Purpose

This function lets applications call TP module-specific operations that have been exported. For PKITP, the module-specific operations support certificate chain validation, based on the CA and SITE certificates that are contained within a key ring.

Parameters

TPHandle

Handle to this Trust Policy module (PKITP).

CLHandle

Not used. PKITP ignores this.

DLHandle

Not used. PKITP ignores this.

DBHandle

Not used. PKITP ignores this.

CCHandle

Not used. PKITP ignores this.

PassThroughId

Used to indicate the pass-through service requested. Two services are provided:

• Service 1 CertGroupVerify (TP_VERIFY_PASSTHROUGH)
• Service 2 FreeEvidence (TP_FREE_EVIDENCE_PASSTHROUGH)

InputParams

Pointer to the API-caller-provided input parameter structure. The same structure is used for both pass-through functions. It is declared in pkitp.h as follows:

typedef struct tp_verify_extra {

   /* similar parameters as TP_CertGroupVerify */
   CSSM_CL_HANDLE CLHandle;
   CSSM_DL_DB_LIST_PTR DBList;
   unsigned int reserved; //@L1C
   CSSM_TP_STOP_ON VerificationAbortOn;
   CSSM_CERTGROUP_PTR CertToBeVerified;

   /* extra parameters: input */
   TP_INITIALPOLICY_PTR InitialPolicy;
   time_t CurrentTime;
   time_t ValidationTime;

   /* extra parameters: output */
   CSSM_BOOL result;
   uint32 DLStatusCode;                   // Status code from DL failures
   uint32 DLindex;                        // Index (from 0) into DBList
   TP_EVIDENCE_PTR Evidence;

} TP_VERIFY_EXTRA, *TP_VERIFY_EXTRA_PTR;

The DB list

This DBList contains one or more handles to open DB stores. The last entry in this list must be a handle to an OCEPDL DB (a real or virtual SAF key ring). The key ring is used to declare the list of trusted CA and SITE certificates. Like the OCEP Trust Policy, certificate chains to verify must originate from one of these trusted CAs (anchors) or the end-entity certificate must be one of the SITE certificates. Also like the OCEP Trust Policy, if the security product (SAF) marks any certificate in the candidate chain NOTRUST, the certificate chain fails validation.

The other entries in the list are used for LDAPDL DB stores. PKITP runs through these to locate CRLs and intermediate CA certificates. For each item PKITP requests, the LDAPDLs are queried in the order in which they appear in the list. The search stops the first time an LDAPDL returns an item or when the OCEPDL is reached. No query is made to the OCEPDL to locate CRLs or intermediate CA certificates.

The initial policy

typedef struct tp_initialpolicy {

   /* initial-policy-set */
   uint32 NumberofPolicyIdentifiers; // number of application specific
                                     // policy OIDs (defaults to 0)
   CSSM_OID_PTR PolicyIdentifiers;   // Address of array of policy OIDs
                                     // or 0
   uint32 useCRLs;                   // 0 - no CRL processing
                                     // 1 - Check CRLs only if current CRLs found
                                     // 2 - Strong CRL checking (default)
   /* initial-explicit-policy indicator */
   CSSM_BOOL initialExplicitPolicy; // If true, indicates PKITP should
                                    // consider policy set critical
                                    // defaults to false
   /* initial-policy-mapping-inhibit indicator */
   CSSM_BOOL initialPolicyMappingInhibit; // not used, ignored

} TP_INITIALPOLICY, *TP_INITIALPOLICY_PTR;

The evidence

typedef struct tp_evidence {

   /* valid certification path if validation succeeds */
   CSSM_CERTGROUP_PTR CompleteCertGroup;

   /* relevant CRL if validation fails */
   CSSM_DATA_PTR CRL;

   /* relevant certificate if validation fails */
   CSSM_DATA_PTR Cert;

   /* authority-constrained-policy */
   CSSM_BOOL authAnyPolicy;
   uint32 NumberofAuthCertPolicyIdentifiers;
   CSSM_OID_PTR AuthCertPolicyIdentifiers;

   /* list of policy mappings that occurred */
   uint32 NumberOfMappedPolicies;
   TP_CSSM_OID_PAIR_PTR mappedPolicies;

} TP_EVIDENCE, *TP_EVIDENCE_PTR;

Error codes