]> git.saurik.com Git - apple/security.git/blob - OSX/libsecurity_keychain/lib/SecCertificate.cpp
Security-57336.1.9.tar.gz
[apple/security.git] / OSX / libsecurity_keychain / lib / SecCertificate.cpp
1 /*
2 * Copyright (c) 2002-2015 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24 #include <Security/SecCertificate.h>
25 #include <Security/SecCertificatePriv.h>
26 #include <security_keychain/Certificate.h>
27 #include <security_keychain/Item.h>
28 #include <security_keychain/KCCursor.h>
29 #include <Security/cssmapi.h>
30 #include <Security/cssmapple.h>
31 #include <security_cdsa_client/cspclient.h>
32 #include <security_cdsa_client/clclient.h>
33 #include <security_cdsa_client/tpclient.h>
34 #include <Security/cssmtype.h>
35
36 #include "SecBridge.h"
37
38 // %%% used by SecCertificate{Copy,Set}Preference
39 #include <Security/SecKeychainItemPriv.h>
40 #include <Security/SecIdentityPriv.h>
41 #include <security_keychain/KCCursor.h>
42 #include <security_cdsa_utilities/Schema.h>
43 #include <security_cdsa_utils/cuCdsaUtils.h>
44 #include <sys/param.h>
45 #include <syslog.h>
46 #include "CertificateValues.h"
47 #include "SecCertificateP.h"
48 #include "SecCertificatePrivP.h"
49
50 #include "AppleBaselineEscrowCertificates.h"
51
52
53 SecCertificateRef SecCertificateCreateItemImplInstance(SecCertificateRef certificate);
54 OSStatus SecCertificateGetCLHandle_legacy(SecCertificateRef certificate, CSSM_CL_HANDLE *clHandle);
55 extern CSSM_KEYUSE ConvertArrayToKeyUsage(CFArrayRef usage);
56
57 #define SEC_CONST_DECL(k,v) const CFStringRef k = CFSTR(v);
58
59 SEC_CONST_DECL (kSecCertificateProductionEscrowKey, "ProductionEscrowKey");
60 SEC_CONST_DECL (kSecCertificateProductionPCSEscrowKey, "ProductionPCSEscrowKey");
61 SEC_CONST_DECL (kSecCertificateEscrowFileName, "AppleESCertificates");
62
63
64 using namespace CssmClient;
65
66 #if !SECTRUST_OSX
67 CFTypeID
68 SecCertificateGetTypeID(void)
69 {
70 BEGIN_SECAPI
71
72 return gTypes().Certificate.typeID;
73
74 END_SECAPI1(_kCFRuntimeNotATypeID)
75 }
76 #endif
77
78 /* convert a new-world SecCertificateRef to an old-world ItemImpl instance */
79 SecCertificateRef
80 SecCertificateCreateItemImplInstance(SecCertificateRef certificate)
81 {
82 #if !SECTRUST_OSX
83 return (SecCertificateRef)(certificate ? CFRetain(certificate) : NULL);
84 #else
85 if (!certificate) {
86 return NULL;
87 }
88 SecCertificateRef implCertRef = (SecCertificateRef) SecCertificateCopyKeychainItem(certificate);
89 if (implCertRef) {
90 return implCertRef;
91 }
92 CFDataRef data = SecCertificateCopyData(certificate);
93 if (!data) {
94 return NULL;
95 }
96 try {
97 CSSM_DATA cssmCertData;
98 cssmCertData.Length = (data) ? (CSSM_SIZE)CFDataGetLength(data) : 0;
99 cssmCertData.Data = (data) ? (uint8 *)CFDataGetBytePtr(data) : NULL;
100
101 SecPointer<Certificate> certificatePtr(new Certificate(cssmCertData, CSSM_CERT_X_509v3, CSSM_CERT_ENCODING_DER));
102 implCertRef = certificatePtr->handle();
103 }
104 catch (...) {}
105 CFRelease(data);
106 return implCertRef;
107 #endif
108 }
109
110 /* convert an old-world ItemImpl instance to a new-world SecCertificateRef */
111 SecCertificateRef
112 SecCertificateCreateFromItemImplInstance(SecCertificateRef certificate)
113 {
114 #if !SECTRUST_OSX
115 return (SecCertificateRef)(certificate ? CFRetain(certificate) : NULL);
116 #else
117 if (!certificate) {
118 return NULL;
119 }
120 SecCertificateRef result = NULL;
121 CFDataRef data = NULL;
122 try {
123 CssmData certData = Certificate::required(certificate)->data();
124 if (certData.Data && certData.Length) {
125 data = CFDataCreate(NULL, certData.Data, certData.Length);
126 }
127 if (!data) {
128 if (certData.Data && !certData.Length) {
129 /* zero-length certs can exist, so don't bother logging this */
130 }
131 else {
132 syslog(LOG_ERR, "WARNING: SecKeychainSearchCopyNext failed to retrieve certificate data (length=%ld, data=0x%lX)",
133 (long)certData.Length, (uintptr_t)certData.Data);
134 }
135 return NULL;
136 }
137 }
138 catch (...) {}
139
140 result = SecCertificateCreateWithKeychainItem(NULL, data, certificate);
141 if (data)
142 CFRelease(data);
143 return result;
144 #endif
145 }
146
147 /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
148 OSStatus
149 SecCertificateCreateFromData(const CSSM_DATA *data, CSSM_CERT_TYPE type, CSSM_CERT_ENCODING encoding, SecCertificateRef *certificate)
150 {
151 #if !SECTRUST_OSX
152 BEGIN_SECAPI
153
154 SecPointer<Certificate> certificatePtr(new Certificate(Required(data), type, encoding));
155 Required(certificate) = certificatePtr->handle();
156
157 END_SECAPI
158 #else
159 /* bridge to support old functionality */
160 if (!data || !data->Data || !data->Length || !certificate) {
161 return errSecParam;
162 }
163 SecCertificateRef certRef = NULL;
164 CFDataRef dataRef = CFDataCreate(NULL, data->Data, data->Length);
165 if (dataRef) {
166 certRef = SecCertificateCreateWithData(NULL, dataRef);
167 CFRelease(dataRef);
168 }
169 *certificate = certRef;
170 return (certRef) ? errSecSuccess : errSecUnknownFormat;
171 #endif
172 }
173
174 #if !SECTRUST_OSX
175 /* new in 10.6 */
176 SecCertificateRef
177 SecCertificateCreateWithData(CFAllocatorRef allocator, CFDataRef data)
178 {
179 SecCertificateRef certificate = NULL;
180 OSStatus __secapiresult;
181 try {
182 CSSM_DATA cssmCertData;
183 cssmCertData.Length = (data) ? (CSSM_SIZE)CFDataGetLength(data) : 0;
184 cssmCertData.Data = (data) ? (uint8 *)CFDataGetBytePtr(data) : NULL;
185
186 //NOTE: there isn't yet a Certificate constructor which accepts a CFAllocatorRef
187 SecPointer<Certificate> certificatePtr(new Certificate(cssmCertData, CSSM_CERT_X_509v3, CSSM_CERT_ENCODING_DER));
188 certificate = certificatePtr->handle();
189
190 __secapiresult=errSecSuccess;
191 }
192 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
193 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
194 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
195 catch (...) { __secapiresult=errSecInternalComponent; }
196 return certificate;
197 }
198 #endif
199
200 /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_3, __IPHONE_NA) */
201 OSStatus
202 SecCertificateAddToKeychain(SecCertificateRef certificate, SecKeychainRef keychain)
203 {
204 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
205 BEGIN_SECCERTAPI
206
207 Item item(Certificate::required(__itemImplRef));
208 Keychain::optional(keychain)->add(item);
