[apple/security.git] / SecurityTool / identity_prefs.c

/*
 * Copyright (c) 2003-2010,2012,2014 Apple Inc. All Rights Reserved.
 *
 * @APPLE_LICENSE_HEADER_START@
 * 
 * This file contains Original Code and/or Modifications of Original Code
 * as defined in and that are subject to the Apple Public Source License
 * Version 2.0 (the 'License'). You may not use this file except in
 * compliance with the License. Please obtain a copy of the License at
 * http://www.opensource.apple.com/apsl/ and read it before using this
 * file.
 * 
 * The Original Code and all software distributed under the License are
 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 * Please see the License for the specific language governing rights and
 * limitations under the License.
 * 
 * @APPLE_LICENSE_HEADER_END@
 *
 * identity_prefs.c
 */

#include "identity_prefs.h"
#include "identity_find.h"
#include "keychain_utilities.h"
#include "security.h"

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <Security/cssmtype.h>
#include <Security/SecCertificate.h>
#include <Security/SecIdentity.h>
#include <Security/SecIdentitySearch.h>

// SecCertificateInferLabel, SecDigestGetData
#include <Security/SecCertificatePriv.h>


static int
do_set_identity_preference(CFTypeRef keychainOrArray,
	const char *identity,
	const char *service,
	CSSM_KEYUSE keyUsage,
	const char *hash)
{
	int result = 0;
	CFStringRef serviceRef = NULL;
	SecIdentityRef identityRef = NULL;

	// must have a service name
	if (!service) {
		return 2;
	}

	// find identity (if specified by name or hash)
	if (identity || hash) {
		identityRef = find_identity(keychainOrArray, identity, hash, keyUsage);
		if (!identityRef) {
			sec_error("No matching identity found for \"%s\"", (hash) ? hash : identity);
			result = 1;
			goto cleanup;
		}
	}

	// set the identity preference
	serviceRef = CFStringCreateWithCString(NULL, service, kCFStringEncodingUTF8);
	result = SecIdentitySetPreference(identityRef, serviceRef, keyUsage);

cleanup:
	if (identityRef)
		CFRelease(identityRef);
	if (serviceRef)
		CFRelease(serviceRef);

	return result;
}

int
do_get_identity_preference(const char *service,
	CSSM_KEYUSE keyUsage,
	Boolean printName,
	Boolean printHash,
	Boolean pemFormat)
{
	int result = 0;
	if (!service) {
		return 2;
	}
	CFStringRef serviceRef = CFStringCreateWithCString(NULL, service, kCFStringEncodingUTF8);
	SecCertificateRef certRef = NULL;
	SecIdentityRef identityRef = NULL;
	CSSM_DATA certData = { 0, NULL };

	result = SecIdentityCopyPreference(serviceRef, keyUsage, NULL, &identityRef);
	if (result) {
		sec_perror("SecIdentityCopyPreference", result);
		goto cleanup;
	}
	result = SecIdentityCopyCertificate(identityRef, &certRef);
	if (result) {
		sec_perror("SecIdentityCopyCertificate", result);
		goto cleanup;
	}
	result = SecCertificateGetData(certRef, &certData);
	if (result) {
		sec_perror("SecCertificateGetData", result);
		goto cleanup;
	}

	if (printName) {
		char *nameBuf = NULL;
		CFStringRef nameRef = NULL;
		(void)SecCertificateCopyCommonName(certRef, &nameRef);
		CFIndex nameLen = (nameRef) ? CFStringGetLength(nameRef) : 0;
		if (nameLen > 0) {
			CFIndex bufLen = 1 + CFStringGetMaximumSizeForEncoding(nameLen, kCFStringEncodingUTF8);
			nameBuf = (char *)malloc(bufLen);
			if (!CFStringGetCString(nameRef, nameBuf, bufLen-1, kCFStringEncodingUTF8))
				nameBuf[0]=0;
		}
		fprintf(stdout, "common name: \"%s\"\n", (nameBuf && nameBuf[0] != 0) ? nameBuf : "<NULL>");
		if (nameBuf)
			free(nameBuf);
		safe_CFRelease(&nameRef);
	}

