OSX/utilities/src/SecAKSWrappers.h

   1 /*
   2  * Copyright (c) 2013-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 #ifndef _SECAKSWRAPPERS_H_
  26 #define _SECAKSWRAPPERS_H_
  27
  28 #include <TargetConditionals.h>
  29 #include <utilities/SecCFError.h>
  30 #include <AssertMacros.h>
  31 #include <dispatch/dispatch.h>
  32
  33 #include <CoreFoundation/CFData.h>
  34
  35 #if TARGET_OS_SIMULATOR
  36 #define TARGET_HAS_KEYSTORE 0
  37 #elif TARGET_OS_MAC && !(TARGET_CPU_X86)
  38 #define TARGET_HAS_KEYSTORE 1
  39 #elif TARGET_OS_EMBEDDED
  40 #define TARGET_HAS_KEYSTORE 1
  41 #else /* no keystore on this platform */
  42 #define TARGET_HAS_KEYSTORE 0
  43 #endif
  44
  45 #if !TARGET_HAS_KEYSTORE
  46
  47 #include <IOKit/IOReturn.h>
  48
  49 // Make the compiler happy so this will compile.
  50 #define device_keybag_handle 0
  51 #define session_keybag_handle 0
  52
  53 #define bad_keybag_handle -1
  54
  55 enum keybag_state {
  56     keybag_state_unlocked = 0,
  57     keybag_state_locked = 1 << 0,
  58     keybag_state_no_pin = 1 << 1,
  59     keybag_state_been_unlocked = 1 << 2,
  60 };
  61 typedef uint32_t keybag_state_t;
  62 typedef int32_t keybag_handle_t;
  63
  64 static kern_return_t aks_get_lock_state(keybag_handle_t handle, keybag_state_t *state) {
  65     if (state) *state = keybag_state_no_pin & keybag_state_been_unlocked;
  66     return kIOReturnSuccess;
  67 }
  68
  69 #else
  70
  71 #include <libaks.h>
  72
  73 #endif
  74
  75 //
  76 // MARK: User lock state
  77 //
  78
  79 enum {
  80     user_keybag_handle = TARGET_OS_EMBEDDED ? device_keybag_handle : session_keybag_handle,
  81 };
  82
  83 extern const char * const kUserKeybagStateChangeNotification;
  84
  85 static inline bool SecAKSGetLockedState(keybag_state_t *state, CFErrorRef* error)
  86 {
  87     kern_return_t status = aks_get_lock_state(user_keybag_handle, state);
  88
  89     return SecKernError(status, error, CFSTR("aks_get_lock_state failed: %d"), status);
  90 }
  91
  92 // returns true if any of the bits in bits is set in the current state of the user bag
  93 static inline bool SecAKSLockedAnyStateBitIsSet(bool* isSet, keybag_state_t bits, CFErrorRef* error)
  94 {
  95     keybag_state_t state;
  96     bool success = SecAKSGetLockedState(&state, error);
  97
  98     require_quiet(success, exit);
  99
 100     if (isSet)
 101         *isSet = (state & bits);
 102
 103 exit:
 104     return success;
 105
 106 }
 107
 108 static inline bool SecAKSGetIsLocked(bool* isLocked, CFErrorRef* error)
 109 {
 110     return SecAKSLockedAnyStateBitIsSet(isLocked, keybag_state_locked, error);
 111 }
 112
 113 static inline bool SecAKSGetIsUnlocked(bool* isUnlocked, CFErrorRef* error)
 114 {
 115     bool isLocked = false;
 116     bool success = SecAKSGetIsLocked(&isLocked, error);
 117
 118     if (success && isUnlocked)
 119         *isUnlocked = !isLocked;
 120
 121     return success;
 122 }
 123
 124 static inline bool SecAKSGetHasBeenUnlocked(bool* hasBeenUnlocked, CFErrorRef* error)
 125 {
 126     return SecAKSLockedAnyStateBitIsSet(hasBeenUnlocked, keybag_state_been_unlocked, error);
 127 }
 128
 129 bool SecAKSDoWhileUserBagLocked(CFErrorRef *error, dispatch_block_t action);
 130
 131 //
 132 // if you can't use the block version above, use these.
 133 // !!!!!Remember to balance them!!!!!!
 134 //
 135 bool SecAKSUnLockUserKeybag(CFErrorRef *error);
 136 bool SecAKSLockUserKeybag(uint64_t timeout, CFErrorRef *error);
 137
 138
 139 CFDataRef SecAKSCopyBackupBagWithSecret(size_t size, uint8_t *secret, CFErrorRef *error);
 140
 141 #endif