]> git.saurik.com Git - apple/security.git/blob - OSX/libsecurity_keychain/lib/SecItem.cpp
projects / apple / security.git / blob
? search:


2cdb17f942f5d256d6dc24c426f987c6dfa1d390
[apple/security.git] / OSX / libsecurity_keychain / lib / SecItem.cpp
1 /*
2 * Copyright (c) 2006-2019 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24 #include "SecBridge.h"
25 #include <Security/SecInternal.h>
26 #include <CoreFoundation/CoreFoundation.h>
27 #include <security_utilities/cfutilities.h>
28 #include <Security/SecBase.h>
29 #include <Security/SecKeychainItem.h>
30 #include <Security/SecCertificate.h>
31 #include <Security/SecCertificatePriv.h>
32 #include <sys/param.h>
33 #include "cssmdatetime.h"
34 #include <Security/SecItem.h>
35 #include <Security/SecItemPriv.h>
36 #include <Security/SecIdentitySearchPriv.h>
37 #include <Security/SecKeychainPriv.h>
38 #include <Security/SecCertificatePriv.h>
39 #include <Security/SecPolicyPriv.h>
40 #include "TrustAdditions.h"
41 #include "TrustSettingsSchema.h"
42 #include <Security/SecTrustPriv.h>
43 #include "utilities/array_size.h"
44 #include "utilities/SecCFWrappers.h"
45
46 #include <AssertMacros.h>
47 #include <syslog.h>
48 #include <dlfcn.h>
49
50 #include <Security/SecTrustedApplication.h>
51 #include <Security/SecTrustedApplicationPriv.h>
52 #include <Security/SecCode.h>
53 #include <Security/SecCodePriv.h>
54 #include <Security/SecRequirement.h>
55
56 #include <login/SessionAgentCom.h>
57 #include <login/SessionAgentStatusCom.h>
58 #include <os/activity.h>
59 #include <CoreFoundation/CFPriv.h>
60
61
62 const uint8_t kUUIDStringLength = 36;
63
64 OSStatus SecItemAdd_osx(CFDictionaryRef attributes, CFTypeRef *result);
65 OSStatus SecItemCopyMatching_osx(CFDictionaryRef query, CFTypeRef *result);
66 OSStatus SecItemUpdate_osx(CFDictionaryRef query, CFDictionaryRef attributesToUpdate);
67 OSStatus SecItemDelete_osx(CFDictionaryRef query);
68
69 extern "C" {
70 OSStatus SecItemAdd_ios(CFDictionaryRef attributes, CFTypeRef *result);
71 OSStatus SecItemCopyMatching_ios(CFDictionaryRef query, CFTypeRef *result);
72 OSStatus SecItemUpdate_ios(CFDictionaryRef query, CFDictionaryRef attributesToUpdate);
73 OSStatus SecItemDelete_ios(CFDictionaryRef query);
74 OSStatus SecItemUpdateTokenItems_ios(CFTypeRef tokenID, CFArrayRef tokenItemsAttributes);
75
76
77 OSStatus SecItemValidateAppleApplicationGroupAccess(CFStringRef group);
78 CFDictionaryRef SecItemCopyTranslatedAttributes(CFDictionaryRef inOSXDict, CFTypeRef itemClass,
79 bool iOSOut, bool pruneMatch, bool pruneSync, bool pruneReturn, bool pruneData, bool pruneAccess);
80
81 bool _SecItemParsePersistentRef(CFDataRef persistent_ref, CFStringRef *return_class,
82 long long int *return_rowid, CFDictionaryRef *return_token_attrs);
83 }
84
85 static Boolean SecItemSynchronizable(CFDictionaryRef query);
86 static CFArrayRef _CopyMatchingIssuers(CFArrayRef issuers);
87
88 static void secitemlog(int priority, const char *format, ...)
89 {
90 #ifndef NDEBUG
91 // log everything
92 #else
93 if (priority < LOG_NOTICE) // log warnings and errors
94 #endif
95 {
96 va_list list;
97 va_start(list, format);
98 vsyslog(priority, format, list);
99 va_end(list);
100 }
101 }
102
103 static void secitemshow(CFTypeRef obj, const char *context)
104 {
105 #ifndef NDEBUG
106 CFStringRef desc = CFCopyDescription(obj);
107 if (!desc) return;
108
109 CFIndex length = CFStringGetMaximumSizeForEncoding(CFStringGetLength(desc), kCFStringEncodingUTF8) + 1;
110 char* buffer = (char*) malloc(length);
111 if (buffer) {
112 Boolean converted = CFStringGetCString(desc, buffer, length, kCFStringEncodingUTF8);
113 if (converted) {
114 const char *prefix = (context) ? context : "";
115 const char *separator = (context) ? " " : "";
116 secitemlog(LOG_NOTICE, "%s%s%s", prefix, separator, buffer);
117 }
118 free(buffer);
119 }
120 CFRelease(desc);
121 #endif
122 }
123
124
125 #define CFDataGetBytePtrVoid CFDataGetBytePtr
126
127 #pragma mark SecItem private utility functions
128
129 /******************************************************************************/
130
131 struct ProtocolAttributeInfo {
132 const CFStringRef *protocolValue;
133 SecProtocolType protocolType;
134 };
135
136 static ProtocolAttributeInfo gProtocolTypes[] = {
137 { &kSecAttrProtocolFTP, kSecProtocolTypeFTP },
138 { &kSecAttrProtocolFTPAccount, kSecProtocolTypeFTPAccount },
139 { &kSecAttrProtocolHTTP, kSecProtocolTypeHTTP },
140 { &kSecAttrProtocolIRC, kSecProtocolTypeIRC },
141 { &kSecAttrProtocolNNTP, kSecProtocolTypeNNTP },
142 { &kSecAttrProtocolPOP3, kSecProtocolTypePOP3 },
143 { &kSecAttrProtocolSMTP, kSecProtocolTypeSMTP },
144 { &kSecAttrProtocolSOCKS, kSecProtocolTypeSOCKS },
145 { &kSecAttrProtocolIMAP, kSecProtocolTypeIMAP },
146 { &kSecAttrProtocolLDAP, kSecProtocolTypeLDAP },
147 { &kSecAttrProtocolAppleTalk, kSecProtocolTypeAppleTalk },
148 { &kSecAttrProtocolAFP, kSecProtocolTypeAFP },
149 { &kSecAttrProtocolTelnet, kSecProtocolTypeTelnet },
150 { &kSecAttrProtocolSSH, kSecProtocolTypeSSH },
151 { &kSecAttrProtocolFTPS, kSecProtocolTypeFTPS },
152 { &kSecAttrProtocolHTTPS, kSecProtocolTypeHTTPS },
153 { &kSecAttrProtocolHTTPProxy, kSecProtocolTypeHTTPProxy },
154 { &kSecAttrProtocolHTTPSProxy, kSecProtocolTypeHTTPSProxy },
155 { &kSecAttrProtocolFTPProxy, kSecProtocolTypeFTPProxy },
156 { &kSecAttrProtocolSMB, kSecProtocolTypeSMB },
157 { &kSecAttrProtocolRTSP, kSecProtocolTypeRTSP },
158 { &kSecAttrProtocolRTSPProxy, kSecProtocolTypeRTSPProxy },
159 { &kSecAttrProtocolDAAP, kSecProtocolTypeDAAP },
160 { &kSecAttrProtocolEPPC, kSecProtocolTypeEPPC },
161 { &kSecAttrProtocolIPP, kSecProtocolTypeIPP },
162 { &kSecAttrProtocolNNTPS, kSecProtocolTypeNNTPS },
163 { &kSecAttrProtocolLDAPS, kSecProtocolTypeLDAPS },
164 { &kSecAttrProtocolTelnetS, kSecProtocolTypeTelnetS },
165 { &kSecAttrProtocolIMAPS, kSecProtocolTypeIMAPS },
166 { &kSecAttrProtocolIRCS, kSecProtocolTypeIRCS },
167 { &kSecAttrProtocolPOP3S, kSecProtocolTypePOP3S }
168 };
169
170 static const int kNumberOfProtocolTypes = sizeof(gProtocolTypes) / sizeof(ProtocolAttributeInfo);
171
172 /*
173 * _SecProtocolTypeForSecAttrProtocol converts a SecAttrProtocol to a SecProtocolType.
174 */
175 static SecProtocolType
176 _SecProtocolTypeForSecAttrProtocol(
177 CFTypeRef protocol)
178 {
179 SecProtocolType result = kSecProtocolTypeAny;
180
181 if (protocol != NULL) {
182 CFIndex count;
183 for (count=0; count<kNumberOfProtocolTypes; count++) {
184 if (CFEqual(protocol, *(gProtocolTypes[count].protocolValue))) {
185 result = gProtocolTypes[count].protocolType;
186 break;
187 }
188 }
189 }
190
191 return result;
192 }
193
194 /*
195 * _SecAttrProtocolForSecProtocolType converts a SecProtocolType to a SecAttrProtocol.
196 */
197 static CFTypeRef
198 _SecAttrProtocolForSecProtocolType(
199 SecProtocolType protocolType)
200 {
201 CFTypeRef result = NULL;
202 CFIndex count;
203 for (count=0; count<kNumberOfProtocolTypes; count++) {
204 if (gProtocolTypes[count].protocolType == protocolType) {
205 result = *(gProtocolTypes[count].protocolValue);
206 break;
207 }
208 }
209
210 return result;
211 }
212
213
214 /******************************************************************************/
215
216 struct AuthenticationAttributeInfo {
217 const CFStringRef *authValue;
218 SecAuthenticationType authType;
219 };
220
221 static AuthenticationAttributeInfo gAuthTypes[] = {
222 { &kSecAttrAuthenticationTypeNTLM, kSecAuthenticationTypeNTLM },
223 { &kSecAttrAuthenticationTypeMSN, kSecAuthenticationTypeMSN },
224 { &kSecAttrAuthenticationTypeDPA, kSecAuthenticationTypeDPA },
225 { &kSecAttrAuthenticationTypeRPA, kSecAuthenticationTypeRPA },
226 { &kSecAttrAuthenticationTypeHTTPBasic, kSecAuthenticationTypeHTTPBasic },
227 { &kSecAttrAuthenticationTypeHTTPDigest, kSecAuthenticationTypeHTTPDigest },
228 { &kSecAttrAuthenticationTypeHTMLForm, kSecAuthenticationTypeHTMLForm },
229 { &kSecAttrAuthenticationTypeDefault, kSecAuthenticationTypeDefault }
230 };
231
232 static const int kNumberOfAuthenticationTypes = sizeof(gAuthTypes) / sizeof(AuthenticationAttributeInfo);
233
234 /*
235 * _SecAuthenticationTypeForSecAttrAuthenticationType converts a
236 * SecAttrAuthenticationType to a SecAuthenticationType.
237 */
238 static SecAuthenticationType
239 _SecAuthenticationTypeForSecAttrAuthenticationType(
240 CFTypeRef authenticationType)
241 {
242 SecAuthenticationType result = kSecAuthenticationTypeAny;
243
244 if (authenticationType != NULL) {
245 CFIndex count;
246 for (count=0; count<kNumberOfAuthenticationTypes; count++) {
247 if (CFEqual(authenticationType, *(gAuthTypes[count].authValue))) {
248 result = gAuthTypes[count].authType;
249 break;
250 }
251 }
252 }
253
254 return result;
255 }
256
257 /*
258 * _SecAttrAuthenticationTypeForSecAuthenticationType converts a SecAuthenticationType
259 * to a SecAttrAuthenticationType.
260 */
261 static CFTypeRef
262 _SecAttrAuthenticationTypeForSecAuthenticationType(
263 SecAuthenticationType authenticationType)
264 {
265 CFTypeRef result = NULL;
266 CFIndex count;
267 for (count=0; count<kNumberOfAuthenticationTypes; count++) {
268 if (gAuthTypes[count].authType == authenticationType) {
269 result = *(gAuthTypes[count].authValue);
270 break;
271 }
272 }
273
274 return result;
275 }
276
277
278 /******************************************************************************/
279
280 struct KeyAlgorithmInfo {
281 const CFStringRef *keyType;
282 UInt32 keyValue;
283 };
284
285 static KeyAlgorithmInfo gKeyTypes[] = {
286 { &kSecAttrKeyTypeRSA, CSSM_ALGID_RSA },
287 { &kSecAttrKeyTypeDSA, CSSM_ALGID_DSA },
288 { &kSecAttrKeyTypeAES, CSSM_ALGID_AES },
289 { &kSecAttrKeyTypeDES, CSSM_ALGID_DES },
290 { &kSecAttrKeyType3DES, CSSM_ALGID_3DES },
291 { &kSecAttrKeyTypeRC4, CSSM_ALGID_RC4 },
292 { &kSecAttrKeyTypeRC2, CSSM_ALGID_RC2 },
293 { &kSecAttrKeyTypeCAST, CSSM_ALGID_CAST },
294 { &kSecAttrKeyTypeECDSA, CSSM_ALGID_ECDSA },
295 { &kSecAttrKeyTypeEC, CSSM_ALGID_ECDSA }
296 };
297
298 static const int kNumberOfKeyTypes = sizeof(gKeyTypes) / sizeof (KeyAlgorithmInfo);
299
300
301 static UInt32 _SecAlgorithmTypeFromSecAttrKeyType(
302 CFTypeRef keyTypeRef)
303 {
304 UInt32 keyAlgValue = 0;
305 if (CFStringGetTypeID() != CFGetTypeID(keyTypeRef))
306 return keyAlgValue;
307
308 int ix;
309 for (ix=0; ix<kNumberOfKeyTypes; ix++) {
310 if (CFEqual(keyTypeRef, *(gKeyTypes[ix].keyType))) {
311 keyAlgValue = gKeyTypes[ix].keyValue;
312 return keyAlgValue;
313 }
314 }
315
316 //%%%TODO try to convert the input string to a number here
317
318 return keyAlgValue;
319 }
320
321
322 enum ItemRepresentation
323 {
324 kStringRepresentation,
325 kDataRepresentation,
326 kNumberRepresentation,
327 kBooleanRepresentation,
328 kDateRepresentation
329 };
330
331
332 struct InternalAttributeListInfo
333 {
334 UInt32 oldItemType;
335 const CFStringRef *newItemType;
336 ItemRepresentation itemRepresentation;
337 };
338
339
340 static InternalAttributeListInfo gGenericPasswordAttributes[] =
341 {
342 { kSecCreationDateItemAttr, &kSecAttrCreationDate, kDateRepresentation },
343 { kSecModDateItemAttr, &kSecAttrModificationDate, kDateRepresentation },
344 { kSecDescriptionItemAttr, &kSecAttrDescription, kStringRepresentation },
345 { kSecCommentItemAttr, &kSecAttrComment, kStringRepresentation },
346 { kSecCreatorItemAttr, &kSecAttrCreator, kNumberRepresentation }, // UInt32, a.k.a. FourCharCode
347 { kSecTypeItemAttr, &kSecAttrType, kNumberRepresentation }, // UInt32, a.k.a. FourCharCode
348 { kSecLabelItemAttr, &kSecAttrLabel, kStringRepresentation },
349 { kSecInvisibleItemAttr, &kSecAttrIsInvisible, kBooleanRepresentation },
350 { kSecNegativeItemAttr, &kSecAttrIsNegative, kBooleanRepresentation },
351 { kSecAccountItemAttr, &kSecAttrAccount, kStringRepresentation },
352 { kSecServiceItemAttr, &kSecAttrService, kStringRepresentation },
353 { kSecGenericItemAttr, &kSecAttrGeneric, kDataRepresentation }
354 };
355
356 static const int kNumberOfGenericPasswordAttributes = sizeof(gGenericPasswordAttributes) / sizeof (InternalAttributeListInfo);
357
358 #if 0
359 static InternalAttributeListInfo gInternetPasswordAttributes[] =
360 {
361 { kSecCreationDateItemAttr, &kSecAttrCreationDate, kDateRepresentation },
362 { kSecModDateItemAttr, &kSecAttrModificationDate, kDateRepresentation },
363 { kSecDescriptionItemAttr, &kSecAttrDescription, kStringRepresentation },
364 { kSecCommentItemAttr, &kSecAttrComment, kStringRepresentation },
365 { kSecCreatorItemAttr, &kSecAttrCreator, kNumberRepresentation }, // UInt32, a.k.a. FourCharCode
366 { kSecTypeItemAttr, &kSecAttrType, kNumberRepresentation }, // UInt32, a.k.a. FourCharCode
367 { kSecLabelItemAttr, &kSecAttrLabel, kStringRepresentation },
368 { kSecInvisibleItemAttr, &kSecAttrIsInvisible, kBooleanRepresentation },
369 { kSecNegativeItemAttr, &kSecAttrIsNegative, kBooleanRepresentation },
370 { kSecAccountItemAttr, &kSecAttrAccount, kStringRepresentation },
371 { kSecSecurityDomainItemAttr, &kSecAttrSecurityDomain, kStringRepresentation },
372 { kSecServerItemAttr, &kSecAttrServer, kStringRepresentation },
373 { kSecAuthenticationTypeItemAttr, &kSecAttrAuthenticationType, kStringRepresentation }, // maps from UInt32 value to string constant
374 { kSecPortItemAttr, &kSecAttrPort, kNumberRepresentation },
375 { kSecPathItemAttr, &kSecAttrPath, kStringRepresentation }
376 };
377
378 static const int kNumberOfInternetPasswordAttributes = sizeof(gInternetPasswordAttributes) / sizeof (InternalAttributeListInfo);
379 #endif
380
381 static InternalAttributeListInfo gCertificateAttributes[] =
382 {
383 { kSecLabelItemAttr, &kSecAttrLabel, kStringRepresentation },
384 { kSecSubjectItemAttr, &kSecAttrSubject, kDataRepresentation },
385 { kSecIssuerItemAttr, &kSecAttrIssuer, kDataRepresentation },
386 { kSecSerialNumberItemAttr, &kSecAttrSerialNumber, kDataRepresentation },
387 { kSecPublicKeyHashItemAttr, &kSecAttrPublicKeyHash, kDataRepresentation },
388 { kSecSubjectKeyIdentifierItemAttr, &kSecAttrSubjectKeyID, kDataRepresentation },
389 { kSecCertTypeItemAttr, &kSecAttrCertificateType, kDataRepresentation },
390 { kSecCertEncodingItemAttr, &kSecAttrCertificateEncoding, kDataRepresentation }
391 };
392
393 static const int kNumberOfCertificateAttributes = sizeof(gCertificateAttributes) / sizeof(InternalAttributeListInfo);
394
395
396 static InternalAttributeListInfo gKeyAttributes[] =
397 {
398 { kSecKeyKeyClass, &kSecAttrKeyClass, kStringRepresentation }, // key class maps from UInt32 value to string constant
399 { kSecKeyPrintName, &kSecAttrLabel, kStringRepresentation }, // note that "print name" maps to the user-visible label
400 // { kSecKeyAlias, /* not yet exposed by SecItem */, kDataRepresentation },
401 { kSecKeyPermanent, &kSecAttrIsPermanent, kBooleanRepresentation },
402 // { kSecKeyPrivate, /* not yet exposed by SecItem */, kBooleanRepresentation },
403 // { kSecKeyModifiable, /* not yet exposed by SecItem */, kBooleanRepresentation },
404 { kSecKeyLabel, &kSecAttrApplicationLabel, kDataRepresentation }, // this contains the hash of the key (or the public key hash, if asymmetric) as a CFData. Legacy keys may contain a UUID as a CFString
405 { kSecKeyApplicationTag, &kSecAttrApplicationTag, kDataRepresentation },
406 // { kSecKeyKeyCreator, /* not yet exposed by SecItem */, kStringRepresentation }, // this is the GUID of the CSP that owns this key
407 { kSecKeyKeyType, &kSecAttrKeyType, kStringRepresentation }, // algorithm type is given as a string constant (e.g. kSecAttrKeyTypeAES)
408 { kSecKeyKeySizeInBits, &kSecAttrKeySizeInBits, kNumberRepresentation },
409 { kSecKeyEffectiveKeySize, &kSecAttrEffectiveKeySize, kNumberRepresentation },
410 // { kSecKeyStartDate, /* not yet exposed by SecItem */, kDateRepresentation },
411 // { kSecKeyEndDate, /* not yet exposed by SecItem */, kDateRepresentation },
412 // { kSecKeySensitive, /* not yet exposed by SecItem */, kBooleanRepresentation },
413 // { kSecKeyAlwaysSensitive, /* not yet exposed by SecItem */, kBooleanRepresentation },
414 // { kSecKeyExtractable, /* not yet exposed by SecItem */, kBooleanRepresentation },
415 // { kSecKeyNeverExtractable, /* not yet exposed by SecItem */, kBooleanRepresentation },
416 { kSecKeyEncrypt, &kSecAttrCanEncrypt, kBooleanRepresentation },
417 { kSecKeyDecrypt, &kSecAttrCanDecrypt, kBooleanRepresentation },
418 { kSecKeyDerive, &kSecAttrCanDerive, kBooleanRepresentation },
419 { kSecKeySign, &kSecAttrCanSign, kBooleanRepresentation },
420 { kSecKeyVerify, &kSecAttrCanVerify, kBooleanRepresentation },
421 // { kSecKeySignRecover, /* not yet exposed by SecItem */, kBooleanRepresentation },
422 // { kSecKeyVerifyRecover, /* not yet exposed by SecItem */, kBooleanRepresentation },
423 { kSecKeyWrap, &kSecAttrCanWrap, kBooleanRepresentation },
424 { kSecKeyUnwrap, &kSecAttrCanUnwrap, kBooleanRepresentation }
425 };
426
427 static const int kNumberOfKeyAttributes = sizeof(gKeyAttributes) / sizeof(InternalAttributeListInfo);
428
429
430 static void* CloneDataByType(ItemRepresentation type, CFTypeRef value, UInt32& length)
431 {
432 switch (type)
433 {
434 case kStringRepresentation:
435 {
436 if (CFStringGetTypeID() != CFGetTypeID(value)) {
437 length = 0;
438 return NULL;
439 }
440 CFIndex maxLength = CFStringGetMaximumSizeForEncoding(CFStringGetLength((CFStringRef) value), kCFStringEncodingUTF8) + 1;
441 char* buffer = (char*) malloc(maxLength);
442 Boolean converted = CFStringGetCString((CFStringRef) value, buffer, maxLength, kCFStringEncodingUTF8);
443 if (converted) {
444 length = (UInt32)strlen(buffer);
445 }
446 else {
447 length = 0;
448 free(buffer);
449 buffer = NULL;
450 }
451 return buffer;
452 }
453
454 case kDataRepresentation:
455 {
456 if (CFStringGetTypeID() == CFGetTypeID(value)) {
457 // We may have a string here, since the key label may be a GUID for the symmetric keys
458 CFIndex maxLength = CFStringGetMaximumSizeForEncoding(CFStringGetLength((CFStringRef) value), kCFStringEncodingUTF8) + 1;
459 char* buffer = (char*) malloc(maxLength);
460 Boolean converted = CFStringGetCString((CFStringRef) value, buffer, maxLength, kCFStringEncodingUTF8);
461 if (converted) {
462 length = (UInt32)strlen(buffer);
463 }
464 else {
465 length = 0;
466 free(buffer);
467 buffer = NULL;
468 }
469 return buffer;
470 }
471
472 if (CFDataGetTypeID() != CFGetTypeID(value)) {
473 length = 0;
474 return NULL;
475 }
476 length = (UInt32)CFDataGetLength((CFDataRef) value);
477 uint8_t* buffer = (uint8_t*) malloc(length);
478 CFDataGetBytes((CFDataRef) value, CFRangeMake(0, length), buffer);
479 return buffer;
480 }
481
482 case kNumberRepresentation:
483 {
484 if (CFNumberGetTypeID() != CFGetTypeID(value)) {
485 length = 0;
486 return NULL;
487 }
488 uint32_t* buffer = (uint32_t*) malloc(sizeof(uint32_t));
489 Boolean converted = CFNumberGetValue((CFNumberRef) value, kCFNumberSInt32Type, buffer);
490 if (converted) {
491 length = sizeof(uint32_t);
492 }
493 else {
494 length = 0;
495 free(buffer);
496 buffer = NULL;
497 }
498 return buffer;
499 }
500
501 case kBooleanRepresentation:
502 {
503 if (CFBooleanGetTypeID() != CFGetTypeID(value)) {
504 length = 0;
505 return NULL;
506 }
507 uint32_t* buffer = (uint32_t*) malloc(sizeof(uint32_t));
508 *buffer = (CFEqual(kCFBooleanTrue, value)) ? 1 : 0;
509 length = sizeof(uint32_t);
510 return buffer;
511 }
512
513 case kDateRepresentation:
514 {
515 if (CFDateGetTypeID() != CFGetTypeID(value)) {
516 length = 0;
517 return NULL;
518 }
519 char* buffer = (char*) calloc(1, 32); // max length of a CSSM date string
520 CSSMDateTimeUtils::CFDateToCssmDate((CFDateRef) value, buffer);
521 length = (UInt32)strlen(buffer);
522 return buffer;
523 }
524
525 default:
526 {
527 length = 0;
528 return NULL;
529 }
530 }
531 }
532
533
534 static OSStatus
535 _ConvertNewFormatToOldFormat(
536 CFAllocatorRef allocator,
537 const InternalAttributeListInfo* info,
538 int infoNumItems,
539 CFDictionaryRef dictionaryRef,
540 SecKeychainAttributeList* &attrList
541 )
542 {
543 // make storage to extract the dictionary items
544 CFIndex itemsInDictionary = CFDictionaryGetCount(dictionaryRef);
545 if (itemsInDictionary > 10000) {
546 return errSecParam;
547 }
548
549 // get the keychain attributes array from the data item
550 // here's the problem. On the one hand, we have a dictionary that is purported to contain
551 // attributes for our type. On the other hand, the dictionary may contain items we don't support,
552 // and we therefore don't know how many attributes we will have unless we count them first
553
554 // setup the return
555 attrList = (SecKeychainAttributeList*) calloc(1, sizeof(SecKeychainAttributeList));
556
557 std::vector<CFTypeRef> keys(itemsInDictionary);
558 std::vector<CFTypeRef> values(itemsInDictionary);
559
560 CFDictionaryGetKeysAndValues(dictionaryRef, keys.data(), values.data());
561
562 // count the number of items we are interested in
563 CFIndex count = 0;
564 CFIndex i;
565
566 // since this is one of those nasty order n^2 loops, we cache as much stuff as possible so that
567 // we don't pay the price for this twice
568 std::vector<SecKeychainAttrType> tags(itemsInDictionary);
569 std::vector<ItemRepresentation> types(itemsInDictionary);
570
571 for (i = 0; i < itemsInDictionary; ++i)
572 {
573 CFTypeRef key = keys[i];
574
575 int j;
576 for (j = 0; j < infoNumItems; ++j)
577 {
578 if (CFEqual(*(info[j].newItemType), key))
579 {
580 tags[i] = info[j].oldItemType;
581 types[i] = info[j].itemRepresentation;
582 count += 1;
583 break;
584 }
585 }
586
587 if (j >= infoNumItems)
588 {
589 // if we got here, we aren't interested in this item.
590 values[i] = NULL;
591 }
592 }
593
594 // now we can make the result array
595 attrList->count = (UInt32)count;
596
597 if(count == 0) {
598 attrList->attr = NULL;
599 } else {
600 attrList->attr = (SecKeychainAttribute*) calloc(count, sizeof(SecKeychainAttribute));
601
602 // fill out the array
603 int resultPointer = 0;
604 for (i = 0; i < itemsInDictionary; ++i)
605 {
606 if (values[i] != NULL)
607 {
608 attrList->attr[resultPointer].tag = tags[i];
609
610 // we have to clone the data pointer. The caller will need to make sure to throw these away
611 // with _FreeAttrList when it is done...
