInsensitive)) {
341                  match = true;
342                  break;
343              }
344          }
345          CFRelease(addrs);
346      }
347  
348      return match;
349  }
350  
351  bool SecPolicyCheckCertTemporalValidity(SecCertificateRef cert, CFTypeRef pvcValue) {
352      CFAbsoluteTime verifyTime = CFDateGetAbsoluteTime(pvcValue);
353      if (!SecCertificateIsValid(cert, verifyTime)) {
354          /* Leaf certificate has expired. */
355          return false;
356      }
357      return true;
358  }
359  
360  bool SecPolicyCheckCertSubjectCommonNamePrefix(SecCertificateRef cert, CFTypeRef pvcValue) {
361      CFStringRef prefix = pvcValue;
362      bool match = true;
363      if (!isString(prefix)) {
364          /* @@@ We can't return an error here and making the evaluation fail
365           won't help much either. */
366          return false;
367      }
368      CFArrayRef commonNames = SecCertificateCopyCommonNames(cert);
369      if (!commonNames || CFArrayGetCount(commonNames) != 1 ||
370          !CFStringHasPrefix(CFArrayGetValueAtIndex(commonNames, 0), prefix)) {
371          /* Common Name prefix mismatch. */
372          match = false;
373      }
374      CFReleaseSafe(commonNames);
375      return match;
376  }
377  
378  bool SecPolicyCheckCertSubjectCommonName(SecCertificateRef cert, CFTypeRef pvcValue) {
379      CFStringRef common_name = pvcValue;
380      bool match = true;
381      if (!isString(common_name)) {
382          /* @@@ We can't return an error here and making the evaluation fail
383           won't help much either. */
384          return false;
385      }
386      CFArrayRef commonNames = SecCertificateCopyCommonNames(cert);
387      if (!commonNames || CFArrayGetCount(commonNames) != 1 ||
388          !CFEqual(common_name, CFArrayGetValueAtIndex(commonNames, 0))) {
389          /* Common Name mismatch. */
390          match = false;
391      }
392      CFReleaseSafe(commonNames);
393      return match;
394  }
395  
396  bool SecPolicyCheckCertSubjectCommonNameTEST(SecCertificateRef cert, CFTypeRef pvcValue) {
397      CFStringRef common_name = pvcValue;
398      bool match = true;
399      if (!isString(common_name)) {
400          /* @@@ We can't return an error here and making the evaluation fail
401           won't help much either. */
402          return false;
403      }
404      CFArrayRef commonNames = SecCertificateCopyCommonNames(cert);
405      if (!commonNames || CFArrayGetCount(commonNames) != 1) {
406          CFStringRef cert_common_name = CFArrayGetValueAtIndex(commonNames, 0);
407          CFStringRef test_common_name = common_name ?
408          CFStringCreateWithFormat(kCFAllocatorDefault,
409                                   NULL, CFSTR("TEST %@ TEST"), common_name) :
410          NULL;
411          if (!CFEqual(common_name, cert_common_name) &&
412              (!test_common_name || !CFEqual(test_common_name, cert_common_name)))
413          /* Common Name mismatch. */
414              match = false;
415          CFReleaseSafe(test_common_name);
416      }
417      CFReleaseSafe(commonNames);
418      return match;
419  }
420  
421  bool SecPolicyCheckCertNotValidBefore(SecCertificateRef cert, CFTypeRef pvcValue) {
422      CFDateRef date = pvcValue;
423      if (!isDate(date)) {
424          /* @@@ We can't return an error here and making the evaluation fail
425           won't help much either. */
426          return false;
427      }
428      CFAbsoluteTime at = CFDateGetAbsoluteTime(date);
429      if (SecCertificateNotValidBefore(cert) <= at) {
430          /* Leaf certificate has not valid before that is too old. */
431          return false;
432      }
433      return true;
434  }
435  
436  bool SecPolicyCheckCertSubjectOrganization(SecCertificateRef cert, CFTypeRef pvcValue) {
437      CFStringRef org = pvcValue;
438      bool match = true;
439      if (!isString(org)) {
440          /* @@@ We can't return an error here and making the evaluation fail
441           won't help much either. */
442          return false;
443      }
444      CFArrayRef organization = SecCertificateCopyOrganization(cert);
445      if (!organization || CFArrayGetCount(organization) != 1 ||
446          !CFEqual(org, CFArrayGetValueAtIndex(organization, 0))) {
447          /* Leaf Subject Organization mismatch. */
448          match = false;
449      }
450      CFReleaseSafe(organization);
451      return match;
452  }
453  
454  bool SecPolicyCheckCertSubjectOrganizationalUnit(SecCertificateRef cert, CFTypeRef pvcValue) {
455      CFStringRef orgUnit = pvcValue;
456      bool match = true;
457      if (!isString(orgUnit)) {
458          /* @@@ We can't return an error here and making the evaluation fail
459           won't help much either. */
