lib/requirement.h

   1 /*
   2  * Copyright (c) 2006-2007 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 //
  25 // requirement - Code Requirement Blob description
  26 //
  27 #ifndef _H_REQUIREMENT
  28 #define _H_REQUIREMENT
  29
  30 #include <security_utilities/blob.h>
  31 #include <security_utilities/superblob.h>
  32 #include <security_utilities/hashing.h>
  33 #include <Security/CodeSigning.h>
  34 #include "codedirectory.h"
  35 #include <map>
  36
  37 namespace Security {
  38 namespace CodeSigning {
  39
  40
  41 //
  42 // Single requirement.
  43 // This is a contiguous binary blob, starting with this header
  44 // and followed by binary expr-code. All links within the blob
  45 // are offset-relative to the start of the header.
  46 // This is designed to be a binary stable format. Note that we restrict
  47 // outselves to 4GB maximum size (4 byte size/offset), and we expect real
  48 // Requirement blobs to be fairly small (a few kilobytes at most).
  49 //
  50 // The "kind" field allows for adding different kinds of Requirements altogether
  51 // in the future. We expect to stay within the framework of "opExpr" requirements,
  52 // but it never hurts to have a way out.
  53 //
  54 class Requirement: public Blob<Requirement, 0xfade0c00> {
  55 public:
  56         class Maker;                            // makes Requirement blobs
  57         class Context;                          // evaluation context
  58         class Reader;                           // structured reader
  59         class Interpreter;                      // evaluation engine
  60
  61         // different forms of Requirements. Right now, we only support exprForm ("opExprs")
  62         enum Kind {
  63                 exprForm = 1                    // prefix expr form
  64         };
  65
  66         void kind(Kind k) { mKind = k; }
  67         Kind kind() const { return Kind(uint32_t(mKind)); }
  68
  69         // validate this requirement against a code context
  70         void validate(const Context &ctx, OSStatus failure = errSecCSReqFailed) const;
  71
  72         // certificate positions (within a standard certificate chain)
  73         static const int leafCert = 0;          // index for leaf (first in chain)
  74         static const int anchorCert = -1;       // index for anchor (last in chain)
  75
  76         // the SHA1 hash of the canonical "Apple Anchor", i.e. the X509 Anchor
  77         // that is considered "Apple's anchor certificate", as defined by hashOfCertificate().
  78         static const SHA1::Digest &appleAnchorHash();
  79 #if defined(TEST_APPLE_ANCHOR)
  80         static const char testAppleAnchorEnv[];
  81         static const SHA1::Digest &testAppleAnchorHash();
  82 #endif //TEST_APPLE_ANCHOR
  83
  84         // common alignment rule for all requirement forms
  85         static const size_t baseAlignment = sizeof(uint32_t); // (we might as well say "four")
  86
  87     // canonical (source) names of Requirement types (matched to SecRequirementType in CSCommon.h)
  88     static const char *const typeNames[];
  89
  90         IFDUMP(void dump() const);
  91
  92 private:
  93         Endian<uint32_t> mKind;                 // expression kind
  94 };
  95
  96
  97 //
  98 // An interpretation context
  99 //
 100 struct Requirement::Context {
 101         Context(CFArrayRef certChain, CFDictionaryRef infoDict, CFDictionaryRef entitlementDict, const CodeDirectory *dir)
 102                 : certs(certChain), info(infoDict), entitlements(entitlementDict), directory(dir) { }
 103
 104         const CFArrayRef certs;
 105         const CFDictionaryRef info;
 106         const CFDictionaryRef entitlements;
 107         const CodeDirectory * const directory;
 108
 109         SecCertificateRef cert(int ix) const;           // get a cert from the cert chain
 110         unsigned int certCount() const;                         // length of cert chain
 111 };
 112
 113
 114 //
 115 // exprForm opcodes.
 116 //
 117 // Opcodes are broken into flags in the (HBO) high byte, and an opcode value
 118 // in the remaining 24 bits. Note that opcodes will remain fairly small
 119 // (almost certainly <60000), so we have the third byte to play around with
 120 // in the future, if needed. For now, small opcodes effective reserve this byte
 121 // as zero.