209
210 END_SECCERTAPI
211 }
212
213 /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
214 OSStatus
215 SecCertificateGetData(SecCertificateRef certificate, CSSM_DATA_PTR data)
216 {
217 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
218 BEGIN_SECCERTAPI
219
220 Required(data) = Certificate::required(__itemImplRef)->data();
221
222 END_SECCERTAPI
223 }
224
225 #if !SECTRUST_OSX
226 /* new in 10.6 */
227 CFDataRef
228 SecCertificateCopyData(SecCertificateRef certificate)
229 {
230 CFDataRef data = NULL;
231 OSStatus __secapiresult = errSecSuccess;
232 try {
233 CssmData output = Certificate::required(certificate)->data();
234 CFIndex length = (CFIndex)output.length();
235 const UInt8 *bytes = (const UInt8 *)output.data();
236 if (length && bytes) {
237 data = CFDataCreate(NULL, bytes, length);
238 }
239 }
240 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
241 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
242 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
243 catch (...) { __secapiresult=errSecInternalComponent; }
244 return data;
245 }
246 #endif
247
248 #if !SECTRUST_OSX
249 CFDataRef
250 SecCertificateGetSHA1Digest(SecCertificateRef certificate)
251 {
252 CFDataRef data = NULL;
253 OSStatus __secapiresult = errSecSuccess;
254 try {
255 data = Certificate::required(certificate)->sha1Hash();
256 }
257 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
258 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
259 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
260 catch (...) { __secapiresult=errSecInternalComponent; }
261 return data;
262 }
263 #endif
264
265 #if !SECTRUST_OSX
266 CFDataRef
267 SecCertificateCopyPublicKeySHA1Digest(SecCertificateRef certificate)
268 {
269 CFDataRef data = NULL;
270 OSStatus __secapiresult = errSecSuccess;
271 try {
272 CssmData output = Certificate::required(certificate)->publicKeyHash();
273 CFIndex length = (CFIndex)output.length();
274 const UInt8 *bytes = (const UInt8 *)output.data();
275 if (length && bytes) {
276 data = CFDataCreate(NULL, bytes, length);
277 }
278 }
279 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
280 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
281 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
282 catch (...) { __secapiresult=errSecInternalComponent; }
283 return data;
284 }
285 #endif
286
287 #if !SECTRUST_OSX
288 CFArrayRef
289 SecCertificateCopyDNSNames(SecCertificateRef certificate)
290 {
291 CFArrayRef names = NULL;
292 OSStatus __secapiresult = errSecSuccess;
293 try {
294 names = Certificate::required(certificate)->copyDNSNames();
295 }
296 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
297 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
298 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
299 catch (...) { __secapiresult=errSecInternalComponent; }
300 return names;
301 }
302 #endif
303
304 /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
305 OSStatus
306 SecCertificateGetType(SecCertificateRef certificate, CSSM_CERT_TYPE *certificateType)
307 {
308 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
309 BEGIN_SECCERTAPI
310
311 Required(certificateType) = Certificate::required(__itemImplRef)->type();
312
313 END_SECCERTAPI
314 }
315
316 /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
317 OSStatus
318 SecCertificateGetSubject(SecCertificateRef certificate, const CSSM_X509_NAME **subject)
319 {
320 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
321 BEGIN_SECCERTAPI
322
323 Required(subject) = Certificate::required(__itemImplRef)->subjectName();
324
325 END_SECCERTAPI
326 }
327
328 /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
329 OSStatus
330 SecCertificateGetIssuer(SecCertificateRef certificate, const CSSM_X509_NAME **issuer)
331 {
332 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
333 BEGIN_SECCERTAPI
334
335 Required(issuer) = Certificate::required(__itemImplRef)->issuerName();
336
337 END_SECCERTAPI
338 }
339
340 /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
341 OSStatus
342 SecCertificateGetCLHandle(SecCertificateRef certificate, CSSM_CL_HANDLE *clHandle)
343 {
344 #if !SECTRUST_OSX
345 BEGIN_SECAPI
346
347 Required(clHandle) = Certificate::required(certificate)->clHandle();
348
349 END_SECAPI
350 #else
351 #if 0
352 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
353 BEGIN_SECCERTAPI
354
355 Required(clHandle) = Certificate::required(__itemImplRef)->clHandle();
356
357 END_SECCERTAPI
358 #endif
359 /* bridge code to support deprecated functionality */
360 OSStatus __secapiresult=errSecSuccess;
361 bool kcItem=true;
362 SecCertificateRef __itemImplRef=(SecCertificateRef)SecCertificateCopyKeychainItem(certificate);
363 if (!__itemImplRef) { __itemImplRef=SecCertificateCreateItemImplInstance(certificate); kcItem=false; }
364 try {
365 Required(clHandle) = Certificate::required(__itemImplRef)->clHandle();
366 }
367 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
368 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
369 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
370 catch (...) { __secapiresult=errSecInternalComponent; }
371 if (__itemImplRef) {
372 if (!kcItem) {
373 /* we can't release the temporary certificate, or the CL handle becomes invalid.
374 * for now, just stick the temporary certificate into an array.
375 * TBD: use a dictionary, indexed by hash of certificate. */
376 static CFMutableArrayRef sLegacyCertArray = NULL;
377 if (!sLegacyCertArray) {
378 sLegacyCertArray = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
379 if (!sLegacyCertArray) {
380 return errSecAllocate;
381 }
382 }
383 CFArrayAppendValue(sLegacyCertArray, __itemImplRef);
384 #ifndef NDEBUG
385 syslog(LOG_ERR, "WARNING: SecCertificateGetCLHandle called on certificate which is not in a keychain.");
386 #endif
387 }
388 CFRelease(__itemImplRef);
389 }
390 return __secapiresult;
391
392 #endif
393 }
394
395 /* private function; assumes input is old-style ItemImpl certificate reference,
396 and does not release that certificate reference!
397 */
398 OSStatus
399 SecCertificateGetCLHandle_legacy(SecCertificateRef certificate, CSSM_CL_HANDLE *clHandle)
400 {
401 BEGIN_SECAPI
402
403 Required(clHandle) = Certificate::required(certificate)->clHandle();
404
405 END_SECAPI
406 }
407
408
409 /*
410 * Private API to infer a display name for a SecCertificateRef which
411 * may or may not be in a keychain.