460          return false;
461      }
462      CFArrayRef organizationalUnit = SecCertificateCopyOrganizationalUnit(cert);
463      if (!organizationalUnit || CFArrayGetCount(organizationalUnit) != 1 ||
464          !CFEqual(orgUnit, CFArrayGetValueAtIndex(organizationalUnit, 0))) {
465          /* Leaf Subject Organizational Unit mismatch. */
466          match = false;
467      }
468      CFReleaseSafe(organizationalUnit);
469      return match;
470  }
471  
472  bool SecPolicyCheckCertSubjectCountry(SecCertificateRef cert, CFTypeRef pvcValue) {
473      CFStringRef country = pvcValue;
474      bool match = true;
475      if (!isString(country)) {
476          /* @@@ We can't return an error here and making the evaluation fail
477           won't help much either. */
478          return false;
479      }
480      CFArrayRef certCountry = SecCertificateCopyCountry(cert);
481      if (!certCountry || CFArrayGetCount(certCountry) != 1 ||
482          !CFEqual(country, CFArrayGetValueAtIndex(certCountry, 0))) {
483          /* Subject Country mismatch. */
484          match = false;
485      }
486      CFReleaseSafe(certCountry);
487      return match;
488  }
489  
490  bool SecPolicyCheckCertEAPTrustedServerNames(SecCertificateRef cert, CFTypeRef pvcValue) {
491      CFArrayRef trustedServerNames = pvcValue;
492      /* No names specified means we accept any name. */
493      if (!trustedServerNames)
494          return true;
495      if (!isArray(trustedServerNames)) {
496          /* @@@ We can't return an error here and making the evaluation fail
497           won't help much either. */
498          return false;
499      }
500  
501      CFIndex tsnCount = CFArrayGetCount(trustedServerNames);
502      bool dnsMatch = false;
503      CFArrayRef dnsNames = SecCertificateCopyDNSNames(cert);
504      if (dnsNames) {
505          CFIndex ix, count = CFArrayGetCount(dnsNames);
506          // @@@ This is O(N^2) unfortunately we can't do better easily unless
507          // we don't do wildcard matching. */
508          for (ix = 0; !dnsMatch && ix < count; ++ix) {
509              CFStringRef dns = (CFStringRef)CFArrayGetValueAtIndex(dnsNames, ix);
510              CFIndex tix;
511              for (tix = 0; tix < tsnCount; ++tix) {
512                  CFStringRef serverName =
513                  (CFStringRef)CFArrayGetValueAtIndex(trustedServerNames, tix);
514                  if (!isString(serverName)) {
515                      /* @@@ We can't return an error here and making the
516                       evaluation fail won't help much either. */
517                      CFReleaseSafe(dnsNames);
518                      return false;
519                  }
520                  /* we purposefully reverse the arguments here such that dns names
521                   from the cert are matched against a server name list, where
522                   the server names list can contain wildcards and the dns name
523                   cannot.  References: http://support.microsoft.com/kb/941123
524                   It's easy to find occurrences where people tried to use
525                   wildcard certificates and were told that those don't work
526                   in this context. */
527                  if (SecDNSMatch(dns, serverName)) {
528                      dnsMatch = true;
529                      break;
530                  }
531              }
532          }
533          CFRelease(dnsNames);
534      }
535  
536      return dnsMatch;
537  }
538  
539  bool SecPolicyCheckCertLeafMarkerOid(SecCertificateRef cert, CFTypeRef pvcValue) {
540      if (pvcValue && SecCertificateHasMarkerExtension(cert, pvcValue)) {
541          return true;
542      }
543  
544      return false;
545  }
546  
547  bool SecPolicyCheckCertLeafMarkerOidWithoutValueCheck(SecCertificateRef cert,
548                                                        CFTypeRef pvcValue) {
549      if (CFGetTypeID(pvcValue) == CFArrayGetTypeID()) {
550          CFIndex ix, length = CFArrayGetCount(pvcValue);
551          for (ix = 0; ix < length; ix++)
552              if (SecPolicyCheckCertLeafMarkerOidWithoutValueCheck(cert,
553                      CFArrayGetValueAtIndex((CFArrayRef)pvcValue, ix))) {
554                  return true;
555              }
556      } else if (CFGetTypeID(pvcValue) == CFDataGetTypeID()  ||
557                 CFGetTypeID(pvcValue) == CFStringGetTypeID()) {
558          return (NULL != SecCertificateGetExtensionValue(cert, pvcValue));
559      }
560      return false;
561  }
562  
563  /*
564   * The value is a dictionary. The dictionary contains keys indicating
565   * whether the value is for Prod or QA. The values are the same as
566   * in the options dictionary for SecPolicyCheckLeafMarkerOid.