612 attrList->attr[resultPointer].data = CloneDataByType(types[i], values[i], attrList->attr[resultPointer].length);
613 resultPointer += 1;
614 }
615 }
616 }
617
618 return errSecSuccess;
619 }
620
621
622
623 static OSStatus
624 _ConvertOldFormatToNewFormat(
625 CFAllocatorRef allocator,
626 const InternalAttributeListInfo* info,
627 int infoNumItems,
628 SecKeychainItemRef itemRef,
629 CFMutableDictionaryRef& dictionaryRef)
630 {
631 SecKeychainAttributeList list;
632 list.count = infoNumItems;
633 list.attr = (SecKeychainAttribute*) calloc(infoNumItems, sizeof(SecKeychainAttribute));
634
635 // fill out the array. We only need to fill in the tags, since calloc zeros what it returns
636 int i;
637 for (i = 0; i < infoNumItems; ++i)
638 {
639 list.attr[i].tag = info[i].oldItemType;
640 }
641
642 OSStatus result = SecKeychainItemCopyContent(itemRef, NULL, &list, NULL, NULL);
643 if (result != errSecSuccess)
644 {
645 dictionaryRef = NULL;
646 free(list.attr);
647 return result;
648 }
649
650 // create the dictionary
651 dictionaryRef = CFDictionaryCreateMutable(allocator, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
652
653 // add the pairs
654 for (i = 0; i < infoNumItems; ++i)
655 {
656 if (list.attr[i].data == NULL)
657 continue;
658
659 switch (info[i].itemRepresentation)
660 {
661 case kStringRepresentation:
662 {
663 CFStringRef stringRef;
664 if (info[i].oldItemType == kSecKeyKeyClass) {
665 // special case: kSecKeyKeyClass is a UInt32 value that maps to a CFStringRef constant
666 uint32_t keyRecordValue = *((uint32_t*)list.attr[i].data);
667 bool retainString = true;
668 switch (keyRecordValue) {
669 case CSSM_DL_DB_RECORD_PUBLIC_KEY :
670 stringRef = (CFStringRef) kSecAttrKeyClassPublic;
671 break;
672 case CSSM_DL_DB_RECORD_PRIVATE_KEY:
673 stringRef = (CFStringRef) kSecAttrKeyClassPrivate;
674 break;
675 case CSSM_DL_DB_RECORD_SYMMETRIC_KEY:
676 stringRef = (CFStringRef) kSecAttrKeyClassSymmetric;
677 break;
678 default:
679 stringRef = CFStringCreateWithFormat(allocator, NULL, CFSTR("%d"), keyRecordValue);
680 retainString = false;
681 break;
682 }
683 if (stringRef) {
684 if (retainString) CFRetain(stringRef);
685 CFDictionaryAddValue(dictionaryRef, *(info[i].newItemType), stringRef);
686 CFRelease(stringRef);
687 }
688 }
689 else if (info[i].oldItemType == kSecKeyKeyType) {
690 // special case: kSecKeyKeyType is a UInt32 value that maps to a CFStringRef constant
691 uint32_t keyAlgValue = *((uint32_t*)list.attr[i].data);
692 bool retainString = true;
693 switch (keyAlgValue) {
694 case CSSM_ALGID_RSA :
695 stringRef = (CFStringRef) kSecAttrKeyTypeRSA;
696 break;
697 case CSSM_ALGID_DSA :
698 stringRef = (CFStringRef) kSecAttrKeyTypeDSA;
699 break;
700 case CSSM_ALGID_AES :
701 stringRef = (CFStringRef) kSecAttrKeyTypeAES;
702 break;
703 case CSSM_ALGID_DES :
704 stringRef = (CFStringRef) kSecAttrKeyTypeDES;
705 break;
706 case CSSM_ALGID_3DES :
707 stringRef = (CFStringRef) kSecAttrKeyType3DES;
708 break;
709 case CSSM_ALGID_RC4 :
710 stringRef = (CFStringRef) kSecAttrKeyTypeRC4;
711 break;
712 case CSSM_ALGID_RC2 :
713 stringRef = (CFStringRef) kSecAttrKeyTypeRC2;
714 break;
715 case CSSM_ALGID_CAST :
716 stringRef = (CFStringRef) kSecAttrKeyTypeCAST;
717 break;
718 case CSSM_ALGID_ECDSA :
719 stringRef = (CFStringRef) kSecAttrKeyTypeEC;
720 break;
721 default :
722 stringRef = CFStringCreateWithFormat(allocator, NULL, CFSTR("%d"), keyAlgValue);
723 retainString = false;
724 break;
725 }
726 if (stringRef) {
727 if (retainString) CFRetain(stringRef);
728 CFDictionaryAddValue(dictionaryRef, *(info[i].newItemType), stringRef);
729 CFRelease(stringRef);
730 }
731 }
732 else {
733 // normal case: attribute contains a string
734 stringRef = CFStringCreateWithBytes(allocator, (UInt8*)list.attr[i].data, list.attr[i].length, kCFStringEncodingUTF8, FALSE);
735 if (stringRef == NULL)
736 stringRef = (CFStringRef) CFRetain(kCFNull);
737 CFDictionaryAddValue(dictionaryRef, *(info[i].newItemType), stringRef);
738 CFRelease(stringRef);
739 }
740 }
741 break;
742
743 case kDataRepresentation:
744 {
745 if ((info[i].oldItemType == kSecKeyLabel) && (list.attr[i].length == kUUIDStringLength)) {
746 // It's possible that there could be a string here because the key label may have a UUID
747 CFStringRef stringRef = CFStringCreateWithBytes(allocator, (UInt8*)list.attr[i].data, list.attr[i].length, kCFStringEncodingUTF8, FALSE);
748 if (stringRef == NULL)
749 stringRef = (CFStringRef) CFRetain(kCFNull);
750 CFDictionaryAddValue(dictionaryRef, *(info[i].newItemType), stringRef);
751 CFRelease(stringRef);
752 break;
753 }
754 CFDataRef dataRef = CFDataCreate(allocator, (UInt8*) list.attr[i].data, list.attr[i].length);
755 if (dataRef == NULL)
756 dataRef = (CFDataRef) CFRetain(kCFNull);
757 CFDictionaryAddValue(dictionaryRef, *(info[i].newItemType), dataRef);
758 CFRelease(dataRef);
759 }
760 break;
761
762 case kNumberRepresentation:
763 {
764 CFNumberRef numberRef = CFNumberCreate(allocator, kCFNumberSInt32Type, list.attr[i].data);
765 if (numberRef == NULL)
766 numberRef = (CFNumberRef) CFRetain(kCFNull);
767 CFDictionaryAddValue(dictionaryRef, *(info[i].newItemType), numberRef);
768 CFRelease(numberRef);
769 }
770 break;
771
772 case kBooleanRepresentation:
773 {
774 uint32_t value = *((uint32_t*)list.attr[i].data);
775 CFBooleanRef boolRef = (value) ? kCFBooleanTrue : kCFBooleanFalse;
776 CFDictionaryAddValue(dictionaryRef, *(info[i].newItemType), boolRef);
777 }
778 break;
779
780 case kDateRepresentation:
781 {
782 CFDateRef dateRef = NULL;
783 CSSMDateTimeUtils::CssmDateStringToCFDate((const char *)list.attr[i].data, list.attr[i].length, &dateRef);
784 if (dateRef == NULL)
785 dateRef = (CFDateRef) CFRetain(kCFNull);
786 CFDictionaryAddValue(dictionaryRef, *(info[i].newItemType), dateRef);
787 CFRelease(dateRef);
788 }
789 break;
790 }
791 }
792
793 // cleanup
794 SecKeychainItemFreeContent(&list, NULL);
795 free(list.attr);
796
797 return result;
798 }
799
800
801
802 //
803 /*
804 * _CreateAttributesDictionaryFromGenericPasswordItem creates a CFDictionaryRef using the
805 * attributes of item.
806 */
807 static OSStatus
808 _CreateAttributesDictionaryFromGenericPasswordItem(
809 CFAllocatorRef allocator,
810 SecKeychainItemRef item,
811 CFDictionaryRef *dictionary)
812 {
813 // do the basic allocations
814 CFMutableDictionaryRef dict = NULL;
815 OSStatus result = _ConvertOldFormatToNewFormat(allocator, gGenericPasswordAttributes, kNumberOfGenericPasswordAttributes, item, dict);
816 if (result == errSecSuccess) // did we complete OK
817 {
818 CFDictionaryAddValue(dict, kSecClass, kSecClassGenericPassword);
819 }
820
821 *dictionary = dict;
822
823 return result;
824 }
825
826
827
828 /*
829 * _CreateAttributesDictionaryFromCertificateItem creates a CFDictionaryRef using the
830 * attributes of item.
831 */
832 static OSStatus
833 _CreateAttributesDictionaryFromCertificateItem(
834 CFAllocatorRef allocator,
835 SecKeychainItemRef item,
836 CFDictionaryRef *dictionary)
837 {
838 // do the basic allocations
839 CFMutableDictionaryRef dict = NULL;
840 OSStatus result = _ConvertOldFormatToNewFormat(allocator, gCertificateAttributes, kNumberOfCertificateAttributes, item, dict);
841 if (result == errSecSuccess) // did we complete OK
842 {
843 CFDictionaryAddValue(dict, kSecClass, kSecClassCertificate);
844 }
845
846 *dictionary = dict;
847
848 return errSecSuccess;
849 }
850
851 /*
852 * _CreateAttributesDictionaryFromKeyItem creates a CFDictionaryRef using the
853 * attributes of item.
854 */
855 static OSStatus
856 _CreateAttributesDictionaryFromKeyItem(
857 CFAllocatorRef allocator,
858 SecKeychainItemRef item,
859 CFDictionaryRef *dictionary)
860 {
861 #if 0
862 //%%%FIXME this ought to work, but the call to SecKeychainCopyContent in _ConvertOldFormatToNewFormat fails.
863 // Need to rewrite _ConvertOldFormatToNewFormat so that it uses SecKeychainAttributeInfoForItemID and
864 // SecKeychainItemCopyAttributesAndData to get the attributes, rather than SecKeychainCopyContent.
865
866 if (status) {
867 goto error_exit; // unable to get the attribute info (i.e. database schema)
868 }
869
870 status = SecKeychainItemCopyAttributesAndData(item, info, &itemClass, &attrList, NULL, NULL);
871
872 // do the basic allocations
873 CFMutableDictionaryRef dict = NULL;
874 OSStatus result = _ConvertOldFormatToNewFormat(allocator, gKeyAttributes, kNumberOfKeyAttributes, item, dict);
875 if (result == errSecSuccess) // did we complete OK
876 {
877 CFDictionaryAddValue(dict, kSecClass, kSecClassKey);
878 }
879
880 *dictionary = dict;
881
882 return errSecSuccess;
883 #endif
884
885 CFMutableDictionaryRef dict = CFDictionaryCreateMutable(allocator, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
886 unsigned int ix;
887 SecItemClass itemClass = (SecItemClass) 0;
888 UInt32 itemID;
889 SecKeychainAttributeList *attrList = NULL;
890 SecKeychainAttributeInfo *info = NULL;
891 SecKeychainRef keychain = NULL;
892
893 OSStatus status = SecKeychainItemCopyAttributesAndData(item, NULL, &itemClass, NULL, NULL, NULL);
894 if (status) {
895 goto error_exit; // item must have an itemClass
896 }
897
898 switch (itemClass)
899 {
900 case kSecInternetPasswordItemClass:
901 itemID = CSSM_DL_DB_RECORD_INTERNET_PASSWORD;
902 break;
903 case kSecGenericPasswordItemClass:
904 itemID = CSSM_DL_DB_RECORD_GENERIC_PASSWORD;
905 break;
906 case 'ashp': /* kSecAppleSharePasswordItemClass */
907 itemID = CSSM_DL_DB_RECORD_APPLESHARE_PASSWORD;
908 break;
909 default:
910 itemID = itemClass;
911 break;
912 }
913
914 status = SecKeychainItemCopyKeychain(item, &keychain);
915 if (status) {
916 goto error_exit; // item must have a keychain, so we can get the attribute info for it
917 }
918
919 status = SecKeychainAttributeInfoForItemID(keychain, itemID, &info);
920 if (status) {
921 goto error_exit; // unable to get the attribute info (i.e. database schema)
922 }
923
924 status = SecKeychainItemCopyAttributesAndData(item, info, &itemClass, &attrList, NULL, NULL);
925 if (status) {
926 goto error_exit; // unable to get the attribute info (i.e. database schema)
927 }
928
929 for (ix = 0; ix < info->count; ++ix)
930 {
931 SecKeychainAttribute *attribute = &attrList->attr[ix];
932 if (!attribute->length && !attribute->data)
933 continue;
934
935 UInt32 j, count = kNumberOfKeyAttributes;
936 InternalAttributeListInfo *intInfo = NULL;
937 for (j=0; j<count; j++) {
938 if (gKeyAttributes[j].oldItemType == info->tag[ix]) {
939 intInfo = &gKeyAttributes[j];
940 break;
941 }
942 }
943 if (!intInfo)
944 continue;
945
946 switch (intInfo->itemRepresentation)
947 {
948 case kStringRepresentation:
949 {
950 CFStringRef stringRef;
951 if (intInfo->oldItemType == kSecKeyKeyClass) {
952 // special case: kSecKeyKeyClass is a UInt32 value that maps to a CFStringRef constant
953 UInt32 keyRecordValue = *((UInt32*)attribute->data);
954 bool retainString = true;
955 switch (keyRecordValue) {
956 case CSSM_DL_DB_RECORD_PUBLIC_KEY :
957 stringRef = (CFStringRef) kSecAttrKeyClassPublic;
958 break;
959 case CSSM_DL_DB_RECORD_PRIVATE_KEY:
960 stringRef = (CFStringRef) kSecAttrKeyClassPrivate;
961 break;
962 case CSSM_DL_DB_RECORD_SYMMETRIC_KEY:
963 stringRef = (CFStringRef) kSecAttrKeyClassSymmetric;
964 break;
965 default:
966 stringRef = CFStringCreateWithFormat(allocator, NULL, CFSTR("%u"), (unsigned int)keyRecordValue);
967 retainString = false;
968 break;
969 }
970 if (stringRef) {
971 if (retainString) CFRetain(stringRef);
972 CFDictionaryAddValue(dict, *(intInfo->newItemType), stringRef);
973 CFRelease(stringRef);
974 }
975 }
976 else if (intInfo->oldItemType == kSecKeyKeyType) {
977 // special case: kSecKeyKeyType is a UInt32 value that maps to a CFStringRef constant
978 UInt32 keyAlgValue = *((UInt32*)attribute->data);
979 bool retainString = true;
980 switch (keyAlgValue) {
981 case CSSM_ALGID_RSA :
982 stringRef = (CFStringRef) kSecAttrKeyTypeRSA;
983 break;
984 case CSSM_ALGID_DSA :
985 stringRef = (CFStringRef) kSecAttrKeyTypeDSA;
986 break;
987 case CSSM_ALGID_AES :
988 stringRef = (CFStringRef) kSecAttrKeyTypeAES;
989 break;
990 case CSSM_ALGID_DES :
991 stringRef = (CFStringRef) kSecAttrKeyTypeDES;
992 break;
993 case CSSM_ALGID_3DES :
994 stringRef = (CFStringRef) kSecAttrKeyType3DES;
995 break;
996 case CSSM_ALGID_RC4 :
997 stringRef = (CFStringRef) kSecAttrKeyTypeRC4;
998 break;
999 case CSSM_ALGID_RC2 :
1000 stringRef = (CFStringRef) kSecAttrKeyTypeRC2;
1001 break;
1002 case CSSM_ALGID_CAST :
1003 stringRef = (CFStringRef) kSecAttrKeyTypeCAST;
1004 break;
1005 case CSSM_ALGID_ECDSA :
1006 stringRef = (CFStringRef) kSecAttrKeyTypeEC;
1007 break;
1008 default :
1009 stringRef = CFStringCreateWithFormat(allocator, NULL, CFSTR("%u"), (unsigned int)keyAlgValue);
1010 retainString = false;
1011 break;
1012 }
1013 if (stringRef) {
1014 if (retainString) CFRetain(stringRef);
1015 CFDictionaryAddValue(dict, *(intInfo->newItemType), stringRef);
1016 CFRelease(stringRef);
1017 }
1018 }
1019 else {
1020 // normal case: attribute contains a string
1021 stringRef = CFStringCreateWithBytes(allocator, (UInt8*)attribute->data, attribute->length, kCFStringEncodingUTF8, FALSE);
1022 if (stringRef == NULL)
1023 stringRef = (CFStringRef) CFRetain(kCFNull);
1024 CFDictionaryAddValue(dict, *(intInfo->newItemType), stringRef);
1025 CFRelease(stringRef);
1026 }
1027 }
1028 break;
1029
1030 case kDataRepresentation:
1031 {
1032 if ((intInfo->oldItemType == kSecKeyLabel) && (attribute->length == kUUIDStringLength)) {
1033 // It's possible that there could be a string here because the key label may have a UUID
1034 CFStringRef stringRef = CFStringCreateWithBytes(allocator, (UInt8*)attribute->data, attribute->length, kCFStringEncodingUTF8, FALSE);
1035 if (stringRef == NULL)
1036 stringRef = (CFStringRef) CFRetain(kCFNull);
1037 CFDictionaryAddValue(dict, *(intInfo->newItemType), stringRef);
1038 CFRelease(stringRef);
1039 break;
1040 }
1041
1042 CFDataRef dataRef = CFDataCreate(allocator, (UInt8*)attribute->data, attribute->length);
1043 if (dataRef == NULL)
1044 dataRef = (CFDataRef) CFRetain(kCFNull);
1045 CFDictionaryAddValue(dict, *(intInfo->newItemType), dataRef);
1046 CFRelease(dataRef);
1047 }
1048 break;
1049
1050 case kNumberRepresentation:
1051 {
1052 CFNumberRef numberRef = CFNumberCreate(allocator, kCFNumberSInt32Type, attribute->data);
1053 if (numberRef == NULL)
1054 numberRef = (CFNumberRef) CFRetain(kCFNull);
1055 CFDictionaryAddValue(dict, *(intInfo->newItemType), numberRef);
1056 CFRelease(numberRef);
1057 }
1058 break;
1059
1060 case kBooleanRepresentation:
1061 {
1062 UInt32 value = *((UInt32*)attribute->data);
1063 CFBooleanRef boolRef = (value) ? kCFBooleanTrue : kCFBooleanFalse;
1064 CFDictionaryAddValue(dict, *(intInfo->newItemType), boolRef);
1065 }
1066 break;
1067
1068 case kDateRepresentation:
1069 {
1070 //%%% FIXME need to convert from a CSSM date string to a CFDateRef here
1071 CFDateRef dateRef = NULL;
1072 if (dateRef == NULL)
1073 dateRef = (CFDateRef) CFRetain(kCFNull);
1074 CFDictionaryAddValue(dict, *(intInfo->newItemType), dateRef);
1075 CFRelease(dateRef);
1076 }
1077 break;
1078 }
1079 }
1080
1081 CFDictionaryAddValue(dict, kSecClass, kSecClassKey);
1082
1083 error_exit:
1084
1085 if (attrList)
1086 SecKeychainItemFreeAttributesAndData(attrList, NULL);
1087
1088 if (info)
1089 SecKeychainFreeAttributeInfo(info);
1090
1091 if (keychain)
1092 CFRelease(keychain);
1093
1094 *dictionary = dict;
1095
1096 return status;
1097 }
1098
1099
1100 /*
1101 * _CreateAttributesDictionaryFromInternetPasswordItem creates a CFDictionaryRef using the
1102 * attributes of item.
1103 */
1104 static OSStatus
1105 _CreateAttributesDictionaryFromInternetPasswordItem(
1106 CFAllocatorRef allocator,
1107 SecKeychainItemRef item,
1108 CFDictionaryRef *dictionary)
1109 {
1110 OSStatus status;
1111 SecKeychainAttribute attr[] = {
1112 { kSecServerItemAttr, 0, NULL }, /* [0] server */
1113 { kSecSecurityDomainItemAttr, 0, NULL }, /* [1] securityDomain */
1114 { kSecAccountItemAttr, 0, NULL }, /* [2] account */
1115 { kSecPathItemAttr, 0, NULL }, /* [3] path */
1116 { kSecPortItemAttr, 0, NULL }, /* [4] port */
1117 { kSecProtocolItemAttr, 0, NULL }, /* [5] protocol */
1118 { kSecAuthenticationTypeItemAttr, 0, NULL }, /* [6] authenticationType */
1119 { kSecCommentItemAttr, 0, NULL }, /* [7] comment */
1120 { kSecDescriptionItemAttr, 0, NULL }, /* [8] description */
1121 { kSecLabelItemAttr, 0, NULL }, /* [9] label */
1122 { kSecCreationDateItemAttr, 0, NULL }, /* [10] creation date */
1123 { kSecModDateItemAttr, 0, NULL }, /* [11] modification date */
1124 { kSecCreatorItemAttr, 0, NULL }, /* [12] creator */
1125 { kSecTypeItemAttr, 0, NULL }, /* [13] type */
1126 { kSecInvisibleItemAttr, 0, NULL }, /* [14] invisible */
1127 { kSecNegativeItemAttr, 0, NULL }, /* [15] negative */
1128 };
1129 SecKeychainAttributeList attrList = { sizeof(attr) / sizeof(SecKeychainAttribute), attr };
1130 CFIndex numValues;
1131 CFIndex index;
1132 CFTypeRef keys[(sizeof(attr) / sizeof(SecKeychainAttribute)) + 2];
1133 CFTypeRef values[(sizeof(attr) / sizeof(SecKeychainAttribute)) + 2];
1134
1135 *dictionary = NULL;
1136
1137 // copy the item's attributes
1138 status = SecKeychainItemCopyContent(item, NULL, &attrList, NULL, NULL);
1139 require_noerr(status, SecKeychainItemCopyContent_failed);
1140
1141 numValues = 0;
1142
1143 // add kSecClass
1144 keys[numValues] = kSecClass;
1145 values[numValues] = kSecClassInternetPassword;
1146 ++numValues;
1147
1148 // add kSecAttrServer
1149 if ( attrList.attr[0].length > 0 ) {
1150 keys[numValues] = kSecAttrServer;
1151 values[numValues] = CFStringCreateWithBytes(allocator, (UInt8 *)attrList.attr[0].data, attrList.attr[0].length, kCFStringEncodingUTF8, FALSE);
1152 if ( values[numValues] != NULL ) {
1153 ++numValues;
1154 }
1155 }
1156
1157 // add kSecAttrSecurityDomain
1158 if ( attrList.attr[1].length > 0 ) {
1159 keys[numValues] = kSecAttrSecurityDomain;
1160 values[numValues] = CFStringCreateWithBytes(allocator, (UInt8 *)attrList.attr[1].data, attrList.attr[1].length, kCFStringEncodingUTF8, FALSE);
1161 if ( values[numValues] != NULL ) {
1162 ++numValues;
1163 }
1164 }
1165
1166 // add kSecAttrAccount
1167 if ( attrList.attr[2].length > 0 ) {
1168 keys[numValues] = kSecAttrAccount;
1169 values[numValues] = CFStringCreateWithBytes(allocator, (UInt8 *)attrList.attr[2].data, attrList.attr[2].length, kCFStringEncodingUTF8, FALSE);
1170 if ( values[numValues] != NULL ) {
1171 ++numValues;
1172 }
1173 }
1174
1175 // add kSecAttrPath
1176 if ( attrList.attr[3].length > 0 ) {
1177 keys[numValues] = kSecAttrPath;
1178 values[numValues] = CFStringCreateWithBytes(allocator, (UInt8 *)attrList.attr[3].data, attrList.attr[3].length, kCFStringEncodingUTF8, FALSE);
1179 if ( values[numValues] != NULL ) {
1180 ++numValues;
1181 }
1182 }
1183
1184 // add kSecAttrPort
1185 if ( attrList.attr[4].length > 0 ) {
1186 keys[numValues] = kSecAttrPort;
1187 values[numValues] = CFNumberCreate(allocator, kCFNumberSInt32Type, attrList.attr[4].data);
1188 if ( values[numValues] != NULL ) {
1189 ++numValues;
1190 }
1191 }
1192
1193 // add kSecAttrProtocol
1194 if ( attrList.attr[5].length > 0 ) {
1195 keys[numValues] = kSecAttrProtocol;
1196 values[numValues] = _SecAttrProtocolForSecProtocolType(*(SecProtocolType*)attrList.attr[5].data);
1197 if ( values[numValues] != NULL ) {
1198 CFRetain(values[numValues]);
1199 ++numValues;
1200 }
1201 }
1202
1203 // add kSecAttrAuthenticationType
1204 if ( attrList.attr[6].length > 0 ) {
1205 keys[numValues] = kSecAttrAuthenticationType;
1206 values[numValues] = _SecAttrAuthenticationTypeForSecAuthenticationType( (SecAuthenticationType) (*(SecProtocolType*)attrList.attr[6].data));
1207 if ( values[numValues] != NULL ) {
1208 CFRetain(values[numValues]);
1209 ++numValues;
1210 }
1211 }
1212
1213 // add kSecAttrComment
1214 if ( attrList.attr[7].length > 0 ) {
1215 keys[numValues] = kSecAttrComment;
1216 values[numValues] = CFStringCreateWithBytes(allocator, (UInt8 *)attrList.attr[7].data, attrList.attr[7].length, kCFStringEncodingUTF8, FALSE);
1217 if ( values[numValues] != NULL ) {
1218 ++numValues;
1219 }
1220 }
1221
1222 // add kSecAttrDescription
1223 if ( attrList.attr[8].length > 0 ) {
1224 keys[numValues] = kSecAttrDescription;
1225 values[numValues] = CFStringCreateWithBytes(allocator, (UInt8 *)attrList.attr[8].data, attrList.attr[8].length, kCFStringEncodingUTF8, FALSE);
1226 if ( values[numValues] != NULL ) {
1227 ++numValues;
1228 }
1229 }
1230
1231 // add kSecAttrLabel
1232 if ( attrList.attr[9].length > 0 ) {
1233 keys[numValues] = kSecAttrLabel;
1234 values[numValues] = CFStringCreateWithBytes(allocator, (UInt8 *)attrList.attr[9].data, attrList.attr[9].length, kCFStringEncodingUTF8, FALSE);
1235 if ( values[numValues] != NULL ) {
1236 ++numValues;
1237 }
1238 }
1239
1240 // add kSecAttrCreationDate
1241 if ( attrList.attr[10].length > 0 ) {
1242 CFDateRef creationDate = NULL;
1243 CSSMDateTimeUtils::CssmDateStringToCFDate((const char *)attrList.attr[10].data, attrList.attr[10].length, &creationDate);
1244 keys[numValues] = kSecAttrCreationDate;
1245 values[numValues] = creationDate;
1246 if ( values[numValues] != NULL ) {
1247 ++numValues;
1248 }
1249 }
1250
1251 // add kSecAttrModificationDate
1252 if ( attrList.attr[11].length > 0 ) {
1253 CFDateRef modDate = NULL;
1254 CSSMDateTimeUtils::CssmDateStringToCFDate((const char *)attrList.attr[11].data, attrList.attr[11].length, &modDate);
1255 keys[numValues] = kSecAttrModificationDate;
1256 values[numValues] = modDate;
1257 if ( values[numValues] != NULL ) {
1258 ++numValues;
1259 }
1260 }
1261
1262 // add kSecCreatorItemAttr
1263 if ( attrList.attr[12].length > 0 ) {
1264 CFNumberRef numberRef = CFNumberCreate(allocator, kCFNumberSInt32Type, attrList.attr[12].data);
1265 keys[numValues] = kSecAttrCreator;
1266 values[numValues] = numberRef;
1267 if ( values[numValues] != NULL ) {
1268 CFRetain(values[numValues]);
1269 ++numValues;
1270 }
1271 }
1272
1273 // add kSecTypeItemAttr
1274 if ( attrList.attr[13].length > 0 ) {
1275 CFNumberRef numberRef = CFNumberCreate(allocator, kCFNumberSInt32Type, attrList.attr[13].data);
1276 keys[numValues] = kSecAttrType;
1277 values[numValues] = numberRef;
1278 if ( values[numValues] != NULL ) {
1279 CFRetain(values[numValues]);
1280 ++numValues;
1281 }
1282 }
1283
1284 // add kSecInvisibleItemAttr
1285 if ( attrList.attr[14].length > 0 ) {
1286 uint32_t value = *((uint32_t*)attrList.attr[14].data);
1287 CFBooleanRef boolRef = (value) ? kCFBooleanTrue : kCFBooleanFalse;
1288 keys[numValues] = kSecAttrIsInvisible;
1289 values[numValues] = boolRef;
1290 if ( values[numValues] != NULL ) {
1291 CFRetain(values[numValues]);
1292 ++numValues;
1293 }
1294 }
1295
1296 // add kSecNegativeItemAttr
1297 if ( attrList.attr[15].length > 0 ) {
1298 uint32_t value = *((uint32_t*)attrList.attr[15].data);
1299 CFBooleanRef boolRef = (value) ? kCFBooleanTrue : kCFBooleanFalse;
1300 keys[numValues] = kSecAttrIsNegative;
1301 values[numValues] = boolRef;
1302 if ( values[numValues] != NULL ) {
1303 CFRetain(values[numValues]);
1304 ++numValues;
1305 }
1306 }
1307
1308 // create the dictionary
1309 *dictionary = CFDictionaryCreate(allocator, keys, values, numValues, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
1310
1311 // release the values added to the dictionary
1312 for ( index = 0; index < numValues; ++index )
1313 {
1314 CFRelease(values[index]);
1315 }
1316
1317 // and free the attributes
1318 (void) SecKeychainItemFreeContent(&attrList, NULL);
1319
1320 SecKeychainItemCopyContent_failed:
1321
1322 return ( status );
1323 }
1324
1325
1326 /*
1327 * _CreateAttributesDictionaryFromItem creates a CFDictionaryRef using the
1328 * attributes of the specified item class and item.
1329 */
1330 static OSStatus
1331 _CreateAttributesDictionaryFromItem(
1332 CFAllocatorRef allocator,
1333 SecItemClass itemClass,
1334 SecKeychainItemRef item,
1335 CFDictionaryRef *dictionary)
1336 {
1337 switch (itemClass)
1338 {
1339 case kSecInternetPasswordItemClass:
1340 return _CreateAttributesDictionaryFromInternetPasswordItem(allocator, item, dictionary);
1341
1342 case kSecGenericPasswordItemClass:
1343 return _CreateAttributesDictionaryFromGenericPasswordItem(allocator, item, dictionary);
1344
1345 case kSecCertificateItemClass:
1346 return _CreateAttributesDictionaryFromCertificateItem(allocator, item, dictionary);
1347
1348 case kSecPublicKeyItemClass:
1349 case kSecPrivateKeyItemClass:
1350 case kSecSymmetricKeyItemClass:
1351 return _CreateAttributesDictionaryFromKeyItem(allocator, item, dictionary);
1352
1353 default:
1354 *dictionary = NULL;
1355 break;
1356 }
1357 return errSecParam;
1358 }
1359
1360
1361 /*
1362 * _FreeAttrList frees the memory allocated for the SecKeychainAttributeList
1363 * by the _CreateSecKeychainAttributeListFromDictionary function.
1364 */
1365 static void
1366 _FreeAttrList(
1367 SecKeychainAttributeList *attrListPtr)
1368 {
1369 UInt32 index;
1370
1371 if ( attrListPtr != NULL ) {
1372 if ( attrListPtr->attr != NULL ) {
1373 // free any attribute data
1374 for ( index = 0; index < attrListPtr->count; ++index ) {
1375 free(attrListPtr->attr[index].data);
1376 }
1377 // free the attribute array
1378 free(attrListPtr->attr);
1379 }
1380 // free the attribute list
1381 free(attrListPtr);
1382 }
1383 }
1384
1385 /*
1386 * _CFDataCreateAttribute initializes the SecKeychainAttribute pointed to by
1387 * attr using the data and tag parameters.
1388 *
1389 * The memory for the SecKeychainAttribute's data field is allocated with malloc
1390 * and must be released by the caller (this is normally done by calling _FreeAttrList).
1391 */
1392 static OSStatus
1393 _CFDataCreateAttribute(
1394 CFDataRef data,
1395 SecKeychainAttrType tag,
1396 SecKeychainAttributePtr attr)
1397 {
1398 OSStatus status = errSecSuccess;
1399 CFRange range;
1400
1401 // set the attribute tag
1402 attr->tag = tag;
1403
1404 // determine the attribute length
1405 attr->length = (UInt32) CFDataGetLength(data);
1406 range = CFRangeMake(0, (CFIndex)attr->length);
1407
1408 // allocate memory for the attribute bytes
1409 attr->data = malloc(attr->length);
1410 require_action(attr->data != NULL, malloc_failed, status = errSecBufferTooSmall);
1411
1412 // get the attribute bytes
1413 CFDataGetBytes(data, range, (UInt8 *)attr->data);
1414
1415 malloc_failed:
1416
1417 return ( status );
1418 }
1419
1420 /*
1421 * _CFStringCreateAttribute initializes the SecKeychainAttribute pointed to by
1422 * attr using the string and tag parameters.