412 *
413 * OS X only
414 */
415 OSStatus
416 SecCertificateInferLabel(SecCertificateRef certificate, CFStringRef *label)
417 {
418 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
419 BEGIN_SECCERTAPI
420
421 Certificate::required(__itemImplRef)->inferLabel(false, &Required(label));
422
423 END_SECCERTAPI
424 }
425
426 /* OS X only (note: iOS version has different arguments and return value) */
427 OSStatus
428 SecCertificateCopyPublicKey(SecCertificateRef certificate, SecKeyRef *key)
429 {
430 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
431 BEGIN_SECCERTAPI
432
433 Required(key) = Certificate::required(__itemImplRef)->publicKey()->handle();
434
435 END_SECCERTAPI
436 }
437
438 /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
439 OSStatus
440 SecCertificateGetAlgorithmID(SecCertificateRef certificate, const CSSM_X509_ALGORITHM_IDENTIFIER **algid)
441 {
442 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
443 BEGIN_SECCERTAPI
444
445 Required(algid) = Certificate::required(__itemImplRef)->algorithmID();
446
447 END_SECCERTAPI
448 }
449
450 /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_5, __IPHONE_NA) */
451 OSStatus
452 SecCertificateCopyCommonName(SecCertificateRef certificate, CFStringRef *commonName)
453 {
454 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
455 BEGIN_SECCERTAPI
456
457 Required(commonName) = Certificate::required(__itemImplRef)->commonName();
458
459 END_SECCERTAPI
460 }
461
462 #if !SECTRUST_OSX
463 /* new in 10.6 */
464 CFStringRef
465 SecCertificateCopySubjectSummary(SecCertificateRef certificate)
466 {
467 CFStringRef summary = NULL;
468 OSStatus __secapiresult;
469 try {
470 Certificate::required(certificate)->inferLabel(false, &summary);
471
472 __secapiresult=errSecSuccess;
473 }
474 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
475 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
476 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
477 catch (...) { __secapiresult=errSecInternalComponent; }
478 return summary;
479 }
480 #endif
481
482 #if !SECTRUST_OSX
483 CFStringRef
484 SecCertificateCopyIssuerSummary(SecCertificateRef certificate)
485 {
486 CFStringRef issuerStr = NULL;
487 SecCertificateRefP certP = NULL;
488 CFDataRef certData = SecCertificateCopyData(certificate);
489 if (certData) {
490 certP = SecCertificateCreateWithDataP(NULL, certData);
491 CFRelease(certData);
492 }
493 if (certP) {
494 issuerStr = SecCertificateCopyIssuerSummaryP(certP);
495 CFRelease(certP);
496 }
497 return issuerStr;
498 }
499 #endif
500
501 /* OS X only */
502 OSStatus
503 SecCertificateCopySubjectComponent(SecCertificateRef certificate, const CSSM_OID *component, CFStringRef *result)
504 {
505 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
506 BEGIN_SECCERTAPI
507
508 Required(result) = Certificate::required(__itemImplRef)->distinguishedName(&CSSMOID_X509V1SubjectNameCStruct, component);
509
510 END_SECCERTAPI
511 }
512
513 /* OS X only; deprecated SPI */
514 OSStatus
515 SecCertificateGetCommonName(SecCertificateRef certificate, CFStringRef *commonName)
516 {
517 // deprecated SPI signature; replaced by SecCertificateCopyCommonName
518 return SecCertificateCopyCommonName(certificate, commonName);
519 }
520
521 /* OS X only; deprecated SPI */
522 OSStatus
523 SecCertificateGetEmailAddress(SecCertificateRef certificate, CFStringRef *emailAddress)
524 {
525 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
526 BEGIN_SECCERTAPI
527
528 Required(emailAddress) = Certificate::required(__itemImplRef)->copyFirstEmailAddress();
529
530 END_SECCERTAPI
531 }
532
533 /* OS X only */
534 OSStatus
535 SecCertificateCopyEmailAddresses(SecCertificateRef certificate, CFArrayRef *emailAddresses)
536 {
537 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
538 BEGIN_SECCERTAPI
539
540 Required(emailAddresses) = Certificate::required(__itemImplRef)->copyEmailAddresses();
541
542 END_SECCERTAPI
543 }
544
545 /* Return a zero terminated list of CSSM_DATA_PTR's with the values of the field specified by field.
546 * Caller must call releaseFieldValues to free the storage allocated by this call.
547 *
548 * OS X only
549 */
550 OSStatus
551 SecCertificateCopyFieldValues(SecCertificateRef certificate, const CSSM_OID *field, CSSM_DATA_PTR **fieldValues)
552 {
553 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
554 BEGIN_SECCERTAPI
555
556 Required(fieldValues) = Certificate::required(__itemImplRef)->copyFieldValues(Required(field));
557
558 END_SECCERTAPI
559 }
560
561 /* OS X only */
562 OSStatus
563 SecCertificateReleaseFieldValues(SecCertificateRef certificate, const CSSM_OID *field, CSSM_DATA_PTR *fieldValues)
564 {
565 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
566 BEGIN_SECCERTAPI
567
568 Certificate::required(__itemImplRef)->releaseFieldValues(Required(field), fieldValues);
569
570 END_SECCERTAPI
571 }
572
573 /* OS X only */
574 OSStatus
575 SecCertificateCopyFirstFieldValue(SecCertificateRef certificate, const CSSM_OID *field, CSSM_DATA_PTR *fieldValue)
576 {
577 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
578 BEGIN_SECCERTAPI
579
580 Required(fieldValue) = Certificate::required(__itemImplRef)->copyFirstFieldValue(Required(field));
581
582 END_SECCERTAPI
583 }
584
585 /* OS X only */
586 OSStatus
587 SecCertificateReleaseFirstFieldValue(SecCertificateRef certificate, const CSSM_OID *field, CSSM_DATA_PTR fieldValue)
588 {
589 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
590 BEGIN_SECCERTAPI
591
592 Certificate::required(__itemImplRef)->releaseFieldValue(Required(field), fieldValue);
593
594 END_SECCERTAPI
595 }
596
597 /* OS X only */
598 OSStatus
599 SecCertificateFindByIssuerAndSN(CFTypeRef keychainOrArray,const CSSM_DATA *issuer,
600 const CSSM_DATA *serialNumber, SecCertificateRef *certificate)
601 {
602 BEGIN_SECAPI
603
604 StorageManager::KeychainList keychains;
605 globals().storageManager.optionalSearchList(keychainOrArray, keychains);
606 Required(certificate) = Certificate::findByIssuerAndSN(keychains, CssmData::required(issuer), CssmData::required(serialNumber))->handle();
607
608 #if SECTRUST_OSX
609 // convert ItemImpl-based SecCertificateRef to new-world version before returning
610 CssmData certData = Certificate::required(*certificate)->data();
611 CFRef<CFDataRef> cfData(CFDataCreate(NULL, certData.Data, certData.Length));
612 SecCertificateRef tmpRef = *certificate;
613 *certificate = SecCertificateCreateWithData(NULL, cfData);
614 CFRelease(tmpRef);
615 #endif
616
617 END_SECAPI
618 }
619
620 /* OS X only */
621 OSStatus
622 SecCertificateFindBySubjectKeyID(CFTypeRef keychainOrArray, const CSSM_DATA *subjectKeyID,
623 SecCertificateRef *certificate)
624 {
625 BEGIN_SECAPI
626
627 StorageManager::KeychainList keychains;
628 globals().storageManager.optionalSearchList(keychainOrArray, keychains);
629 Required(certificate) = Certificate::findBySubjectKeyID(keychains, CssmData::required(subjectKeyID))->handle();
630
631 #if SECTRUST_OSX
632 // convert ItemImpl-based SecCertificateRef to new-world version before returning