567   */
568  bool SecPolicyCheckCertLeafMarkersProdAndQA(SecCertificateRef cert, CFTypeRef pvcValue)
569  {
570      CFTypeRef prodValue = CFDictionaryGetValue(pvcValue, kSecPolicyLeafMarkerProd);
571  
572      if (!SecPolicyCheckCertLeafMarkerOid(cert, prodValue)) {
573          bool result = false;
574          return result;
575      }
576      return true;
577  }
578  
579  static CFSetRef copyCertificatePolicies(SecCertificateRef cert) {
580      CFMutableSetRef policies = NULL;
581      policies = CFSetCreateMutable(NULL, 0, &kCFTypeSetCallBacks);
582      if (!policies) return NULL;
583  
584      const SecCECertificatePolicies *cp = SecCertificateGetCertificatePolicies(cert);
585      size_t policy_ix, policy_count = cp ? cp->numPolicies : 0;
586      for (policy_ix = 0; policy_ix < policy_count; ++policy_ix) {
587          CFDataRef oidData = NULL;
588          DERItem *policyOID = &cp->policies[policy_ix].policyIdentifier;
589          oidData = CFDataCreate(kCFAllocatorDefault, policyOID->data, policyOID->length);
590          CFSetAddValue(policies, oidData);
591          CFReleaseSafe(oidData);
592      }
593      return policies;
594  }
595  
596  static bool checkPolicyOidData(SecCertificateRef cert , CFDataRef oid) {
597      CFSetRef policies = copyCertificatePolicies(cert);
598      bool found = false;
599      if (policies && CFSetContainsValue(policies, oid)) {
600          found = true;
601      }
602      CFReleaseSafe(policies);
603      return found;
604  }
605  
606  /* This one is different from SecPolicyCheckCertificatePolicyOid because
607     that one checks the whole chain. (And uses policy_set_t...) */
608  bool SecPolicyCheckCertCertificatePolicy(SecCertificateRef cert, CFTypeRef pvcValue) {
609      CFTypeRef value = pvcValue;
610      bool result = false;
611  
612      if (CFGetTypeID(value) == CFDataGetTypeID())
613      {
614          result = checkPolicyOidData(cert, value);
615      } else if (CFGetTypeID(value) == CFStringGetTypeID()) {
616          CFDataRef dataOid = SecCertificateCreateOidDataFromString(NULL, value);
617          if (dataOid) {
618              result = checkPolicyOidData(cert, dataOid);
619              CFRelease(dataOid);
620          }
621      }
622      return result;
623  }
624  
625  bool SecPolicyCheckCertWeakKeySize(SecCertificateRef cert, CFTypeRef __unused pvcValue) {
626      if (cert && SecCertificateIsWeakKey(cert)) {
627          /* Leaf certificate has a weak key. */
628          return false;
629      }
630      return true;
631  }
632  
633  bool SecPolicyCheckCertKeySize(SecCertificateRef cert, CFTypeRef pvcValue) {
634      CFDictionaryRef keySizes = pvcValue;
635      if (!SecCertificateIsAtLeastMinKeySize(cert, keySizes)) {
636          return false;
637      }
638      return true;
639  }
640  
641  bool SecPolicyCheckCertWeakSignature(SecCertificateRef cert, CFTypeRef __unused pvcValue) {
642      bool result = true;
643      CFMutableArrayRef disallowedHashes = CFArrayCreateMutable(NULL, 3, &kCFTypeArrayCallBacks);
644      if (!disallowedHashes) {
645          return result;
646      }
647      CFArrayAppendValue(disallowedHashes, kSecSignatureDigestAlgorithmMD2);
648      CFArrayAppendValue(disallowedHashes, kSecSignatureDigestAlgorithmMD4);