	if (printHash) {
		uint8 sha1_hash[20];
		CSSM_DATA digest;
		digest.Length = sizeof(sha1_hash);
		digest.Data = sha1_hash;
		if (SecDigestGetData(CSSM_ALGID_SHA1, &digest, &certData) == CSSM_OK) {
			unsigned int i;
			uint32 len = digest.Length;
			uint8 *cp = digest.Data;
			fprintf(stdout, "SHA-1 hash: ");
			for(i=0; i<len; i++) {
				fprintf(stdout, "%02X", ((unsigned char *)cp)[i]);
			}
			fprintf(stdout, "\n");
		}
	}

	if (pemFormat)
	{
		CSSM_DATA certData = { 0, NULL };
		result = SecCertificateGetData(certRef, &certData);
		if (result) {
			sec_perror("SecCertificateGetData", result);
			goto cleanup;
		}

		print_buffer_pem(stdout, "CERTIFICATE", certData.Length, certData.Data);
	}
	else
	{
		print_keychain_item_attributes(stdout, (SecKeychainItemRef)certRef, FALSE, FALSE, FALSE, FALSE);
	}

cleanup:
	safe_CFRelease(&serviceRef);
	safe_CFRelease(&certRef);
	safe_CFRelease(&identityRef);

	return result;
}

int
set_identity_preference(int argc, char * const *argv)
{
	int ch, result = 0;
	char *identity = NULL, *service = NULL, *hash = NULL;
	CSSM_KEYUSE keyUsage = 0;
	CFTypeRef keychainOrArray = NULL;

	/*
	 *	"    -n  Specify no identity (clears existing preference for service)\n"
	 *	"    -c  Specify identity by common name of the certificate\n"
	 *	"    -s  Specify service (URI, email address, DNS host, or other name)\n"
	 *  "        for which this identity is to be preferred\n"
	 *	"    -u  Specify key usage (optional)\n"
	 *	"    -Z  Specify identity by SHA-1 hash of certificate (optional)\n"
	 */

	while ((ch = getopt(argc, argv, "hnc:s:u:Z:")) != -1)
	{
		switch  (ch)
		{
			case 'n':
				identity = NULL;
				break;
			case 'c':
				identity = optarg;
				break;
			case 's':
				service = optarg;
				break;
			case 'u':
				keyUsage = atoi(optarg);
				break;
			case 'Z':
				hash = optarg;
				break;
			case '?':
			default:
				result = 2; /* @@@ Return 2 triggers usage message. */
				goto cleanup;
		}
	}

	argc -= optind;
	argv += optind;

    keychainOrArray = keychain_create_array(argc, argv);

	result = do_set_identity_preference(keychainOrArray, identity, service, keyUsage, hash);

cleanup:
	safe_CFRelease(&keychainOrArray);

	return result;
}

int
get_identity_preference(int argc, char * const *argv)
{
	int ch, result = 0;
	char *service = NULL;
	Boolean printName = FALSE, printHash = FALSE, pemFormat = FALSE;
	CSSM_KEYUSE keyUsage = 0;

	/*
	 *	"    -s  Specify service (URI, email address, DNS host, or other name)\n"
	 *	"    -u  Specify key usage (optional)\n"
	 *  "    -p  Output identity certificate in pem format\n"
	 *	"    -c  Print common name of the preferred identity certificate (optional)\n"
	 *	"    -Z  Print SHA-1 hash of the preferred identity certificate (optional)\n"
	 */

	while ((ch = getopt(argc, argv, "hs:u:pcZ")) != -1)
	{
		switch  (ch)
		{
			case 'c':
				printName = TRUE;
				break;
			case 'p':
				pemFormat = TRUE;
				break;
			case 's':
				service = optarg;
				break;
			case 'u':
				keyUsage = atoi(optarg);
				break;
			case 'Z':
				printHash = TRUE;
				break;
			case '?':
			default:
				result = 2; /* @@@ Return 2 triggers usage message. */
				goto cleanup;
		}
	}

	result = do_get_identity_preference(service, keyUsage, printName, printHash, pemFormat);

cleanup:

	return result;
}
Commit	Line	Data
d8f41ccd A	1	/*
	2	* Copyright (c) 2003-2010,2012,2014 Apple Inc. All Rights Reserved.
	3	*
	4	* @APPLE_LICENSE_HEADER_START@
	5	*
	6	* This file contains Original Code and/or Modifications of Original Code
	7	* as defined in and that are subject to the Apple Public Source License
	8	* Version 2.0 (the 'License'). You may not use this file except in
	9	* compliance with the License. Please obtain a copy of the License at
	10	* http://www.opensource.apple.com/apsl/ and read it before using this
	11	* file.
	12	*
	13	* The Original Code and all software distributed under the License are
	14	* distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
	15	* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
	16	* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
	17	* FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
	18	* Please see the License for the specific language governing rights and
	19	* limitations under the License.
	20	*
	21	* @APPLE_LICENSE_HEADER_END@
	22	*
	23	* identity_prefs.c
	24	*/
	25
	26	#include "identity_prefs.h"
	27	#include "identity_find.h"
	28	#include "keychain_utilities.h"
	29	#include "security.h"
	30
	31	#include <stdio.h>
	32	#include <stdlib.h>
	33	#include <string.h>
	34	#include <unistd.h>
	35	#include <Security/cssmtype.h>
	36	#include <Security/SecCertificate.h>
	37	#include <Security/SecIdentity.h>
	38	#include <Security/SecIdentitySearch.h>
	39
	40	// SecCertificateInferLabel, SecDigestGetData
	41	#include <Security/SecCertificatePriv.h>
	42
	43
	44	static int
	45	do_set_identity_preference(CFTypeRef keychainOrArray,
	46	const char *identity,
	47	const char *service,
	48	CSSM_KEYUSE keyUsage,
	49	const char *hash)
	50	{
	51	int result = 0;
	52	CFStringRef serviceRef = NULL;
	53	SecIdentityRef identityRef = NULL;
	54
	55	// must have a service name
	56	if (!service) {
	57	return 2;
	58	}
	59
	60	// find identity (if specified by name or hash)
	61	if (identity \|\| hash) {
	62	identityRef = find_identity(keychainOrArray, identity, hash, keyUsage);
	63	if (!identityRef) {
	64	sec_error("No matching identity found for \"%s\"", (hash) ? hash : identity);
65	result = 1;
66	goto cleanup;
67	}
68	}
69
70	// set the identity preference
71	serviceRef = CFStringCreateWithCString(NULL, service, kCFStringEncodingUTF8);
72	result = SecIdentitySetPreference(identityRef, serviceRef, keyUsage);
73
74	cleanup:
75	if (identityRef)
76	CFRelease(identityRef);
77	if (serviceRef)
78	CFRelease(serviceRef);
79
80	return result;
81	}
82
83	int
84	do_get_identity_preference(const char *service,
85	CSSM_KEYUSE keyUsage,
86	Boolean printName,
87	Boolean printHash,
88	Boolean pemFormat)
89	{
90	int result = 0;
91	if (!service) {
92	return 2;
93	}
94	CFStringRef serviceRef = CFStringCreateWithCString(NULL, service, kCFStringEncodingUTF8);
95	SecCertificateRef certRef = NULL;
96	SecIdentityRef identityRef = NULL;
97	CSSM_DATA certData = { 0, NULL };
98
99	result = SecIdentityCopyPreference(serviceRef, keyUsage, NULL, &identityRef);
100	if (result) {
101	sec_perror("SecIdentityCopyPreference", result);
102	goto cleanup;
103	}
104	result = SecIdentityCopyCertificate(identityRef, &certRef);
105	if (result) {
106	sec_perror("SecIdentityCopyCertificate", result);
107	goto cleanup;
108	}
109	result = SecCertificateGetData(certRef, &certData);
110	if (result) {
111	sec_perror("SecCertificateGetData", result);
112	goto cleanup;
113	}
114
115	if (printName) {
116	char *nameBuf = NULL;
117	CFStringRef nameRef = NULL;
118	(void)SecCertificateCopyCommonName(certRef, &nameRef);
119	CFIndex nameLen = (nameRef) ? CFStringGetLength(nameRef) : 0;
120	if (nameLen > 0) {
121	CFIndex bufLen = 1 + CFStringGetMaximumSizeForEncoding(nameLen, kCFStringEncodingUTF8);
122	nameBuf = (char *)malloc(bufLen);