633 CssmData certData = Certificate::required(*certificate)->data();
634 CFRef<CFDataRef> cfData(CFDataCreate(NULL, certData.Data, certData.Length));
635 SecCertificateRef tmpRef = *certificate;
636 *certificate = SecCertificateCreateWithData(NULL, cfData);
637 CFRelease(tmpRef);
638 #endif
639
640 END_SECAPI
641 }
642
643 /* OS X only */
644 OSStatus
645 SecCertificateFindByEmail(CFTypeRef keychainOrArray, const char *emailAddress, SecCertificateRef *certificate)
646 {
647 BEGIN_SECAPI
648
649 StorageManager::KeychainList keychains;
650 globals().storageManager.optionalSearchList(keychainOrArray, keychains);
651 Required(certificate) = Certificate::findByEmail(keychains, emailAddress)->handle();
652
653 #if SECTRUST_OSX
654 // convert ItemImpl-based SecCertificateRef to new-world version before returning
655 CssmData certData = Certificate::required(*certificate)->data();
656 CFRef<CFDataRef> cfData(CFDataCreate(NULL, certData.Data, certData.Length));
657 SecCertificateRef tmpRef = *certificate;
658 *certificate = SecCertificateCreateWithData(NULL, cfData);
659 CFRelease(tmpRef);
660 #endif
661
662 END_SECAPI
663 }
664
665 /* OS X only */
666 OSStatus
667 SecKeychainSearchCreateForCertificateByIssuerAndSN(CFTypeRef keychainOrArray, const CSSM_DATA *issuer,
668 const CSSM_DATA *serialNumber, SecKeychainSearchRef *searchRef)
669 {
670 BEGIN_SECAPI
671
672 Required(searchRef);
673
674 StorageManager::KeychainList keychains;
675 globals().storageManager.optionalSearchList(keychainOrArray, keychains);
676 KCCursor cursor(Certificate::cursorForIssuerAndSN(keychains, CssmData::required(issuer), CssmData::required(serialNumber)));
677 *searchRef = cursor->handle();
678
679 END_SECAPI
680 }
681
682 /* OS X only */
683 OSStatus
684 SecKeychainSearchCreateForCertificateByIssuerAndSN_CF(CFTypeRef keychainOrArray, CFDataRef issuer,
685 CFDataRef serialNumber, SecKeychainSearchRef *searchRef)
686 {
687 BEGIN_SECAPI
688
689 Required(searchRef);
690
691 StorageManager::KeychainList keychains;
692 globals().storageManager.optionalSearchList(keychainOrArray, keychains);
693 Required(issuer);
694 Required(serialNumber);
695 KCCursor cursor(Certificate::cursorForIssuerAndSN_CF(keychains, issuer, serialNumber));
696 *searchRef = cursor->handle();
697
698 END_SECAPI
699 }
700
701 /* OS X only */
702 OSStatus
703 SecKeychainSearchCreateForCertificateBySubjectKeyID(CFTypeRef keychainOrArray, const CSSM_DATA *subjectKeyID,
704 SecKeychainSearchRef *searchRef)
705 {
706 BEGIN_SECAPI
707
708 Required(searchRef);
709
710 StorageManager::KeychainList keychains;
711 globals().storageManager.optionalSearchList(keychainOrArray, keychains);
712 KCCursor cursor(Certificate::cursorForSubjectKeyID(keychains, CssmData::required(subjectKeyID)));
713 *searchRef = cursor->handle();
714
715 END_SECAPI
716 }
717
718 /* OS X only */
719 OSStatus
720 SecKeychainSearchCreateForCertificateByEmail(CFTypeRef keychainOrArray, const char *emailAddress,
721 SecKeychainSearchRef *searchRef)
722 {
723 BEGIN_SECAPI
724
725 Required(searchRef);
726
727 StorageManager::KeychainList keychains;
728 globals().storageManager.optionalSearchList(keychainOrArray, keychains);
729 KCCursor cursor(Certificate::cursorForEmail(keychains, emailAddress));
730 *searchRef = cursor->handle();
731
732 END_SECAPI
733 }
734
735 /* OS X only */
736 CSSM_RETURN
737 SecDigestGetData (CSSM_ALGORITHMS alg, CSSM_DATA* digest, const CSSM_DATA* data)
738 {
739 BEGIN_SECAPI
740 // sanity checking
741 if (!digest || !digest->Data || !digest->Length || !data || !data->Data || !data->Length)
742 return errSecParam;
743
744 CSP csp(gGuidAppleCSP);
745 Digest context(csp, alg);
746 CssmData input(data->Data, data->Length);
747 CssmData output(digest->Data, digest->Length);
748
749 context.digest(input, output);
750 digest->Length = output.length();
751
752 return CSSM_OK;
753 END_SECAPI1(1);
754 }
755
756 #if !SECTRUST_OSX
757 /* determine whether a cert is self-signed */
758 OSStatus SecCertificateIsSelfSigned(
759 SecCertificateRef certificate,
760 Boolean *isSelfSigned) /* RETURNED */
761 {
762 BEGIN_SECAPI
763
764 *isSelfSigned = Certificate::required(certificate)->isSelfSigned();
765
766 END_SECAPI
767 }
768 #endif
769
770 /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
771 OSStatus
772 SecCertificateCopyPreference(
773 CFStringRef name,
774 CSSM_KEYUSE keyUsage,
775 SecCertificateRef *certificate)
776 {
777 BEGIN_SECAPI
778
779 Required(name);
780 Required(certificate);
781 StorageManager::KeychainList keychains;
782 globals().storageManager.getSearchList(keychains);
783 KCCursor cursor(keychains, kSecGenericPasswordItemClass, NULL);
784
785 char idUTF8[MAXPATHLEN];
786 if (!CFStringGetCString(name, idUTF8, sizeof(idUTF8)-1, kCFStringEncodingUTF8))
787 idUTF8[0] = (char)'\0';
788 CssmData service(const_cast<char *>(idUTF8), strlen(idUTF8));
789 FourCharCode itemType = 'cprf';
790 cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecServiceItemAttr), service);
791 cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecTypeItemAttr), itemType);
792 if (keyUsage)
793 cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecScriptCodeItemAttr), (sint32)keyUsage);
794
795 Item prefItem;
796 if (!cursor->next(prefItem))
797 MacOSError::throwMe(errSecItemNotFound);
798
799 // get persistent certificate reference
800 SecKeychainAttribute itemAttrs[] = { { kSecGenericItemAttr, 0, NULL } };
801 SecKeychainAttributeList itemAttrList = { sizeof(itemAttrs) / sizeof(itemAttrs[0]), itemAttrs };
802 prefItem->getContent(NULL, &itemAttrList, NULL, NULL);
803
804 // find certificate, given persistent reference data
805 CFDataRef pItemRef = CFDataCreateWithBytesNoCopy(NULL, (const UInt8 *)itemAttrs[0].data, itemAttrs[0].length, kCFAllocatorNull);
806 SecKeychainItemRef certItemRef = nil;
807 OSStatus status = SecKeychainItemCopyFromPersistentReference(pItemRef, &certItemRef); //%%% need to make this a method of ItemImpl
808 prefItem->freeContent(&itemAttrList, NULL);
809 if (pItemRef)
810 CFRelease(pItemRef);
811 if (status)
812 return status;
813
814 *certificate = (SecCertificateRef)certItemRef;
815
816 #if SECTRUST_OSX
817 // convert ItemImpl-based SecCertificateRef to new-world version before returning
818 CssmData certData = Certificate::required(*certificate)->data();
819 CFRef<CFDataRef> cfData(CFDataCreate(NULL, certData.Data, certData.Length));
820 SecCertificateRef tmpRef = *certificate;
821 *certificate = SecCertificateCreateWithData(NULL, cfData);
822 CFRelease(tmpRef);
823 #endif
824
825 END_SECAPI
826 }
827
828 /* OS X only */
829 SecCertificateRef
830 SecCertificateCopyPreferred(
831 CFStringRef name,
832 CFArrayRef keyUsage)
833 {
834 // This function will look for a matching preference in the following order:
835 // - matches the name and the supplied key use
836 // - matches the name and the special 'ANY' key use
837 // - matches the name with no key usage constraint
838
839 SecCertificateRef certRef = NULL;
840 CSSM_KEYUSE keyUse = ConvertArrayToKeyUsage(keyUsage);
841 OSStatus status = SecCertificateCopyPreference(name, keyUse, &certRef);