1423 *
1424 * The memory for the SecKeychainAttribute's data field is allocated with malloc
1425 * and must be released by the caller (this is normally done by calling _FreeAttrList).
1426 */
1427 static OSStatus
1428 _CFStringCreateAttribute(
1429 CFStringRef string,
1430 SecKeychainAttrType tag,
1431 SecKeychainAttributePtr attr)
1432 {
1433 OSStatus status = errSecSuccess;
1434 CFRange range;
1435
1436 // set the attribute tag
1437 attr->tag = tag;
1438
1439 // determine the attribute length
1440 range = CFRangeMake(0, CFStringGetLength(string));
1441 CFStringGetBytes(string, range, kCFStringEncodingUTF8, 0, FALSE, NULL, 0, (CFIndex *)&attr->length);
1442
1443 // allocate memory for the attribute bytes
1444 attr->data = malloc(attr->length);
1445 require_action(attr->data != NULL, malloc_failed, status = errSecBufferTooSmall);
1446
1447 // get the attribute bytes
1448 CFStringGetBytes(string, range, kCFStringEncodingUTF8, 0, FALSE, (UInt8 *)attr->data, attr->length, NULL);
1449
1450 malloc_failed:
1451
1452 return ( status );
1453 }
1454
1455
1456 /*
1457 * _CreateSecKeychainGenericPasswordAttributeListFromDictionary creates a SecKeychainAttributeList
1458 * from the attribute key/values in attrDictionary.
1459 *
1460 * If this function returns errSecSuccess, the pointer to the SecKeychainAttributeList
1461 * must be freed by the caller with _FreeAttrList()
1462 */
1463 static OSStatus
1464 _CreateSecKeychainGenericPasswordAttributeListFromDictionary(
1465 CFDictionaryRef attrDictionary,
1466 SecKeychainAttributeList **attrList)
1467 {
1468 return _ConvertNewFormatToOldFormat(NULL, gGenericPasswordAttributes, kNumberOfGenericPasswordAttributes, attrDictionary, *attrList);
1469 }
1470
1471
1472 /*
1473 * _CreateSecKeychainCertificateAttributeListFromDictionary creates a SecKeychainAttributeList
1474 * from the attribute key/values in attrDictionary.
1475 *
1476 * If this function returns errSecSuccess, the pointer to the SecKeychainAttributeList
1477 * must be freed by the caller with _FreeAttrList()
1478 */
1479 static OSStatus
1480 _CreateSecKeychainCertificateAttributeListFromDictionary(
1481 CFDictionaryRef attrDictionary,
1482 SecKeychainAttributeList **attrList)
1483 {
1484 return _ConvertNewFormatToOldFormat(NULL, gCertificateAttributes, kNumberOfCertificateAttributes, attrDictionary, *attrList);
1485 }
1486
1487
1488 /*
1489 * _CreateSecKeychainKeyAttributeListFromDictionary creates a SecKeychainAttributeList
1490 * from the attribute key/values in attrDictionary.
1491 *
1492 * If this function returns errSecSuccess, the pointer to the SecKeychainAttributeList
1493 * must be freed by the caller with _FreeAttrList()
1494 */
1495 static OSStatus
1496 _CreateSecKeychainKeyAttributeListFromDictionary(
1497 CFDictionaryRef attrDictionary,
1498 SecKeychainAttributeList **attrList)
1499 {
1500 #if 0
1501 //%%%FIXME this function should work for key attributes, but currently doesn't; need to debug
1502 return _ConvertNewFormatToOldFormat(NULL, gKeyAttributes, kNumberOfKeyAttributes, attrDictionary, *attrList);
1503 #else
1504 // explicitly build attribute list for supported key attributes
1505 // NOTE: this code supports only MaxSecKeyAttributes (15) attributes
1506 const int MaxSecKeyAttributes = 15;
1507
1508 OSStatus status;
1509 CFTypeRef value;
1510 SecKeychainAttributeList *attrListPtr;
1511
1512 attrListPtr = (SecKeychainAttributeList*)calloc(1, sizeof(SecKeychainAttributeList));
1513 require_action(attrListPtr != NULL, calloc_attrListPtr_failed, status = errSecBufferTooSmall);
1514
1515 attrListPtr->attr = (SecKeychainAttribute*)calloc(MaxSecKeyAttributes, sizeof(SecKeychainAttribute));
1516 require_action(attrListPtr->attr != NULL, malloc_attrPtr_failed, status = errSecBufferTooSmall);
1517
1518 // [0] get the kSecKeyKeyClass value
1519 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrKeyClass, (const void **)&value) && value) {
1520 UInt32 keyRecordValue = 0;
1521 if (CFEqual(kSecAttrKeyClassPublic, value))
1522 keyRecordValue = CSSM_DL_DB_RECORD_PUBLIC_KEY;
1523 else if (CFEqual(kSecAttrKeyClassPrivate, value))
1524 keyRecordValue = CSSM_DL_DB_RECORD_PRIVATE_KEY;
1525 else if (CFEqual(kSecAttrKeyClassSymmetric, value))
1526 keyRecordValue = CSSM_DL_DB_RECORD_SYMMETRIC_KEY;
1527
1528 // only use this attribute if we recognize the value!
1529 if (keyRecordValue != 0) {
1530 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1531 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_number_failed, status = errSecBufferTooSmall);
1532
1533 attrListPtr->attr[attrListPtr->count].tag = kSecKeyKeyClass;
1534 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1535 *((UInt32*)attrListPtr->attr[attrListPtr->count].data) = keyRecordValue;
1536
1537 ++attrListPtr->count;
1538 }
1539 }
1540
1541 // [1] get the kSecKeyPrintName string
1542 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrLabel, (const void **)&value) && value) {
1543 status = _CFStringCreateAttribute((CFStringRef)value, kSecKeyPrintName, &attrListPtr->attr[attrListPtr->count]);
1544 require_noerr_quiet(status, CFStringCreateAttribute_failed);
1545
1546 ++attrListPtr->count;
1547 }
1548
1549 // [2] get the kSecKeyPermanent boolean
1550 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrIsPermanent, (const void **)&value) && value) {
1551 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1552 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_number_failed, status = errSecBufferTooSmall);
1553
1554 attrListPtr->attr[attrListPtr->count].tag = kSecKeyPermanent;
1555 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1556 *((UInt32*)attrListPtr->attr[attrListPtr->count].data) = (CFEqual(kCFBooleanTrue, value)) ? 1 : 0;
1557
1558 ++attrListPtr->count;
1559 }
1560
1561 // [3] get the kSecKeyLabel string
1562 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrApplicationLabel, (const void **)&value) && value) {
1563 if (CFStringGetTypeID() == CFGetTypeID(value))
1564 status = _CFStringCreateAttribute((CFStringRef)value, kSecKeyLabel, &attrListPtr->attr[attrListPtr->count]);
1565 else if (CFDataGetTypeID() == CFGetTypeID(value))
1566 status = _CFDataCreateAttribute((CFDataRef)value, kSecKeyLabel, &attrListPtr->attr[attrListPtr->count]);
1567 else
1568 status = errSecParam;
1569
1570 require_noerr_quiet(status, CFStringCreateAttribute_failed);
1571
1572 ++attrListPtr->count;
1573 }
1574
1575 // [4] get the kSecKeyApplicationTag data
1576 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrApplicationTag, (const void **)&value) && value) {
1577 if (CFStringGetTypeID() == CFGetTypeID(value))
1578 status = _CFStringCreateAttribute((CFStringRef)value, kSecKeyApplicationTag, &attrListPtr->attr[attrListPtr->count]);
1579 else if (CFDataGetTypeID() == CFGetTypeID(value))
1580 status = _CFDataCreateAttribute((CFDataRef)value, kSecKeyApplicationTag, &attrListPtr->attr[attrListPtr->count]);
1581 else
1582 status = errSecParam;
1583
1584 require_noerr_quiet(status, CFDataCreateAttribute_failed);
1585 ++attrListPtr->count;
1586 }
1587
1588 // [5] get the kSecKeyKeyType number
1589 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrKeyType, (const void **)&value) && value) {
1590 UInt32 keyAlgValue = _SecAlgorithmTypeFromSecAttrKeyType(value);
1591 if (keyAlgValue != 0) {
1592 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1593 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_number_failed, status = errSecBufferTooSmall);
1594
1595 attrListPtr->attr[attrListPtr->count].tag = kSecKeyKeyType;
1596 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1597 *((UInt32*)attrListPtr->attr[attrListPtr->count].data) = keyAlgValue;
1598
1599 ++attrListPtr->count;
1600 }
1601 }
1602
1603 // [6] get the kSecKeyKeySizeInBits number
1604 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrKeySizeInBits, (const void **)&value) && value) {
1605 if (CFNumberGetTypeID() == CFGetTypeID(value)) {
1606 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1607 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_number_failed, status = errSecBufferTooSmall);
1608
1609 attrListPtr->attr[attrListPtr->count].tag = kSecKeyKeySizeInBits;
1610 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1611 CFNumberGetValue((CFNumberRef)value, kCFNumberSInt32Type, attrListPtr->attr[attrListPtr->count].data);
1612
1613 ++attrListPtr->count;
1614 }
1615 }
1616
1617 // [7] get the kSecKeyEffectiveKeySize number
1618 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrEffectiveKeySize, (const void **)&value) && value) {
1619 if (CFNumberGetTypeID() == CFGetTypeID(value)) {
1620 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1621 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_number_failed, status = errSecBufferTooSmall);
1622
1623 attrListPtr->attr[attrListPtr->count].tag = kSecKeyEffectiveKeySize;
1624 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1625 CFNumberGetValue((CFNumberRef)value, kCFNumberSInt32Type, attrListPtr->attr[attrListPtr->count].data);
1626
1627 ++attrListPtr->count;
1628 }
1629 }
1630
1631 // [8] get the kSecKeyEncrypt boolean
1632 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrCanEncrypt, (const void **)&value) && value) {
1633 if (CFBooleanGetTypeID() == CFGetTypeID(value)) {
1634 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1635 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_number_failed, status = errSecBufferTooSmall);
1636
1637 attrListPtr->attr[attrListPtr->count].tag = kSecKeyEncrypt;
1638 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1639 *((UInt32*)attrListPtr->attr[attrListPtr->count].data) = (CFEqual(kCFBooleanTrue, value)) ? 1 : 0;
1640
1641 ++attrListPtr->count;
1642 }
1643 }
1644
1645 // [9] get the kSecKeyDecrypt boolean
1646 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrCanDecrypt, (const void **)&value) && value) {
1647 if (CFBooleanGetTypeID() == CFGetTypeID(value)) {
1648 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1649 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_number_failed, status = errSecBufferTooSmall);
1650
1651 attrListPtr->attr[attrListPtr->count].tag = kSecKeyDecrypt;
1652 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1653 *((UInt32*)attrListPtr->attr[attrListPtr->count].data) = (CFEqual(kCFBooleanTrue, value)) ? 1 : 0;
1654
1655 ++attrListPtr->count;
1656 }
1657 }
1658
1659 // [10] get the kSecKeyDerive boolean
1660 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrCanDerive, (const void **)&value) && value) {
1661 if (CFBooleanGetTypeID() == CFGetTypeID(value)) {
1662 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1663 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_number_failed, status = errSecBufferTooSmall);
1664
1665 attrListPtr->attr[attrListPtr->count].tag = kSecKeyDerive;
1666 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1667 *((UInt32*)attrListPtr->attr[attrListPtr->count].data) = (CFEqual(kCFBooleanTrue, value)) ? 1 : 0;
1668
1669 ++attrListPtr->count;
1670 }
1671 }
1672
1673 // [11] get the kSecKeySign boolean
1674 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrCanSign, (const void **)&value) && value) {
1675 if (CFBooleanGetTypeID() == CFGetTypeID(value)) {
1676 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1677 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_number_failed, status = errSecBufferTooSmall);
1678
1679 attrListPtr->attr[attrListPtr->count].tag = kSecKeySign;
1680 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1681 *((UInt32*)attrListPtr->attr[attrListPtr->count].data) = (CFEqual(kCFBooleanTrue, value)) ? 1 : 0;
1682
1683 ++attrListPtr->count;
1684 }
1685 }
1686
1687 // [12] get the kSecKeyVerify boolean
1688 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrCanVerify, (const void **)&value) && value) {
1689 if (CFBooleanGetTypeID() == CFGetTypeID(value)) {
1690 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1691 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_number_failed, status = errSecBufferTooSmall);
1692
1693 attrListPtr->attr[attrListPtr->count].tag = kSecKeyVerify;
1694 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1695 *((UInt32*)attrListPtr->attr[attrListPtr->count].data) = (CFEqual(kCFBooleanTrue, value)) ? 1 : 0;
1696
1697 ++attrListPtr->count;
1698 }
1699 }
1700
1701 // [13] get the kSecKeyWrap boolean
1702 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrCanWrap, (const void **)&value) && value) {
1703 if (CFBooleanGetTypeID() == CFGetTypeID(value)) {
1704 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1705 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_number_failed, status = errSecBufferTooSmall);
1706
1707 attrListPtr->attr[attrListPtr->count].tag = kSecKeyWrap;
1708 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1709 *((UInt32*)attrListPtr->attr[attrListPtr->count].data) = (CFEqual(kCFBooleanTrue, value)) ? 1 : 0;
1710
1711 ++attrListPtr->count;
1712 }
1713 }
1714
1715 // [14] get the kSecKeyUnwrap boolean
1716 if (CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrCanUnwrap, (const void **)&value) && value) {
1717 if (CFBooleanGetTypeID() == CFGetTypeID(value)) {
1718 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1719 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_number_failed, status = errSecBufferTooSmall);
1720
1721 attrListPtr->attr[attrListPtr->count].tag = kSecKeyUnwrap;
1722 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1723 *((UInt32*)attrListPtr->attr[attrListPtr->count].data) = (CFEqual(kCFBooleanTrue, value)) ? 1 : 0;
1724
1725 ++attrListPtr->count;
1726 }
1727 }
1728
1729 // return the pointer to the attrList
1730 *attrList = attrListPtr;
1731
1732 return ( errSecSuccess );
1733
1734 /***************/
1735
1736 malloc_number_failed:
1737 CFDataCreateAttribute_failed:
1738 CFStringCreateAttribute_failed:
1739 malloc_attrPtr_failed:
1740
1741 // free any attributes
1742 _FreeAttrList(attrListPtr);
1743
1744 calloc_attrListPtr_failed:
1745
1746 return ( errSecBufferTooSmall );
1747
1748 #endif
1749 }
1750
1751 static CFTypeRef copyNumber(CFTypeRef obj)
1752 {
1753 if (!obj)
1754 return NULL;
1755
1756 CFTypeID tid = CFGetTypeID(obj);
1757 if (tid == CFNumberGetTypeID())
1758 {
1759 CFRetain(obj);
1760 return obj;
1761 }
1762
1763 if (tid == CFBooleanGetTypeID())
1764 {
1765 SInt32 value = CFBooleanGetValue((CFBooleanRef)obj);
1766 return CFNumberCreate(0, kCFNumberSInt32Type, &value);
1767 }
1768
1769 if (tid == CFStringGetTypeID())
1770 {
1771 SInt32 value = CFStringGetIntValue((CFStringRef)obj);
1772 CFStringRef t = CFStringCreateWithFormat(0, 0, CFSTR("%ld"), (long) value);
1773 /* If a string converted to an int isn't equal to the int printed as
1774 a string, return a NULL instead. */
1775 if (!CFEqual(t, obj))
1776 {
1777 CFRelease(t);
1778 return NULL;
1779 }
1780 CFRelease(t);
1781 return CFNumberCreate(0, kCFNumberSInt32Type, &value);
1782 }
1783 return NULL;
1784 }
1785
1786 /*
1787 * _CreateSecKeychainInternetPasswordAttributeListFromDictionary creates a SecKeychainAttributeList
1788 * from the attribute key/values in attrDictionary.
1789 *
1790 * If this function returns errSecSuccess, the pointer to the SecKeychainAttributeList
1791 * must be freed by the caller with _FreeAttrList()
1792 */
1793 static OSStatus
1794 _CreateSecKeychainInternetPasswordAttributeListFromDictionary(
1795 CFDictionaryRef attrDictionary,
1796 SecKeychainAttributeList **attrList)
1797 {
1798 // explicitly build attribute list for supported key attributes
1799 // NOTE: this code supports only MaxSecKeychainAttributes (14) attributes
1800 const int MaxSecKeychainAttributes = 14;
1801
1802 OSStatus status;
1803 CFTypeRef value;
1804 SecKeychainAttributeList *attrListPtr;
1805
1806 attrListPtr = (SecKeychainAttributeList*)calloc(1, sizeof(SecKeychainAttributeList));
1807 require_action(attrListPtr != NULL, calloc_attrListPtr_failed, status = errSecBufferTooSmall);
1808
1809 attrListPtr->attr = (SecKeychainAttribute*)calloc(MaxSecKeychainAttributes, sizeof(SecKeychainAttribute));
1810 require_action(attrListPtr->attr != NULL, malloc_attrPtr_failed, status = errSecBufferTooSmall);
1811
1812
1813 // [0] get the serverName string
1814 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrServer, (const void **)&value) ) {
1815 status = _CFStringCreateAttribute((CFStringRef)value, kSecServerItemAttr, &attrListPtr->attr[attrListPtr->count]);
1816 require_noerr_quiet(status, CFStringCreateAttribute_failed);
1817
1818 ++attrListPtr->count;
1819 }
1820
1821 // [1] get the securityDomain string
1822 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrSecurityDomain, (const void **)&value) ) {
1823 status = _CFStringCreateAttribute((CFStringRef)value, kSecSecurityDomainItemAttr, &attrListPtr->attr[attrListPtr->count]);
1824 require_noerr_quiet(status, CFStringCreateAttribute_failed);
1825
1826 ++attrListPtr->count;
1827 }
1828
1829 // [2] get the accountName string
1830 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrAccount, (const void **)&value) ) {
1831 status = _CFStringCreateAttribute((CFStringRef)value, kSecAccountItemAttr, &attrListPtr->attr[attrListPtr->count]);
1832 require_noerr_quiet(status, CFStringCreateAttribute_failed);
1833
1834 ++attrListPtr->count;
1835 }
1836
1837 // [3] get the path string
1838 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrPath, (const void **)&value) ) {
1839 status = _CFStringCreateAttribute((CFStringRef)value, kSecPathItemAttr, &attrListPtr->attr[attrListPtr->count]);
1840 require_noerr_quiet(status, CFStringCreateAttribute_failed);
1841
1842 ++attrListPtr->count;
1843 }
1844
1845 // [4] get the port number
1846 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrPort, (const void **)&value) ) {
1847 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt16));
1848 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_port_failed, status = errSecBufferTooSmall);
1849
1850 CFTypeRef num = copyNumber(value);
1851 require_action(num != NULL, CFStringCreateAttribute_failed, status = errSecParam);
1852 attrListPtr->attr[attrListPtr->count].tag = kSecPortItemAttr;
1853 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt16);
1854 CFNumberGetValue((CFNumberRef)num, kCFNumberSInt16Type, attrListPtr->attr[attrListPtr->count].data);
1855 CFRelease(num);
1856
1857 ++attrListPtr->count;
1858 }
1859
1860 // [5] get the protocol
1861 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrProtocol, (const void **)&value) ) {
1862 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(SecProtocolType));
1863 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_protocol_failed, status = errSecBufferTooSmall);
1864
1865 attrListPtr->attr[attrListPtr->count].tag = kSecProtocolItemAttr;
1866 attrListPtr->attr[attrListPtr->count].length = sizeof(SecProtocolType);
1867 *(SecProtocolType *)(attrListPtr->attr[attrListPtr->count].data) = _SecProtocolTypeForSecAttrProtocol(value);
1868
1869 ++attrListPtr->count;
1870 }
1871
1872 // [6] get the authenticationType
1873 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrAuthenticationType, (const void **)&value) ) {
1874 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(SecAuthenticationType));
1875 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_authenticationType_failed, status = errSecBufferTooSmall);
1876
1877 attrListPtr->attr[attrListPtr->count].tag = kSecAuthenticationTypeItemAttr;
1878 attrListPtr->attr[attrListPtr->count].length = sizeof(SecAuthenticationType);
1879 *(SecAuthenticationType *)(attrListPtr->attr[attrListPtr->count].data) = _SecAuthenticationTypeForSecAttrAuthenticationType(value);
1880
1881 ++attrListPtr->count;
1882 }
1883
1884 // [7] get the comment string
1885 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrComment, (const void **)&value) ) {
1886 status = _CFStringCreateAttribute((CFStringRef)value, kSecCommentItemAttr, &attrListPtr->attr[attrListPtr->count]);
1887 require_noerr_quiet(status, CFStringCreateAttribute_failed);
1888
1889 ++attrListPtr->count;
1890 }
1891
1892 // [8] get the description string
1893 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrDescription, (const void **)&value) ) {
1894 status = _CFStringCreateAttribute((CFStringRef)value, kSecDescriptionItemAttr, &attrListPtr->attr[attrListPtr->count]);
1895 require_noerr_quiet(status, CFStringCreateAttribute_failed);
1896
1897 ++attrListPtr->count;
1898 }
1899
1900 // [9] get the label string
1901 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrLabel, (const void **)&value) ) {
1902 status = _CFStringCreateAttribute((CFStringRef)value, kSecLabelItemAttr, &attrListPtr->attr[attrListPtr->count]);
1903 require_noerr_quiet(status, CFStringCreateAttribute_failed);
1904
1905 ++attrListPtr->count;
1906 }
1907
1908 // [10] get the creator code
1909 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrCreator, (const void **)&value) ) {
1910 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1911 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_port_failed, status = errSecBufferTooSmall);
1912
1913 CFTypeRef num = copyNumber(value);
1914 require_action(num != NULL, CFStringCreateAttribute_failed, status = errSecParam);
1915 attrListPtr->attr[attrListPtr->count].tag = kSecCreatorItemAttr;
1916 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1917 CFNumberGetValue((CFNumberRef)num, kCFNumberSInt32Type, attrListPtr->attr[attrListPtr->count].data);
1918 CFRelease(num);
1919
1920 ++attrListPtr->count;
1921 }
1922
1923 // [11] get the type code
1924 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrType, (const void **)&value) ) {
1925 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1926 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_port_failed, status = errSecBufferTooSmall);
1927
1928 CFTypeRef num = copyNumber(value);
1929 require_action(num != NULL, CFStringCreateAttribute_failed, status = errSecParam);
1930 attrListPtr->attr[attrListPtr->count].tag = kSecTypeItemAttr;
1931 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1932 CFNumberGetValue((CFNumberRef)num, kCFNumberSInt32Type, attrListPtr->attr[attrListPtr->count].data);
1933 CFRelease(num);
1934
1935 ++attrListPtr->count;
1936 }
1937
1938 // [12] get the invisible flag
1939 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrIsInvisible, (const void **)&value) ) {
1940 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1941 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_port_failed, status = errSecBufferTooSmall);
1942
1943 attrListPtr->attr[attrListPtr->count].tag = kSecInvisibleItemAttr;
1944 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1945 *(UInt32 *)(attrListPtr->attr[attrListPtr->count].data) = (CFBooleanGetValue((CFBooleanRef)value)) ? 1 : 0;
1946
1947 ++attrListPtr->count;
1948 }
1949
1950 // [13] get the negative flag
1951 if ( CFDictionaryGetValueIfPresent(attrDictionary, kSecAttrIsNegative, (const void **)&value) ) {
1952 attrListPtr->attr[attrListPtr->count].data = malloc(sizeof(UInt32));
1953 require_action(attrListPtr->attr[attrListPtr->count].data != NULL, malloc_port_failed, status = errSecBufferTooSmall);
1954
1955 attrListPtr->attr[attrListPtr->count].tag = kSecNegativeItemAttr;
1956 attrListPtr->attr[attrListPtr->count].length = sizeof(UInt32);
1957 *(UInt32 *)(attrListPtr->attr[attrListPtr->count].data) = (CFBooleanGetValue((CFBooleanRef)value)) ? 1 : 0;
1958
1959 ++attrListPtr->count;
1960 }
1961
1962 // return the pointer to the attrList
1963 *attrList = attrListPtr;
1964
1965 return ( errSecSuccess );
1966
1967 /***************/
1968
1969 malloc_authenticationType_failed:
1970 malloc_protocol_failed:
1971 malloc_port_failed:
1972 CFStringCreateAttribute_failed:
1973 malloc_attrPtr_failed:
1974
1975 // free any attributes
1976 _FreeAttrList(attrListPtr);
1977
1978 calloc_attrListPtr_failed:
1979
1980 return ( errSecBufferTooSmall );
1981 }
1982
1983
1984 /*
1985 * _CreateSecKeychainAttributeListFromDictionary creates a SecKeychainAttributeList
1986 * from the attribute key/values in attrDictionary for the specified item class.
1987 *
1988 * If this function returns errSecSuccess, the pointer to the SecKeychainAttributeList
1989 * must be freed by the caller with _FreeAttrList()
1990 */
1991 static OSStatus
1992 _CreateSecKeychainAttributeListFromDictionary(
1993 CFDictionaryRef attrDictionary,
1994 SecItemClass itemClass,
1995 SecKeychainAttributeList **attrList)
1996 {
1997 switch (itemClass)
1998 {
1999 case kSecInternetPasswordItemClass:
2000 return _CreateSecKeychainInternetPasswordAttributeListFromDictionary(attrDictionary, attrList);
2001
2002 case kSecGenericPasswordItemClass:
2003 return _CreateSecKeychainGenericPasswordAttributeListFromDictionary(attrDictionary, attrList);
2004
2005 case kSecCertificateItemClass:
2006 return _CreateSecKeychainCertificateAttributeListFromDictionary(attrDictionary, attrList);
2007
2008 case kSecPublicKeyItemClass:
2009 case kSecPrivateKeyItemClass:
2010 case kSecSymmetricKeyItemClass:
2011 return _CreateSecKeychainKeyAttributeListFromDictionary(attrDictionary, attrList);
2012
2013 default:
2014 break;
2015 }
2016 return errSecParam;
2017 }
2018
2019
2020 /*
2021 * _AppNameFromSecTrustedApplication attempts to pull the name of the
2022 * application/tool from the SecTrustedApplicationRef.
2023 */
2024 static CFStringRef CF_RETURNS_RETAINED
2025 _AppNameFromSecTrustedApplication(
2026 CFAllocatorRef alloc,
2027 SecTrustedApplicationRef appRef)
2028 {
2029 CFStringRef result;
2030 OSStatus status;
2031 CFDataRef appDataRef;
2032
2033 result = NULL;
2034
2035 // get the data for item's application/tool
2036 status = SecTrustedApplicationCopyData(appRef, &appDataRef);
2037 if ( status == errSecSuccess ) {
2038 CFStringRef path;
2039
2040 // convert it to a CFString potentially containing the path
2041 path = CFStringCreateWithCString(NULL, (char *)CFDataGetBytePtrVoid(appDataRef), kCFStringEncodingUTF8);
2042 if ( path != NULL ) {
2043 // the path has to start with a "/" and cannot contain "://"
2044 if ( CFStringHasPrefix(path, CFSTR("/")) && (CFStringFind(path, CFSTR("://"), 0).location == kCFNotFound) ) {
2045 CFRange nameRange, compRg;
2046
2047 nameRange = CFRangeMake(0, CFStringGetLength(path));
2048
2049 // remove the trailing slashes (if any)
2050 while ( (nameRange.length > 0) && (CFStringGetCharacterAtIndex(path, nameRange.length - 1) == '/') ) {
2051 nameRange.length --;
2052 }
2053
2054 if ( nameRange.length > 0 ) {
2055 // find last slash and adjust nameRange to be everything after it
2056 if ( CFStringFindWithOptions(path, CFSTR("/"), nameRange, kCFCompareBackwards, &compRg) ) {
2057 nameRange.length = nameRange.location + nameRange.length - (compRg.location + 1);
2058 nameRange.location = compRg.location + 1;
2059 }
2060
2061 result = CFStringCreateWithSubstring(alloc, path, nameRange);
2062 }
2063 }
2064 CFRelease(path);
2065 }
2066 CFRelease(appDataRef);
2067 }
2068
2069 return ( result );
2070 }
2071
2072 /* (This function really belongs in SecIdentity.cpp!)
2073 *
2074 * Returns the public key item corresponding to the identity, if it exists in
2075 * the same keychain as the private key. Note that the public key might not
2076 * exist in the same keychain (e.g. if the identity was imported via PKCS12),
2077 * in which case it will not be found.
2078 */
2079 static OSStatus
2080 _SecIdentityCopyPublicKey(
2081 SecIdentityRef identityRef,
2082 SecKeyRef *publicKeyRef)
2083 {
2084 OSStatus status;
2085 UInt32 count;
2086 SecKeychainAttribute attr = { kSecKeyLabel, 0, NULL };
2087 SecKeychainAttributeList attrList = { 1, &attr };
2088 SecKeychainAttributeList *keyAttrList = NULL;
2089 SecKeychainAttributeInfo *info = NULL;
2090 SecKeychainSearchRef search = NULL;
2091 SecKeychainRef keychain = NULL;
2092 SecKeychainItemRef privateKey = NULL;
2093 SecKeychainItemRef publicKey = NULL;
2094
2095 status = SecIdentityCopyPrivateKey(identityRef, (SecKeyRef *)&privateKey);
2096 if (status) {
2097 goto error_exit; // identity must have a private key
2098 }
2099 status = SecKeychainItemCopyKeychain(privateKey, &keychain);
2100 if (status) {
2101 goto error_exit; // private key must have a keychain, so we can get the attribute info for it
2102 }
2103 status = SecKeychainAttributeInfoForItemID(keychain, kSecPrivateKeyItemClass, &info);
2104 if (status) {
2105 goto error_exit; // unable to get the attribute info (i.e. database schema) for private keys
2106 }
2107 status = SecKeychainItemCopyAttributesAndData(privateKey, info, NULL, &keyAttrList, NULL, NULL);
2108 if (status) {
2109 goto error_exit; // unable to get the key label attribute for the private key
2110 }
2111
2112 // use the found kSecKeyLabel attribute from the private key in a separate attribute list for searching
2113 for (count = 0; count < keyAttrList->count; count++) {
2114 if (keyAttrList->attr[count].tag == kSecKeyLabel) {
2115 attr.length = keyAttrList->attr[count].length;
2116 attr.data = keyAttrList->attr[count].data;
2117 break;
2118 }
2119 }
2120 if (!attr.length || !attr.data) {
2121 status = errSecNoSuchAttr;
2122 goto error_exit; // the private key didn't have the hash of the public key in its kSecKeyLabel
2123 }
2124 status = SecKeychainSearchCreateFromAttributes(keychain, kSecPublicKeyItemClass, &attrList, &search);
2125 if (status) {
2126 goto error_exit; // unable to create the search reference
2127 }
2128 status = SecKeychainSearchCopyNext(search, &publicKey);
2129 if (status) {
2130 goto error_exit; // unable to find the public key
2131 }
2132
2133 if (publicKeyRef)
2134 *publicKeyRef = (SecKeyRef)publicKey;
2135 else
2136 CFRelease(publicKey);
2137
2138 error_exit:
2139 if (status != errSecSuccess) {
2140 if (publicKeyRef)
2141 *publicKeyRef = NULL;
2142 if (publicKey)
2143 CFRelease(publicKey);
2144 }
2145 if (search)
2146 CFRelease(search);
2147
2148 if (keyAttrList)
2149 SecKeychainItemFreeAttributesAndData(keyAttrList, NULL);
2150
2151 if (info)
2152 SecKeychainFreeAttributeInfo(info);
2153
2154 if (keychain)
2155 CFRelease(keychain);
2156
2157 if (privateKey)
2158 CFRelease(privateKey);
2159
2160 return status;
2161 }
2162
2163
2164 /*
2165 * Deletes a keychain item if the current application/tool is the only application/tool
2166 * with decrypt access to that keychain item. If more than one application/tool
2167 * has decrypt access to the keychain item, the item is left on the keychain.