649      CFArrayAppendValue(disallowedHashes, kSecSignatureDigestAlgorithmMD5);
650  
651      /* Weak Signature failures only for non-self-signed certs */
652      Boolean isSelfSigned = false;
653      OSStatus status = SecCertificateIsSelfSigned(cert, &isSelfSigned);
654      if (!SecPolicyCheckCertSignatureHashAlgorithms(cert, disallowedHashes) && (status != errSecSuccess || !isSelfSigned)) {
655          result = false;
656      }
657      CFReleaseSafe(disallowedHashes);
658      return result;
659  }
660  
661  static CFStringRef convertSignatureHashAlgorithm(SecSignatureHashAlgorithm algorithmEnum) {
662      const void *digests[] = { kSecSignatureDigestAlgorithmUnknown,
663          kSecSignatureDigestAlgorithmMD2,
664          kSecSignatureDigestAlgorithmMD4,
665          kSecSignatureDigestAlgorithmMD5,
666          kSecSignatureDigestAlgorithmSHA1,
667          kSecSignatureDigestAlgorithmSHA224,
668          kSecSignatureDigestAlgorithmSHA256,
669          kSecSignatureDigestAlgorithmSHA384,
670          kSecSignatureDigestAlgorithmSHA512,
671      };
672      return digests[algorithmEnum];
673  }
674  
675  bool SecPolicyCheckCertSignatureHashAlgorithms(SecCertificateRef cert, CFTypeRef pvcValue) {
676      /* skip signature algorithm check on self-signed certs */
677      Boolean isSelfSigned = false;
678      OSStatus status = SecCertificateIsSelfSigned(cert, &isSelfSigned);
679      if ((status == errSecSuccess) && isSelfSigned) {
680          return true;
681      }
682  
683      CFArrayRef disallowedHashAlgorithms = pvcValue;
684      CFStringRef certAlg = convertSignatureHashAlgorithm(SecCertificateGetSignatureHashAlgorithm(cert));
685      if (CFArrayContainsValue(disallowedHashAlgorithms, CFRangeMake(0,CFArrayGetCount(disallowedHashAlgorithms)), certAlg)) {
686          return false;
687      }
688      return true;
689  }
690  
691  bool SecPolicyCheckCertUnparseableExtension(SecCertificateRef cert, CFTypeRef pvcValue) {
692      if (SecCertificateGetUnparseableKnownExtension(cert) != kCFNotFound) {
693          return false;
694      }
695      return true;
696  }
697  
698  bool SecPolicyCheckCertNotCA(SecCertificateRef cert, CFTypeRef pvcValue) {
699      if (SecCertificateIsCA(cert)) {
700          return false;
701      }
702      return true;
703  }
704  
705  /*
706   * MARK: SecLeafPVC functions
707   */
708  static CFDictionaryRef SecLeafPVCCopyCallbacks(void) {
709      CFMutableDictionaryRef leafCallbacks = NULL;
710      leafCallbacks = CFDictionaryCreateMutable(kCFAllocatorDefault, 0,
711                                                          &kCFTypeDictionaryKeyCallBacks, NULL);
712  
713  #undef POLICYCHECKMACRO
714  #define __PC_ADD_CHECK_(NAME)
715  #define __PC_ADD_CHECK_O(NAME) CFDictionaryAddValue(leafCallbacks, \
716  kSecPolicyCheck##NAME, SecPolicyCheckCert##NAME);
717  
718  #define POLICYCHECKMACRO(NAME, TRUSTRESULT, SUBTYPE, LEAFCHECK, PATHCHECK, LEAFONLY, CSSMERR, OSSTATUS) \
719  __PC_ADD_CHECK_##LEAFONLY(NAME)
720  #include "SecPolicyChecks.list"
721  
722      return leafCallbacks;
723  }
724  
725  void SecLeafPVCInit(SecLeafPVCRef pvc, SecCertificateRef leaf, CFArrayRef policies,
726                      CFAbsoluteTime verifyTime) {
727      secdebug("alloc", "leafpvc %p", pvc);
728      // Weird logging policies crashes.
