diff -Naur libressl-2.6.2.orig/crypto/Makefile.am libressl-2.6.2/crypto/Makefile.am --- libressl-2.6.2.orig/crypto/Makefile.am 2017-09-02 01:49:55.000000000 +0200 +++ libressl-2.6.2/crypto/Makefile.am 2017-10-07 14:05:16.000000000 +0200 @@ -92,7 +92,7 @@ -mv crypto_portable.sym.tmp crypto_portable.sym endif -libcrypto_la_LDFLAGS = -version-info @LIBCRYPTO_VERSION@ -no-undefined -export-symbols crypto_portable.sym +libcrypto_la_LDFLAGS = -version-info @LIBCRYPTO_VERSION@ -no-undefined -export-symbols crypto_portable.sym -framework Security -framework CoreFoundation libcrypto_la_LIBADD = libcompat.la if !HAVE_EXPLICIT_BZERO libcrypto_la_LIBADD += libcompatnoopt.la @@ -863,6 +863,7 @@ libcrypto_la_SOURCES += x509/x509_txt.c libcrypto_la_SOURCES += x509/x509_v3.c libcrypto_la_SOURCES += x509/x509_vfy.c +libcrypto_la_SOURCES += x509/x509_vfy_apple.c libcrypto_la_SOURCES += x509/x509_vpm.c libcrypto_la_SOURCES += x509/x509cset.c libcrypto_la_SOURCES += x509/x509name.c diff -Naur libressl-2.6.2.orig/crypto/Makefile.in libressl-2.6.2/crypto/Makefile.in --- libressl-2.6.2.orig/crypto/Makefile.in 2017-09-26 06:07:03.000000000 +0200 +++ libressl-2.6.2/crypto/Makefile.in 2017-10-07 14:05:24.000000000 +0200 @@ -426,20 +426,20 @@ x509/x509_err.c x509/x509_ext.c x509/x509_lu.c x509/x509_obj.c \ x509/x509_r2x.c x509/x509_req.c x509/x509_set.c \ x509/x509_trs.c x509/x509_txt.c x509/x509_v3.c x509/x509_vfy.c \ - x509/x509_vpm.c x509/x509cset.c x509/x509name.c \ - x509/x509rset.c x509/x509spki.c x509/x509type.c x509/x_all.c \ - x509v3/pcy_cache.c x509v3/pcy_data.c x509v3/pcy_lib.c \ - x509v3/pcy_map.c x509v3/pcy_node.c x509v3/pcy_tree.c \ - x509v3/v3_akey.c x509v3/v3_akeya.c x509v3/v3_alt.c \ - x509v3/v3_bcons.c x509v3/v3_bitst.c x509v3/v3_conf.c \ - x509v3/v3_cpols.c x509v3/v3_crld.c x509v3/v3_enum.c \ - x509v3/v3_extku.c x509v3/v3_genn.c x509v3/v3_ia5.c \ - x509v3/v3_info.c x509v3/v3_int.c x509v3/v3_lib.c \ - x509v3/v3_ncons.c x509v3/v3_ocsp.c x509v3/v3_pci.c \ - x509v3/v3_pcia.c x509v3/v3_pcons.c x509v3/v3_pku.c \ - x509v3/v3_pmaps.c x509v3/v3_prn.c x509v3/v3_purp.c \ - x509v3/v3_skey.c x509v3/v3_sxnet.c x509v3/v3_utl.c \ - x509v3/v3err.c + x509/x509_vfy_apple.c x509/x509_vpm.c x509/x509cset.c \ + x509/x509name.c x509/x509rset.c x509/x509spki.c \ + x509/x509type.c x509/x_all.c x509v3/pcy_cache.c \ + x509v3/pcy_data.c x509v3/pcy_lib.c x509v3/pcy_map.c \ + x509v3/pcy_node.c x509v3/pcy_tree.c x509v3/v3_akey.c \ + x509v3/v3_akeya.c x509v3/v3_alt.c x509v3/v3_bcons.c \ + x509v3/v3_bitst.c x509v3/v3_conf.c x509v3/v3_cpols.c \ + x509v3/v3_crld.c x509v3/v3_enum.c x509v3/v3_extku.c \ + x509v3/v3_genn.c x509v3/v3_ia5.c x509v3/v3_info.c \ + x509v3/v3_int.c x509v3/v3_lib.c x509v3/v3_ncons.c \ + x509v3/v3_ocsp.c x509v3/v3_pci.c x509v3/v3_pcia.c \ + x509v3/v3_pcons.c x509v3/v3_pku.c x509v3/v3_pmaps.c \ + x509v3/v3_prn.c x509v3/v3_purp.c x509v3/v3_skey.c \ + x509v3/v3_sxnet.c x509v3/v3_utl.c x509v3/v3err.c am__objects_27 = aes/libcrypto_la-aes-elf-x86_64.lo \ aes/libcrypto_la-bsaes-elf-x86_64.lo \ aes/libcrypto_la-vpaes-elf-x86_64.lo \ @@ -759,11 +759,12 @@ x509/libcrypto_la-x509_r2x.lo x509/libcrypto_la-x509_req.lo \ x509/libcrypto_la-x509_set.lo x509/libcrypto_la-x509_trs.lo \ x509/libcrypto_la-x509_txt.lo x509/libcrypto_la-x509_v3.lo \ - x509/libcrypto_la-x509_vfy.lo x509/libcrypto_la-x509_vpm.lo \ - x509/libcrypto_la-x509cset.lo x509/libcrypto_la-x509name.lo \ - x509/libcrypto_la-x509rset.lo x509/libcrypto_la-x509spki.lo \ - x509/libcrypto_la-x509type.lo x509/libcrypto_la-x_all.lo \ - x509v3/libcrypto_la-pcy_cache.lo \ + x509/libcrypto_la-x509_vfy.lo \ + x509/libcrypto_la-x509_vfy_apple.lo \ + x509/libcrypto_la-x509_vpm.lo x509/libcrypto_la-x509cset.lo \ + x509/libcrypto_la-x509name.lo x509/libcrypto_la-x509rset.lo \ + x509/libcrypto_la-x509spki.lo x509/libcrypto_la-x509type.lo \ + x509/libcrypto_la-x_all.lo x509v3/libcrypto_la-pcy_cache.lo \ x509v3/libcrypto_la-pcy_data.lo x509v3/libcrypto_la-pcy_lib.lo \ x509v3/libcrypto_la-pcy_map.lo x509v3/libcrypto_la-pcy_node.lo \ x509v3/libcrypto_la-pcy_tree.lo x509v3/libcrypto_la-v3_akey.lo \ @@ -1000,7 +1001,7 @@ $(ASM_X86_64_ELF) $(ASM_X86_64_MACOSX) BUILT_SOURCES = crypto_portable.sym CLEANFILES = crypto_portable.sym -libcrypto_la_LDFLAGS = -version-info @LIBCRYPTO_VERSION@ -no-undefined -export-symbols crypto_portable.sym +libcrypto_la_LDFLAGS = -version-info @LIBCRYPTO_VERSION@ -no-undefined -export-symbols crypto_portable.sym -framework Security -framework CoreFoundation libcrypto_la_LIBADD = libcompat.la $(am__append_1) libcrypto_la_CPPFLAGS = $(AM_CPPFLAGS) -DLIBRESSL_INTERNAL \ -DOPENSSL_NO_HW_PADLOCK $(am__append_2) $(am__append_3) \ @@ -1272,20 +1273,20 @@ x509/x509_err.c x509/x509_ext.c x509/x509_lu.c x509/x509_obj.c \ x509/x509_r2x.c x509/x509_req.c x509/x509_set.c \ x509/x509_trs.c x509/x509_txt.c x509/x509_v3.c x509/x509_vfy.c \ - x509/x509_vpm.c x509/x509cset.c x509/x509name.c \ - x509/x509rset.c x509/x509spki.c x509/x509type.c x509/x_all.c \ - x509v3/pcy_cache.c x509v3/pcy_data.c x509v3/pcy_lib.c \ - x509v3/pcy_map.c x509v3/pcy_node.c x509v3/pcy_tree.c \ - x509v3/v3_akey.c x509v3/v3_akeya.c x509v3/v3_alt.c \ - x509v3/v3_bcons.c x509v3/v3_bitst.c x509v3/v3_conf.c \ - x509v3/v3_cpols.c x509v3/v3_crld.c x509v3/v3_enum.c \ - x509v3/v3_extku.c x509v3/v3_genn.c x509v3/v3_ia5.c \ - x509v3/v3_info.c x509v3/v3_int.c x509v3/v3_lib.c \ - x509v3/v3_ncons.c x509v3/v3_ocsp.c x509v3/v3_pci.c \ - x509v3/v3_pcia.c x509v3/v3_pcons.c x509v3/v3_pku.c \ - x509v3/v3_pmaps.c x509v3/v3_prn.c x509v3/v3_purp.c \ - x509v3/v3_skey.c x509v3/v3_sxnet.c x509v3/v3_utl.c \ - x509v3/v3err.c + x509/x509_vfy_apple.c x509/x509_vpm.c x509/x509cset.c \ + x509/x509name.c x509/x509rset.c x509/x509spki.c \ + x509/x509type.c x509/x_all.c x509v3/pcy_cache.c \ + x509v3/pcy_data.c x509v3/pcy_lib.c x509v3/pcy_map.c \ + x509v3/pcy_node.c x509v3/pcy_tree.c x509v3/v3_akey.c \ + x509v3/v3_akeya.c x509v3/v3_alt.c x509v3/v3_bcons.c \ + x509v3/v3_bitst.c x509v3/v3_conf.c x509v3/v3_cpols.c \ + x509v3/v3_crld.c x509v3/v3_enum.c x509v3/v3_extku.c \ + x509v3/v3_genn.c x509v3/v3_ia5.c x509v3/v3_info.c \ + x509v3/v3_int.c x509v3/v3_lib.c