2168 *
2169 * TBD: If more than one app/tool has access to the keychain item, we should remove
2170 * the current app/tool's decrypt access. There's no easy way to do that with
2171 * current keychain APIs without bringing up the security UI.
2172 */
2173 static OSStatus
2174 _SafeSecKeychainItemDelete(
2175 SecKeychainItemRef itemRef)
2176 {
2177 OSStatus status;
2178 SecAccessRef access = NULL;
2179 CFArrayRef aclList = NULL;
2180 SecACLRef acl = NULL;
2181 CFArrayRef appList = NULL;
2182 CFStringRef description = NULL;
2183 CSSM_ACL_KEYCHAIN_PROMPT_SELECTOR promptSelector;
2184 CFIndex idx, count = 0;
2185 SecTrustedApplicationRef currentAppRef = NULL;
2186 CFStringRef itemAppName = NULL, currentAppName = NULL;
2187
2188 SecItemClass itemClass = (SecItemClass)0;
2189 status = SecKeychainItemCopyAttributesAndData(itemRef, NULL, &itemClass, NULL, NULL, NULL);
2190 if (!(itemClass == kSecInternetPasswordItemClass || itemClass == kSecGenericPasswordItemClass)) {
2191 // only perform the access control safety check on deletion of password credentials;
2192 // if the item is of some other type, delete it normally.
2193 return SecKeychainItemDelete(itemRef);
2194 }
2195
2196 // skip access control checking for web form passwords: <rdar://10957301>
2197 // This permits Safari to manage the removal of all web form passwords,
2198 // regardless of whether they are shared by multiple applications.
2199 if (itemClass == kSecInternetPasswordItemClass) {
2200 UInt32 tags[1] = { kSecAuthenticationTypeItemAttr };
2201 SecKeychainAttributeInfo attrInfo = { 1, tags, NULL };
2202 SecKeychainAttributeList *attrs = NULL;
2203 status = SecKeychainItemCopyAttributesAndData(itemRef, &attrInfo, NULL, &attrs, NULL, NULL);
2204 if (!status && attrs) {
2205 bool webFormPassword = (attrs->attr[0].length == 4 && (!memcmp(attrs->attr[0].data, "form", 4)));
2206 SecKeychainItemFreeAttributesAndData(attrs, NULL);
2207 if (webFormPassword) {
2208 return SecKeychainItemDelete(itemRef);
2209 }
2210 }
2211 }
2212
2213 // copy the access of the keychain item
2214 status = SecKeychainItemCopyAccess(itemRef, &access);
2215 require_noerr(status, finish);
2216 require_quiet(access != NULL, finish);
2217
2218 // copy the decrypt access control lists -- this is what has access to the keychain item
2219 status = SecAccessCopySelectedACLList(access, CSSM_ACL_AUTHORIZATION_DECRYPT, &aclList);
2220 require_noerr(status, finish);
2221 require_quiet(aclList != NULL, finish);
2222
2223 // get the access control list
2224 acl = (SecACLRef)CFArrayGetValueAtIndex(aclList, 0);
2225 require_quiet(acl != NULL, finish);
2226
2227 // copy the application list, description, and CSSM prompt selector for a given access control list entry
2228 status = SecACLCopySimpleContents(acl, &appList, &description, &promptSelector);
2229 require_noerr(status, finish);
2230 require_quiet(appList != NULL, finish);
2231
2232 // does the calling application/tool have decrypt access to this item?
2233 count = CFArrayGetCount(appList);
2234 for ( idx = 0; idx < count; idx++ ) {
2235 // get SecTrustedApplicationRef for this entry
2236 SecTrustedApplicationRef itemAppRef = (SecTrustedApplicationRef)CFArrayGetValueAtIndex(appList, idx);
2237 require_quiet(itemAppRef != NULL, finish);
2238
2239 // copy the name out
2240 CFReleaseSafe(itemAppName);
2241 itemAppName = _AppNameFromSecTrustedApplication(CFGetAllocator(itemRef), itemAppRef);
2242 if (itemAppName == NULL) {
2243 /*
2244 * If there is no app name, it's probably because it's not an appname
2245 * in the ACE but an entitlement/info.plist based rule instead;
2246 * just let the caller have it. */
2247 count = 0;
2248 goto finish;
2249 }
2250
2251 // create SecTrustedApplicationRef for current application/tool
2252 CFReleaseNull(currentAppRef);
2253 status = SecTrustedApplicationCreateFromPath(NULL, &currentAppRef);
2254 require_noerr(status, finish);
2255 require_quiet(currentAppRef != NULL, finish);
2256
2257 // copy the name out
2258 CFReleaseSafe(currentAppName);
2259 currentAppName = _AppNameFromSecTrustedApplication(CFGetAllocator(itemRef), currentAppRef);
2260 require_quiet(currentAppName != NULL, finish);
2261
2262 // compare the names to see if we own the decrypt access
2263 // TBD: validation of membership in an application group
2264 if ( CFStringCompare(currentAppName, itemAppName, 0) == kCFCompareEqualTo ) {
2265 count = 0;
2266 goto finish;
2267 }
2268 }
2269
2270 finish:
2271
2272 CFReleaseSafe(currentAppName);
2273 CFReleaseSafe(itemAppName);
2274 CFReleaseSafe(currentAppRef);
2275 CFReleaseSafe(description);
2276 CFReleaseSafe(appList);
2277 CFReleaseSafe(aclList);
2278 CFReleaseSafe(access);
2279
2280 if ((count == 0) || (status == errSecVerifyFailed)) {
2281 // no "owners" remain in the ACL list (or unable to get ACL)
2282 status = SecKeychainItemDelete(itemRef);
2283 } else {
2284 // caller is not the "owner" of the item
2285 status = errSecInvalidOwnerEdit;
2286 }
2287
2288 return status;
2289 }
2290
2291 static OSStatus
2292 _ReplaceKeychainItem(
2293 SecKeychainItemRef itemToUpdate,
2294 SecKeychainAttributeList *changeAttrList,
2295 CFDataRef itemData)
2296 {
2297 OSStatus status;
2298 UInt32 itemID;
2299 SecItemClass itemClass;
2300 SecKeychainAttributeInfo *info = NULL;
2301 SecKeychainAttributeList *attrList = NULL;
2302 SecKeychainAttributeList newAttrList = { 0, NULL};
2303 SecKeychainRef keychain = NULL;
2304 SecKeychainItemRef newItem = NULL;
2305
2306 int priority = LOG_DEBUG;
2307 const char *format = "ReplaceKeychainItem (%d) error %d";
2308
2309 // get existing item's keychain
2310 status = SecKeychainItemCopyKeychain(itemToUpdate, &keychain);
2311 if (status) { secitemlog(priority, format, 1, (int)status); }
2312 require_noerr(status, replace_failed);
2313
2314 // get attribute info (i.e. database schema) for the item class
2315 status = SecKeychainItemCopyAttributesAndData(itemToUpdate, NULL, &itemClass, NULL, NULL, NULL);
2316 if (status) { secitemlog(priority, format, 2, (int)status); }
2317 require_noerr(status, replace_failed);
2318
2319 switch (itemClass)
2320 {
2321 case kSecInternetPasswordItemClass:
2322 itemID = CSSM_DL_DB_RECORD_INTERNET_PASSWORD;
2323 break;
2324 case kSecGenericPasswordItemClass:
2325 itemID = CSSM_DL_DB_RECORD_GENERIC_PASSWORD;
2326 break;
2327 default:
2328 itemID = itemClass;
2329 break;
2330 }
2331 status = SecKeychainAttributeInfoForItemID(keychain, itemID, &info);
2332 if (status) { secitemlog(priority, format, 3, (int)status); }
2333
2334 // get item's existing attributes (but not data!)
2335 status = SecKeychainItemCopyAttributesAndData(itemToUpdate, info, &itemClass, &attrList, NULL, NULL);
2336 if (status) { secitemlog(priority, format, 4, (int)status); }
2337 require(attrList != NULL, replace_failed);
2338
2339 // move aside the item by changing a primary attribute
2340 // (currently only for passwords)
2341 if (itemClass == kSecInternetPasswordItemClass || itemClass == kSecGenericPasswordItemClass) {
2342 CFUUIDRef uuid = CFUUIDCreate(kCFAllocatorDefault);
2343 CFStringRef uuidStr = (uuid) ? CFUUIDCreateString(kCFAllocatorDefault, uuid) : CFSTR("MOVED");
2344 CFReleaseSafe(uuid);
2345 if (uuidStr) {
2346 CFIndex maxLength = CFStringGetMaximumSizeForEncoding(CFStringGetLength(uuidStr), kCFStringEncodingUTF8) + 1;
2347 char* buffer = (char*) malloc(maxLength);
2348 if (buffer) {
2349 if (CFStringGetCString(uuidStr, buffer, maxLength, kCFStringEncodingUTF8)) {
2350 UInt32 length = (UInt32)strlen(buffer);
2351 SecKeychainAttribute attrs[] = { { kSecAccountItemAttr, length, (char*)buffer }, };
2352 SecKeychainAttributeList updateAttrList = { sizeof(attrs) / sizeof(attrs[0]), attrs };
2353 status = SecKeychainItemModifyAttributesAndData(itemToUpdate, &updateAttrList, 0, NULL);
2354 if (status) { secitemlog(priority, format, 5, (int)status); }
2355 if (status == errSecVerifyFailed) {
2356 // still unable to change attrs? delete unconditionally here
2357 status = SecKeychainItemDelete(itemToUpdate);
2358 if (status) { secitemlog(priority, format, 6, (int)status); }
2359 }
2360 }
2361 free(buffer);
2362 }
2363 CFReleaseSafe(uuidStr);
2364 }
2365 }
2366 require_noerr(status, replace_failed);
2367
2368 // make attribute list for new item (the data is still owned by attrList)
2369 newAttrList.count = attrList->count;
2370 newAttrList.attr = (SecKeychainAttribute *) calloc(attrList->count, sizeof(SecKeychainAttribute));
2371 int i, newCount;
2372 for (i=0, newCount=0; i < attrList->count; i++) {
2373 if (attrList->attr[i].length > 0) {
2374 newAttrList.attr[newCount++] = attrList->attr[i];
2375 }
2376 }
2377 newAttrList.count = newCount;
2378
2379 // create new item in the same keychain
2380 status = SecKeychainItemCreateFromContent(itemClass, &newAttrList,
2381 (UInt32)((itemData) ? CFDataGetLength(itemData) : 0),
2382 (const void *)((itemData) ? CFDataGetBytePtr(itemData) : NULL),
2383 keychain, NULL, &newItem);
2384 if (status) { secitemlog(priority, format, 7, (int)status); }
2385 require_noerr(status, replace_failed);
2386
2387 // delete the old item unconditionally once new item exists
2388 status = SecKeychainItemDelete(itemToUpdate);
2389
2390 // update the new item with changed attributes, if any
2391 status = (changeAttrList) ? SecKeychainItemModifyContent(newItem, changeAttrList, 0, NULL) : errSecSuccess;
2392 if (status) { secitemlog(priority, format, 8, (int)status); }
2393 if (status == errSecSuccess) {
2394 // say the item already exists, because it does now. <rdar://19063674>
2395 status = errSecDuplicateItem;
2396 }
2397
2398 replace_failed:
2399 if (newAttrList.attr) {
2400 free(newAttrList.attr);
2401 }
2402 if (attrList) {
2403 SecKeychainItemFreeAttributesAndData(attrList, NULL);
2404 }
2405 if (info) {
2406 SecKeychainFreeAttributeInfo(info);
2407 }
2408 CFReleaseSafe(newItem);
2409 CFReleaseSafe(keychain);
2410
2411 return status;
2412 }
2413
2414 static OSStatus
2415 _UpdateKeychainItem(CFTypeRef item, CFDictionaryRef changedAttributes)
2416 {
2417 // This function updates a single keychain item, which may be specified as
2418 // a reference, persistent reference or attribute dictionary, with the
2419 // attributes provided.
2420
2421 OSStatus status = errSecSuccess;
2422 if (!item) {
2423 return errSecParam;
2424 }
2425
2426 SecItemClass itemClass = (SecItemClass) 0;
2427 SecAccessRef access = NULL;
2428 SecKeychainAttributeList *changeAttrList = NULL;
2429 SecKeychainItemRef itemToUpdate = NULL;
2430 CFDataRef theData = NULL;
2431 CFTypeID itemType = CFGetTypeID(item);
2432
2433 // validate input item (must be convertible to a SecKeychainItemRef)
2434 if (SecKeychainItemGetTypeID() == itemType ||
2435 SecCertificateGetTypeID() == itemType ||
2436 SecKeyGetTypeID() == itemType) {
2437 // item is already a reference, retain it
2438 itemToUpdate = (SecKeychainItemRef) CFRetain(item);
2439 }
2440 else if (CFDataGetTypeID() == itemType) {
2441 // item is a persistent reference, must convert it
2442 status = SecKeychainItemCopyFromPersistentReference((CFDataRef)item, &itemToUpdate);
2443 }
2444 else if (CFDictionaryGetTypeID() == itemType) {
2445 // item is a dictionary
2446 CFTypeRef value = NULL;
2447 if (CFDictionaryGetValueIfPresent((CFDictionaryRef)item, kSecValueRef, &value)) {
2448 // kSecValueRef value is a SecKeychainItemRef, retain it
2449 itemToUpdate = (SecKeychainItemRef) CFRetain(value);
2450 }
2451 else if (CFDictionaryGetValueIfPresent((CFDictionaryRef)item, kSecValuePersistentRef, &value)) {
2452 // kSecValuePersistentRef value is a persistent reference, must convert it
2453 status = SecKeychainItemCopyFromPersistentReference((CFDataRef)value, &itemToUpdate);
2454 }
2455 }
2456 else if (SecIdentityGetTypeID() == itemType) {
2457 // item is a certificate + private key; since we can't really change the
2458 // certificate's attributes, assume we want to update the private key
2459 status = SecIdentityCopyPrivateKey((SecIdentityRef)item, (SecKeyRef*)&itemToUpdate);
2460 }
2461 require_action(itemToUpdate != NULL, update_failed, status = errSecInvalidItemRef);
2462 require_noerr(status, update_failed);
2463
2464 status = SecKeychainItemCopyContent(itemToUpdate, &itemClass, NULL, NULL, NULL);
2465 require_noerr(status, update_failed);
2466
2467 // build changeAttrList from changedAttributes dictionary
2468 switch (itemClass)
2469 {
2470 case kSecInternetPasswordItemClass:
2471 {
2472 status = _CreateSecKeychainInternetPasswordAttributeListFromDictionary(changedAttributes, &changeAttrList);
2473 require_noerr(status, update_failed);
2474 }
2475 break;
2476
2477 case kSecGenericPasswordItemClass:
2478 {
2479 status = _CreateSecKeychainGenericPasswordAttributeListFromDictionary(changedAttributes, &changeAttrList);
2480 require_noerr(status, update_failed);
2481 }
2482 break;
2483
2484 case kSecCertificateItemClass:
2485 {
2486 status = _CreateSecKeychainCertificateAttributeListFromDictionary(changedAttributes, &changeAttrList);
2487 require_noerr(status, update_failed);
2488 }
2489 break;
2490
2491 case kSecPublicKeyItemClass:
2492 case kSecPrivateKeyItemClass:
2493 case kSecSymmetricKeyItemClass:
2494 {
2495 status = _CreateSecKeychainKeyAttributeListFromDictionary(changedAttributes, &changeAttrList);
2496 require_noerr(status, update_failed);
2497 }
2498 break;
2499 case kSecAppleSharePasswordItemClass:
2500 {
2501 // do nothing (legacy behavior).
2502 }
2503 break;
2504
2505 }
2506
2507 // get the password
2508 // (if the caller is not updating the password, this value will be NULL)
2509 theData = (CFDataRef)CFDictionaryGetValue(changedAttributes, kSecValueData);
2510 if (theData != NULL) {
2511 require_action(CFDataGetTypeID() == CFGetTypeID(theData), update_failed, status = errSecParam);
2512 }
2513 // update item
2514 status = SecKeychainItemModifyContent(itemToUpdate,
2515 (!changeAttrList || changeAttrList->count == 0) ? NULL : changeAttrList,
2516 (theData != NULL) ? (UInt32)CFDataGetLength(theData) : 0,
2517 (theData != NULL) ? CFDataGetBytePtrVoid(theData) : NULL);
2518 require_noerr(status, update_failed);
2519
2520 // one more thing... update access?
2521 if (CFDictionaryGetValueIfPresent(changedAttributes, kSecAttrAccess, (const void **)&access)) {
2522 status = SecKeychainItemSetAccess(itemToUpdate, access);
2523 }
2524
2525 update_failed:
2526 if (status == errSecVerifyFailed &&
2527 (itemClass == kSecInternetPasswordItemClass || itemClass == kSecGenericPasswordItemClass)) {
2528 // if we got a cryptographic failure updating a password item, it needs to be replaced
2529 status = _ReplaceKeychainItem(itemToUpdate,
2530 (!changeAttrList || changeAttrList->count == 0) ? NULL : changeAttrList,
2531 theData);
2532 }
2533 if (itemToUpdate)
2534 CFRelease(itemToUpdate);
2535 _FreeAttrList(changeAttrList);
2536 return status;
2537 }
2538
2539 static OSStatus
2540 _DeleteKeychainItem(CFTypeRef item)
2541 {
2542 // This function deletes a single keychain item, which may be specified as
2543 // a reference, persistent reference or attribute dictionary. It will not
2544 // delete non-keychain items or aggregate items (such as a SecIdentityRef);
2545 // it is assumed that the caller will pass identity components separately.
2546
2547 OSStatus status = errSecSuccess;
2548 if (!item) {
2549 return errSecParam;
2550 }
2551
2552 SecKeychainItemRef itemToDelete = NULL;
2553 CFTypeID itemType = CFGetTypeID(item);
2554 if (SecKeychainItemGetTypeID() == itemType ||
2555 SecCertificateGetTypeID() == itemType ||
2556 SecKeyGetTypeID() == itemType) {
2557 // item is already a reference, retain it
2558 itemToDelete = (SecKeychainItemRef) CFRetain(item);
2559 }
2560 else if (CFDataGetTypeID() == itemType) {
2561 // item is a persistent reference, must convert it
2562 status = SecKeychainItemCopyFromPersistentReference((CFDataRef)item, &itemToDelete);
2563 }
2564 else if (CFDictionaryGetTypeID() == itemType) {
2565 // item is a dictionary
2566 CFTypeRef value = NULL;
2567 if (CFDictionaryGetValueIfPresent((CFDictionaryRef)item, kSecValueRef, &value)) {
2568 // kSecValueRef value is a SecKeychainItemRef, retain it
2569 itemToDelete = (SecKeychainItemRef) CFRetain(value);
2570 }
2571 else if (CFDictionaryGetValueIfPresent((CFDictionaryRef)item, kSecValuePersistentRef, &value)) {
2572 // kSecValuePersistentRef value is a persistent reference, must convert it
2573 status = SecKeychainItemCopyFromPersistentReference((CFDataRef)value, &itemToDelete);
2574 }
2575 }
2576
2577 if (itemToDelete) {
2578 if (!status) {
2579 status = _SafeSecKeychainItemDelete(itemToDelete);
2580 }
2581 CFRelease(itemToDelete);
2582 }
2583
2584 return status;
2585 }
2586
2587 static OSStatus
2588 _DeleteIdentity(SecIdentityRef identity)
2589 {
2590 OSStatus status, result = errSecSuccess;
2591 SecKeyRef privateKey = NULL;
2592 SecCertificateRef certificate = NULL;
2593
2594 status = SecIdentityCopyPrivateKey(identity, &privateKey);
2595 if (!status) {
2596 SecKeyRef publicKey = NULL;
2597 status = _SecIdentityCopyPublicKey(identity, &publicKey);
2598 if (!status) {
2599 status = _DeleteKeychainItem(publicKey);
2600 CFRelease(publicKey);
2601 }
2602 status = _DeleteKeychainItem(privateKey);
2603 }
2604
2605 if (privateKey) CFRelease(privateKey);
2606 if (status) result = status;
2607
2608 status = SecIdentityCopyCertificate(identity, &certificate);
2609 if (!status) {
2610 status = _DeleteKeychainItem(certificate);
2611 }
2612
2613 if (certificate) CFRelease(certificate);
2614 if (status) result = status;
2615
2616 return result;
2617 }
2618
2619 static OSStatus
2620 _UpdateAggregateStatus(OSStatus newStatus, OSStatus curStatus, OSStatus baseStatus)
2621 {
2622 // This function is used when atomically processing multiple items,
2623 // where an overall error result must be returned for the entire operation.
2624 // When newStatus is something other than errSecSuccess, we want to keep the "most
2625 // interesting" status (which usually will be newStatus, unless curStatus is
2626 // already set; in that case, newStatus can trump curStatus only by being
2627 // something different than baseStatus.)
2628
2629 OSStatus result = curStatus;
2630
2631 if (newStatus != errSecSuccess) {
2632 result = newStatus;
2633 if (curStatus != errSecSuccess) {
2634 result = (newStatus != baseStatus) ? newStatus : curStatus;
2635 }
2636 }
2637 return result;
2638 }
2639
2640 static void
2641 _AddDictValueToOtherDict(const void *key, const void *value, void *context)
2642 {
2643 // CFDictionaryApplierFunction
2644 // This function just takes the given key/value pair,
2645 // and adds it to another dictionary supplied in the context argument.
2646
2647 CFMutableDictionaryRef dict = *((CFMutableDictionaryRef*) context);
2648 if (key && value) {
2649 CFDictionaryAddValue(dict, key, value);
2650 }
2651 }
2652
2653 static CFStringCompareFlags
2654 _StringCompareFlagsFromQuery(CFDictionaryRef query)
2655 {
2656 CFTypeRef value;
2657 CFStringCompareFlags flags = 0;
2658 if (!query) return flags;
2659
2660 if (CFDictionaryGetValueIfPresent(query, kSecMatchSubjectStartsWith, (const void **)&value) ||
2661 CFDictionaryGetValueIfPresent(query, kSecMatchSubjectEndsWith, (const void **)&value))
2662 flags |= kCFCompareAnchored;
2663
2664 if (CFDictionaryGetValueIfPresent(query, kSecMatchSubjectEndsWith, (const void **)&value))
2665 flags |= kCFCompareBackwards;
2666
2667 if (CFDictionaryGetValueIfPresent(query, kSecMatchCaseInsensitive, (const void **)&value) && CFEqual(kCFBooleanTrue, value))
2668 flags |= kCFCompareCaseInsensitive;
2669
2670 if (CFDictionaryGetValueIfPresent(query, kSecMatchDiacriticInsensitive, (const void **)&value) && CFEqual(kCFBooleanTrue, value))
2671 flags |= kCFCompareDiacriticInsensitive;
2672
2673 if (CFDictionaryGetValueIfPresent(query, kSecMatchWidthInsensitive, (const void **)&value) && CFEqual(kCFBooleanTrue, value))
2674 flags |= kCFCompareWidthInsensitive;
2675
2676 return flags;
2677 }
2678
2679 static uint32
2680 _CssmKeyUsageFromQuery(CFDictionaryRef query)
2681 {
2682 CFTypeRef value;
2683 uint32 keyUsage = 0;
2684 if (!query) return keyUsage;
2685
2686 if (CFDictionaryGetValueIfPresent(query, kSecAttrCanEncrypt, (const void **)&value) && CFEqual(kCFBooleanTrue, value))
2687 keyUsage |= CSSM_KEYUSE_ENCRYPT;
2688
2689 if (CFDictionaryGetValueIfPresent(query, kSecAttrCanDecrypt, (const void **)&value) && CFEqual(kCFBooleanTrue, value))
2690 keyUsage |= CSSM_KEYUSE_DECRYPT;
2691
2692 if (CFDictionaryGetValueIfPresent(query, kSecAttrCanSign, (const void **)&value) && CFEqual(kCFBooleanTrue, value))
2693 keyUsage |= CSSM_KEYUSE_SIGN;
2694
2695 if (CFDictionaryGetValueIfPresent(query, kSecAttrCanVerify, (const void **)&value) && CFEqual(kCFBooleanTrue, value))
2696 keyUsage |= CSSM_KEYUSE_VERIFY;
2697
2698 if (CFDictionaryGetValueIfPresent(query, kSecAttrCanWrap, (const void **)&value) && CFEqual(kCFBooleanTrue, value))
2699 keyUsage |= CSSM_KEYUSE_WRAP;
2700
2701 if (CFDictionaryGetValueIfPresent(query, kSecAttrCanUnwrap, (const void **)&value) && CFEqual(kCFBooleanTrue, value))
2702 keyUsage |= CSSM_KEYUSE_UNWRAP;
2703
2704 if (CFDictionaryGetValueIfPresent(query, kSecAttrCanDerive, (const void **)&value) && CFEqual(kCFBooleanTrue, value))
2705 keyUsage |= CSSM_KEYUSE_DERIVE;
2706
2707 return keyUsage;
2708 }
2709
2710 static SecItemClass
2711 _ConvertItemClass(const void* item, const void* keyClass, Boolean *isIdentity)
2712 {
2713 SecItemClass itemClass = (SecItemClass) 0;
2714 if (isIdentity) *isIdentity = false;
2715
2716 if (CFEqual(item, kSecClassGenericPassword)) {
2717 itemClass = kSecGenericPasswordItemClass;
2718 }
2719 else if (CFEqual(item, kSecClassInternetPassword)) {
2720 itemClass = kSecInternetPasswordItemClass;
2721 }
2722 else if (CFEqual(item, kSecClassCertificate)) {
2723 itemClass = kSecCertificateItemClass;
2724 }
2725 else if (CFEqual(item, kSecClassIdentity)) {
2726 // will perform a certificate lookup
2727 itemClass = kSecCertificateItemClass;
2728 if (isIdentity) *isIdentity = true;
2729 }
2730 else if (CFEqual(item, kSecClassKey)) {
2731 // examine second parameter to determine type of key
2732 if (!keyClass || CFEqual(keyClass, kSecAttrKeyClassSymmetric)) {
2733 itemClass = kSecSymmetricKeyItemClass;
2734 }
2735 else if (keyClass && CFEqual(keyClass, kSecAttrKeyClassPublic)) {
2736 itemClass = kSecPublicKeyItemClass;
2737 }
2738 else if (keyClass && CFEqual(keyClass, kSecAttrKeyClassPrivate)) {
2739 itemClass = kSecPrivateKeyItemClass;
2740 }
2741 }
2742
2743 return itemClass;
2744 }
2745
2746 static SecItemClass
2747 _ItemClassFromItemList(CFArrayRef itemList)
2748 {
2749 // Given a list of items (standard or persistent references),
2750 // determine whether they all have the same item class. Returns
2751 // the item class, or 0 if multiple classes in list.
2752 SecItemClass result = (SecItemClass) 0;
2753 CFIndex index, count = (itemList) ? CFArrayGetCount(itemList) : 0;
2754 for (index=0; index < count; index++) {
2755 CFTypeRef item = (CFTypeRef) CFArrayGetValueAtIndex(itemList, index);
2756 if (item) {
2757 SecKeychainItemRef itemRef = NULL;
2758 OSStatus status;
2759 if (CFGetTypeID(item) == CFDataGetTypeID()) {
2760 // persistent reference, resolve first
2761 status = SecKeychainItemCopyFromPersistentReference((CFDataRef)item, &itemRef);
2762 }
2763 else {
2764 itemRef = (SecKeychainItemRef) CFRetain(item);
2765 }
2766 if (itemRef) {
2767 SecItemClass itemClass = (SecItemClass) 0;
2768 CFTypeID itemTypeID = CFGetTypeID(itemRef);
2769 if (itemTypeID == SecIdentityGetTypeID() || itemTypeID == SecCertificateGetTypeID()) {
2770 // Identities and certificates have the same underlying item class
2771 itemClass = kSecCertificateItemClass;
2772 }
2773 else if (itemTypeID == SecKeychainItemGetTypeID()) {
2774 // Reference to item in a keychain
2775 status = SecKeychainItemCopyAttributesAndData(itemRef, NULL, &itemClass, NULL, NULL, NULL);
2776 }
2777 else if (itemTypeID == SecKeyGetTypeID()) {
2778 // SecKey that isn't stored in a keychain
2779 // %%% will need to change this code when SecKey is no longer CSSM-based %%%
2780 const CSSM_KEY *cssmKey;
2781 status = SecKeyGetCSSMKey((SecKeyRef)itemRef, &cssmKey);
2782 if (status == errSecSuccess) {
2783 if (cssmKey->KeyHeader.KeyClass == CSSM_KEYCLASS_PUBLIC_KEY)
2784 itemClass = kSecPublicKeyItemClass;
2785 else if (cssmKey->KeyHeader.KeyClass == CSSM_KEYCLASS_PRIVATE_KEY)
2786 itemClass = kSecPrivateKeyItemClass;
2787 else
2788 itemClass = kSecSymmetricKeyItemClass;
2789 }
2790 }
2791 CFRelease(itemRef);
2792 if (itemClass != 0) {
2793 if (result != 0 && result != itemClass) {
2794 return (SecItemClass) 0; // different item classes in list; bail out
2795 }
2796 result = itemClass;
2797 }
2798 }
2799 }
2800 }
2801 return result;
2802 }
2803
2804 // SecItemParams contains a validated set of input parameters, as well as a
2805 // search reference and attribute list built from those parameters. It is
2806 // designed to be allocated with _CreateSecItemParamsFromDictionary, and
2807 // freed with _FreeSecItemParams.
