OSX/sec/Security/SecImportExport.c

   1 /*
   2  * Copyright (c) 2007-2008,2012-2013 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #include <Security/SecBase.h>
  25 #include <Security/SecBasePriv.h>
  26 #include <Security/SecItem.h>
  27 #include <Security/SecRSAKey.h>
  28 #include <Security/SecECKey.h>
  29 #include <Security/SecCertificate.h>
  30 #include <Security/SecIdentityPriv.h>
  31 #include <Security/SecPolicy.h>
  32 #include <Security/SecTrust.h>
  33 #include <Security/SecInternal.h>
  34 #include <libDER/oids.h>
  35
  36 #include <AssertMacros.h>
  37
  38 #include "p12import.h"
  39 #include <Security/SecImportExportPriv.h>
  40
  41 #if !TARGET_OS_OSX
  42 const CFStringRef kSecImportExportPassphrase = CFSTR("passphrase");
  43 const CFStringRef kSecImportItemLabel = CFSTR("label");
  44 const CFStringRef kSecImportItemKeyID = CFSTR("keyid");
  45 const CFStringRef kSecImportItemTrust = CFSTR("trust");
  46 const CFStringRef kSecImportItemCertChain = CFSTR("chain");
  47 const CFStringRef kSecImportItemIdentity = CFSTR("identity");
  48 #endif
  49
  50 typedef struct {
  51     CFMutableArrayRef certs;
  52     p12_error *status;
  53 } collect_certs_context;
  54
  55
  56 static void collect_certs(const void *key, const void *value, void *context)
  57 {
  58     if (!CFDictionaryContainsKey(value, CFSTR("key"))) {
  59         CFDataRef cert_bytes = CFDictionaryGetValue(value, CFSTR("cert"));
  60         if (!cert_bytes)
  61             return;
  62         collect_certs_context *a_collect_certs_context = (collect_certs_context *)context;
  63         SecCertificateRef cert =
  64             SecCertificateCreateWithData(kCFAllocatorDefault, cert_bytes);
  65         if (!cert)  {
  66             *a_collect_certs_context->status = p12_decodeErr;
  67             return;
  68         }
  69         CFMutableArrayRef cert_array = a_collect_certs_context->certs;
  70         CFArrayAppendValue(cert_array, cert);
  71         CFRelease(cert);
  72     }
  73 }
  74
  75 typedef struct {
  76     CFMutableArrayRef identities;
  77     CFArrayRef certs;
  78     p12_error *status;
  79 } build_trust_chains_context;
  80
  81 static void build_trust_chains(const void *key, const void *value,
  82     void *context)
  83 {
  84     CFMutableDictionaryRef identity_dict = CFDictionaryCreateMutable(kCFAllocatorDefault,
  85         0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
  86     SecKeyRef private_key = NULL;
  87     SecCertificateRef cert = NULL;
  88     SecIdentityRef identity = NULL;
  89     SecPolicyRef policy = NULL;
  90     CFMutableArrayRef cert_chain = NULL, eval_chain = NULL;
  91     SecTrustRef trust = NULL;
  92     build_trust_chains_context * a_build_trust_chains_context = (build_trust_chains_context*)context;
  93
  94     CFDataRef key_bytes = CFDictionaryGetValue(value, CFSTR("key"));
  95     require(key_bytes, out);
  96     CFDataRef cert_bytes = CFDictionaryGetValue(value, CFSTR("cert"));
  97     require(cert_bytes, out);
  98     CFDataRef algoid_bytes = CFDictionaryGetValue(value, CFSTR("algid"));
  99
 100
 101     DERItem algorithm = { (DERByte *)CFDataGetBytePtr(algoid_bytes), CFDataGetLength(algoid_bytes) };
 102     if (DEROidCompare(&oidEcPubKey, &algorithm)) {
 103         require (private_key = SecKeyCreateECPrivateKey(kCFAllocatorDefault,
 104                                                          CFDataGetBytePtr(key_bytes), CFDataGetLength(key_bytes),
 105                                                          kSecKeyEncodingPkcs1), out);
 106     } else if (DEROidCompare(&oidRsa, &algorithm)) {
 107         require (private_key = SecKeyCreateRSAPrivateKey(kCFAllocatorDefault,
 108                                                          CFDataGetBytePtr(key_bytes), CFDataGetLength(key_bytes),
 109                                                          kSecKeyEncodingPkcs1), out);