x509v3/v3_ncons.c \ + x509v3/v3_ocsp.c x509v3/v3_pci.c x509v3/v3_pcia.c \ + x509v3/v3_pcons.c x509v3/v3_pku.c x509v3/v3_pmaps.c \ + x509v3/v3_prn.c x509v3/v3_purp.c x509v3/v3_skey.c \ + x509v3/v3_sxnet.c x509v3/v3_utl.c x509v3/v3err.c # chacha @@ -2808,6 +2809,8 @@ x509/$(DEPDIR)/$(am__dirstamp) x509/libcrypto_la-x509_vfy.lo: x509/$(am__dirstamp) \ x509/$(DEPDIR)/$(am__dirstamp) +x509/libcrypto_la-x509_vfy_apple.lo: x509/$(am__dirstamp) \ + x509/$(DEPDIR)/$(am__dirstamp) x509/libcrypto_la-x509_vpm.lo: x509/$(am__dirstamp) \ x509/$(DEPDIR)/$(am__dirstamp) x509/libcrypto_la-x509cset.lo: x509/$(am__dirstamp) \ @@ -3583,6 +3586,7 @@ @AMDEP_TRUE@@am__include@ @am__quote@x509/$(DEPDIR)/libcrypto_la-x509_txt.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@x509/$(DEPDIR)/libcrypto_la-x509_v3.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@x509/$(DEPDIR)/libcrypto_la-x509_vfy.Plo@am__quote@ +@AMDEP_TRUE@@am__include@ @am__quote@x509/$(DEPDIR)/libcrypto_la-x509_vfy_apple.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@x509/$(DEPDIR)/libcrypto_la-x509_vpm.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@x509/$(DEPDIR)/libcrypto_la-x509cset.Plo@am__quote@ @AMDEP_TRUE@@am__include@ @am__quote@x509/$(DEPDIR)/libcrypto_la-x509name.Plo@am__quote@ @@ -7460,6 +7464,13 @@ @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ @am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcrypto_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o x509/libcrypto_la-x509_vfy.lo `test -f 'x509/x509_vfy.c' || echo '$(srcdir)/'`x509/x509_vfy.c +x509/libcrypto_la-x509_vfy_apple.lo: x509/x509_vfy_apple.c +@am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcrypto_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT x509/libcrypto_la-x509_vfy_apple.lo -MD -MP -MF x509/$(DEPDIR)/libcrypto_la-x509_vfy_apple.Tpo -c -o x509/libcrypto_la-x509_vfy_apple.lo `test -f 'x509/x509_vfy_apple.c' || echo '$(srcdir)/'`x509/x509_vfy_apple.c +@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) x509/$(DEPDIR)/libcrypto_la-x509_vfy_apple.Tpo x509/$(DEPDIR)/libcrypto_la-x509_vfy_apple.Plo +@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='x509/x509_vfy_apple.c' object='x509/libcrypto_la-x509_vfy_apple.lo' libtool=yes @AMDEPBACKSLASH@ +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ +@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcrypto_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o x509/libcrypto_la-x509_vfy_apple.lo `test -f 'x509/x509_vfy_apple.c' || echo '$(srcdir)/'`x509/x509_vfy_apple.c + x509/libcrypto_la-x509_vpm.lo: x509/x509_vpm.c @am__fastdepCC_TRUE@ $(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcrypto_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT x509/libcrypto_la-x509_vpm.lo -MD -MP -MF x509/$(DEPDIR)/libcrypto_la-x509_vpm.Tpo -c -o x509/libcrypto_la-x509_vpm.lo `test -f 'x509/x509_vpm.c' || echo '$(srcdir)/'`x509/x509_vpm.c @am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) x509/$(DEPDIR)/libcrypto_la-x509_vpm.Tpo x509/$(DEPDIR)/libcrypto_la-x509_vpm.Plo diff -Naur