2808
2809 struct SecItemParams {
2810 CFDictionaryRef query; // caller-supplied query
2811 int numResultTypes; // number of result types requested
2812 int maxMatches; // max number of matches to return
2813 uint32 keyUsage; // key usage(s) requested
2814 Boolean returningAttributes; // true if returning attributes dictionary
2815 Boolean returningData; // true if returning item's data
2816 Boolean returningRef; // true if returning item reference
2817 Boolean returningPersistentRef; // true if returing a persistent reference
2818 Boolean returnAllMatches; // true if we should return all matches
2819 Boolean returnIdentity; // true if we are returning a SecIdentityRef
2820 Boolean trustedOnly; // true if we only return trusted certs
2821 Boolean issuerAndSNToMatch; // true if both issuer and SN were provided
2822 SecItemClass itemClass; // item class for this query
2823 SecPolicyRef policy; // value for kSecMatchPolicy (may be NULL)
2824 SecKeychainRef keychain; // value for kSecUseKeychain (may be NULL)
2825 CFArrayRef useItems; // value for kSecUseItemList (may be NULL)
2826 CFArrayRef itemList; // value for kSecMatchItemList (may be NULL)
2827 CFTypeRef searchList; // value for kSecMatchSearchList (may be NULL)
2828 CFTypeRef matchLimit; // value for kSecMatchLimit (may be NULL)
2829 CFTypeRef emailAddrToMatch; // value for kSecMatchEmailAddressIfPresent (may be NULL)
2830 CFTypeRef validOnDate; // value for kSecMatchValidOnDate (may be NULL)
2831 CFTypeRef keyClass; // value for kSecAttrKeyClass (may be NULL)
2832 CFTypeRef service; // value for kSecAttrService (may be NULL)
2833 CFTypeRef issuer; // value for kSecAttrIssuer (may be NULL)
2834 CFTypeRef matchIssuers; // value for kSecMatchIssuers (may be NULL)
2835 CFTypeRef serialNumber; // value for kSecAttrSerialNumber (may be NULL)
2836 CFTypeRef search; // search reference for this query (SecKeychainSearchRef or SecIdentitySearchRef)
2837 CFTypeRef assumedKeyClass; // if no kSecAttrKeyClass provided, holds the current class we're searching for
2838 CFIndex itemListIndex; // if no search reference but we have itemList, holds index of next item to return
2839 SecKeychainAttributeList *attrList; // attribute list for this query
2840 SecAccessRef access; // access reference (for SecItemAdd only, not used to find items)
2841 CFDataRef itemData; // item data (for SecItemAdd only, not used to find items)
2842 CFTypeRef itemRef; // item reference (to find, add, update or delete, depending on context)
2843 SecIdentityRef identityRef; // identity reference (input as kSecValueRef)
2844 CFDataRef itemPersistentRef; // item persistent reference (to find, add, update or delete, depending on context)
2845 Boolean isPCSItem; // true if this query is for a Protected Cloud Storage item
2846 };
2847
2848 static OSStatus
2849 _ValidateDictionaryEntry(CFDictionaryRef dict, CFTypeRef key, const void **value, CFTypeID expectedTypeID, CFTypeID altTypeID)
2850 {
2851 if (!dict || !key || !value || !expectedTypeID)
2852 return errSecParam;
2853
2854 if (!CFDictionaryGetValueIfPresent(dict, key, value)) {
2855 // value was not provided for this key (not an error!)
2856 *value = NULL;
2857 }
2858 else if (!(*value)) {
2859 // provided value is NULL (also not an error!)
2860 return errSecSuccess;
2861 }
2862 else {
2863 CFTypeID actualTypeID = CFGetTypeID(*value);
2864 if (!((expectedTypeID == actualTypeID) || (altTypeID && altTypeID == actualTypeID))) {
2865 // provided value does not have the expected (or alternate) CF type ID
2866 if ((expectedTypeID == SecKeychainItemGetTypeID()) &&
2867 (actualTypeID == SecKeyGetTypeID() || actualTypeID == SecCertificateGetTypeID())) {
2868 // provided value is a "floating" reference which is not yet in a keychain
2869 CFRetain(*value);
2870 return errSecSuccess;
2871 }
2872 return errSecItemInvalidValue;
2873 }
2874 else {
2875 // provided value is OK; retain it
2876 CFRetain(*value);
2877 }
2878 }
2879 return errSecSuccess;
2880 }
2881
2882 static void
2883 _EnsureUserDefaultKeychainIsSearched(SecItemParams *itemParams)
2884 {
2885 OSStatus status;
2886 CFArrayRef tmpList = (CFArrayRef) itemParams->searchList;
2887 if (tmpList) {
2888 // search list exists; make it mutable
2889 itemParams->searchList = (CFArrayRef) CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, tmpList);
2890 CFRelease(tmpList);
2891 } else {
2892 // no search list; start with default list
2893 status = SecKeychainCopySearchList(&tmpList);
2894 if (!status && tmpList) {
2895 itemParams->searchList = (CFArrayRef) CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, tmpList);
2896 CFRelease(tmpList);
2897 }
2898 else {
2899 itemParams->searchList = (CFArrayRef) CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
2900 }
2901 }
2902
2903 SecKeychainRef userKeychain = NULL;
2904 status = SecKeychainCopyDomainDefault(kSecPreferencesDomainUser, &userKeychain);
2905 if (!status && userKeychain) {
2906 if (!CFArrayContainsValue((CFArrayRef)itemParams->searchList,
2907 CFRangeMake(0, CFArrayGetCount((CFArrayRef)itemParams->searchList)), userKeychain)) {
2908 // user's default keychain isn't currently in the search list, so append it
2909 CFArrayAppendValue((CFMutableArrayRef)itemParams->searchList, userKeychain);
2910 }
2911 CFRelease(userKeychain);
2912 }
2913 }
2914
2915 static void
2916 _EnsureUserDefaultKeychainIsTargeted(SecItemParams *itemParams)
2917 {
2918 if (itemParams->keychain) {
2919 return; // keychain is already explicitly specified, assume it's correct
2920 }
2921 SecKeychainRef userKeychain = NULL;
2922 OSStatus status = SecKeychainCopyDomainDefault(kSecPreferencesDomainUser, &userKeychain);
2923 if (!status && userKeychain) {
2924 itemParams->keychain = userKeychain;
2925 }
2926 }
2927
2928 static void
2929 _FreeSecItemParams(SecItemParams *itemParams)
2930 {
2931 if (!itemParams)
2932 return;
2933
2934 if (itemParams->query) CFRelease(itemParams->query);
2935 if (itemParams->policy) CFRelease(itemParams->policy);
2936 if (itemParams->keychain) CFRelease(itemParams->keychain);
2937 if (itemParams->useItems) CFRelease(itemParams->useItems);
2938 if (itemParams->itemList) CFRelease(itemParams->itemList);
2939 if (itemParams->searchList) CFRelease(itemParams->searchList);
2940 if (itemParams->matchLimit) CFRelease(itemParams->matchLimit);
2941 if (itemParams->emailAddrToMatch) CFRelease(itemParams->emailAddrToMatch);
2942 if (itemParams->validOnDate) CFRelease(itemParams->validOnDate);
2943 if (itemParams->keyClass) CFRelease(itemParams->keyClass);
2944 if (itemParams->service) CFRelease(itemParams->service);
2945 if (itemParams->issuer) CFRelease(itemParams->issuer);
2946 if (itemParams->matchIssuers) CFRelease(itemParams->matchIssuers);
2947 if (itemParams->serialNumber) CFRelease(itemParams->serialNumber);
2948 if (itemParams->search) CFRelease(itemParams->search);
2949 if (itemParams->access) CFRelease(itemParams->access);
2950 if (itemParams->itemData) CFRelease(itemParams->itemData);
2951 if (itemParams->itemRef) CFRelease(itemParams->itemRef);
2952 if (itemParams->identityRef) CFRelease(itemParams->identityRef);
2953 if (itemParams->itemPersistentRef) CFRelease(itemParams->itemPersistentRef);
2954
2955 _FreeAttrList(itemParams->attrList);
2956
2957 free(itemParams);
2958 }
2959
2960 static SecItemParams*
2961 _CreateSecItemParamsFromDictionary(CFDictionaryRef dict, OSStatus *error)
2962 {
2963 OSStatus status;
2964 CFTypeRef value = NULL;
2965 CFDictionaryRef policyDict = NULL;
2966 SecItemParams *itemParams = (SecItemParams *)calloc(1, sizeof(struct SecItemParams));
2967
2968 require_action(itemParams != NULL, error_exit, status = errSecAllocate);
2969 require_action(dict && (CFDictionaryGetTypeID() == CFGetTypeID(dict)), error_exit, status = errSecParam);
2970
2971 itemParams->query = (CFDictionaryRef) CFRetain(dict);
2972
2973 // validate input search parameters
2974 require_noerr(status = _ValidateDictionaryEntry(dict, kSecMatchPolicy, (const void **)&itemParams->policy, SecPolicyGetTypeID(), NULL), error_exit);
2975 require_noerr(status = _ValidateDictionaryEntry(dict, kSecMatchSearchList, (const void **)&itemParams->searchList, CFArrayGetTypeID(), NULL), error_exit);
2976 require_noerr(status = _ValidateDictionaryEntry(dict, kSecMatchItemList, (const void **)&itemParams->itemList, CFArrayGetTypeID(), NULL), error_exit);
2977 require_noerr(status = _ValidateDictionaryEntry(dict, kSecMatchEmailAddressIfPresent, (const void **)&itemParams->emailAddrToMatch, CFStringGetTypeID(), NULL), error_exit);
2978 require_noerr(status = _ValidateDictionaryEntry(dict, kSecMatchValidOnDate, (const void **)&itemParams->validOnDate, CFDateGetTypeID(), CFNullGetTypeID()), error_exit);
2979 require_noerr(status = _ValidateDictionaryEntry(dict, kSecMatchLimit, (const void **)&itemParams->matchLimit, CFStringGetTypeID(), CFNumberGetTypeID()), error_exit);
2980
2981 require_noerr(status = _ValidateDictionaryEntry(dict, kSecUseItemList, (const void **)&itemParams->useItems, CFArrayGetTypeID(), NULL), error_exit);
2982 require_noerr(status = _ValidateDictionaryEntry(dict, kSecUseKeychain, (const void **)&itemParams->keychain, SecKeychainGetTypeID(), NULL), error_exit);
2983
2984 // validate a subset of input attributes (used to create an appropriate search reference)
2985 require_noerr(status = _ValidateDictionaryEntry(dict, kSecAttrIssuer, (const void **)&itemParams->issuer, CFDataGetTypeID(), NULL), error_exit);
2986 require_noerr(status = _ValidateDictionaryEntry(dict, kSecAttrSerialNumber, (const void **)&itemParams->serialNumber, CFDataGetTypeID(), NULL), error_exit);
2987 require_noerr(status = _ValidateDictionaryEntry(dict, kSecAttrService, (const void **)&itemParams->service, CFStringGetTypeID(), NULL), error_exit);
2988 require_noerr(status = _ValidateDictionaryEntry(dict, kSecAttrKeyClass, (const void **)&itemParams->keyClass, CFStringGetTypeID(), NULL), error_exit);
2989
2990 if (itemParams->service && CFStringHasPrefix((CFStringRef)itemParams->service, CFSTR("ProtectedCloudStorage"))) {
2991 itemParams->isPCSItem = true;
2992 if (!SecItemSynchronizable(dict)) {
2993 _EnsureUserDefaultKeychainIsSearched(itemParams); // for SecItemCopyMatching, SecItemUpdate, SecItemDelete
2994 _EnsureUserDefaultKeychainIsTargeted(itemParams); // for SecItemAdd
2995 }
2996 }
2997
2998 // validate the payload (password, key or certificate data), used for SecItemAdd but not for finding items
2999 require_noerr(status = _ValidateDictionaryEntry(dict, kSecValueData, (const void **)&itemParams->itemData, CFDataGetTypeID(), CFStringGetTypeID()), error_exit);
3000 if (itemParams->itemData && CFGetTypeID(itemParams->itemData) == CFStringGetTypeID()) {
3001 /* If we got a string, convert it into a data object */
3002 CFStringRef string = (CFStringRef)itemParams->itemData;
3003 CFIndex maxLength = CFStringGetMaximumSizeForEncoding(CFStringGetLength(string), kCFStringEncodingUTF8) + 1;
3004 CFMutableDataRef data = CFDataCreateMutable(NULL, maxLength);
3005 require_action(data, error_exit, status = errSecAllocate);
3006
3007 CFDataSetLength(data, maxLength);
3008
3009 if (!CFStringGetCString(string, (char *)CFDataGetMutableBytePtr(data), maxLength, kCFStringEncodingUTF8)) {
3010 CFRelease(data);
3011 status = errSecAllocate;
3012 goto error_exit;
3013 }
3014
3015 CFDataSetLength(data, strlen((const char *)CFDataGetBytePtr(data))); /* dont include NUL in string */
3016 itemParams->itemData = data;
3017 CFRelease(string);
3018 }
3019
3020 // validate item references
3021 require_noerr(status = _ValidateDictionaryEntry(dict, kSecValueRef, (const void **)&itemParams->itemRef, SecKeychainItemGetTypeID(), SecIdentityGetTypeID()), error_exit);
3022 if (itemParams->itemRef && (CFGetTypeID(itemParams->itemRef) == SecIdentityGetTypeID())) {
3023 itemParams->identityRef = (SecIdentityRef)itemParams->itemRef;
3024 itemParams->itemRef = NULL;
3025 SecIdentityCopyCertificate(itemParams->identityRef, (SecCertificateRef *)&itemParams->itemRef);
3026 }
3027 require_noerr(status = _ValidateDictionaryEntry(dict, kSecValuePersistentRef, (const void **)&itemParams->itemPersistentRef, CFDataGetTypeID(), NULL), error_exit);
3028 if (itemParams->itemRef || itemParams->itemPersistentRef) {
3029 // Caller is trying to add or find an item by reference.
3030 // The supported method for doing that is to provide a kSecUseItemList array
3031 // for SecItemAdd, or a kSecMatchItemList array for SecItemCopyMatching et al,
3032 // so add the item reference to those arrays here.
3033 if (itemParams->useItems) {
3034 CFArrayRef tmpItems = itemParams->useItems;
3035 itemParams->useItems = (CFArrayRef) CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, tmpItems);
3036 CFRelease(tmpItems);
3037 } else {
3038 itemParams->useItems = (CFArrayRef) CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
3039 }
3040 if (itemParams->itemRef) CFArrayAppendValue((CFMutableArrayRef)itemParams->useItems, itemParams->itemRef);
3041 if (itemParams->itemPersistentRef) CFArrayAppendValue((CFMutableArrayRef)itemParams->useItems, itemParams->itemPersistentRef);
3042
3043 if (itemParams->itemList) {
3044 CFArrayRef tmpItems = itemParams->itemList;
3045 itemParams->itemList = (CFArrayRef) CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, tmpItems);
3046 CFRelease(tmpItems);
3047 } else {
3048 itemParams->itemList = (CFArrayRef) CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
3049 }
3050 if (itemParams->itemRef) CFArrayAppendValue((CFMutableArrayRef)itemParams->itemList, itemParams->itemRef);
3051 if (itemParams->itemPersistentRef) CFArrayAppendValue((CFMutableArrayRef)itemParams->itemList, itemParams->itemPersistentRef);
3052 }
3053
3054 // must have an explicit item class, unless one of the following is true:
3055 // - we have an item list to add or search (kSecUseItemList)
3056 // - we have an item reference or persistent reference for the thing we want to look up
3057 // Note that both of these cases will set itemParams->useItems.
3058 // If we have an item list to match (kSecMatchItemList), that still requires an item class,
3059 // so we can perform a search and see if the results match items in the list.
3060 //
3061 if (!CFDictionaryGetValueIfPresent(dict, kSecClass, (const void**) &value) && !itemParams->useItems) {
3062 require_action(false, error_exit, status = errSecItemClassMissing);
3063 }
3064 else if (value) {
3065 itemParams->itemClass = _ConvertItemClass(value, itemParams->keyClass, &itemParams->returnIdentity);
3066 if (itemParams->itemClass == kSecSymmetricKeyItemClass && !itemParams->keyClass) {
3067 // no key class specified, so start with symmetric key class; will search the others later in UpdateKeychainSearchAndCopyNext
3068 itemParams->itemClass = kSecSymmetricKeyItemClass;
3069 itemParams->assumedKeyClass = kSecAttrKeyClassPublic;
3070 }
3071 require_action(!(itemParams->itemClass == 0 && !itemParams->useItems), error_exit, status = errSecItemClassMissing);
3072 }
3073
3074 // kSecMatchIssuers is only permitted with identities or certificates.
3075 // Convert the input issuers to normalized form.
3076 require_noerr(status = _ValidateDictionaryEntry(dict, kSecMatchIssuers, (const void **)&itemParams->matchIssuers, CFArrayGetTypeID(), NULL), error_exit);
3077 if (itemParams->matchIssuers) {
3078 CFTypeRef allowCerts = CFDictionaryGetValue(itemParams->query, kSecUseCertificatesWithMatchIssuers);
3079 require_action(itemParams->returnIdentity || (allowCerts && CFEqual(allowCerts, kCFBooleanTrue)), error_exit, status = errSecParam);
3080 CFMutableArrayRef canonical_issuers = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
3081 CFArrayRef issuers = (CFArrayRef)itemParams->matchIssuers;
3082 if (canonical_issuers) {
3083 CFIndex i, count = CFArrayGetCount(issuers);
3084 for (i = 0; i < count; i++) {
3085 CFTypeRef issuer_data = CFArrayGetValueAtIndex(issuers, i);
3086 CFDataRef issuer_canonical = NULL;
3087 if (CFDataGetTypeID() == CFGetTypeID(issuer_data))
3088 issuer_canonical = SecDistinguishedNameCopyNormalizedSequence((CFDataRef)issuer_data);
3089 if (issuer_canonical) {
3090 CFArrayAppendValue(canonical_issuers, issuer_canonical);
3091 CFRelease(issuer_canonical);
3092 }
3093 }
3094 if (CFArrayGetCount(canonical_issuers) > 0) {
3095 CFAssignRetained(itemParams->matchIssuers, canonical_issuers);
3096 } else
3097 CFRelease(canonical_issuers);
3098 }
3099 }
3100
3101 itemParams->keyUsage = _CssmKeyUsageFromQuery(dict);
3102 itemParams->trustedOnly = CFDictionaryGetValueIfPresent(dict, kSecMatchTrustedOnly, (const void **)&value) && value && CFEqual(kCFBooleanTrue, value);
3103 itemParams->issuerAndSNToMatch = (itemParams->issuer != NULL && itemParams->serialNumber != NULL);
3104
3105 // other input attributes, used for SecItemAdd but not for finding items
3106 require_noerr(status = _ValidateDictionaryEntry(dict, kSecAttrAccess, (const void **)&itemParams->access, SecAccessGetTypeID(), NULL), error_exit);
3107 if (itemParams->access == NULL) {
3108 // check for the old definition of kSecAttrAccess from SecItem-shim (see <rdar://7987447>)
3109 require_noerr(status = _ValidateDictionaryEntry(dict, CFSTR("kSecAttrAccess"), (const void **)&itemParams->access, SecAccessGetTypeID(), NULL), error_exit);
3110 }
3111
3112 // determine how to return the result
3113 itemParams->numResultTypes = 0;
3114 itemParams->returningRef = CFDictionaryGetValueIfPresent(dict, kSecReturnRef, (const void **)&value) && value && CFEqual(kCFBooleanTrue, value);
3115 if (itemParams->returningRef) ++itemParams->numResultTypes;
3116 itemParams->returningPersistentRef = CFDictionaryGetValueIfPresent(dict, kSecReturnPersistentRef, (const void **)&value) && value && CFEqual(kCFBooleanTrue, value);
3117 if (itemParams->returningPersistentRef) ++itemParams->numResultTypes;
3118 itemParams->returningAttributes = CFDictionaryGetValueIfPresent(dict, kSecReturnAttributes, (const void **)&value) && value && CFEqual(kCFBooleanTrue, value);
3119 if (itemParams->returningAttributes) ++itemParams->numResultTypes;
3120 itemParams->returningData = CFDictionaryGetValueIfPresent(dict, kSecReturnData, (const void **)&value) && value && CFEqual(kCFBooleanTrue, value);
3121 if (itemParams->returningData) ++itemParams->numResultTypes;
3122
3123 // default is kSecReturnRef if no result types were specified
3124 if (!itemParams->numResultTypes) {
3125 itemParams->returningRef = TRUE;
3126 itemParams->numResultTypes = 1;
3127 }
3128
3129 // determine if one, some or all matches should be returned (default is kSecMatchLimitOne)
3130 itemParams->maxMatches = 1;
3131 itemParams->returnAllMatches = FALSE;
3132 if (itemParams->matchLimit) {
3133 if (CFStringGetTypeID() == CFGetTypeID(itemParams->matchLimit)) {
3134 itemParams->returnAllMatches = CFEqual(kSecMatchLimitAll, itemParams->matchLimit);
3135 }
3136 else if (CFNumberGetTypeID() == CFGetTypeID(itemParams->matchLimit)) {
3137 CFNumberGetValue((CFNumberRef)itemParams->matchLimit, kCFNumberIntType, &itemParams->maxMatches);
3138 require_action(!(itemParams->maxMatches < 0), error_exit, status = errSecMatchLimitUnsupported);
3139 }
3140 }
3141 if (itemParams->returnAllMatches) {
3142 itemParams->maxMatches = INT32_MAX;
3143 // if we're returning all matches, then we don't support getting passwords as data (which could require authentication for each)
3144 if ((itemParams->itemClass==kSecInternetPasswordItemClass || itemParams->itemClass==kSecGenericPasswordItemClass) && itemParams->returningData)
3145 status = errSecReturnDataUnsupported;
3146 require_noerr(status, error_exit);
3147 }
3148
3149 // if we already have an item list (to add or find items in), we don't need a search reference
3150 if (itemParams->useItems) {
3151 if (itemParams->itemClass == 0) {
3152 itemParams->itemClass = _ItemClassFromItemList(itemParams->useItems);
3153 }
3154
3155 // build a SecKeychainAttributeList from the query dictionary for the specified item class
3156 if (itemParams->itemClass != 0) {
3157 status = _CreateSecKeychainAttributeListFromDictionary(dict, itemParams->itemClass, &itemParams->attrList);
3158 } else {
3159 status = errSecSuccess;
3160 }
3161 goto error_exit; // all done here
3162 }
3163
3164 // build a SecKeychainAttributeList from the query dictionary for the specified item class
3165 require_noerr(status = _CreateSecKeychainAttributeListFromDictionary(dict, itemParams->itemClass, &itemParams->attrList), error_exit);
3166
3167 // if policy is a SMIME policy, copy email address in policy into emailAddrToMatch parameter
3168 if(itemParams->policy) {
3169 policyDict = SecPolicyCopyProperties(itemParams->policy);
3170 CFStringRef oidStr = (CFStringRef) CFDictionaryGetValue(policyDict, kSecPolicyOid);
3171 if(oidStr && CFStringCompare(kSecPolicyAppleSMIME,oidStr,0) == 0) {
3172 require_noerr(status = _ValidateDictionaryEntry(policyDict, kSecPolicyName, (const void **)&itemParams->emailAddrToMatch, CFStringGetTypeID(), NULL), error_exit);
3173 }
3174 CFReleaseNull(policyDict);
3175 }
3176
3177 // create a search reference (either a SecKeychainSearchRef or a SecIdentitySearchRef)
3178 if ((itemParams->itemClass == kSecCertificateItemClass) && itemParams->emailAddrToMatch) {
3179 // searching for certificates by email address
3180 char *nameBuf = (char*)malloc(MAXPATHLEN);
3181 if (!nameBuf) {
3182 status = errSecAllocate;
3183 }
3184 else if (CFStringGetCString((CFStringRef)itemParams->emailAddrToMatch, nameBuf, (CFIndex)MAXPATHLEN-1, kCFStringEncodingUTF8)) {
3185 status = SecKeychainSearchCreateForCertificateByEmail(itemParams->searchList, (const char *)nameBuf, (SecKeychainSearchRef*)&itemParams->search);
3186 }
3187 else {
3188 status = errSecItemInvalidValue;
3189 }
3190 if (nameBuf) free(nameBuf);
3191 }
3192 else if ((itemParams->itemClass == kSecCertificateItemClass) && itemParams->issuerAndSNToMatch) {
3193 // searching for certificates by issuer and serial number
3194 status = SecKeychainSearchCreateForCertificateByIssuerAndSN_CF(itemParams->searchList,
3195 (CFDataRef)itemParams->issuer,
3196 (CFDataRef)itemParams->serialNumber,
3197 (SecKeychainSearchRef*)&itemParams->search);
3198 }
3199 else if (itemParams->returnIdentity && itemParams->policy) {
3200 // searching for identities by policy
3201 status = SecIdentitySearchCreateWithPolicy(itemParams->policy,
3202 (CFStringRef)itemParams->service,
3203 itemParams->keyUsage,
3204 itemParams->searchList,
3205 itemParams->trustedOnly,
3206 (SecIdentitySearchRef*)&itemParams->search);
3207 }
3208 else if (itemParams->returnIdentity) {
3209 // searching for identities
3210 status = SecIdentitySearchCreate(itemParams->searchList,
3211 itemParams->keyUsage,
3212 (SecIdentitySearchRef*)&itemParams->search);
3213 }
3214 else {
3215 // normal keychain item search
3216 status = SecKeychainSearchCreateFromAttributes(itemParams->searchList,
3217 itemParams->itemClass,
3218 (itemParams->attrList->count == 0) ? NULL : itemParams->attrList,
3219 (SecKeychainSearchRef*)&itemParams->search);
3220 }
3221
3222 error_exit:
3223 CFReleaseNull(policyDict);
3224 if (status) {
3225 _FreeSecItemParams(itemParams);
3226 itemParams = NULL;
3227 }
3228 if (error) {
3229 *error = status;
3230 }
3231 return itemParams;
3232 }
3233
3234
3235 static OSStatus
3236 _ImportKey(
3237 SecKeyRef keyRef,
3238 SecKeychainRef keychainRef,
3239 SecAccessRef accessRef,
3240 SecKeychainAttributeList *attrList,
3241 SecKeychainItemRef *outItemRef)
3242 {
3243 BEGIN_SECAPI
3244
3245 // We must specify the access, since a free-floating key won't have one yet by default
3246 SecPointer<Access> access;
3247 if (accessRef) {
3248 access = Access::required(accessRef);
3249 }
3250 else {
3251 CFStringRef descriptor = NULL;
3252 if (attrList) {
3253 for (UInt32 index=0; index < attrList->count; index++) {
3254 SecKeychainAttribute attr = attrList->attr[index];
3255 if (attr.tag == kSecKeyPrintName) {
3256 descriptor = CFStringCreateWithBytes(NULL, (const UInt8 *)attr.data, attr.length, kCFStringEncodingUTF8, FALSE);
3257 break;
3258 }
3259 }
3260 }
3261 if (descriptor == NULL) {
3262 descriptor = (CFStringRef) CFRetain(CFSTR("<unknown>"));
3263 }
3264 access = new Access(cfString(descriptor));
3265 CFRelease(descriptor);
3266 }
3267
3268 KeyItem *key = KeyItem::required(keyRef);
3269 Item item = key->importTo(Keychain::optional(keychainRef), access, attrList);
3270 if (outItemRef)
3271 *outItemRef = item->handle();
3272
3273 END_SECAPI
3274 }
3275
3276 static OSStatus
3277 _FilterWithPolicy(SecPolicyRef policy, CFDateRef date, SecCertificateRef cert)
3278 {
3279 CFDictionaryRef props = NULL;
3280 CFArrayRef keychains = NULL;
3281 CFArrayRef anchors = NULL;
3282 CFArrayRef certs = NULL;
3283 CFArrayRef chain = NULL;
3284 SecTrustRef trust = NULL;
3285
3286 SecTrustResultType trustResult;
3287 Boolean needChain = false;
3288 Boolean needCSEKU = false;
3289 OSStatus status;
3290 if (!policy || !cert) return errSecParam;
3291
3292 certs = CFArrayCreate(NULL, (const void **)&cert, (CFIndex)1, &kCFTypeArrayCallBacks);
3293 status = SecTrustCreateWithCertificates(certs, policy, &trust);
3294 if(status) goto cleanup;
3295
3296 /* Set evaluation date, if specified (otherwise current date is implied) */
3297 if (date && (CFGetTypeID(date) == CFDateGetTypeID())) {
3298 status = SecTrustSetVerifyDate(trust, date);
3299 if(status) goto cleanup;
3300 }
3301
3302 /* Check whether we can avoid full chain evaluation, based on policy */
3303 props = SecPolicyCopyProperties(policy);
3304 if (props) {
3305 CFTypeRef oid = (CFTypeRef) CFDictionaryGetValue(props, kSecPolicyOid);
3306 if (oid && (CFEqual(oid, kSecPolicyAppleX509Basic) ||
3307 CFEqual(oid, kSecPolicyAppleRevocation))) {
3308 needChain = true;
3309 } else if (oid && (CFEqual(oid, kSecPolicyAppleCodeSigning))) {
3310 needCSEKU = true;
3311 }
3312 }
3313
3314 /* If a code signing EKU purpose is needed, filter out certs without it here
3315 to reduce log noise associated with evaluation failures. */
3316 if (needCSEKU) {
3317 CFDataRef eku = CFDataCreate(kCFAllocatorDefault,
3318 oidExtendedKeyUsageCodeSigning.data,
3319 oidExtendedKeyUsageCodeSigning.length);
3320 if (eku) {
3321 if (!SecPolicyCheckCertExtendedKeyUsage(cert, eku)) {
3322 needCSEKU = false;
3323 }
3324 CFRelease(eku);
3325 }
3326 if (!needCSEKU) {
3327 status = errSecCertificateCannotOperate;
3328 goto cleanup;
3329 }
3330 }
3331
3332 if (!needChain) {
3333 status = SecTrustEvaluateLeafOnly(trust, &trustResult);
3334 } else {
3335 status = SecTrustEvaluate(trust, &trustResult);
3336 }
3337
3338 if (!(trustResult == kSecTrustResultProceed ||
3339 trustResult == kSecTrustResultUnspecified ||
3340 trustResult == kSecTrustResultRecoverableTrustFailure)) {
3341 /* The evaluation failed in a non-recoverable way */
3342 status = errSecCertificateCannotOperate;
3343 goto cleanup;
3344 }
3345
3346 /* If there are no per-cert policy status codes,
3347 * and the cert has not expired, consider it valid for the policy.