 110     } else {
 111         *a_build_trust_chains_context->status = p12_decodeErr;
 112         goto out;
 113     }
 114
 115     require_action(cert = SecCertificateCreateWithData(kCFAllocatorDefault, cert_bytes), out,
 116                    *a_build_trust_chains_context->status = p12_decodeErr);
 117     require_action(identity = SecIdentityCreate(kCFAllocatorDefault, cert, private_key), out,
 118                    *a_build_trust_chains_context->status = p12_decodeErr);
 119     CFDictionarySetValue(identity_dict, kSecImportItemIdentity, identity);
 120
 121     eval_chain = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
 122     require(eval_chain, out);
 123     CFArrayAppendValue(eval_chain, cert);
 124     CFRange all_certs = { 0, CFArrayGetCount(a_build_trust_chains_context->certs) };
 125     CFArrayAppendArray(eval_chain, a_build_trust_chains_context->certs, all_certs);
 126     require(policy = SecPolicyCreateBasicX509(), out);
 127     SecTrustResultType result;
 128     SecTrustCreateWithCertificates(eval_chain, policy, &trust);
 129     require(trust, out);
 130     SecTrustEvaluate(trust, &result);
 131     CFDictionarySetValue(identity_dict, kSecImportItemTrust, trust);
 132
 133     require(cert_chain = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks), out);
 134     CFIndex cert_chain_length = SecTrustGetCertificateCount(trust);
 135     int i;
 136     for (i = 0; i < cert_chain_length; i++)
 137         CFArrayAppendValue(cert_chain, SecTrustGetCertificateAtIndex(trust, i));
 138     CFDictionarySetValue(identity_dict, kSecImportItemCertChain, cert_chain);
 139
 140     CFArrayAppendValue(a_build_trust_chains_context->identities, identity_dict);
 141 out:
 142     CFReleaseSafe(identity_dict);
 143     CFReleaseSafe(identity);
 144     CFReleaseSafe(private_key);
 145     CFReleaseSafe(cert);
 146     CFReleaseSafe(policy);
 147     CFReleaseSafe(cert_chain);
 148     CFReleaseSafe(eval_chain);
 149     CFReleaseSafe(trust);
 150 }
 151
 152 #if TARGET_OS_OSX
 153 OSStatus SecPKCS12Import_ios(CFDataRef pkcs12_data, CFDictionaryRef options, CFArrayRef *items)
 154 #else
 155 OSStatus SecPKCS12Import(CFDataRef pkcs12_data, CFDictionaryRef options, CFArrayRef *items)
 156 #endif
 157 {
 158     pkcs12_context context = {};
 159     SecAsn1CoderCreate(&context.coder);
 160     if (options)
 161         context.passphrase = CFDictionaryGetValue(options, kSecImportExportPassphrase);
 162     context.items = CFDictionaryCreateMutable(kCFAllocatorDefault,
 163         0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 164     p12_error status = p12decode(&context, pkcs12_data);
 165     if (!status) {
 166         CFMutableArrayRef certs = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
 167         collect_certs_context a_collect_certs_context = { certs, &status };
 168         CFDictionaryApplyFunction(context.items, collect_certs, &a_collect_certs_context);
 169
 170         if (!status) {
 171             CFMutableArrayRef identities = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
 172             build_trust_chains_context a_build_trust_chains_context = { identities, certs, &status };
 173             CFDictionaryApplyFunction(context.items, build_trust_chains, &a_build_trust_chains_context);
 174             CFReleaseSafe(certs);
 175
 176             /* ignoring certs that weren't picked up as part of the certchain for found keys */
 177             *items = identities;
 178         }
 179     }
 180
 181     CFReleaseSafe(context.items);
 182     SecAsn1CoderRelease(context.coder);
 183
 184     switch (status) {
 185     case p12_noErr: return errSecSuccess;
 186     case p12_passwordErr: return errSecAuthFailed;
 187     case p12_decodeErr: return errSecDecode;
 188     default: return errSecInternal;
 189     };
 190     return errSecSuccess;
 191 }
 192