842 if (status != errSecSuccess && keyUse != CSSM_KEYUSE_ANY)
843 status = SecCertificateCopyPreference(name, CSSM_KEYUSE_ANY, &certRef);
844 if (status != errSecSuccess && keyUse != 0)
845 status = SecCertificateCopyPreference(name, 0, &certRef);
846
847 return certRef;
848 }
849
850 /* OS X only; not exported */
851 static OSStatus
852 SecCertificateFindPreferenceItemWithNameAndKeyUsage(
853 CFTypeRef keychainOrArray,
854 CFStringRef name,
855 int32_t keyUsage,
856 SecKeychainItemRef *itemRef)
857 {
858 BEGIN_SECAPI
859
860 StorageManager::KeychainList keychains;
861 globals().storageManager.optionalSearchList(keychainOrArray, keychains);
862 KCCursor cursor(keychains, kSecGenericPasswordItemClass, NULL);
863
864 char idUTF8[MAXPATHLEN];
865 idUTF8[0] = (char)'\0';
866 if (name)
867 {
868 if (!CFStringGetCString(name, idUTF8, sizeof(idUTF8)-1, kCFStringEncodingUTF8))
869 idUTF8[0] = (char)'\0';
870 }
871 size_t idUTF8Len = strlen(idUTF8);
872 if (!idUTF8Len)
873 MacOSError::throwMe(errSecParam);
874
875 CssmData service(const_cast<char *>(idUTF8), idUTF8Len);
876 cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecServiceItemAttr), service);
877 cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecTypeItemAttr), (FourCharCode)'cprf');
878 if (keyUsage)
879 cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecScriptCodeItemAttr), (sint32)keyUsage);
880
881 Item item;
882 if (!cursor->next(item))
883 MacOSError::throwMe(errSecItemNotFound);
884
885 if (itemRef)
886 *itemRef=item->handle();
887
888 END_SECAPI
889 }
890
891 /* OS X only; not exported */
892 static
893 OSStatus SecCertificateDeletePreferenceItemWithNameAndKeyUsage(
894 CFTypeRef keychainOrArray,
895 CFStringRef name,
896 int32_t keyUsage)
897 {
898 // when a specific key usage is passed, we'll only match & delete that pref;
899 // when a key usage of 0 is passed, all matching prefs should be deleted.
900 // maxUsages represents the most matches there could theoretically be, so
901 // cut things off at that point if we're still finding items (if they can't
902 // be deleted for some reason, we'd never break out of the loop.)
903
904 OSStatus status;
905 SecKeychainItemRef item = NULL;
906 int count = 0, maxUsages = 12;
907 while (++count <= maxUsages &&
908 (status = SecCertificateFindPreferenceItemWithNameAndKeyUsage(keychainOrArray, name, keyUsage, &item)) == errSecSuccess) {
909 status = SecKeychainItemDelete(item);
910 CFRelease(item);
911 item = NULL;
912 }
913
914 // it's not an error if the item isn't found
915 return (status == errSecItemNotFound) ? errSecSuccess : status;
916 }
917
918 /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_5, __IPHONE_NA) */
919 OSStatus SecCertificateSetPreference(
920 SecCertificateRef certificate,
921 CFStringRef name,
922 CSSM_KEYUSE keyUsage,
923 CFDateRef date)
924 {
925 if (!name) {
926 return errSecParam;
927 }
928 if (!certificate) {
929 // treat NULL certificate as a request to clear the preference
930 // (note: if keyUsage is 0, this clears all key usage prefs for name)
931 return SecCertificateDeletePreferenceItemWithNameAndKeyUsage(NULL, name, keyUsage);
932 }
933
934 // This macro converts a new-style SecCertificateRef to an old-style ItemImpl
935 BEGIN_SECCERTAPI
936
937 // determine the account attribute
938 //
939 // This attribute must be synthesized from certificate label + pref item type + key usage,
940 // as only the account and service attributes can make a generic keychain item unique.
941 // For 'iprf' type items (but not 'cprf'), we append a trailing space. This insures that
942 // we can save a certificate preference if an identity preference already exists for the
943 // given service name, and vice-versa.
944 // If the key usage is 0 (i.e. the normal case), we omit the appended key usage string.
945 //
946 CFStringRef labelStr = nil;
947 Certificate::required(__itemImplRef)->inferLabel(false, &labelStr);
948 if (!labelStr) {
949 MacOSError::throwMe(errSecDataTooLarge); // data is "in a format which cannot be displayed"
950 }
951 CFIndex accountUTF8Len = CFStringGetMaximumSizeForEncoding(CFStringGetLength(labelStr), kCFStringEncodingUTF8) + 1;
952 const char *templateStr = "%s [key usage 0x%X]";
953 const int keyUsageMaxStrLen = 8;
954 accountUTF8Len += strlen(templateStr) + keyUsageMaxStrLen;
955 char accountUTF8[accountUTF8Len];
956 if (!CFStringGetCString(labelStr, accountUTF8, accountUTF8Len-1, kCFStringEncodingUTF8))
957 accountUTF8[0] = (char)'\0';
958 if (keyUsage)
959 snprintf(accountUTF8, accountUTF8Len-1, templateStr, accountUTF8, keyUsage);
960 CssmData account(const_cast<char *>(accountUTF8), strlen(accountUTF8));
961 CFRelease(labelStr);
962
963 // service attribute (name provided by the caller)
964 CFIndex serviceUTF8Len = CFStringGetMaximumSizeForEncoding(CFStringGetLength(name), kCFStringEncodingUTF8) + 1;;
965 char serviceUTF8[serviceUTF8Len];
966 if (!CFStringGetCString(name, serviceUTF8, serviceUTF8Len-1, kCFStringEncodingUTF8))
967 serviceUTF8[0] = (char)'\0';
968 CssmData service(const_cast<char *>(serviceUTF8), strlen(serviceUTF8));
969
970 // look for existing preference item, in case this is an update
971 StorageManager::KeychainList keychains;
972 globals().storageManager.getSearchList(keychains);
973 KCCursor cursor(keychains, kSecGenericPasswordItemClass, NULL);
974 FourCharCode itemType = 'cprf';
975 cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecServiceItemAttr), service);
976 cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecTypeItemAttr), itemType);
977 if (keyUsage)
978 cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecScriptCodeItemAttr), (sint32)keyUsage);
979 if (date)
980 ; // %%%TBI
981
982 Item item(kSecGenericPasswordItemClass, 'aapl', 0, NULL, false);
983 bool add = (!cursor->next(item));
984 // at this point, we either have a new item to add or an existing item to update
985
986 // set item attribute values
987 item->setAttribute(Schema::attributeInfo(kSecServiceItemAttr), service);
988 item->setAttribute(Schema::attributeInfo(kSecTypeItemAttr), itemType);
989 item->setAttribute(Schema::attributeInfo(kSecAccountItemAttr), account);
990 item->setAttribute(Schema::attributeInfo(kSecScriptCodeItemAttr), (sint32)keyUsage);
991 item->setAttribute(Schema::attributeInfo(kSecLabelItemAttr), service);
992
993 // date
994 if (date)
995 ; // %%%TBI
996
997 // generic attribute (store persistent certificate reference)
998 CFDataRef pItemRef = nil;
999 Certificate::required(__itemImplRef)->copyPersistentReference(pItemRef);
1000 if (!pItemRef) {
1001 MacOSError::throwMe(errSecInvalidItemRef);
1002 }
1003 const UInt8 *dataPtr = CFDataGetBytePtr(pItemRef);
1004 CFIndex dataLen = CFDataGetLength(pItemRef);
1005 CssmData pref(const_cast<void *>(reinterpret_cast<const void *>(dataPtr)), dataLen);
1006 item->setAttribute(Schema::attributeInfo(kSecGenericItemAttr), pref);
1007 CFRelease(pItemRef);
1008
1009 if (add) {
1010 Keychain keychain = nil;
1011 try {
1012 keychain = globals().storageManager.defaultKeychain();
1013 if (!keychain->exists())