3348 */
3349 if (true) {
3350 (void)SecTrustGetCssmResultCode(trust, &status);
3351 }
3352
3353 cleanup:
3354 if(props) CFRelease(props);
3355 if(chain) CFRelease(chain);
3356 if(anchors) CFRelease(anchors);
3357 if(keychains) CFRelease(keychains);
3358 if(certs) CFRelease(certs);
3359 if(trust) CFRelease(trust);
3360
3361 return status;
3362 }
3363
3364 static OSStatus
3365 _FilterWithDate(CFTypeRef validOnDate, SecCertificateRef cert)
3366 {
3367 if (!validOnDate || !cert) return errSecParam;
3368
3369 CFAbsoluteTime at, nb, na;
3370 if (CFGetTypeID(validOnDate) == CFDateGetTypeID())
3371 at = CFDateGetAbsoluteTime((CFDateRef)validOnDate);
3372 else
3373 at = CFAbsoluteTimeGetCurrent();
3374
3375 OSStatus status = errSecSuccess;
3376 nb = SecCertificateNotValidBefore(cert);
3377 na = SecCertificateNotValidAfter(cert);
3378
3379 if (nb == 0 || na == 0 || nb == na)
3380 status = errSecCertificateCannotOperate;
3381 else if (at < nb)
3382 status = errSecCertificateNotValidYet;
3383 else if (at > na)
3384 status = errSecCertificateExpired;
3385
3386 return status;
3387 }
3388
3389 static OSStatus
3390 _FilterWithTrust(Boolean trustedOnly, SecCertificateRef cert)
3391 {
3392 if (!cert) return errSecParam;
3393 if (!trustedOnly) return errSecSuccess;
3394
3395 CFArrayRef certArray = CFArrayCreate(NULL, (const void**)&cert, 1, &kCFTypeArrayCallBacks);
3396 SecPolicyRef policy = SecPolicyCreateWithOID(kSecPolicyAppleX509Basic);
3397 OSStatus status = (policy == NULL) ? errSecPolicyNotFound : errSecSuccess;
3398
3399 if (!status) {
3400 SecTrustRef trust = NULL;
3401 status = SecTrustCreateWithCertificates(certArray, policy, &trust);
3402 if (!status) {
3403 SecTrustResultType trustResult;
3404 status = SecTrustEvaluate(trust, &trustResult);
3405 if (!status) {
3406 if (!(trustResult == kSecTrustResultProceed || trustResult == kSecTrustResultUnspecified)) {
3407 status = (trustResult == kSecTrustResultDeny) ? errSecTrustSettingDeny : errSecNotTrusted;
3408 }
3409 }
3410 CFRelease(trust);
3411 }
3412 CFRelease(policy);
3413 }
3414 if (certArray) {
3415 CFRelease(certArray);
3416 }
3417
3418 return status;
3419 }
3420
3421 static bool items_matching_issuer_parent(CFDataRef issuer, CFArrayRef issuers, int recurse) {
3422 if (!issuers || CFArrayGetCount(issuers) == 0) { return false; }
3423
3424 /* We found a match, we're done. */
3425 if (CFArrayContainsValue(issuers, CFRangeMake(0, CFArrayGetCount(issuers)), issuer)) { return true; }
3426
3427 /* Prevent infinite recursion */
3428 if (recurse <= 0) { return false; }
3429 recurse--;
3430
3431 /* Query for parents */
3432 CFMutableDictionaryRef query = NULL;
3433 CFTypeRef parents = NULL;
3434 bool found = false;
3435
3436 require_quiet(query = CFDictionaryCreateMutable(kCFAllocatorDefault, 4, &kCFTypeDictionaryKeyCallBacks,
3437 &kCFTypeDictionaryValueCallBacks), out);
3438 CFDictionaryAddValue(query, kSecClass, kSecClassCertificate);
3439 CFDictionaryAddValue(query, kSecReturnRef, kCFBooleanTrue);
3440 CFDictionaryAddValue(query, kSecAttrSubject, issuer);
3441 CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitAll);
3442 require_noerr_quiet(SecItemCopyMatching(query, &parents), out);
3443
3444 if (parents && CFArrayGetTypeID() == CFGetTypeID(parents)) {
3445 CFIndex i, count = CFArrayGetCount((CFArrayRef)parents);
3446 for (i = 0; i < count; i++) {
3447 SecCertificateRef cert = (SecCertificateRef)CFArrayGetValueAtIndex((CFArrayRef)parents, i);
3448 CFDataRef cert_issuer = SecCertificateCopyNormalizedIssuerSequence(cert);
3449 if (CFEqual(cert_issuer, issuer)) {
3450 // Self-issued cert, don't look for parents.
3451 CFReleaseNull(cert_issuer);
3452 continue;
3453 }
3454 found = items_matching_issuer_parent(cert_issuer, issuers, recurse);
3455 CFReleaseNull(cert_issuer);
3456 if (found) { break; }
3457 }
3458 } else if (parents && SecCertificateGetTypeID() == CFGetTypeID(parents)) {
3459 SecCertificateRef cert = (SecCertificateRef)parents;
3460 CFDataRef cert_issuer = SecCertificateCopyNormalizedIssuerSequence(cert);
3461 require_action_quiet(!CFEqual(cert_issuer, issuer), out, CFReleaseNull(cert_issuer));
3462 found = items_matching_issuer_parent(cert_issuer, issuers, recurse);
3463 CFReleaseNull(cert_issuer);
3464 }
3465
3466 out:
3467 CFReleaseNull(query);
3468 CFReleaseNull(parents);
3469 return found;
3470 }
3471
3472 static OSStatus
3473 _FilterWithIssuers(CFArrayRef issuers, SecCertificateRef cert)
3474 {
3475 if (!issuers || CFArrayGetCount(issuers) == 0) return errSecParam;
3476 if (!cert) return errSecParam;
3477
3478 OSStatus status = errSecInternalError;
3479
3480 /* kSecMatchIssuers matches certificates where ANY certificate in the chain has this issuer.
3481 * So we now need to recursively query the keychain for this cert's parents to determine if
3482 * they match. (This is why we limited the use of this key in _CreateSecItemParamsFromDictionary.) */
3483 CFDataRef issuer = SecCertificateCopyNormalizedIssuerSequence(cert);
3484 if (items_matching_issuer_parent(issuer, issuers, 10)) {
3485 status = errSecSuccess;
3486 }
3487
3488 CFReleaseNull(issuer);
3489 return status;
3490 }
3491
3492 static SecKeychainItemRef
3493 CopyResolvedKeychainItem(CFTypeRef item)
3494 {
3495 SecKeychainItemRef kcItem = NULL;
3496 OSStatus status = errSecSuccess;
3497 if (item) {
3498 if (CFGetTypeID(item) == CFDataGetTypeID()) {
3499 // persistent reference, resolve first
3500 status = SecKeychainItemCopyFromPersistentReference((CFDataRef)item, &kcItem);
3501 }
3502 else {
3503 // normal reference
3504 kcItem = (SecKeychainItemRef) CFRetain(item);
3505 }
3506 if (kcItem) {
3507 // ask for the item's class:
3508 // will return an error if the item has been deleted
3509 SecItemClass itemClass;
3510 SecCertificateRef certRef = NULL;
3511 CFTypeID itemTypeID = CFGetTypeID(kcItem);
3512 if (itemTypeID == SecIdentityGetTypeID()) {
3513 status = SecIdentityCopyCertificate((SecIdentityRef)kcItem, &certRef);
3514 }
3515 else if (itemTypeID == SecCertificateGetTypeID()) {
3516 certRef = (SecCertificateRef) CFRetain(kcItem);
3517 }
3518 if (certRef) {
3519 // can't call SecKeychainItemCopyAttributesAndData on a SecCertificateRef
3520 itemClass = kSecCertificateItemClass;
3521 }
3522 else {
3523 status = SecKeychainItemCopyAttributesAndData(kcItem, NULL, &itemClass, NULL, NULL, NULL);
3524 }
3525 if (certRef) {
3526 CFRelease(certRef);
3527 }
3528 if (status) {
3529 CFRelease(kcItem);
3530 kcItem = NULL;
3531 }
3532 }
3533 }
3534 return kcItem;
3535 }
3536
3537 static OSStatus
3538 UpdateKeychainSearchAndCopyNext(SecItemParams *params, CFTypeRef *item)
3539 {
3540 // This function refreshes the search parameters in the specific case where
3541 // the caller is searching for kSecClassKey items but did not provide the
3542 // kSecAttrKeyClass. In that case, params->assumedKeyClass will be set, and
3543 // we must perform separate searches to obtain all results.
3544
3545 OSStatus status = errSecItemNotFound;
3546 if (!params || !params->assumedKeyClass || !params->query || !item)
3547 return status;
3548
3549 // Free the previous search reference and attribute list.
3550 if (params->search)
3551 CFRelease(params->search);
3552 params->search = NULL;
3553 _FreeAttrList(params->attrList);
3554 params->attrList = NULL;
3555
3556 // Make a copy of the query dictionary so we can set the key class parameter.
3557 CFMutableDictionaryRef dict = CFDictionaryCreateMutableCopy(NULL, 0, params->query);
3558 CFRelease(params->query);
3559 params->query = dict;
3560 CFDictionarySetValue(dict, kSecAttrKeyClass, params->assumedKeyClass);
3561
3562 // Determine the current item class for this search, and the next assumed key class.
3563 if (CFEqual(params->assumedKeyClass, kSecAttrKeyClassSymmetric)) {
3564 params->itemClass = kSecSymmetricKeyItemClass;
3565 params->assumedKeyClass = kSecAttrKeyClassPublic;
3566 } else if (CFEqual(params->assumedKeyClass, kSecAttrKeyClassPublic)) {
3567 params->itemClass = kSecPublicKeyItemClass;
3568 params->assumedKeyClass = kSecAttrKeyClassPrivate;
3569 } else {
3570 params->itemClass = kSecPrivateKeyItemClass;
3571 params->assumedKeyClass = NULL;
3572 }
3573
3574 // Rebuild the attribute list for the new key class.
3575 if (_CreateSecKeychainAttributeListFromDictionary(dict, params->itemClass, &params->attrList) == errSecSuccess) {
3576 // Create a new search reference for the new attribute list.
3577 if (SecKeychainSearchCreateFromAttributes(params->searchList,
3578 params->itemClass,
3579 (params->attrList->count == 0) ? NULL : params->attrList,
3580 (SecKeychainSearchRef*)&params->search) == errSecSuccess) {
3581 // Return the first matching item from the new search.
3582 // We won't come back here again until there are no more matching items for this search.
3583 status = SecKeychainSearchCopyNext((SecKeychainSearchRef)params->search, (SecKeychainItemRef*)item);
3584 }
3585 }
3586 return status;
3587 }
3588
3589
3590 static OSStatus
3591 SecItemSearchCopyNext(SecItemParams *params, CFTypeRef *item)
3592 {
3593 // Generic "copy next match" function for SecKeychainSearchRef or SecIdentitySearchRef.
3594 // Returns either a SecKeychainItemRef or a SecIdentityRef in the output parameter,
3595 // depending on the type of search reference.
3596
3597 OSStatus status;
3598 CFTypeRef search = (params) ? params->search : NULL;
3599 CFTypeID typeID = (search) ? CFGetTypeID(search) : 0;
3600
3601 if (search && typeID == SecIdentitySearchGetTypeID()) {
3602 status = SecIdentitySearchCopyNext((SecIdentitySearchRef)search, (SecIdentityRef*)item);
3603 }
3604 else if (search && typeID == SecKeychainSearchGetTypeID()) {
3605 status = SecKeychainSearchCopyNext((SecKeychainSearchRef)search, (SecKeychainItemRef*)item);
3606 // Check if we need to refresh the search for the next key class
3607 while (status == errSecItemNotFound && params->assumedKeyClass != NULL)
3608 status = UpdateKeychainSearchAndCopyNext(params, item);
3609 }
3610 else if (typeID == 0 && params && (params->useItems || params->itemList)) {
3611 // No search available, but there is an item list available.
3612 // Return the next candidate item from the caller's item list
3613 CFArrayRef itemList = (params->useItems) ? params->useItems : params->itemList;
3614 CFIndex count = CFArrayGetCount(itemList);
3615 *item = (CFTypeRef) NULL;
3616 if (params->itemListIndex < count) {
3617 *item = (CFTypeRef)CFArrayGetValueAtIndex(itemList, params->itemListIndex++);
3618 if (*item) {
3619 // Potentially resolve persistent item references here, and
3620 // verify the item reference we're about to hand back is still
3621 // valid (it could have been deleted from the keychain while
3622 // our query was holding onto the itemList).
3623 *item = CopyResolvedKeychainItem(*item);
3624 if (*item && (CFGetTypeID(*item) == SecIdentityGetTypeID())) {
3625 // Persistent reference resolved to an identity, so return that type.
3626 params->returnIdentity = true;
3627 }
3628 }
3629 }
3630 status = (*item) ? errSecSuccess : errSecItemNotFound;
3631 }
3632 else {
3633 status = errSecItemNotFound;
3634 }
3635 return status;
3636 }
3637
3638 static OSStatus
3639 FilterCandidateItem(CFTypeRef *item, SecItemParams *itemParams, SecIdentityRef *identity)
3640 {
3641 if (!item || *item == NULL || !itemParams)
3642 return errSecItemNotFound;
3643
3644 OSStatus status;
3645 CFStringRef commonName = NULL;
3646 SecIdentityRef foundIdentity = NULL;
3647 if (CFGetTypeID(*item) == SecIdentityGetTypeID()) {
3648 // we found a SecIdentityRef, rather than a SecKeychainItemRef;
3649 // replace the found "item" with its associated certificate (which is the
3650 // item we actually want for purposes of getting attributes, data, or a
3651 // persistent data reference), and return the identity separately.
3652 SecCertificateRef certificate;
3653 status = SecIdentityCopyCertificate((SecIdentityRef) *item, &certificate);
3654 if (itemParams->returnIdentity) {
3655 foundIdentity = (SecIdentityRef) *item;
3656 if (identity) {
3657 *identity = foundIdentity;
3658 }
3659 }
3660 else {
3661 CFRelease(*item);
3662 }
3663 *item = (CFTypeRef)certificate;
3664 }
3665
3666 CFDictionaryRef query = itemParams->query;
3667
3668 if (itemParams->itemClass == kSecCertificateItemClass) {
3669 // perform string comparisons first
3670 CFStringCompareFlags flags = _StringCompareFlagsFromQuery(query);
3671 CFStringRef nameContains, nameStarts, nameEnds, nameExact;
3672 if (!CFDictionaryGetValueIfPresent(query, kSecMatchSubjectContains, (const void **)&nameContains))
3673 nameContains = NULL;
3674 if (!CFDictionaryGetValueIfPresent(query, kSecMatchSubjectStartsWith, (const void **)&nameStarts))
3675 nameStarts = NULL;
3676 if (!CFDictionaryGetValueIfPresent(query, kSecMatchSubjectEndsWith, (const void **)&nameEnds))
3677 nameEnds = NULL;
3678 if (!CFDictionaryGetValueIfPresent(query, kSecMatchSubjectWholeString, (const void **)&nameExact))
3679 nameExact = NULL;
3680 if (nameContains || nameStarts || nameEnds || nameExact) {
3681 status = SecCertificateCopyCommonName((SecCertificateRef)*item, &commonName);
3682 if (status || !commonName) goto filterOut;
3683 }
3684 if (nameContains) {
3685 CFRange range = CFStringFind(commonName, nameContains, flags);
3686 if (range.length < 1)
3687 goto filterOut;
3688 // certificate item contains string; proceed to next check
3689 }
3690 if (nameStarts) {
3691 CFRange range = CFStringFind(commonName, nameStarts, flags);
3692 if (range.length < 1 || range.location > 1)
3693 goto filterOut;
3694 // certificate item starts with string; proceed to next check
3695 }
3696 if (nameEnds) {
3697 CFRange range = CFStringFind(commonName, nameEnds, flags);
3698 if (range.length < 1 || range.location != (CFStringGetLength(commonName) - CFStringGetLength(nameEnds)))
3699 goto filterOut;
3700 // certificate item ends with string; proceed to next check
3701 }
3702 if (nameExact) {
3703 CFRange range = CFStringFind(commonName, nameExact, flags);
3704 if (range.length < 1 || (CFStringGetLength(commonName) != CFStringGetLength(nameExact)))
3705 goto filterOut;
3706 // certificate item exactly matches string; proceed to next check
3707 }
3708 if (itemParams->returnIdentity) {
3709 // if we already found and returned the identity, we can skip this
3710 if (!foundIdentity) {
3711 status = SecIdentityCreateWithCertificate(itemParams->searchList, (SecCertificateRef) *item, identity);
3712 if (status) goto filterOut;
3713 }
3714 // certificate item is part of an identity; proceed to next check
3715 }
3716 if (itemParams->policy) {
3717 status = _FilterWithPolicy(itemParams->policy, (CFDateRef)itemParams->validOnDate, (SecCertificateRef) *item);
3718 if (status) goto filterOut;
3719 // certificate item is valid for specified policy (and optionally specified date)
3720 }
3721 if (itemParams->validOnDate) {
3722 status = _FilterWithDate(itemParams->validOnDate, (SecCertificateRef) *item);
3723 if (status) goto filterOut;
3724 // certificate item is valid for specified date
3725 }
3726 if (itemParams->trustedOnly) {
3727 // if we are getting candidate items from a SecIdentitySearchCreateWithPolicy search,
3728 // their trust has already been validated and we can skip this part.
3729 if (!(foundIdentity && itemParams->returnIdentity && itemParams->policy)) {
3730 status = _FilterWithTrust(itemParams->trustedOnly, (SecCertificateRef) *item);
3731 if (status) goto filterOut;
3732 }
3733 // certificate item is trusted on this system
3734 }
3735 if (itemParams->matchIssuers) {
3736 status = _FilterWithIssuers((CFArrayRef)itemParams->matchIssuers, (SecCertificateRef) *item);
3737 if (status) goto filterOut;
3738 // certificate item has one of the issuers
3739 }
3740 }
3741 if (itemParams->itemList) {
3742 Boolean foundMatch = FALSE;
3743 CFIndex idx, count = CFArrayGetCount(itemParams->itemList);
3744 for (idx=0; idx<count; idx++) {
3745 CFTypeRef anItem = (CFTypeRef) CFArrayGetValueAtIndex(itemParams->itemList, idx);
3746 SecKeychainItemRef realItem = NULL;
3747 SecCertificateRef aCert = NULL;
3748 if (anItem == NULL) {
3749 continue;
3750 }
3751 if (CFDataGetTypeID() == CFGetTypeID(anItem) &&
3752 errSecSuccess == SecKeychainItemCopyFromPersistentReference((CFDataRef)anItem, &realItem)) {
3753 anItem = realItem;
3754 }
3755 if (SecIdentityGetTypeID() == CFGetTypeID(anItem) &&
3756 errSecSuccess == SecIdentityCopyCertificate((SecIdentityRef)anItem, &aCert)) {
3757 anItem = aCert;
3758 }
3759 if (CFEqual(anItem, (CFTypeRef) *item)) {
3760 foundMatch = TRUE;
3761 }
3762 if (aCert) {
3763 CFRelease(aCert);
3764 }
3765 if (realItem) {
3766 CFRelease(realItem);
3767 }
3768 if (foundMatch) {
3769 break;
3770 }
3771 }
3772 if (!foundMatch) goto filterOut;
3773 // item was found on provided list
3774 }
3775
3776 if (foundIdentity && !identity) {
3777 CFRelease(foundIdentity);
3778 }
3779 if (commonName) {
3780 CFRelease(commonName);
3781 }
3782
3783 // if we get here, consider the item a match
3784 return errSecSuccess;
3785
3786 filterOut:
3787 if (commonName) {
3788 CFRelease(commonName);
3789 }
3790 CFRelease(*item);
3791 *item = NULL;
3792 if (foundIdentity) {
3793 CFRelease(foundIdentity);
3794 if (identity) {
3795 *identity = NULL;
3796 }
3797 }
3798 return errSecItemNotFound;
3799 }
3800
3801 static OSStatus
3802 AddItemResults(SecKeychainItemRef item,
3803 SecIdentityRef identity,
3804 SecItemParams *itemParams,
3805 CFAllocatorRef allocator,
3806 CFMutableArrayRef *items,
3807 CFTypeRef *result)
3808 {
3809 // Given a found item (which may also be an identity), this function adds
3810 // the requested result types (specified in itemParams) to the appropriate
3811 // container as follows:
3812 //
3813 // 1. If there is only one result type (numResultTypes == 1) and only one
3814 // match requested (maxMatches == 1), set *result directly.
3815 //
3816 // 2. If there are multiple result types (numResultTypes > 1), and only one
3817 // match requested (maxMatches == 1), add each result type to itemDict
3818 // and set itemDict as the value of *result.
3819 //
3820 // 3. If there is only one result type (numResultTypes == 1) and multiple
3821 // possible matches (maxMatches > 1), add the result type to *items
3822 // and set *items as the value of *result.
3823 //
3824 // 4. If there are multiple result types (numResultTypes > 1) and multiple
3825 // possible matches (maxMatches > 1), add each result type to itemDict,
3826 // add itemDict to *items, and set *items as the value of *result.
3827 //
3828 // Note that we allocate *items if needed.
3829
3830 if (!item || !itemParams || !result)
3831 return errSecParam;
3832
3833 if (itemParams->maxMatches > 1) {
3834 // if we can return more than one item, we must have an array
3835 if (!items)
3836 return errSecParam;
3837 else if (*items == NULL)
3838 *items = CFArrayCreateMutable(allocator, 0, &kCFTypeArrayCallBacks);
3839 }
3840
3841 OSStatus tmpStatus, status = errSecSuccess;
3842 CFMutableArrayRef itemArray = (items) ? *items : NULL;
3843 CFMutableDictionaryRef itemDict = NULL;
3844 if (itemParams->numResultTypes > 1) {
3845 // if we're returning more than one result type, each item we return must be a dictionary
3846 itemDict = CFDictionaryCreateMutable(allocator, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
3847 }
3848
3849 if (itemParams->returningRef) {
3850 const void* itemRef = (identity) ? (const void*)identity : (const void*)item;
3851 if (itemDict) {
3852 CFDictionaryAddValue(itemDict, kSecValueRef, itemRef);
3853 }
3854 else if (itemArray) {
3855 CFArrayAppendValue(itemArray, itemRef);
3856 }
3857 else {
3858 *result = CFRetain((CFTypeRef)itemRef);
3859 }
3860 }
3861
3862 if (itemParams->returningPersistentRef) {
3863 CFDataRef persistentRef;
3864 SecKeychainItemRef tmpItem = item;
3865 if (itemParams->identityRef) {
3866 tmpItem = (SecKeychainItemRef)itemParams->identityRef;
3867 }
3868 tmpStatus = SecKeychainItemCreatePersistentReference(tmpItem, &persistentRef);
3869 if (tmpStatus == errSecSuccess) {
3870 if (itemDict) {
3871 CFDictionaryAddValue(itemDict, kSecValuePersistentRef, persistentRef);
3872 }
3873 else if (itemArray) {
3874 CFArrayAppendValue(itemArray, persistentRef);
3875 }
3876 else {
3877 *result = CFRetain(persistentRef);
3878 }
3879 CFRelease(persistentRef);
3880 }
3881 else if (status == errSecSuccess) {
3882 status = tmpStatus;
3883 }
3884 }
3885
3886 if (itemParams->returningData) {
3887 // Use SecCertificateCopyData if we have a SecCertificateRef item.
3888 // Note that a SecCertificateRef may not actually be a SecKeychainItem,
3889 // in which case SecKeychainItemCopyContent will not obtain its data.
3890
3891 if (CFGetTypeID(item) == SecCertificateGetTypeID()) {
3892 CFDataRef dataRef = SecCertificateCopyData((SecCertificateRef)item);
3893 if (dataRef) {
3894 if (itemDict) {
3895 CFDictionaryAddValue(itemDict, kSecValueData, dataRef);
3896 }
3897 else if (itemArray) {
3898 CFArrayAppendValue(itemArray, dataRef);
3899 }
3900 else {
3901 *result = CFRetain(dataRef);
3902 }
3903 CFRelease(dataRef);
3904 status = errSecSuccess;
3905 }
3906 else {
3907 status = errSecAllocate;
3908 }
3909 }
3910 else {
3911 UInt32 length;
3912 void *data;
3913 tmpStatus = SecKeychainItemCopyContent(item, NULL, NULL, &length, &data);
3914 if (tmpStatus == errSecSuccess) {
3915 CFDataRef dataRef = CFDataCreate(allocator, (UInt8 *)data, length);
3916 if (itemDict) {
3917 CFDictionaryAddValue(itemDict, kSecValueData, dataRef);
3918 }
3919 else if (itemArray) {
3920 CFArrayAppendValue(itemArray, dataRef);
3921 }
3922 else {
3923 *result = CFRetain(dataRef);
3924 }
3925 CFRelease(dataRef);
3926 (void) SecKeychainItemFreeContent(NULL, data);
3927 }
3928 else if (status == errSecSuccess) {
3929 status = tmpStatus;
3930 }
3931 }
3932 }
3933
3934 if (itemParams->returningAttributes) {
3935 CFDictionaryRef attrsDict = NULL;
3936 SecItemClass itemClass;
3937 // since we have an item, allow its actual class to override the query-specified item class
3938 tmpStatus = SecKeychainItemCopyAttributesAndData(item, NULL, &itemClass, NULL, NULL, NULL);
3939 if (tmpStatus) {
3940 itemClass = itemParams->itemClass;
3941 }
3942 tmpStatus = _CreateAttributesDictionaryFromItem(allocator, itemClass, item, &attrsDict);
3943 if (attrsDict) {
3944 if (itemDict) {
3945 // add all keys and values from attrsDict to the item dictionary
3946 CFDictionaryApplyFunction(attrsDict, _AddDictValueToOtherDict, &itemDict);
3947 }
3948 else if (itemArray) {
3949 CFArrayAppendValue(itemArray, attrsDict);
3950 }
3951 else {
3952 *result = CFRetain(attrsDict);
3953 }
3954 CFRelease(attrsDict);
3955 }
3956 if (tmpStatus && (status == errSecSuccess)) {
3957 status = tmpStatus;
3958 }
3959 }
3960
3961 if (itemDict) {
3962 if (itemArray) {
3963 CFArrayAppendValue(itemArray, itemDict);
3964 CFRelease(itemDict);
3965 *result = itemArray;
3966 }
3967 else {
3968 *result = itemDict;
3969 }
3970 }
3971 else if (itemArray) {
3972 *result = itemArray;
3973 }
3974
3975 return status;
3976 }
3977
3978 CFDataRef _SecItemGetPersistentReference(CFTypeRef raw_item)
3979 {
3980 try {
3981 Item item = ItemImpl::required((SecKeychainItemRef)raw_item);
3982 return item->getPersistentRef();
3983 } catch(...) {
3984 return NULL;
3985 }
3986 }
3987
3988 /******************************************************************************/
3989 #pragma mark SecItem API functions
3990 /******************************************************************************/
3991
3992 //
3993 // Approximate result of using iOS sec's copyNumber, 0 return could be zero, or error.
3994 //
3995 static SInt32 readNumber(CFTypeRef obj) {
3996 CFTypeID tid = CFGetTypeID(obj);
3997 SInt32 v = 0;
3998 if (tid == CFNumberGetTypeID()) {
3999 CFNumberGetValue((CFNumberRef)obj, kCFNumberSInt32Type, &v);
4000 return v;
4001 } else if (tid == CFBooleanGetTypeID()) {
4002 v = CFBooleanGetValue((CFBooleanRef)obj);
4003 return v;
4004 } else if (tid == CFStringGetTypeID()) {
4005 v = CFStringGetIntValue((CFStringRef)obj);
4006 CFStringRef t = CFStringCreateWithFormat(0, 0, CFSTR("%ld"), (long)v);
4007 /* If a string converted to an int isn't equal to the int printed as
4008 a string, return a CFStringRef instead. */
4009 if (!CFEqual(t, obj)) {
4010 CFRelease(t);
4011 return 0;
4012 }
4013 CFRelease(t);
4014 return v;
4015 } else
4016 return NULL;
4017 }
4018
4019 //
4020 // Function to check whether the kSecAttrSynchronizable flag is set in the query.
4021 //
4022 static Boolean SecItemSynchronizable(CFDictionaryRef query)
4023 {
4024 CFTypeRef value = CFDictionaryGetValue(query, kSecAttrSynchronizable);
4025 Boolean result = (value && readNumber(value));
4026
4027 return result;
4028 }
4029
4030 //
4031 // Function to check whether a synchronizable persistent reference was provided.
4032 //
4033 static Boolean SecItemIsIOSPersistentReference(CFTypeRef value)
4034 {
4035 if (value) {
4036 return ::_SecItemParsePersistentRef((CFDataRef)value, NULL, NULL, NULL);
4037 }
4038 return false;
4039 }
4040
4041 extern "C" Boolean SecKeyIsCDSAKey(SecKeyRef ref);
4042
4043 //
4044 // Function to find out which keychains are targetted by the query.
4045 //
4046 static OSStatus SecItemCategorizeQuery(CFDictionaryRef query, bool &can_target_ios, bool &can_target_osx, bool &useDataProtectionKeychainFlag)
4047 {
4048 // By default, target both keychain.
4049 can_target_osx = can_target_ios = true;
4050 useDataProtectionKeychainFlag = false;
4051
4052 // Check no-legacy flag.
4053 // it's iOS or bust if we're on MZ!
4054 CFTypeRef useDataProtection = NULL;
4055 if (_CFMZEnabled()) {
4056 useDataProtection = kCFBooleanTrue;
4057 }
4058 else {
4059 // In case your CFDict is dumb and compares by pointer equality we check both versions of the symbol
4060 if (!CFDictionaryGetValueIfPresent(query, kSecUseDataProtectionKeychain, &useDataProtection)) {
4061 // Ah the irony of ignoring deprecation while checking for a legacy-avoiding attribute
4062 #pragma clang diagnostic push
4063 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
4064 useDataProtection = CFDictionaryGetValue(query, kSecAttrNoLegacy);
4065 #pragma clang diagnostic pop
4066 }
4067 }
4068
4069 if (useDataProtection != NULL) {
4070 useDataProtectionKeychainFlag = readNumber(useDataProtection);
4071 can_target_ios = useDataProtectionKeychainFlag;
4072 can_target_osx = !can_target_ios;
4073 return errSecSuccess;
4074 }
4075
4076 // Check whether the query contains kSecValueRef and modify can_ flags according to the kind and type of the value.