libressl-2.6.2.orig/crypto/x509/x509_vfy.c libressl-2.6.2/crypto/x509/x509_vfy.c --- libressl-2.6.2.orig/crypto/x509/x509_vfy.c 2017-09-02 14:01:08.000000000 +0200 +++ libressl-2.6.2/crypto/x509/x509_vfy.c 2017-10-07 14:05:16.000000000 +0200 @@ -115,6 +115,13 @@ #define CRL_SCORE_TIME_DELTA 0x002 +/* + * If we are using Trust Evaluation Agent, rename the original function + */ +#ifdef __APPLE__ +#define X509_verify_cert X509_verify_cert_orig +#endif + static int null_callback(int ok, X509_STORE_CTX *e); static int check_issued(X509_STORE_CTX *ctx, X509 *x, X509 *issuer); static X509 *find_issuer(X509_STORE_CTX *ctx, STACK_OF(X509) *sk, X509 *x); diff -Naur libressl-2.6.2.orig/crypto/x509/x509_vfy_apple.c libressl-2.6.2/crypto/x509/x509_vfy_apple.c --- libressl-2.6.2.orig/crypto/x509/x509_vfy_apple.c 1970-01-01 01:00:00.000000000 +0100 +++ libressl-2.6.2/crypto/x509/x509_vfy_apple.c 2017-10-07 14:05:16.000000000 +0200 @@ -0,0 +1,225 @@ +/* + * Copyright (c) 2009 Apple Inc. All Rights Reserved. + * + * @APPLE_LICENSE_HEADER_START@ + * + * This file contains Original Code and/or Modifications of Original Code + * as defined in and that are subject to the Apple Public Source License + * Version 2.0 (the 'License'). You may not use this file except in + * compliance with the License. Please obtain a copy of the License at + * http://www.opensource.apple.com/apsl/ and read it before using this + * file. + * + * The Original Code and all software distributed under the License are + * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER + * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, + * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. + * Please see the License for the specific language governing rights and + * limitations under the License. + * + * @APPLE_LICENSE_HEADER_END@ + * + */ + +#include +#include +#include + +#include + +#include + +#include +#include +#include + +#include "cryptlib.h" +#include "vpm_int.h" +#include "x509_vfy_apple.h" + +#define TEA_might_correct_error(err) (err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY || err == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT || err == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) + + +static bool add_cert_to_array(CFMutableArrayRef array, X509 *x509) +{ + unsigned char *asn1_cert_data = NULL; + int asn1_cert_len = i2d_X509(x509, &asn1_cert_data); + + CFDataRef data = CFDataCreate(kCFAllocatorDefault, asn1_cert_data, asn1_cert_len); + + if (data == NULL) { + return false; + } + + SecCertificateRef cert = SecCertificateCreateWithData(NULL, data); + + free(asn1_cert_data); + + if (cert == NULL) { + CFRelease(data); + return false; + } + + CFArrayAppendValue(array, cert); + CFRelease(data); + + return true; +} + +static CFStringRef to_string(const char *s) { + if (s == NULL) + return NULL; + return CFStringCreateWithCString(kCFAllocatorDefault, s, + kCFStringEncodingASCII); +} + +static SecPolicyRef get_policy(X509_VERIFY_PARAM *param) { + switch (param->purpose) { + case X509_PURPOSE_SSL_CLIENT: + case X509_PURPOSE_SSL_SERVER: { + + if (!param->id) { + fprintf(stderr, "got no ID!