1014 MacOSError::throwMe(errSecNoSuchKeychain); // Might be deleted or not available at this time.
1015 }
1016 catch(...) {
1017 keychain = globals().storageManager.defaultKeychainUI(item);
1018 }
1019
1020 try {
1021 keychain->add(item);
1022 }
1023 catch (const MacOSError &err) {
1024 if (err.osStatus() != errSecDuplicateItem)
1025 throw; // if item already exists, fall through to update
1026 }
1027 }
1028 item->update();
1029
1030 END_SECCERTAPI
1031 }
1032
1033 /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA) */
1034 OSStatus SecCertificateSetPreferred(
1035 SecCertificateRef certificate,
1036 CFStringRef name,
1037 CFArrayRef keyUsage)
1038 {
1039 CSSM_KEYUSE keyUse = ConvertArrayToKeyUsage(keyUsage);
1040 return SecCertificateSetPreference(certificate, name, keyUse, NULL);
1041 }
1042
1043 /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA) */
1044 CFDictionaryRef SecCertificateCopyValues(SecCertificateRef certificate, CFArrayRef keys, CFErrorRef *error)
1045 {
1046 CFDictionaryRef result = NULL;
1047 OSStatus __secapiresult;
1048 try
1049 {
1050 CertificateValues cv(certificate);
1051 result = cv.copyFieldValues(keys,error);
1052 __secapiresult=0;
1053 }
1054 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
1055 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
1056 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
1057 catch (...) { __secapiresult=errSecInternalComponent; }
1058 return result;
1059 }
1060
1061 /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA) */
1062 CFStringRef SecCertificateCopyLongDescription(CFAllocatorRef alloc, SecCertificateRef certificate, CFErrorRef *error)
1063 {
1064 return SecCertificateCopyShortDescription(alloc, certificate, error);
1065 }
1066
1067 /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA) */
1068 CFStringRef SecCertificateCopyShortDescription(CFAllocatorRef alloc, SecCertificateRef certificate, CFErrorRef *error)
1069 {
1070 CFStringRef result = NULL;
1071 OSStatus __secapiresult = SecCertificateInferLabel(certificate, &result);
1072 if (error!=NULL && __secapiresult!=errSecSuccess)
1073 {
1074 *error = CFErrorCreate(kCFAllocatorDefault, kCFErrorDomainOSStatus,
1075 __secapiresult ? __secapiresult : CSSM_ERRCODE_INTERNAL_ERROR, NULL);
1076 }
1077 return result;
1078 }
1079
1080 /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA) */
1081 CFDataRef SecCertificateCopySerialNumber(SecCertificateRef certificate, CFErrorRef *error)
1082 {
1083 CFDataRef result = NULL;
1084 OSStatus __secapiresult;
1085 try
1086 {
1087 CertificateValues cv(certificate);
1088 result = cv.copySerialNumber(error);
1089 __secapiresult=0;
1090 }
1091 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
1092 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
1093 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
1094 catch (...) { __secapiresult=errSecInternalComponent; }
1095 return result;
1096 }
1097
1098 /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA) */
1099 CFDataRef SecCertificateCopyNormalizedIssuerContent(SecCertificateRef certificate, CFErrorRef *error)
1100 {
1101 CFDataRef result = NULL;
1102 OSStatus __secapiresult;
1103 try
1104 {
1105 CertificateValues cv(certificate);
1106 result = cv.copyNormalizedIssuerContent(error);
1107 __secapiresult=0;
1108 }
1109 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
1110 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
1111 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
1112 catch (...) { __secapiresult=errSecInternalComponent; }
1113 return result;
1114 }
1115
1116 /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA) */
1117 CFDataRef SecCertificateCopyNormalizedSubjectContent(SecCertificateRef certificate, CFErrorRef *error)
1118 {
1119 CFDataRef result = NULL;
1120 OSStatus __secapiresult;
1121 try
1122 {
1123 CertificateValues cv(certificate);
1124 result = cv.copyNormalizedSubjectContent(error);
1125 __secapiresult=0;
1126 }
1127 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
1128 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
1129 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
1130 catch (...) { __secapiresult=errSecInternalComponent; }
1131 return result;
1132 }
1133
1134 #if !SECTRUST_OSX
1135 CFDataRef SecCertificateCopyIssuerSequence(SecCertificateRef certificate)
1136 {
1137 CFDataRef result = NULL;
1138 OSStatus __secapiresult;
1139 try
1140 {
1141 CertificateValues cv(certificate);
1142 result = cv.copyIssuerSequence(NULL);
1143 __secapiresult=0;
1144 }
1145 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
1146 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
1147 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
1148 catch (...) { __secapiresult=errSecInternalComponent; }
1149 return result;
1150 }
1151 #endif
1152
1153 #if !SECTRUST_OSX
1154 CFDataRef SecCertificateCopySubjectSequence(SecCertificateRef certificate)
1155 {
1156 CFDataRef result = NULL;
1157 OSStatus __secapiresult;
1158 try
1159 {
1160 CertificateValues cv(certificate);
1161 result = cv.copySubjectSequence(NULL);
1162 __secapiresult=0;
1163 }
1164 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
1165 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
1166 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
1167 catch (...) { __secapiresult=errSecInternalComponent; }
1168 return result;
1169 }
1170 #endif
1171
1172 #if !SECTRUST_OSX
1173 bool SecCertificateIsValid(SecCertificateRef certificate, CFAbsoluteTime verifyTime)
1174 {
1175 bool result = NULL;
1176 OSStatus __secapiresult;
1177 try
1178 {
1179 CFErrorRef error = NULL;
1180 CertificateValues cv(certificate);
1181 result = cv.isValid(verifyTime, &error);
1182 if (error) CFRelease(error);
1183 __secapiresult=0;
1184 }
1185 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
1186 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
1187 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
1188 catch (...) { __secapiresult=errSecInternalComponent; }
1189 return result;
1190 }
1191 #endif
1192