4077 CFTypeRef value = CFDictionaryGetValue(query, kSecValueRef);
4078 if (value != NULL) {
4079 CFTypeID typeID = CFGetTypeID(value);
4080 if (typeID == SecKeyGetTypeID()) {
4081 can_target_osx = SecKeyIsCDSAKey((SecKeyRef)value);
4082 can_target_ios = !can_target_osx;
4083 } else if (typeID == SecCertificateGetTypeID()) {
4084 // All types of certificates can target OSX keychains, but OSX certificates won't work on iOS
4085 can_target_ios &= !SecCertificateIsItemImplInstance((SecCertificateRef)value);
4086 } else if (typeID == SecKeychainItemGetTypeID()) {
4087 // SecKeychainItemRef can target iOS keychain only when it has attached iOS-style persistent reference.
4088 if (_SecItemGetPersistentReference(value) == NULL) {
4089 can_target_ios = false;
4090 }
4091 }
4092 }
4093
4094 // Check presence of kSecAttrTokenID and kSecAttrAccessControl; they are not defined for CDSA keychain.
4095 if (CFDictionaryContainsKey(query, kSecAttrTokenID) || CFDictionaryContainsKey(query, kSecAttrAccessControl)) {
4096 can_target_osx = false;
4097 }
4098
4099 // Check for special token access groups. If present, redirect query to iOS keychain.
4100 value = CFDictionaryGetValue(query, kSecAttrAccessGroup);
4101 if (value != NULL && CFEqual(value, kSecAttrAccessGroupToken)) {
4102 can_target_osx = false;
4103 }
4104
4105 // Synchronizable items should go to iOS keychain only.
4106 if (SecItemSynchronizable(query)) {
4107 can_target_osx = false;
4108 }
4109
4110 value = CFDictionaryGetValue(query, kSecValuePersistentRef);
4111 if (value != NULL) {
4112 if (SecItemIsIOSPersistentReference(value)) {
4113 can_target_osx = false;
4114 } else {
4115 // Non-iOS-style persistent references should not be fed to iOS keychain queries.
4116 can_target_ios = false;
4117 }
4118 }
4119
4120 // Presence of following atributes means that query is OSX-only.
4121 static const CFStringRef *osx_only_items[] = {
4122 &kSecMatchItemList,
4123 &kSecMatchSearchList,
4124 &kSecMatchSubjectStartsWith,
4125 &kSecMatchSubjectEndsWith,
4126 &kSecMatchSubjectWholeString,
4127 &kSecMatchDiacriticInsensitive,
4128 &kSecMatchWidthInsensitive,
4129 &kSecUseItemList,
4130 &kSecUseKeychain,
4131 &kSecAttrAccess,
4132 &kSecAttrPRF,
4133 &kSecAttrSalt,
4134 &kSecAttrRounds,
4135 };
4136
4137 for (CFIndex i = 0; i < array_size(osx_only_items); i++) {
4138 can_target_ios = can_target_ios && !CFDictionaryContainsKey(query, *osx_only_items[i]);
4139 }
4140
4141 // Absence of all of kSecItemClass, kSecValuePersistentRef, and kSecValueRef means that the query can't target iOS
4142 if(CFDictionaryGetValue(query, kSecClass) == NULL &&
4143 CFDictionaryGetValue(query, kSecValuePersistentRef) == NULL &&
4144 CFDictionaryGetValue(query, kSecValueRef) == NULL) {
4145 can_target_ios = false;
4146 }
4147
4148 return (can_target_ios || can_target_osx) ? errSecSuccess : errSecParam;
4149 }
4150
4151 //
4152 // Function to check whether the kSecAttrSynchronizable attribute is being updated.
4153 //
4154 static Boolean SecItemHasSynchronizableUpdate(Boolean synchronizable, CFDictionaryRef changes)
4155 {
4156 CFTypeRef newValue = CFDictionaryGetValue(changes, kSecAttrSynchronizable);
4157 if (!newValue)
4158 return false;
4159
4160 Boolean new_sync = readNumber(newValue);
4161 Boolean old_sync = synchronizable;
4162
4163 return (old_sync != new_sync);
4164 }
4165
4166 //
4167 // Function to apply changes to a mutable dictionary.
4168 // (CFDictionaryApplierFunction, called by CFDictionaryApplyFunction)
4169 //
4170 static void SecItemApplyChanges(const void *key, const void *value, void *context)
4171 {
4172 CFMutableDictionaryRef dict = (CFMutableDictionaryRef) context;
4173 if (!dict) return;
4174
4175 CFDictionarySetValue(dict, key, value);
4176 }
4177
4178 //
4179 // Function to change matching items from non-syncable to syncable
4180 // (if toSyncable is true), otherwise from syncable to non-syncable.
4181 // This currently moves items between keychain containers.
4182 //
4183 static OSStatus SecItemChangeSynchronizability(CFDictionaryRef query, CFDictionaryRef changes, Boolean toSyncable)
4184 {
4185 // Note: the input query dictionary is a mutable copy of the query originally
4186 // provided by the caller as the first parameter to SecItemUpdate. It may not
4187 // specify returning attributes or data, but we will need both to make a copy.
4188 //
4189 CFDictionaryRemoveValue((CFMutableDictionaryRef)query, kSecReturnRef);
4190 CFDictionaryRemoveValue((CFMutableDictionaryRef)query, kSecReturnPersistentRef);
4191 CFDictionaryRemoveValue((CFMutableDictionaryRef)query, kSecReturnData);
4192 CFDictionarySetValue((CFMutableDictionaryRef)query, kSecReturnAttributes, kCFBooleanTrue);
4193 if (NULL == CFDictionaryGetValue(changes, kSecValueData))
4194 CFDictionarySetValue((CFMutableDictionaryRef)query, kSecReturnData, kCFBooleanTrue);
4195
4196 CFTypeRef result;
4197 OSStatus status;
4198 if (toSyncable)
4199 status = SecItemCopyMatching_osx(query, &result);
4200 else
4201 status = SecItemCopyMatching_ios(query, &result);
4202
4203 if (status)
4204 return status;
4205 if (!result)
4206 return errSecItemNotFound;
4207
4208 CFMutableArrayRef items;
4209 if (CFGetTypeID(result) != CFArrayGetTypeID()) {
4210 items = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
4211 CFArrayAppendValue(items, result);
4212 CFRelease(result);
4213 }
4214 else {
4215 items = (CFMutableArrayRef)result;
4216 }
4217
4218 CFIndex idx, count = (items) ? CFArrayGetCount(items) : 0;
4219 int priority = LOG_DEBUG;
4220 OSStatus err = 0;
4221 for (idx = 0; idx < count; idx++) {
4222 CFDictionaryRef dict = (CFDictionaryRef) CFArrayGetValueAtIndex(items, idx);
4223 CFMutableDictionaryRef item = (CFMutableDictionaryRef)
4224 SecItemCopyTranslatedAttributes(dict,
4225 CFDictionaryGetValue(query, kSecClass),
4226 (toSyncable) ? true : false /*iOSOut*/,
4227 true /*pruneMatch*/,
4228 true /*pruneSync*/,
4229 true /*pruneReturn*/,
4230 false /*pruneData*/,
4231 (toSyncable) ? true : false /*pruneAccess*/);
4232 // hold onto the query before applying changes, in case the item already exists.
4233 // note that we cannot include the creation or modification dates from our
4234 // found item in this query, as they may not match the item in the other keychain.
4235 CFMutableDictionaryRef itemQuery = CFDictionaryCreateMutableCopy(NULL, 0, item);
4236 CFDictionaryRemoveValue(itemQuery, kSecAttrCreationDate);
4237 CFDictionaryRemoveValue(itemQuery, kSecAttrModificationDate);
4238 // apply changes to the item dictionary that we will pass to SecItemAdd
4239 CFDictionaryApplyFunction(changes, SecItemApplyChanges, item);
4240 if (toSyncable) {
4241 CFDictionarySetValue(item, kSecAttrSynchronizable, kCFBooleanTrue);
4242 status = SecItemAdd_ios(item, NULL);
4243 secitemlog(priority, "ChangeSync: SecItemAdd_ios=%d", status);
4244 if (errSecDuplicateItem == status) {
4245 // find and apply changes to the existing syncable item.
4246 CFDictionarySetValue(itemQuery, kSecAttrSynchronizable, kCFBooleanTrue);
4247 status = SecItemUpdate_ios(itemQuery, changes);
4248 secitemlog(priority, "ChangeSync: SecItemUpdate_ios=%d", status);
4249 }
4250 if (errSecSuccess == status) {
4251 CFDictionarySetValue(itemQuery, kSecAttrSynchronizable, kCFBooleanFalse);
4252 status = SecItemDelete_osx(itemQuery);
4253 secitemlog(priority, "ChangeSync: SecItemDelete_osx=%d", status);
4254 }
4255 }
4256 else {
4257 CFDictionarySetValue(item, kSecAttrSynchronizable, kCFBooleanFalse);
4258 status = SecItemAdd_osx(item, NULL);
4259 secitemlog(priority, "ChangeSync: SecItemAdd_osx=%d", status);
4260 if (errSecDuplicateItem == status) {
4261 // find and apply changes to the existing non-syncable item.
4262 CFDictionarySetValue(itemQuery, kSecAttrSynchronizable, kCFBooleanFalse);
4263 status = SecItemUpdate_osx(itemQuery, changes);
4264 secitemlog(priority, "ChangeSync: SecItemUpdate_osx=%d", status);
4265 }
4266 if (errSecSuccess == status) {
4267 CFDictionarySetValue(itemQuery, kSecAttrSynchronizable, kCFBooleanTrue);
4268 status = SecItemDelete_ios(itemQuery);
4269 secitemlog(priority, "ChangeSync: SecItemDelete_ios=%d", status);
4270 }
4271 }
4272 CFReleaseSafe(item);
4273 CFReleaseSafe(itemQuery);
4274 if (status)
4275 err = status;
4276 }
4277 CFReleaseSafe(items);
4278
4279 return err;
4280 }
4281
4282
4283 extern "C" {
4284
4285 CFTypeRef
4286 SecItemCreateFromAttributeDictionary_osx(CFDictionaryRef refAttributes) {
4287 CFTypeRef ref = NULL;
4288 CFStringRef item_class_string = (CFStringRef)CFDictionaryGetValue(refAttributes, kSecClass);
4289 SecItemClass item_class = (SecItemClass) 0;
4290
4291 if (CFEqual(item_class_string, kSecClassGenericPassword)) {
4292 item_class = kSecGenericPasswordItemClass;
4293 } else if (CFEqual(item_class_string, kSecClassInternetPassword)) {
4294 item_class = kSecInternetPasswordItemClass;
4295 }
4296
4297 if (item_class != 0) {
4298 // we carry v_Data around here so the *_ios calls can find it and locate
4299 // their own data. Putting things in the attribute list doesn't help as
4300 // the osx keychainitem and item calls bail when they don't see a keychain
4301 // object. If we need to make them work we either have to bridge them, or
4302 // find a way to craft a workable keychain object. #if'ed code left below
4303 // in case we need to go down that path.
4304
4305 SecKeychainAttributeList attrs = {};
4306 SecKeychainAttribute attr = {};
4307
4308 attrs.attr = &attr;
4309 attrs.count = 0;
4310 CFTypeRef v;
4311
4312 Item item = Item(item_class, &attrs, 0, "");
4313 v = CFCast(CFData, CFDictionaryGetValue(refAttributes, kSecValuePersistentRef));
4314 if (v) {
4315 item->setPersistentRef((CFDataRef)v);
4316 }
4317 ref = item->handle();
4318 }
4319
4320 return ref;
4321 }
4322
4323 /*
4324 * SecItemValidateAppleApplicationGroupAccess determines if the caller
4325 * is a member of the specified application group, and is signed by Apple.
4326 */
4327 OSStatus
4328 SecItemValidateAppleApplicationGroupAccess(CFStringRef group)
4329 {
4330 SecTrustedApplicationRef app = NULL;
4331 SecRequirementRef requirement = NULL;
4332 SecCodeRef code = NULL;
4333 OSStatus status = errSecParam;
4334
4335 if (group) {
4336 CFIndex length = CFStringGetMaximumSizeForEncoding(CFStringGetLength(group), kCFStringEncodingUTF8) + 1;
4337 char* buffer = (char*) malloc(length);
4338 if (buffer) {
4339 if (CFStringGetCString(group, buffer, length, kCFStringEncodingUTF8)) {
4340 status = SecTrustedApplicationCreateApplicationGroup(buffer, NULL, &app);
4341 }
4342 free(buffer);
4343 } else {
4344 status = errSecMemoryError;
4345 }
4346 }
4347 if (!status) {
4348 status = SecTrustedApplicationCopyRequirement(app, &requirement);
4349 }
4350 if (!status) {
4351 status = SecCodeCopySelf(kSecCSDefaultFlags, &code);
4352 }
4353 if (!status) {
4354 status = SecCodeCheckValidity(code, kSecCSDefaultFlags, requirement);
4355 }
4356
4357 CFReleaseSafe(code);
4358 CFReleaseSafe(requirement);
4359 CFReleaseSafe(app);
4360 return status;
4361 }
4362
4363 static Mutex& gParentCertCacheLock() {
4364 static Mutex fParentCertCacheLock;
4365 return fParentCertCacheLock;
4366 }
4367 static CFMutableDictionaryRef gParentCertCache;
4368 static CFMutableArrayRef gParentCertCacheList;
4369 #define PARENT_CACHE_SIZE 100
4370
4371 void SecItemParentCachePurge() {
4372 StLock<Mutex> _(gParentCertCacheLock());
4373 CFReleaseNull(gParentCertCache);
4374 CFReleaseNull(gParentCertCacheList);
4375 }
4376
4377 static CFArrayRef CF_RETURNS_RETAINED parentCacheRead(SecCertificateRef certificate) {
4378 CFArrayRef parents = NULL;
4379 CFIndex ix;
4380 CFDataRef digest = SecCertificateGetSHA1Digest(certificate);
4381 if (!digest) return NULL;
4382
4383 StLock<Mutex> _(gParentCertCacheLock());
4384 if (gParentCertCache && gParentCertCacheList) {
4385 if (0 <= (ix = CFArrayGetFirstIndexOfValue(gParentCertCacheList,
4386 CFRangeMake(0, CFArrayGetCount(gParentCertCacheList)),
4387 digest))) {
4388 // Cache hit. Get value and move entry to the top of the list.
4389 parents = (CFArrayRef)CFDictionaryGetValue(gParentCertCache, digest);
4390 CFArrayRemoveValueAtIndex(gParentCertCacheList, ix);
4391 CFArrayAppendValue(gParentCertCacheList, digest);
4392 }
4393 }
4394 CFRetainSafe(parents);
4395 return parents;
4396 }
4397
4398 static void parentCacheWrite(SecCertificateRef certificate, CFArrayRef parents) {
4399 CFDataRef digest = SecCertificateGetSHA1Digest(certificate);
4400 if (!digest) return;
4401
4402 StLock<Mutex> _(gParentCertCacheLock());
4403 if (!gParentCertCache || !gParentCertCacheList) {
4404 CFReleaseNull(gParentCertCache);
4405 gParentCertCache = makeCFMutableDictionary();
4406 CFReleaseNull(gParentCertCacheList);
4407 gParentCertCacheList = makeCFMutableArray(0);
4408 }
4409
4410 if (gParentCertCache && gParentCertCacheList) {
4411 // check to make sure another thread didn't add this entry to the cache already
4412 if (0 > CFArrayGetFirstIndexOfValue(gParentCertCacheList,
4413 CFRangeMake(0, CFArrayGetCount(gParentCertCacheList)),
4414 digest)) {
4415 CFDictionaryAddValue(gParentCertCache, digest, parents);
4416 if (PARENT_CACHE_SIZE <= CFArrayGetCount(gParentCertCacheList)) {
4417 // Remove least recently used cache entry.
4418 CFDictionaryRemoveValue(gParentCertCache, CFArrayGetValueAtIndex(gParentCertCacheList, 0));
4419 CFArrayRemoveValueAtIndex(gParentCertCacheList, 0);
4420 }
4421 CFArrayAppendValue(gParentCertCacheList, digest);
4422 }
4423 }
4424 }
4425
4426 /*
4427 * SecItemCopyParentCertificates_osx returns an array of zero of more possible
4428 * issuer certificates for the provided certificate. No cryptographic validation
4429 * of the signature is performed in this function; its purpose is only to
4430 * provide a list of candidate certificates.
4431 */
4432 CFArrayRef
4433 SecItemCopyParentCertificates_osx(SecCertificateRef certificate, void *context)
4434 {
4435 #pragma unused (context) /* for now; in future this can reference a container object */
4436 /* Check for parents in keychain cache */
4437 CFArrayRef parents = parentCacheRead(certificate);
4438 if (parents) {
4439 return parents;
4440 }
4441
4442 /* Cache miss. Query for parents. */
4443 #if TARGET_OS_OSX
4444 CFDataRef normalizedIssuer = SecCertificateCopyNormalizedIssuerContent(certificate, NULL);
4445 #else
4446 CFDataRef normalizedIssuer = SecCertificateGetNormalizedIssuerContent(certificate);
4447 CFRetainSafe(normalizedIssuer);
4448 #endif
4449 OSStatus status;
4450 CFMutableArrayRef combinedSearchList = NULL;
4451
4452 /* Define the array of keychains which will be searched for parents. */
4453 CFArrayRef searchList = NULL;
4454 status = SecKeychainCopySearchList(&searchList);
4455 if (searchList) {
4456 combinedSearchList = CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, searchList);
4457 CFRelease(searchList);
4458 } else {
4459 combinedSearchList = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
4460 }
4461 SecKeychainRef rootStoreKeychain = NULL;
4462 status = SecKeychainOpen(SYSTEM_ROOT_STORE_PATH, &rootStoreKeychain);
4463 if (rootStoreKeychain) {
4464 if (combinedSearchList) {
4465 CFArrayAppendValue(combinedSearchList, rootStoreKeychain);
4466 }
4467 CFRelease(rootStoreKeychain);
4468 }
4469
4470 /* Create and populate a fixed-size query dictionary. */
4471 CFMutableDictionaryRef query = CFDictionaryCreateMutable(NULL, 5,
4472 &kCFTypeDictionaryKeyCallBacks,
4473 &kCFTypeDictionaryValueCallBacks);
4474 CFDictionaryAddValue(query, kSecClass, kSecClassCertificate);
4475 CFDictionaryAddValue(query, kSecReturnData, kCFBooleanTrue);
4476 CFDictionaryAddValue(query, kSecMatchLimit, kSecMatchLimitAll);
4477 if (combinedSearchList) {
4478 CFDictionaryAddValue(query, kSecMatchSearchList, combinedSearchList);
4479 CFRelease(combinedSearchList);
4480 }
4481
4482 CFTypeRef results = NULL;
4483 if (normalizedIssuer) {
4484 /* Look up certs whose subject is the same as this cert's issuer. */
4485 CFDictionaryAddValue(query, kSecAttrSubject, normalizedIssuer);
4486 status = SecItemCopyMatching_osx(query, &results);
4487 }
4488 else {
4489 /* Cannot match anything without an issuer! */
4490 status = errSecItemNotFound;
4491 }
4492
4493 if ((status != errSecSuccess) && (status != errSecItemNotFound)) {
4494 secitemlog(LOG_WARNING, "SecItemCopyParentCertificates_osx: %d", (int)status);
4495 }
4496 CFRelease(query);
4497
4498 CFMutableArrayRef result = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
4499 CFTypeID resultType = (results) ? CFGetTypeID(results) : 0;
4500 if (resultType == CFArrayGetTypeID()) {
4501 CFIndex index, count = CFArrayGetCount((CFArrayRef)results);
4502 for (index = 0; index < count; index++) {
4503 CFDataRef data = (CFDataRef) CFArrayGetValueAtIndex((CFArrayRef)results, index);
4504 if (data) {
4505 SecCertificateRef cert = SecCertificateCreateWithData(kCFAllocatorDefault, data);
4506 if (cert) {
4507 CFArrayAppendValue(result, cert);
4508 CFRelease(cert);
4509 }
4510 }
4511 }
4512 } else if (results && resultType == CFDataGetTypeID()) {
4513 SecCertificateRef cert = SecCertificateCreateWithData(kCFAllocatorDefault, (CFDataRef)results);
4514 if (cert) {
4515 CFArrayAppendValue(result, cert);
4516 CFRelease(cert);
4517 }
4518 }
4519 CFReleaseSafe(results);
4520 CFReleaseSafe(normalizedIssuer);
4521
4522 /* Add to cache. */
4523 parentCacheWrite(certificate, result);
4524
4525 return result;
4526 }
4527
4528 SecCertificateRef SecItemCopyStoredCertificate(SecCertificateRef certificate, void *context)
4529 {
4530 #pragma unused (context) /* for now; in future this can reference a container object */
4531
4532 /* Certificates are unique by issuer and serial number. */
4533 CFDataRef serialNumber = SecCertificateCopySerialNumberData(certificate, NULL);
4534 #if TARGET_OS_OSX
4535 CFDataRef normalizedIssuer = SecCertificateCopyNormalizedIssuerContent(certificate, NULL);
4536 #else
4537 CFDataRef normalizedIssuer = SecCertificateGetNormalizedIssuerContent(certificate);
4538 CFRetainSafe(normalizedIssuer);
4539 #endif
4540
4541 const void *keys[] = {
4542 kSecClass,
4543 kSecMatchLimit,
4544 kSecAttrIssuer,
4545 kSecAttrSerialNumber,
4546 kSecReturnRef
4547 },
4548 *values[] = {
4549 kSecClassCertificate,
4550 kSecMatchLimitOne,
4551 normalizedIssuer,
4552 serialNumber,
4553 kCFBooleanTrue
4554 };
4555 CFDictionaryRef query = CFDictionaryCreate(NULL, keys, values, 5, NULL, NULL);
4556 CFTypeRef result = NULL;
4557
4558 OSStatus status = SecItemCopyMatching_osx(query, &result);
4559 if ((status != errSecSuccess) && (status != errSecItemNotFound)) {
4560 secitemlog(LOG_WARNING, "SecItemCopyStoredCertificate: %d", (int)status);
4561 CFReleaseNull(result);
4562 }
4563 CFReleaseSafe(query);
4564 CFReleaseSafe(serialNumber);
4565 CFReleaseSafe(normalizedIssuer);
4566
4567 return (SecCertificateRef)result;
4568 }
4569
4570 /*
4571 * SecItemCopyTranslatedAttributes accepts a user-provided attribute dictionary
4572 * and attempts to return a sanitized copy for passing to the underlying
4573 * platform-specific implementation code.
4574 *
4575 * If iOSOut is true, one or more translations may apply:
4576 * - SecKeychain refs are removed, since there aren't multiple keychains
4577 * - SecPolicy refs are removed, since they can't be externalized
4578 * - SecAccess refs are removed, and potentially translated to entitlements
4579 *
4580 * If pruneMatch is true, kSecMatch* attributes are removed; this avoids
4581 * parameter errors due to strict input checks in secd, which only permits
4582 * these constants for calls to SecItemCopyMatching.
4583 *
4584 * If pruneSync is true, the kSecAttrSynchronizable attribute is removed.
4585 * This permits a query to be reused for non-synchronizable items, or to
4586 * resolve a search based on a persistent item reference for iOS.
4587 *
4588 * If pruneReturn is true, kSecReturn* attributes are removed; this avoids
4589 * parameter errors due to strict input checks in secd, which do not permit
4590 * these constants for calls to SecItemUpdate.
4591 */
4592 CFDictionaryRef
4593 SecItemCopyTranslatedAttributes(CFDictionaryRef inOSXDict, CFTypeRef itemClass,
4594 bool iOSOut, bool pruneMatch, bool pruneSync, bool pruneReturn, bool pruneData, bool pruneAccess)
4595 {
4596 CFMutableDictionaryRef result = CFDictionaryCreateMutableCopy(NULL, 0, inOSXDict);
4597 if (result == NULL) {
4598 return result;
4599 }
4600
4601 if (pruneSync) {
4602 CFDictionaryRemoveValue(result, kSecAttrSynchronizable);
4603 }
4604
4605 if (pruneMatch) {
4606 /* Match constants are only supported on iOS for SecItemCopyMatching,
4607 * and will generate an error if passed to other SecItem API functions;
4608 * on OS X, they're just ignored if not applicable for the context.
4609 */
4610 CFDictionaryRemoveValue(result, kSecMatchPolicy);
4611 CFDictionaryRemoveValue(result, kSecMatchItemList);
4612 CFDictionaryRemoveValue(result, kSecMatchSearchList);
4613 CFDictionaryRemoveValue(result, kSecMatchIssuers);
4614 CFDictionaryRemoveValue(result, kSecMatchEmailAddressIfPresent);
4615 CFDictionaryRemoveValue(result, kSecMatchSubjectContains);
4616 CFDictionaryRemoveValue(result, kSecMatchCaseInsensitive);
4617 CFDictionaryRemoveValue(result, kSecMatchTrustedOnly);
4618 CFDictionaryRemoveValue(result, kSecMatchValidOnDate);
4619 CFDictionaryRemoveValue(result, kSecMatchLimit);
4620 CFDictionaryRemoveValue(result, kSecMatchLimitOne);
4621 CFDictionaryRemoveValue(result, kSecMatchLimitAll);
4622 }
4623
4624 if (pruneReturn) {
4625 /* Return constants are not supported on iOS for SecItemUpdate,
4626 * where they will generate an error; on OS X, they're just ignored
4627 * if not applicable for the context.
4628 */
4629 CFDictionaryRemoveValue(result, kSecReturnData);
4630 CFDictionaryRemoveValue(result, kSecReturnAttributes);
4631 CFDictionaryRemoveValue(result, kSecReturnRef);
4632 CFDictionaryRemoveValue(result, kSecReturnPersistentRef);
4633 }
4634
4635 if (pruneData) {
4636 /* Searching on data is not supported. */
4637 CFDictionaryRemoveValue(result, kSecValueData);
4638 }
4639
4640 if (pruneAccess) {
4641 /* Searching on access lists is not supported */
4642 CFDictionaryRemoveValue(result, kSecAttrAccess);
4643 }
4644
4645 if (iOSOut) {
4646 /* Remove kSecMatchSearchList (value is array of SecKeychainRef);
4647 * cannot specify a keychain search list on iOS
4648 */
4649 CFDictionaryRemoveValue(result, kSecMatchSearchList);
4650
4651 /* Remove kSecUseKeychain (value is a SecKeychainRef);
4652 * cannot specify a keychain on iOS
4653 */
4654 CFDictionaryRemoveValue(result, kSecUseKeychain);
4655
4656 /* Potentially translate kSecAttrAccess (value is a SecAccessRef),
4657 * unless kSecAttrAccessGroup has already been specified.
4658 */
4659 SecAccessRef access = (SecAccessRef) CFDictionaryGetValue(result, kSecAttrAccess);
4660 CFStringRef accessGroup = (CFStringRef) CFDictionaryGetValue(result, kSecAttrAccessGroup);
4661 if (access != NULL && accessGroup == NULL) {
4662 /* Translate "InternetAccounts" application group to an access group */
4663 if (errSecSuccess == SecItemValidateAppleApplicationGroupAccess(CFSTR("InternetAccounts"))) {
4664 /* The caller is a valid member of the application group. */
4665 CFStringRef groupName = CFSTR("appleaccount");
4666 CFTypeRef value = CFDictionaryGetValue(result, kSecAttrAuthenticationType);
4667 if (value && CFEqual(value, kSecAttrAuthenticationTypeHTMLForm)) {
4668 groupName = CFSTR("com.apple.cfnetwork");
4669 }
4670 CFDictionarySetValue(result, kSecAttrAccessGroup, groupName);
4671 }
4672 }
4673 CFDictionaryRemoveValue(result, kSecAttrAccess);
4674
4675 /* If item is specified by direct reference, and this is an iOS search,
4676 * replace it with a persistent reference, if it was recorded inside ItemImpl.
4677 */
4678 CFTypeRef directRef = CFDictionaryGetValue(result, kSecValueRef);
4679 if (directRef != NULL) {
4680 CFTypeID typeID = CFGetTypeID(directRef);
4681 if ((typeID != SecKeyGetTypeID() || SecKeyIsCDSAKey((SecKeyRef)directRef)) &&
4682 (typeID != SecCertificateGetTypeID() || SecCertificateIsItemImplInstance((SecCertificateRef)directRef)) &&
4683 (typeID != SecIdentityGetTypeID())) {
4684 CFDataRef persistentRef = _SecItemGetPersistentReference(directRef);
4685 if (persistentRef) {
4686 CFDictionarySetValue(result, kSecValuePersistentRef, persistentRef);
4687 CFDictionaryRemoveValue(result, kSecValueRef);
4688 }
4689 }
4690 }
4691
4692 /* If item is specified by persistent reference, and this is an iOS search,
4693 * remove the synchronizable attribute as it will be rejected by secd.
4694 */
4695 CFTypeRef persistentRef = CFDictionaryGetValue(result, kSecValuePersistentRef);
4696 if (persistentRef) {
4697 CFDictionaryRemoveValue(result, kSecAttrSynchronizable);
4698 }
4699
4700 /* Remove kSecAttrModificationDate; this should never be used as criteria
4701 * for a search, or to add/modify an item. (If we are cloning an item
4702 * and want to keep its modification date, we don't call this function.)
4703 * It turns out that some clients are using the full attributes dictionary
4704 * returned by SecItemCopyMatching as a query to find the same item later,
4705 * which won't work once the item is updated.
4706 */
4707 CFDictionaryRemoveValue(result, kSecAttrModificationDate);
4708
4709 /* Find all intermediate certificates in OSX keychain and append them in to the kSecMatchIssuers.