 122 // The flag byte allows for limited understanding of unknown opcodes. It allows
 123 // the interpreter to use the known opcode parts of the program while semi-creatively
 124 // disregarding the parts it doesn't know about. An unrecognized opcode with zero
 125 // flag byte causes evaluation to categorically fail, since the semantics of such
 126 // an opcode cannot safely be predicted.
 127 //
 128 enum {
 129         // semantic bits or'ed into the opcode
 130         opFlagMask =     0xFF000000,    // high bit flags
 131         opGenericFalse = 0x80000000,    // has size field; okay to default to false
 132         opGenericSkip =  0x40000000,    // has size field; skip and continue
 133 };
 134
 135 enum ExprOp {
 136         opFalse,                                                // unconditionally false
 137         opTrue,                                                 // unconditionally true
 138         opIdent,                                                // match canonical code [string]
 139         opAppleAnchor,                                  // signed by Apple as Apple's product
 140         opAnchorHash,                                   // match anchor [cert hash]
 141         opInfoKeyValue,                                 // *legacy* - use opInfoKeyField [key; value]
 142         opAnd,                                                  // binary prefix expr AND expr [expr; expr]
 143         opOr,                                                   // binary prefix expr OR expr [expr; expr]
 144         opCDHash,                                               // match hash of CodeDirectory directly [cd hash]
 145         opNot,                                                  // logical inverse [expr]
 146         opInfoKeyField,                                 // Info.plist key field [string; match suffix]
 147         opCertField,                                    // Certificate field [cert index; field name; match suffix]
 148         opTrustedCert,                                  // require trust settings to approve one particular cert [cert index]
 149         opTrustedCerts,                                 // require trust settings to approve the cert chain
 150         opCertGeneric,                                  // Certificate component by OID [cert index; oid; match suffix]
 151         opAppleGenericAnchor,                   // signed by Apple in any capacity
 152         opEntitlementField,                             // entitlement dictionary field [string; match suffix]
 153         exprOpCount                                             // (total opcode count in use)
 154 };
 155
 156 // match suffix opcodes
 157 enum MatchOperation {
 158         matchExists,                                    // anything but explicit "false" - no value stored
 159         matchEqual,                                             // equal (CFEqual)
 160         matchContains,                                  // partial match (substring)
 161         matchBeginsWith,                                // partial match (initial substring)
 162         matchEndsWith,                                  // partial match (terminal substring)
 163         matchLessThan,                                  // less than (string with numeric comparison)
 164         matchGreaterThan,                               // greater than (string with numeric comparison)
 165         matchLessEqual,                                 // less or equal (string with numeric comparison)
 166         matchGreaterEqual,                              // greater or equal (string with numeric comparison)
 167 };
 168
 169
 170 //
 171 // We keep Requirement groups in SuperBlobs, indexed by SecRequirementType
 172 //
 173 typedef SuperBlob<0xfade0c01> Requirements;
 174
 175
 176 //
 177 // A helper to deal with the magic merger logic of internal requirements
 178 //
 179 class InternalRequirements : public Requirements::Maker {
 180 public:
 181         InternalRequirements() : mReqs(NULL) { }
 182         ~InternalRequirements() { ::free((void *)mReqs); }
 183         void operator () (const Requirements *given, const Requirements *defaulted);
 184         operator const Requirements * () const { return mReqs; }
 185
 186 private:
 187         const Requirements *mReqs;
 188 };
 189
 190
 191 }       // CodeSigning
 192
 193
 194 //
 195 // Flipper overloads must go directly into the Security namespace
 196 //
 197 inline CodeSigning::ExprOp h2n(CodeSigning::ExprOp op)  { return CodeSigning::ExprOp(h2n(uint32_t(op))); }
 198 inline CodeSigning::ExprOp n2h(CodeSigning::ExprOp op)  { return CodeSigning::ExprOp(n2h(uint32_t(op))); }
 199 inline CodeSigning::MatchOperation h2n(CodeSigning::MatchOperation op)  { return CodeSigning::MatchOperation(h2n(uint32_t(op))); }
 200 inline CodeSigning::MatchOperation n2h(CodeSigning::MatchOperation op)  { return CodeSigning::MatchOperation(n2h(uint32_t(op))); }
 201
 202
 203 }       // Security
 204
 205 #endif //_H_REQUIREMENT