1193 /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_7, __MAC_10_9, __IPHONE_NA, __IPHONE_NA) */
1194 bool SecCertificateIsValidX(SecCertificateRef certificate, CFAbsoluteTime verifyTime)
1195 {
1196 /*
1197 * deprecated function name
1198 */
1199 return SecCertificateIsValid(certificate, verifyTime);
1200 }
1201
1202 #if !SECTRUST_OSX
1203 CFAbsoluteTime SecCertificateNotValidBefore(SecCertificateRef certificate)
1204 {
1205 CFAbsoluteTime result = 0;
1206 OSStatus __secapiresult;
1207 try
1208 {
1209 CFErrorRef error = NULL;
1210 CertificateValues cv(certificate);
1211 result = cv.notValidBefore(&error);
1212 if (error) CFRelease(error);
1213 __secapiresult=0;
1214 }
1215 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
1216 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
1217 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
1218 catch (...) { __secapiresult=errSecInternalComponent; }
1219 return result;
1220 }
1221 #endif
1222
1223 #if !SECTRUST_OSX
1224 CFAbsoluteTime SecCertificateNotValidAfter(SecCertificateRef certificate)
1225 {
1226 CFAbsoluteTime result = 0;
1227 OSStatus __secapiresult;
1228 try
1229 {
1230 CFErrorRef error = NULL;
1231 CertificateValues cv(certificate);
1232 result = cv.notValidAfter(&error);
1233 if (error) CFRelease(error);
1234 __secapiresult=0;
1235 }
1236 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
1237 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
1238 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
1239 catch (...) { __secapiresult=errSecInternalComponent; }
1240 return result;
1241 }
1242 #endif
1243
1244 #if !SECTRUST_OSX
1245 /* new in 10.8 */
1246 SecCertificateRef SecCertificateCreateWithBytes(CFAllocatorRef allocator,
1247 const UInt8 *bytes, CFIndex length)
1248 {
1249 SecCertificateRef certificate = NULL;
1250 OSStatus __secapiresult;
1251 try {
1252 CSSM_DATA cssmCertData = { (CSSM_SIZE)length, (uint8 *)bytes };
1253
1254 //NOTE: there isn't yet a Certificate constructor which accepts a CFAllocatorRef
1255 SecPointer<Certificate> certificatePtr(new Certificate(cssmCertData, CSSM_CERT_X_509v3, CSSM_CERT_ENCODING_DER));
1256 certificate = certificatePtr->handle();
1257
1258 __secapiresult=errSecSuccess;
1259 }
1260 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
1261 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
1262 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
1263 catch (...) { __secapiresult=errSecInternalComponent; }
1264 return certificate;
1265 }
1266 #endif
1267
1268 #if !SECTRUST_OSX
1269 /* new in 10.8 */
1270 CFIndex SecCertificateGetLength(SecCertificateRef certificate)
1271 {
1272 CFIndex length = 0;
1273 OSStatus __secapiresult;
1274 try {
1275 CssmData output = Certificate::required(certificate)->data();
1276 length = (CFIndex)output.length();
1277 __secapiresult=errSecSuccess;
1278 }
1279 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
1280 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
1281 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
1282 catch (...) { __secapiresult=errSecInternalComponent; }
1283 return length;
1284 }
1285 #endif
1286
1287 #if !SECTRUST_OSX
1288 /* new in 10.8 */
1289 const UInt8 *SecCertificateGetBytePtr(SecCertificateRef certificate)
1290 {
1291 const UInt8 *bytes = NULL;
1292 OSStatus __secapiresult;
1293 try {
1294 CssmData output = Certificate::required(certificate)->data();
1295 bytes = (const UInt8 *)output.data();
1296 __secapiresult=errSecSuccess;
1297 }
1298 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
1299 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
1300 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
1301 catch (...) { __secapiresult=errSecInternalComponent; }
1302 return bytes;
1303 }
1304 #endif
1305
1306 #if !SECTRUST_OSX
1307 /* not exported */
1308 static CFArrayRef CopyEscrowCertificates(SecCertificateEscrowRootType escrowRootType, CFErrorRef *error)
1309 {
1310 // Return array of CFDataRef certificates.
1311 CFArrayRef result = NULL;
1312 int iCnt;
1313 int numRoots = 0;
1314
1315 // Get the hard coded set of production roots
1316 // static struct RootRecord* kProductionEscrowRoots[] = {&kOldEscrowRootRecord, &kProductionEscrowRootRecord};
1317
1318 struct RootRecord** pEscrowRoots = NULL;
1319 switch (escrowRootType) {
1320 case kSecCertificateBaselineEscrowRoot:
1321 numRoots = kNumberOfBaseLineEscrowRoots;
1322 pEscrowRoots = kBaseLineEscrowRoots;
1323 break;
1324 case kSecCertificateProductionEscrowRoot:
1325 numRoots = kNumberOfBaseLineEscrowRoots; //%%% currently, production == baseline on OS X
1326 pEscrowRoots = kBaseLineEscrowRoots;
1327 break;
1328 case kSecCertificateBaselinePCSEscrowRoot:
1329 numRoots = kNumberOfBaseLinePCSEscrowRoots;
1330 pEscrowRoots = kBaseLinePCSEscrowRoots;
1331 break;
1332 case kSecCertificateProductionPCSEscrowRoot:
1333 numRoots = kNumberOfBaseLinePCSEscrowRoots; //%%% currently, production == baseline on OS X
1334 pEscrowRoots = kBaseLinePCSEscrowRoots;
1335 break;
1336 default:
1337 break;
1338 }
1339
1340 CFDataRef productionCerts[numRoots];
1341 struct RootRecord* pRootRecord = NULL;
1342
1343 for (iCnt = 0; pEscrowRoots != NULL && iCnt < numRoots; iCnt++)
1344 {
1345 pRootRecord = pEscrowRoots[iCnt];
1346 if (NULL != pRootRecord && pRootRecord->_length > 0 && NULL != pRootRecord->_bytes)
1347 {
1348 productionCerts[iCnt] = CFDataCreate(kCFAllocatorDefault, pRootRecord->_bytes, pRootRecord->_length);
1349 }
1350 }
1351 result = CFArrayCreate(kCFAllocatorDefault, (const void **)productionCerts, numRoots, &kCFTypeArrayCallBacks);
1352 for (iCnt = 0; iCnt < numRoots; iCnt++)
1353 {
1354 if (NULL != productionCerts[iCnt])
1355 {
1356 CFRelease(productionCerts[iCnt]);
1357 }
1358 }
1359
1360 return result;
1361 }
1362 #endif
1363
1364 #if !SECTRUST_OSX
1365 /* new in 10.9 */
1366 CFArrayRef SecCertificateCopyEscrowRoots(SecCertificateEscrowRootType escrowRootType)
1367 {
1368 CFArrayRef result = NULL;
1369 int iCnt;
1370 int numRoots = 0;
1371 CFDataRef certData = NULL;
1372
1373 // The request is for the base line certificates.