729      //secdebug("policy", "%@", policies);
730      pvc->leaf = CFRetainSafe(leaf);
731      pvc->policies = CFRetainSafe(policies);
732      pvc->verifyTime = verifyTime;
733      pvc->callbacks = SecLeafPVCCopyCallbacks();
734      pvc->policyIX = 0;
735      pvc->result = true;
736  
737      CFMutableDictionaryRef certDetail = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks,
738                                                                    &kCFTypeDictionaryValueCallBacks);
739      pvc->details = CFArrayCreate(kCFAllocatorDefault, (const void **)&certDetail, 1,
740                                   &kCFTypeArrayCallBacks);
741      CFRelease(certDetail);
742  }
743  
744  
745  void SecLeafPVCDelete(SecLeafPVCRef pvc) {
746      secdebug("alloc", "delete leaf pvc %p", pvc);
747      CFReleaseNull(pvc->policies);
748      CFReleaseNull(pvc->details);
749      CFReleaseNull(pvc->callbacks);
750      CFReleaseNull(pvc->leaf);
751  }
752  
753  static bool SecLeafPVCSetResultForced(SecLeafPVCRef pvc,
754                                        CFStringRef key, CFIndex ix, CFTypeRef result, bool force) {
755  
756      secdebug("policy", "cert[%d]: %@ =(%s)[%s]> %@", (int) ix, key, "leaf",
757               (force ? "force" : ""), result);
758  
759      /* If this is not something the current policy cares about ignore
760       this error and return true so our caller continues evaluation. */
761      if (!force) {
762          /* @@@ The right long term fix might be to check if none of the passed
763           in policies contain this key, since not all checks are run for all
764           policies. */
765          SecPolicyRef policy = (SecPolicyRef)CFArrayGetValueAtIndex(pvc->policies, pvc->policyIX);
766          if (policy && !CFDictionaryContainsKey(policy->_options, key))
767              return true;
768      }
769  
770      /* @@@ Check to see if the SecTrustSettings for the certificate in question
771       tell us to ignore this error. */
772      pvc->result = false;
773      if (!pvc->details)
774          return false;
775  
776      CFMutableDictionaryRef detail =
777      (CFMutableDictionaryRef)CFArrayGetValueAtIndex(pvc->details, ix);
778  
779      /* Perhaps detail should have an array of results per key?  As it stands
780       in the case of multiple policy failures the last failure stands.  */
781      CFDictionarySetValue(detail, key, result);
782  
783      return true;
784  }
785  
786  static bool SecLeafPVCSetResult(SecLeafPVCRef pvc,
787                                  CFStringRef key, CFIndex ix, CFTypeRef result) {
788      return SecLeafPVCSetResultForced(pvc, key, ix, result, false);
789  }
790  
791  static void SecLeafPVCValidateKey(const void *key, const void *value,
792                                    void *context) {
793      SecLeafPVCRef pvc = (SecLeafPVCRef)context;
794  
795      /* If our caller doesn't want full details and we failed earlier there is
796       no point in doing additional checks. */
797      if (!pvc->result && !pvc->details)
798          return;
799  
800      SecPolicyCheckCertFunction fcn = (SecPolicyCheckCertFunction) CFDictionaryGetValue(pvc->callbacks, key);
801      if (!fcn) {
802          pvc->result = false;
803          return;
804      }
805  
806      /* kSecPolicyCheckTemporalValidity is special */
807      if (CFEqual(key, kSecPolicyCheckTemporalValidity)) {
808          CFDateRef verifyDate = CFDateCreate(NULL, pvc->verifyTime);
809          if(!fcn(pvc->leaf, verifyDate)) {
810              SecLeafPVCSetResult(pvc, key, 0, kCFBooleanFalse);
811          }
812          CFReleaseSafe(verifyDate);
813      } else {
814          /* get pvcValue from current policy */
815          SecPolicyRef policy = (SecPolicyRef)CFArrayGetValueAtIndex(pvc->policies, pvc->policyIX);
816          if (!policy) {
817              pvc->result = false;
818              return;
819          }
820          CFTypeRef pvcValue = (CFTypeRef)CFDictionaryGetValue(policy->_options, key);
821          if(!fcn(pvc->leaf, pvcValue)) {
822              SecLeafPVCSetResult(pvc, key, 0, kCFBooleanFalse);
823          }
824      }
825  }
826  
827  bool SecLeafPVCLeafChecks(SecLeafPVCRef pvc) {
828      pvc->result = true;
829      CFArrayRef policies = pvc->policies;
830      CFIndex ix, count = CFArrayGetCount(policies);
831      for (ix = 0; ix < count; ++ix) {
832          SecPolicyRef policy = (SecPolicyRef)CFArrayGetValueAtIndex(policies, ix);
833          pvc->policyIX = ix;
834          /* Validate all keys for all policies. */
835          CFDictionaryApplyFunction(policy->_options, SecLeafPVCValidateKey, pvc);
836          if (!pvc->result && !pvc->details)
837              return pvc->result;
838      }
839      return pvc->result;
840  }