\n"); + return NULL; + } + + CFStringRef hostname; + int nhosts = sk_OPENSSL_STRING_num(param->id->hosts); + + if (nhosts != 1) { + hostname = NULL; + + } else { + hostname = to_string(sk_OPENSSL_STRING_value(param->id->hosts, 0)); + CFShow(hostname); + } + + return SecPolicyCreateSSL(param->purpose == X509_PURPOSE_SSL_SERVER, + hostname); + } + + case X509_PURPOSE_NS_SSL_SERVER: + case X509_PURPOSE_SMIME_SIGN: + case X509_PURPOSE_SMIME_ENCRYPT: + case X509_PURPOSE_CRL_SIGN: + case X509_PURPOSE_ANY: + case X509_PURPOSE_OCSP_HELPER: + case X509_PURPOSE_TIMESTAMP_SIGN: + default: + fprintf(stderr, "unsupported purpose %d", param->purpose); + return NULL; + } +} + +/* + * Please see comment in x509_vfy_apple.h + */ +int +X509_verify_cert(X509_STORE_CTX *ctx) +{ + uint64_t certLastIndex = 0; + uint64_t i = 0; + + /* Try OpenSSL, if we get a local certificate issue verify against trusted roots */ + int ret = X509_verify_cert_orig(ctx); + + /* Verify TEA is enabled and should be used. */ + if (0 == X509_TEA_is_enabled() || + ret == 1 || !TEA_might_correct_error(ctx->error)) { + return ret; + } + + /* Verify that the certificate chain exists, otherwise make it. */ + if (ctx->chain == NULL && (ctx->chain = sk_X509_new_null()) == NULL) { + fprintf(stderr, "Could not create the certificate chain"); + ctx->error = X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY; + return -1; + } + + /* Verify chain depth */ + certLastIndex = sk_X509_num(ctx->untrusted); + if (certLastIndex > ctx->param->depth) { + fprintf(stderr, "Pruning certificate chain to %" PRIu64, certLastIndex); + certLastIndex = ctx->param->depth; + } + + CFMutableArrayRef certArray = CFArrayCreateMutable(NULL, certLastIndex + 1, NULL); + CFRetain(certArray); + + if (!add_cert_to_array(certArray, ctx->cert)) { + fprintf(stderr, "Failed to add certificate to array"); + CFRelease(certArray); + ctx->error = X509_V_ERR_UNSPECIFIED; + return -1; + } + + for (i = 0; i < certLastIndex; ++i) { + X509 *t = sk_X509_value(ctx->untrusted, i); + if (!add_cert_to_array(certArray, t)) { + fprintf(stderr, "Failed to add chain certificate %lld to array", i); + CFRelease(certArray); + ctx->error = X509_V_ERR_UNSPECIFIED; + return 0; + } + } + + // We put ASN.1 encoded X509 on the CertificateChain, so we don't call TEACertificateChainSetEncodingHandler + SecPolicyRef policy = get_policy(ctx->param); + + if (policy == NULL) { + fprintf(stderr, "Failed to create policy!\n"); + CFRelease(certArray); + ctx->error = X509_V_ERR_UNSPECIFIED; + return -1; + } + + SecTrustRef trust = NULL; + + if (SecTrustCreateWithCertificates(certArray, policy, &trust) != errSecSuccess) { + fprintf(stderr, "Failed to create trust!\n"); + CFRelease(certArray); + ctx->error = X509_V_ERR_CERT_UNTRUSTED; + return -1; + } + + if (ctx->param->flags & X509_V_FLAG_USE_CHECK_TIME) { + fprintf(stderr, "Setting time not supported yet?