123	if (!CFStringGetCString(nameRef, nameBuf, bufLen-1, kCFStringEncodingUTF8))
124	nameBuf[0]=0;
125	}
126	fprintf(stdout, "common name: \"%s\"\n", (nameBuf && nameBuf[0] != 0) ? nameBuf : "<NULL>");
127	if (nameBuf)
128	free(nameBuf);
129	safe_CFRelease(&nameRef);
130	}
131
132	if (printHash) {
133	uint8 sha1_hash[20];
134	CSSM_DATA digest;
135	digest.Length = sizeof(sha1_hash);
136	digest.Data = sha1_hash;
137	if (SecDigestGetData(CSSM_ALGID_SHA1, &digest, &certData) == CSSM_OK) {
138	unsigned int i;
139	uint32 len = digest.Length;
140	uint8 *cp = digest.Data;
141	fprintf(stdout, "SHA-1 hash: ");
142	for(i=0; i<len; i++) {
143	fprintf(stdout, "%02X", ((unsigned char *)cp)[i]);
144	}
145	fprintf(stdout, "\n");
146	}
147	}
148
149	if (pemFormat)
150	{
151	CSSM_DATA certData = { 0, NULL };
152	result = SecCertificateGetData(certRef, &certData);
153	if (result) {
154	sec_perror("SecCertificateGetData", result);
155	goto cleanup;
156	}
157
158	print_buffer_pem(stdout, "CERTIFICATE", certData.Length, certData.Data);
159	}
160	else
161	{
162	print_keychain_item_attributes(stdout, (SecKeychainItemRef)certRef, FALSE, FALSE, FALSE, FALSE);
163	}
164
165	cleanup:
166	safe_CFRelease(&serviceRef);
167	safe_CFRelease(&certRef);
168	safe_CFRelease(&identityRef);
169
170	return result;
171	}
172
173	int
174	set_identity_preference(int argc, char * const *argv)
175	{
176	int ch, result = 0;
177	char identity = NULL, service = NULL, *hash = NULL;
178	CSSM_KEYUSE keyUsage = 0;
179	CFTypeRef keychainOrArray = NULL;
180
181	/*
182	* " -n Specify no identity (clears existing preference for service)\n"
183	* " -c Specify identity by common name of the certificate\n"
184	* " -s Specify service (URI, email address, DNS host, or other name)\n"
185	* " for which this identity is to be preferred\n"
186	* " -u Specify key usage (optional)\n"
187	* " -Z Specify identity by SHA-1 hash of certificate (optional)\n"
188	*/
189
190	while ((ch = getopt(argc, argv, "hnc:s:u:Z:")) != -1)
191	{
192	switch (ch)
193	{
194	case 'n':
195	identity = NULL;
196	break;
197	case 'c':
198	identity = optarg;
199	break;
200	case 's':
201	service = optarg;
202	break;
203	case 'u':
204	keyUsage = atoi(optarg);
205	break;
206	case 'Z':
207	hash = optarg;
208	break;
209	case '?':
210	default:
211	result = 2; /* @@@ Return 2 triggers usage message. */
212	goto cleanup;
213	}
214	}
215
216	argc -= optind;
217	argv += optind;
218
219	keychainOrArray = keychain_create_array(argc, argv);
220
221	result = do_set_identity_preference(keychainOrArray, identity, service, keyUsage, hash);
222
223	cleanup:
224	safe_CFRelease(&keychainOrArray);
225
226	return result;
227	}
228
229	int
230	get_identity_preference(int argc, char * const *argv)
231	{
232	int ch, result = 0;
233	char *service = NULL;
234	Boolean printName = FALSE, printHash = FALSE, pemFormat = FALSE;
235	CSSM_KEYUSE keyUsage = 0;
236
237	/*
238	* " -s Specify service (URI, email address, DNS host, or other name)\n"
239	* " -u Specify key usage (optional)\n"
240	* " -p Output identity certificate in pem format\n"
241	* " -c Print common name of the preferred identity certificate (optional)\n"
242	* " -Z Print SHA-1 hash of the preferred identity certificate (optional)\n"
243	*/
244
245	while ((ch = getopt(argc, argv, "hs:u:pcZ")) != -1)
246	{
247	switch (ch)
248	{
249	case 'c':
250	printName = TRUE;
251	break;
252	case 'p':
253	pemFormat = TRUE;
254	break;
255	case 's':
256	service = optarg;
257	break;
258	case 'u':
259	keyUsage = atoi(optarg);
260	break;
261	case 'Z':
262	printHash = TRUE;
263	break;
264	case '?':
265	default:
266	result = 2; /* @@@ Return 2 triggers usage message. */
267	goto cleanup;
268	}
269	}
270
271	result = do_get_identity_preference(service, keyUsage, printName, printHash, pemFormat);
272
273	cleanup:
274
275	return result;
276	}
277