4710 * This is required because secd cannot do query in to the OSX keychain
4711 */
4712 CFTypeRef matchIssuers = CFDictionaryGetValue(result, kSecMatchIssuers);
4713 if (matchIssuers && CFGetTypeID(matchIssuers) == CFArrayGetTypeID()) {
4714 CFArrayRef newMatchIssuers = _CopyMatchingIssuers((CFArrayRef)matchIssuers);
4715 if (newMatchIssuers) {
4716 CFDictionarySetValue(result, kSecMatchIssuers, newMatchIssuers);
4717 CFRelease(newMatchIssuers);
4718 }
4719 }
4720 }
4721 else {
4722 /* iOS doesn't add the class attribute, so we must do it here. */
4723 if (itemClass)
4724 CFDictionarySetValue(result, kSecClass, itemClass);
4725
4726 /* Remove attributes which are not part of the OS X database schema. */
4727 CFDictionaryRemoveValue(result, kSecAttrAccessible);
4728 CFDictionaryRemoveValue(result, kSecAttrAccessControl);
4729 CFDictionaryRemoveValue(result, kSecAttrAccessGroup);
4730 CFDictionaryRemoveValue(result, kSecAttrSynchronizable);
4731 CFDictionaryRemoveValue(result, kSecAttrTombstone);
4732 }
4733
4734 /* This attribute is consumed by the bridge itself. */
4735 CFDictionaryRemoveValue(result, kSecUseDataProtectionKeychain);
4736 #pragma clang diagnostic push
4737 #pragma clang diagnostic ignored "-Wdeprecated-declarations"
4738 // Also remove deprecated symbol in case your CFDict is derpy
4739 CFDictionaryRemoveValue(result, kSecAttrNoLegacy);
4740 #pragma clang diagnostic pop
4741
4742 return result;
4743 }
4744
4745 } /* extern "C" */
4746
4747 static CFArrayRef
4748 _CopyMatchingIssuers(CFArrayRef matchIssuers) {
4749 CFMutableArrayRef result = NULL;
4750 CFMutableDictionaryRef query = NULL;
4751 CFMutableDictionaryRef policyProperties = NULL;
4752 SecPolicyRef policy = NULL;
4753 CFTypeRef matchedCertificates = NULL;
4754
4755 require_quiet(policyProperties = CFDictionaryCreateMutable(kCFAllocatorDefault, 1, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks), out);
4756 CFDictionarySetValue(policyProperties, kSecPolicyKU_KeyCertSign, kCFBooleanTrue);
4757 require_quiet(policy = SecPolicyCreateWithProperties(kSecPolicyAppleX509Basic, policyProperties), out);
4758
4759 require_quiet(query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks), out);
4760 CFDictionarySetValue(query, kSecClass, kSecClassCertificate);
4761 CFDictionarySetValue(query, kSecMatchIssuers, matchIssuers);
4762 CFDictionarySetValue(query, kSecMatchLimit, kSecMatchLimitAll);
4763 CFDictionarySetValue(query, kSecReturnAttributes, kCFBooleanTrue);
4764 CFDictionarySetValue(query, kSecUseCertificatesWithMatchIssuers, kCFBooleanTrue);
4765 CFDictionarySetValue(query, kSecMatchPolicy, policy);
4766
4767 if (SecItemCopyMatching_osx(query, &matchedCertificates) == errSecSuccess && CFGetTypeID(matchedCertificates) == CFArrayGetTypeID()) {
4768 require_quiet(result = CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, (CFArrayRef)matchedCertificates), out);
4769 for(CFIndex i = 0; i < CFArrayGetCount((CFArrayRef)matchedCertificates); ++i) {
4770 CFDictionaryRef attributes = (CFDictionaryRef)CFArrayGetValueAtIndex((CFArrayRef)matchedCertificates, i);
4771 CFTypeRef subject = CFDictionaryGetValue(attributes, kSecAttrSubject);
4772 if (!CFArrayContainsValue(result, CFRangeMake(0, CFArrayGetCount(result)), subject)) {
4773 CFArrayAppendValue(result, subject);
4774 }
4775 }
4776 }
4777
4778 out:
4779 CFReleaseSafe(query);
4780 CFReleaseSafe(policyProperties);
4781 CFReleaseSafe(policy);
4782 CFReleaseSafe(matchedCertificates);
4783
4784 return result;
4785 }
4786
4787 static OSStatus
4788 SecItemMergeResults(bool can_target_ios, OSStatus status_ios, CFTypeRef result_ios,
4789 bool can_target_osx, OSStatus status_osx, CFTypeRef result_osx,
4790 CFTypeRef *result) {
4791 // When querying both keychains and iOS keychain fails because of missing
4792 // entitlements, completely ignore iOS keychain result. This is to keep
4793 // backward compatibility with applications which know nothing about iOS keychain
4794 // and use SecItem API to access OSX keychain which does not need any entitlements.
4795 if (can_target_osx && can_target_ios && status_ios == errSecMissingEntitlement) {
4796 can_target_ios = false;
4797 }
4798
4799 if (can_target_osx && can_target_ios) {
4800 // If both keychains were targetted, examine returning statuses and decide what to do.
4801 if (status_ios != errSecSuccess) {
4802 // iOS keychain failed to produce results because of some error, go with results from OSX keychain.
4803 // Since iOS keychain queries will fail without a keychain-access-group or proper entitlements, SecItemCopyMatching
4804 // calls against the OSX keychain API that should return errSecItemNotFound will return nonsense from the iOS keychain.
4805 AssignOrReleaseResult(result_osx, result);
4806 return status_osx;
4807 } else if (status_osx != errSecSuccess) {
4808 if (status_osx != errSecItemNotFound) {
4809 // OSX failed to produce results with some failure mode (else than not_found), but iOS produced results.
4810 // We have to either return OSX failure result and discard iOS results, or vice versa. For now, we just
4811 // ignore OSX error and return just iOS results.
4812 secitemlog(LOG_NOTICE, "SecItemMergeResults: osx_result=%d, ignoring it, iOS succeeded fine", status_osx);
4813 }
4814
4815 // OSX failed to produce results, but we have success from iOS keychain; go with results from iOS keychain.
4816 AssignOrReleaseResult(result_ios, result);
4817 return errSecSuccess;
4818 } else {
4819 // Both searches succeeded, merge results.
4820 if (result != NULL) {
4821 CFTypeID id_osx = (result_osx) ? CFGetTypeID(result_osx) : 0;
4822 CFTypeID id_ios = (result_ios) ? CFGetTypeID(result_ios) : 0;
4823 CFTypeID id_array = CFArrayGetTypeID();
4824 if ((id_osx == id_array) && (id_ios == id_array)) {
4825 // Fold the arrays into one.
4826 *result = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
4827 CFArrayAppendArray((CFMutableArrayRef)*result, (CFArrayRef)result_ios,
4828 CFRangeMake(0, CFArrayGetCount((CFArrayRef)result_ios)));
4829 CFArrayAppendArray((CFMutableArrayRef)*result, (CFArrayRef)result_osx,
4830 CFRangeMake(0, CFArrayGetCount((CFArrayRef)result_osx)));
4831 } else {
4832 // Result type is not an array, so only one match can be returned.
4833 *result = (id_ios) ? result_ios : result_osx;
4834 CFRetainSafe(*result);
4835 }
4836 }
4837 CFReleaseSafe(result_osx);
4838 CFReleaseSafe(result_ios);
4839 return errSecSuccess;
4840 }
4841 } else if (can_target_ios) {
4842 // Only iOS keychain was targetted.
4843 AssignOrReleaseResult(result_ios, result);
4844 return status_ios;
4845 } else if (can_target_osx) {
4846 // Only OSX keychain was targetted.
4847 AssignOrReleaseResult(result_osx, result);
4848 return status_osx;
4849 } else {
4850 // Query could not run at all?
4851 return errSecParam;
4852 }
4853 }
4854
4855 OSStatus
4856 SecItemCopyMatching(CFDictionaryRef query, CFTypeRef *result)
4857 {
4858 os_activity_t activity = os_activity_create("SecItemCopyMatching", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_DEFAULT);
4859 os_activity_scope(activity);
4860 os_release(activity);
4861
4862 if (!query) {
4863 return errSecParam;
4864 }
4865 secitemshow(query, "SecItemCopyMatching query:");
4866
4867 OSStatus status_osx = errSecItemNotFound, status_ios = errSecItemNotFound;
4868 CFTypeRef result_osx = NULL, result_ios = NULL;
4869 bool can_target_ios, can_target_osx, useDataProtectionKeychainFlag;
4870 OSStatus status = SecItemCategorizeQuery(query, can_target_ios, can_target_osx, useDataProtectionKeychainFlag);
4871 if (status != errSecSuccess) {
4872 return status;
4873 }
4874
4875 if (can_target_ios) {
4876 CFDictionaryRef attrs_ios = SecItemCopyTranslatedAttributes(query,
4877 CFDictionaryGetValue(query, kSecClass), true, false, false, false, true, true);
4878 if (!attrs_ios) {
4879 status_ios = errSecParam;
4880 }
4881 else {
4882 status_ios = SecItemCopyMatching_ios(attrs_ios, &result_ios);
4883 CFRelease(attrs_ios);
4884 }
4885 secitemlog(LOG_NOTICE, "SecItemCopyMatching_ios result: %d", status_ios);
4886 }
4887
4888 if (can_target_osx) {
4889 CFDictionaryRef attrs_osx = SecItemCopyTranslatedAttributes(query,
4890 CFDictionaryGetValue(query, kSecClass), false, false, true, false, true, true);
4891 if (!attrs_osx) {
4892 status_osx = errSecParam;
4893 }
4894 else {
4895 status_osx = SecItemCopyMatching_osx(attrs_osx, &result_osx);
4896 CFRelease(attrs_osx);
4897 }
4898 secitemlog(LOG_NOTICE, "SecItemCopyMatching_osx result: %d", status_osx);
4899 }
4900
4901 status = SecItemMergeResults(can_target_ios, status_ios, result_ios,
4902 can_target_osx, status_osx, result_osx, result);
4903 secitemlog(LOG_NOTICE, "SecItemCopyMatching result: %d", status);
4904 return status;
4905 }
4906
4907 OSStatus
4908 SecItemAdd(CFDictionaryRef attributes, CFTypeRef *result)
4909 {
4910 os_activity_t activity = os_activity_create("SecItemAdd", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_DEFAULT);
4911 os_activity_scope(activity);
4912 os_release(activity);
4913
4914 if (!attributes) {
4915 return errSecParam;
4916 }
4917 else if (result) {
4918 *result = NULL;
4919 }
4920 secitemshow(attributes, "SecItemAdd attrs:");
4921
4922 CFTypeRef result_osx = NULL, result_ios = NULL;
4923 bool can_target_ios, can_target_osx, useDataProtectionKeychainFlag;
4924 OSStatus status = SecItemCategorizeQuery(attributes, can_target_ios, can_target_osx, useDataProtectionKeychainFlag);
4925 if (status != errSecSuccess) {
4926 return status;
4927 }
4928
4929 // SecItemAdd cannot be really done on both keychains. In order to keep backward compatibility
4930 // with existing applications, we prefer to add items into legacy keychain and fallback
4931 // into iOS (modern) keychain only when the query is not suitable for legacy keychain.
4932 if (!can_target_osx) {
4933 CFDictionaryRef attrs_ios = SecItemCopyTranslatedAttributes(attributes,
4934 NULL, true, true, false, false, false, false);
4935 if (!attrs_ios) {
4936 status = errSecParam;
4937 } else {
4938 status = SecItemAdd_ios(attrs_ios, &result_ios);
4939 CFRelease(attrs_ios);
4940 }
4941 secitemlog(LOG_NOTICE, "SecItemAdd_ios result: %d", status);
4942 AssignOrReleaseResult(result_ios, result);
4943 return status;
4944 } else {
4945 CFDictionaryRef attrs_osx = SecItemCopyTranslatedAttributes(attributes,
4946 NULL, false, false, true, false, false, false);
4947 if (!attrs_osx) {
4948 status = errSecParam;
4949 } else {
4950 status = SecItemAdd_osx(attrs_osx, &result_osx);
4951 CFRelease(attrs_osx);
4952 }
4953 secitemlog(LOG_NOTICE, "SecItemAdd_osx result: %d", status);
4954 AssignOrReleaseResult(result_osx, result);
4955 return status;
4956 }
4957 }
4958
4959 OSStatus
4960 SecItemUpdate(CFDictionaryRef query, CFDictionaryRef attributesToUpdate)
4961 {
4962 os_activity_t activity = os_activity_create("SecItemUpdate", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_DEFAULT);
4963 os_activity_scope(activity);
4964 os_release(activity);
4965
4966 if (!query || !attributesToUpdate) {
4967 return errSecParam;
4968 }
4969 secitemshow(query, "SecItemUpdate query:");
4970 secitemshow(attributesToUpdate, "SecItemUpdate attrs:");
4971
4972 OSStatus status_osx = errSecItemNotFound, status_ios = errSecItemNotFound;
4973 bool can_target_ios, can_target_osx, useDataProtectionKeychainFlag;
4974 OSStatus status = SecItemCategorizeQuery(query, can_target_ios, can_target_osx, useDataProtectionKeychainFlag);
4975 if (status != errSecSuccess) {
4976 return status;
4977 }
4978
4979 /*
4980 * If the user have explicity opted in to UseDataProtectionKeychain, then don't touch the legacy keychain at all
4981 * ie don't move the item back to legacy keychain if you remove sync=1 or the inverse.
4982 */
4983 if (useDataProtectionKeychainFlag) {
4984 CFDictionaryRef attrs_ios = SecItemCopyTranslatedAttributes(query,
4985 CFDictionaryGetValue(query, kSecClass), true, true, false, true, true, true);
4986 if (!attrs_ios) {
4987 status_ios = errSecParam;
4988 } else {
4989 status_ios = SecItemUpdate_ios(attrs_ios, attributesToUpdate);
4990 CFRelease(attrs_ios);
4991 }
4992 secitemlog(LOG_NOTICE, "SecItemUpdate(ios only) result: %d", status_ios);
4993 return status_ios;
4994 }
4995
4996 if (can_target_ios) {
4997 CFDictionaryRef attrs_ios = SecItemCopyTranslatedAttributes(query,
4998 CFDictionaryGetValue(query, kSecClass), true, true, false, true, true, true);
4999 if (!attrs_ios) {
5000 status_ios = errSecParam;
5001 }
5002 else {
5003 if (SecItemHasSynchronizableUpdate(true, attributesToUpdate)) {
5004 status_ios = SecItemChangeSynchronizability(attrs_ios, attributesToUpdate, false);
5005 } else {
5006 status_ios = SecItemUpdate_ios(attrs_ios, attributesToUpdate);
5007 }
5008 CFRelease(attrs_ios);
5009 }
5010 secitemlog(LOG_NOTICE, "SecItemUpdate_ios result: %d", status_ios);
5011 }
5012
5013 if (can_target_osx) {
5014 CFDictionaryRef attrs_osx = SecItemCopyTranslatedAttributes(query,
5015 CFDictionaryGetValue(query, kSecClass), false, false, true, true, true, true);
5016 if (!attrs_osx) {
5017 status_osx = errSecParam;
5018 }
5019 else {
5020 if (SecItemHasSynchronizableUpdate(false, attributesToUpdate))
5021 status_osx = SecItemChangeSynchronizability(attrs_osx, attributesToUpdate, true);
5022 else
5023 status_osx = SecItemUpdate_osx(attrs_osx, attributesToUpdate);
5024
5025 CFRelease(attrs_osx);
5026 }
5027 secitemlog(LOG_NOTICE, "SecItemUpdate_osx result: %d", status_osx);
5028 }
5029
5030 status = SecItemMergeResults(can_target_ios, status_ios, NULL,
5031 can_target_osx, status_osx, NULL, NULL);
5032 secitemlog(LOG_NOTICE, "SecItemUpdate result: %d", status);
5033 return status;
5034 }
5035
5036 OSStatus
5037 SecItemDelete(CFDictionaryRef query)
5038 {
5039 os_activity_t activity = os_activity_create("SecItemDelete", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_DEFAULT);
5040 os_activity_scope(activity);
5041 os_release(activity);
5042
5043 if (!query) {
5044 return errSecParam;
5045 }
5046 secitemshow(query, "SecItemDelete query:");
5047
5048 OSStatus status_osx = errSecItemNotFound, status_ios = errSecItemNotFound;
5049 bool can_target_ios, can_target_osx, useDataProtectionKeychainFlag;
5050 OSStatus status = SecItemCategorizeQuery(query, can_target_ios, can_target_osx, useDataProtectionKeychainFlag);
5051 if (status != errSecSuccess) {
5052 return status;
5053 }
5054
5055 if (can_target_ios) {
5056 CFDictionaryRef attrs_ios = SecItemCopyTranslatedAttributes(query,
5057 NULL, true, true, false, true, true, true);
5058 if (!attrs_ios) {
5059 status_ios = errSecParam;
5060 } else {
5061 status_ios = SecItemDelete_ios(attrs_ios);
5062 CFRelease(attrs_ios);
5063 }
5064 secitemlog(LOG_NOTICE, "SecItemDelete_ios result: %d", status_ios);
5065 }
5066
5067 if (can_target_osx) {
5068 CFDictionaryRef attrs_osx = SecItemCopyTranslatedAttributes(query,
5069 NULL, false, false, true, true, true, true);
5070 if (!attrs_osx) {
5071 status_osx = errSecParam;
5072 } else {
5073 status_osx = SecItemDelete_osx(attrs_osx);
5074 CFRelease(attrs_osx);
5075 }
5076 secitemlog(LOG_NOTICE, "SecItemDelete_osx result: %d", status_osx);
5077 }
5078
5079 status = SecItemMergeResults(can_target_ios, status_ios, NULL,
5080 can_target_osx, status_osx, NULL, NULL);
5081 secitemlog(LOG_NOTICE, "SecItemCopyDelete result: %d", status);
5082 return status;
5083 }
5084
5085 OSStatus
5086 SecItemUpdateTokenItems(CFTypeRef tokenID, CFArrayRef tokenItemsAttributes)
5087 {
5088 OSStatus status = SecItemUpdateTokenItems_ios(tokenID, tokenItemsAttributes);
5089 secitemlog(LOG_NOTICE, "SecItemUpdateTokenItems_ios result: %d", status);
5090 return status;
5091 }
5092
5093 OSStatus
5094 SecItemCopyMatching_osx(
5095 CFDictionaryRef query,
5096 CFTypeRef *result)
5097 {
5098 if (!query || !result)
5099 return errSecParam;
5100 else
5101 *result = NULL;
5102
5103 CFAllocatorRef allocator = CFGetAllocator(query);
5104 CFIndex matchCount = 0;
5105 CFMutableArrayRef itemArray = NULL;
5106 SecKeychainItemRef item = NULL;
5107 SecIdentityRef identity = NULL;
5108 OSStatus tmpStatus, status = errSecSuccess;
5109
5110 // validate input query parameters and create the search reference
5111 SecItemParams *itemParams = _CreateSecItemParamsFromDictionary(query, &status);
5112 require_action(itemParams != NULL, error_exit, itemParams = NULL);
5113
5114 // find the next match until we hit maxMatches, or no more matches found
5115 while ( !(!itemParams->returnAllMatches && matchCount >= itemParams->maxMatches) &&
5116 SecItemSearchCopyNext(itemParams, (CFTypeRef*)&item) == errSecSuccess) {
5117
5118 if (FilterCandidateItem((CFTypeRef*)&item, itemParams, &identity))
5119 continue; // move on to next item
5120
5121 ++matchCount; // we have a match
5122
5123 tmpStatus = AddItemResults(item, identity, itemParams, allocator, &itemArray, result);
5124 if (tmpStatus && (status == errSecSuccess))
5125 status = tmpStatus;
5126
5127 if (item) {
5128 CFRelease(item);
5129 item = NULL;
5130 }
5131 if (identity) {
5132 CFRelease(identity);
5133 identity = NULL;
5134 }
5135 }
5136
5137 if (status == errSecSuccess)
5138 status = (matchCount > 0) ? errSecSuccess : errSecItemNotFound;
5139
5140 error_exit:
5141 if (status != errSecSuccess && result != NULL && *result != NULL) {
5142 CFRelease(*result);
5143 *result = NULL;
5144 }
5145 _FreeSecItemParams(itemParams);
5146
5147 return status;
5148 }
5149
5150 OSStatus
5151 SecItemCopyDisplayNames(
5152 CFArrayRef items,
5153 CFArrayRef *displayNames)
5154 {
5155 BEGIN_SECAPI
5156 Required(items);
5157 Required(displayNames);
5158 //%%%TBI
5159 return errSecUnimplemented;
5160 END_SECAPI
5161 }
5162
5163 OSStatus
5164 SecItemAdd_osx(
5165 CFDictionaryRef attributes,
5166 CFTypeRef *result)
5167 {
5168 if (!attributes)
5169 return errSecParam;
5170 else if (result)
5171 *result = NULL;
5172
5173 CFAllocatorRef allocator = CFGetAllocator(attributes);
5174 CFMutableArrayRef itemArray = NULL;
5175 SecKeychainItemRef item = NULL;
5176 OSStatus tmpStatus, status = errSecSuccess;
5177
5178 // validate input attribute parameters
5179 SecItemParams *itemParams = _CreateSecItemParamsFromDictionary(attributes, &status);
5180 require_action(itemParams != NULL, error_exit, itemParams = NULL);
5181
5182 // currently, we don't support adding SecIdentityRef items (an aggregate item class),
5183 // since the private key should already be in a keychain by definition. We could support
5184 // this as a copy operation for the private key if a different keychain is specified,
5185 // but in any case it should try to add the certificate. See <rdar://8317887>.
5186 require_action(!itemParams->returnIdentity, error_exit, status = errSecItemInvalidValue);
5187
5188 if (itemParams->useItems == NULL) {
5189
5190 require_action(itemParams->itemData == NULL || CFGetTypeID(itemParams->itemData) == CFDataGetTypeID(),
5191 error_exit, status = errSecItemInvalidValue);
5192
5193 // create a single keychain item specified by the input attributes
5194 status = SecKeychainItemCreateFromContent(itemParams->itemClass,
5195 itemParams->attrList,
5196 (itemParams->itemData) ? (UInt32)CFDataGetLength(itemParams->itemData) : 0,
5197 (itemParams->itemData) ? CFDataGetBytePtrVoid(itemParams->itemData) : NULL,
5198 itemParams->keychain,
5199 itemParams->access,
5200 &item);
5201 require_noerr(status, error_exit);
5202
5203 // return results (if requested)
5204 if (result) {
5205 itemParams->maxMatches = 1; // in case kSecMatchLimit was set to > 1
5206 tmpStatus = AddItemResults(item, NULL, itemParams, allocator, &itemArray, result);
5207 if (tmpStatus && (status == errSecSuccess))
5208 status = tmpStatus;
5209 }
5210 CFRelease(item);
5211 }
5212 else {
5213 // add multiple items which are specified in the itemParams->useItems array.
5214 // -- SecCertificateRef or SecKeyRef items may or may not be in a keychain.
5215 // -- SecKeychainItemRef items are in a keychain (by definition), but may be copied to another keychain.
5216 // -- CFDataRef items are a persistent reference; the represented item may be copied to another keychain.
5217 //
5218 OSStatus aggregateStatus = errSecSuccess;
5219 CFIndex ix, count = CFArrayGetCount(itemParams->useItems);
5220 itemParams->maxMatches = (count > 1) ? (int)count : 2; // force results to always be returned as an array
5221 for (ix=0; ix < count; ix++) {
5222 CFTypeRef anItem = (CFTypeRef) CFArrayGetValueAtIndex(itemParams->useItems, ix);
5223 if (anItem) {
5224 if (SecCertificateGetTypeID() == CFGetTypeID(anItem)) {
5225 // SecCertificateRef item
5226 tmpStatus = SecCertificateAddToKeychain((SecCertificateRef)anItem, itemParams->keychain);
5227 if (!tmpStatus && result) {
5228 tmpStatus = AddItemResults((SecKeychainItemRef)anItem, NULL, itemParams, allocator, &itemArray, result);
5229 }
5230 aggregateStatus = _UpdateAggregateStatus(tmpStatus, aggregateStatus, errSecDuplicateItem);
5231 }
5232 else if (SecKeyGetTypeID() == CFGetTypeID(anItem)) {
5233 // SecKeyRef item
5234 SecKeychainRef itemKeychain = NULL;
5235 tmpStatus = SecKeychainItemCopyKeychain((SecKeychainItemRef)anItem, &itemKeychain);
5236 if (tmpStatus == errSecSuccess) {
5237 // key was in a keychain, so we can attempt to copy it
5238 SecKeychainItemRef itemCopy = NULL;
5239 tmpStatus = SecKeychainItemCreateCopy((SecKeychainItemRef)anItem, itemParams->keychain, itemParams->access, &itemCopy);
5240 if (!tmpStatus && result) {
5241 tmpStatus = AddItemResults(itemCopy, NULL, itemParams, allocator, &itemArray, result);
5242 }
5243 if (itemCopy) {
5244 CFRelease(itemCopy);
5245 }
5246 }
5247 else {
5248 // key was not in any keychain, so must be imported
5249 SecKeychainItemRef keyItem = NULL;
5250 tmpStatus = _ImportKey((SecKeyRef)anItem, itemParams->keychain, itemParams->access, itemParams->attrList, &keyItem);
5251 if (!tmpStatus && result) {
5252 tmpStatus = AddItemResults(keyItem, NULL, itemParams, allocator, &itemArray, result);
5253 }
5254 if (keyItem) {
5255 CFRelease(keyItem);
5256 }
5257 }
5258 if (itemKeychain) {
5259 CFRelease(itemKeychain);
5260 }
5261 aggregateStatus = _UpdateAggregateStatus(tmpStatus, aggregateStatus, errSecDuplicateItem);
5262 }
5263 else if (SecKeychainItemGetTypeID() == CFGetTypeID(anItem)) {
5264 // SecKeychainItemRef item
5265 SecKeychainItemRef itemCopy = NULL;
5266 tmpStatus = SecKeychainItemCreateCopy((SecKeychainItemRef)anItem, itemParams->keychain, itemParams->access, &itemCopy);
5267 if (!tmpStatus && result) {
5268 tmpStatus = AddItemResults(itemCopy, NULL, itemParams, allocator, &itemArray, result);
5269 }
5270 if (itemCopy) {
5271 CFRelease(itemCopy);
5272 }
5273 aggregateStatus = _UpdateAggregateStatus(tmpStatus, aggregateStatus, errSecDuplicateItem);
5274 }
5275 else if (CFDataGetTypeID() == CFGetTypeID(anItem)) {
5276 // CFDataRef item (persistent reference)
5277 SecKeychainItemRef realItem = NULL;
5278 tmpStatus = SecKeychainItemCopyFromPersistentReference((CFDataRef)anItem, &realItem);
5279 if (tmpStatus == errSecSuccess) {
5280 // persistent reference resolved to a keychain item, so we can attempt to copy it
5281 SecKeychainItemRef itemCopy = NULL;
5282 tmpStatus = SecKeychainItemCreateCopy(realItem, itemParams->keychain, itemParams->access, &itemCopy);
5283 if (!tmpStatus && result) {
5284 tmpStatus = AddItemResults(itemCopy, NULL, itemParams, allocator, &itemArray, result);
5285 }
5286 if (itemCopy) {
5287 CFRelease(itemCopy);
5288 }
5289 }
5290 if (realItem) {
5291 CFRelease(realItem);
5292 }
5293 aggregateStatus = _UpdateAggregateStatus(tmpStatus, aggregateStatus, errSecDuplicateItem);
5294 }
5295 }
5296 } // end of itemList array loop
5297 status = aggregateStatus;
5298 } // end processing multiple items
5299
5300 error_exit:
5301 if (status != errSecSuccess && result != NULL && *result != NULL) {
5302 CFRelease(*result);
5303 *result = NULL;
5304 }
5305 _FreeSecItemParams(itemParams);
5306
5307 return status;
5308 }
5309
5310 OSStatus
5311 SecItemUpdate_osx(
5312 CFDictionaryRef query,
5313 CFDictionaryRef attributesToUpdate)
5314 {
5315 if (!query || !attributesToUpdate)
5316 return errSecParam;
5317
5318 // run the provided query to get a list of items to update
5319 CFTypeRef results = NULL;
5320 OSStatus status = SecItemCopyMatching_osx(query, &results);
5321 if (status != errSecSuccess)
5322 return status; // nothing was matched, or the query was bad
5323
5324 CFArrayRef items = NULL;
5325 if (CFArrayGetTypeID() == CFGetTypeID(results)) {
5326 items = (CFArrayRef) results;
5327 }
5328 else {
5329 items = CFArrayCreate(NULL, &results, 1, &kCFTypeArrayCallBacks);
5330 CFRelease(results);
5331 }
5332
5333 OSStatus result = errSecSuccess;
5334 CFIndex ix, count = CFArrayGetCount(items);
5335 for (ix=0; ix < count; ix++) {
5336 CFTypeRef anItem = (CFTypeRef) CFArrayGetValueAtIndex(items, ix);
5337 if (anItem) {
5338 status = _UpdateKeychainItem(anItem, attributesToUpdate);
5339 result = _UpdateAggregateStatus(status, result, errSecSuccess);
5340 }
5341 }
5342
5343 if (items) {
5344 CFRelease(items);
5345 }
5346 return result;
5347 }
5348
5349 OSStatus
5350 SecItemDelete_osx(
5351 CFDictionaryRef query)
5352 {
5353 if (!query)
5354 return errSecParam;
5355
5356 // run the provided query to get a list of items to delete
5357 CFTypeRef results = NULL;
5358 OSStatus status = SecItemCopyMatching_osx(query, &results);
5359 if (status != errSecSuccess)
5360 return status; // nothing was matched, or the query was bad
5361
5362 CFArrayRef items = NULL;
5363 if (CFArrayGetTypeID() == CFGetTypeID(results)) {
5364 items = (CFArrayRef) results;
5365 }
5366 else {
5367 items = CFArrayCreate(NULL, &results, 1, &kCFTypeArrayCallBacks);
5368 CFRelease(results);
5369 }
5370
5371 OSStatus result = errSecSuccess;
5372 CFIndex ix, count = CFArrayGetCount(items);
5373 for (ix=0; ix < count; ix++) {
5374 CFTypeRef anItem = (CFTypeRef) CFArrayGetValueAtIndex(items, ix);
5375 if (anItem) {
5376 if (SecIdentityGetTypeID() == CFGetTypeID(anItem)) {
5377 status = _DeleteIdentity((SecIdentityRef)anItem);
5378 }
5379 else {
5380 status = _DeleteKeychainItem(anItem);
5381 }
5382 result = _UpdateAggregateStatus(status, result, errSecSuccess);
5383 }
5384 }
5385
5386 if (items)
5387 CFRelease(items);
5388
5389 return result;
5390 }
mirror of Security