\n"); + SecTrustSetVerifyDate(trust, CFDateCreate(NULL, ctx->param->check_time)); + } + + SecTrustResultType result = 0; + + if (SecTrustEvaluate(trust, &result) != errSecSuccess || result != kSecTrustResultUnspecified) { + CFRelease(certArray); + ctx->error = X509_V_ERR_CERT_UNTRUSTED; + return 0; + } + + CFRelease(certArray); + ctx->error = 0; + return 1; +} + +#pragma mark Trust Evaluation Agent + +/* -1: not set + * 0: set to false + * 1: set to true + */ +static int tea_enabled = -1; + +void +X509_TEA_set_state(int change) +{ + tea_enabled = (change) ? 1 : 0; +} + +int +X509_TEA_is_enabled() +{ + if (tea_enabled < 0) + tea_enabled = (NULL == getenv(X509_TEA_ENV_DISABLE)); + + return tea_enabled != 0; +} diff -Naur libressl-2.6.2.orig/crypto/x509/x509_vfy_apple.h libressl-2.6.2/crypto/x509/x509_vfy_apple.h --- libressl-2.6.2.orig/crypto/x509/x509_vfy_apple.h 1970-01-01 01:00:00.000000000 +0100 +++ libressl-2.6.2/crypto/x509/x509_vfy_apple.h 2017-10-07 14:05:16.000000000 +0200 @@ -0,0 +1,74 @@ +/* + * Copyright (c) 2009 Apple Inc. All Rights Reserved. + * + * @APPLE_LICENSE_HEADER_START@ + * + * This file contains Original Code and/or Modifications of Original Code + * as defined in and that are subject to the Apple Public Source License + * Version 2.0 (the 'License'). You may not use this file except in + * compliance with the License. Please obtain a copy of the License at + * http://www.opensource.apple.com/apsl/ and read it before using this + * file. + * + * The Original Code and all software distributed under the License are + * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER + * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, + * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. + * Please see the License for the specific language governing rights and + * limitations under the License. + * + * @APPLE_LICENSE_HEADER_END@ + * + */ + +#ifndef HEADER_X509_H +#include +#endif + +#ifndef HEADER_X509_VFY_APPLE_H +#define HEADER_X509_VFY_APPLE_H + +/* Environment variable name to disable TEA. */ +#define X509_TEA_ENV_DISABLE "OPENSSL_X509_TEA_DISABLE" + +/* + * X509_verify_cert + * + * Originally located in x509_vfy.c. + * + * Verify certificate with OpenSSL created X509_verify_cert. If and only if + * OpenSSL cannot get certificate issuer locally then OS X security API will + * verify the certificate, using Trust Evaluation Agent. + * + * Return values: + * -------------- + * -1: Null was passed for either ctx or ctx->cert. + * 0: Certificate is trusted. + * 1: Certificate is not trusted. + */ +int X509_verify_cert(X509_STORE_CTX *ctx); + +/* + * X509_TEA_is_enabled + * + * Is the Trust Evaluation Agent (TEA) used for certificate verification when + * the issuer cannot be verified. + * + * Returns 0 if TEA is disabled and 1 if TEA is enabled. + */ +int X509_TEA_is_enabled(); + +/* + * X509_TEA_set_state + * + * Enables/disables certificate verification with Trust Evaluation Agent (TEA) + * when the issuer cannot be verified. + * + * Pass 0 to disable TEA and non-zero to enable TEA. + */ +void X509_TEA_set_state(int change); + +int X509_verify_cert_orig(X509_STORE_CTX *ctx); + +#endif /* HEADER_X509_VFY_APPLE_H */