1374 // Use the hard coded data to generate the return array
1375 if (kSecCertificateBaselineEscrowRoot == escrowRootType)
1376 {
1377 // Get the hard coded set of roots
1378 numRoots = kNumberOfBaseLineEscrowRoots;
1379 SecCertificateRef baseLineCerts[numRoots];
1380 struct RootRecord* pRootRecord = NULL;
1381
1382 for (iCnt = 0; iCnt < numRoots; iCnt++)
1383 {
1384 pRootRecord = kBaseLineEscrowRoots[iCnt];
1385 if (NULL != pRootRecord && pRootRecord->_length > 0 && NULL != pRootRecord->_bytes)
1386 {
1387 certData = CFDataCreate(kCFAllocatorDefault, pRootRecord->_bytes, pRootRecord->_length);
1388 if (NULL != certData)
1389 {
1390 baseLineCerts[iCnt] = SecCertificateCreateWithData(kCFAllocatorDefault, certData);
1391 CFRelease(certData);
1392 }
1393 }
1394 }
1395 result = CFArrayCreate(kCFAllocatorDefault, (const void **)baseLineCerts, numRoots, &kCFTypeArrayCallBacks);
1396 for (iCnt = 0; iCnt < numRoots; iCnt++)
1397 {
1398 if (NULL != baseLineCerts[iCnt])
1399 {
1400 CFRelease(baseLineCerts[iCnt]);
1401 }
1402 }
1403 }
1404 // The request is for the current certificates.
1405 else
1406 {
1407 CFErrorRef error = NULL;
1408 CFArrayRef cert_datas = CopyEscrowCertificates(escrowRootType, &error);
1409 if (NULL != error || NULL == cert_datas || 0 == (numRoots = (int)CFArrayGetCount(cert_datas)))
1410 {
1411 if (NULL != error)
1412 {
1413 CFRelease(error);
1414 }
1415
1416 if (NULL != cert_datas)
1417 {
1418 CFRelease(cert_datas);
1419 }
1420 return result;
1421 }
1422
1423 SecCertificateRef assetCerts[numRoots];
1424 for (iCnt = 0; iCnt < numRoots; iCnt++)
1425 {
1426 certData = (CFDataRef)CFArrayGetValueAtIndex(cert_datas, iCnt);
1427 if (NULL != certData)
1428 {
1429 SecCertificateRef aCertRef = SecCertificateCreateWithData(kCFAllocatorDefault, certData);
1430 assetCerts[iCnt] = aCertRef;
1431 }
1432 else
1433 {
1434 assetCerts[iCnt] = NULL;
1435 }
1436 }
1437
1438 if (numRoots > 0)
1439 {
1440 result = CFArrayCreate(kCFAllocatorDefault, (const void **)assetCerts, numRoots, &kCFTypeArrayCallBacks);
1441 for (iCnt = 0; iCnt < numRoots; iCnt++)
1442 {
1443 if (NULL != assetCerts[iCnt])
1444 {
1445 CFRelease(assetCerts[iCnt]);
1446 }
1447 }
1448 }
1449 CFRelease(cert_datas);
1450 }
1451
1452 return result;
1453 }
1454 #endif
1455
1456 #if !SECTRUST_OSX
1457 /* new in 10.11 */
1458 SecSignatureHashAlgorithm SecCertificateGetSignatureHashAlgorithm(SecCertificateRef certificate)
1459 {
1460 SecSignatureHashAlgorithm result = kSecSignatureHashAlgorithmUnknown;
1461 CSSM_X509_ALGORITHM_IDENTIFIER_PTR algId = NULL;
1462 CSSM_DATA_PTR fieldValue = NULL;
1463 CSSM_OID_PTR algOID = NULL;
1464 const CSSM_OID *sigAlgOID = &CSSMOID_X509V1SignatureAlgorithm;
1465 OSStatus status;
1466
1467 status = SecCertificateCopyFirstFieldValue(certificate, sigAlgOID, &fieldValue);
1468 if (status || !fieldValue) {
1469 return result;
1470 }
1471 algId = (CSSM_X509_ALGORITHM_IDENTIFIER_PTR)fieldValue->Data;
1472 algOID = (algId) ? &algId->algorithm : NULL;
1473
1474 while (algOID) {
1475 if (!algOID->Data || !algOID->Length) {
1476 break;
1477 }
1478 /* classify the signature algorithm OID into one of our known types */
1479 if (cuCompareCssmData(algOID, &CSSMOID_ECDSA_WithSHA512) ||
1480 cuCompareCssmData(algOID, &CSSMOID_SHA512WithRSA) ||
1481 cuCompareCssmData(algOID, &CSSMOID_SHA512)) {
1482 result = kSecSignatureHashAlgorithmSHA512;
1483 break;
1484 }
1485 if (cuCompareCssmData(algOID, &CSSMOID_ECDSA_WithSHA384) ||
1486 cuCompareCssmData(algOID, &CSSMOID_SHA384WithRSA) ||
1487 cuCompareCssmData(algOID, &CSSMOID_SHA384)) {
1488 result = kSecSignatureHashAlgorithmSHA384;
1489 break;
1490 }
1491 if (cuCompareCssmData(algOID, &CSSMOID_ECDSA_WithSHA256) ||
1492 cuCompareCssmData(algOID, &CSSMOID_SHA256WithRSA) ||
1493 cuCompareCssmData(algOID, &CSSMOID_SHA256)) {
1494 result = kSecSignatureHashAlgorithmSHA256;
1495 break;
1496 }
1497 if (cuCompareCssmData(algOID, &CSSMOID_ECDSA_WithSHA224) ||
1498 cuCompareCssmData(algOID, &CSSMOID_SHA224WithRSA) ||
1499 cuCompareCssmData(algOID, &CSSMOID_SHA224)) {
1500 result = kSecSignatureHashAlgorithmSHA224;
1501 break;
1502 }
1503 if (cuCompareCssmData(algOID, &CSSMOID_ECDSA_WithSHA1) ||
1504 cuCompareCssmData(algOID, &CSSMOID_SHA1WithRSA) ||
1505 cuCompareCssmData(algOID, &CSSMOID_SHA1WithDSA) ||
1506 cuCompareCssmData(algOID, &CSSMOID_SHA1WithDSA_CMS) ||
1507 cuCompareCssmData(algOID, &CSSMOID_SHA1WithDSA_JDK) ||
1508 cuCompareCssmData(algOID, &CSSMOID_SHA1WithRSA_OIW) ||
1509 cuCompareCssmData(algOID, &CSSMOID_APPLE_FEE_SHA1) ||
1510 cuCompareCssmData(algOID, &CSSMOID_SHA1)) {
1511 result = kSecSignatureHashAlgorithmSHA1;
1512 break;
1513 }
1514 if (cuCompareCssmData(algOID, &CSSMOID_MD5WithRSA) ||
1515 cuCompareCssmData(algOID, &CSSMOID_APPLE_FEE_MD5) ||
1516 cuCompareCssmData(algOID, &CSSMOID_MD5)) {
1517 result = kSecSignatureHashAlgorithmMD5;
1518 break;
1519 }
1520 if (cuCompareCssmData(algOID, &CSSMOID_MD4WithRSA) ||
1521 cuCompareCssmData(algOID, &CSSMOID_MD4)) {
1522 result = kSecSignatureHashAlgorithmMD4;
1523 break;
1524 }
1525 if (cuCompareCssmData(algOID, &CSSMOID_MD2WithRSA) ||
1526 cuCompareCssmData(algOID, &CSSMOID_MD2)) {
1527 result = kSecSignatureHashAlgorithmMD2;
1528 break;
1529 }
1530 break;
1531 }
1532
1533 (void)SecCertificateReleaseFirstFieldValue(certificate, sigAlgOID, fieldValue);
1534
1535 return result;
1536 }
1537 #endif
1538