cdsa/cdsa_utilities/acl_protectedpw.cpp

   1 /*
   2  * Copyright (c) 2000-2001 Apple Computer, Inc. All Rights Reserved.
   3  *
   4  * The contents of this file constitute Original Code as defined in and are
   5  * subject to the Apple Public Source License Version 1.2 (the 'License').
   6  * You may not use this file except in compliance with the License. Please obtain
   7  * a copy of the License at http://www.apple.com/publicsource and read it before
   8  * using this file.
   9  *
  10  * This Original Code and all software distributed under the License are
  11  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
  12  * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
  13  * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
  14  * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
  15  * specific language governing rights and limitations under the License.
  16  */
  17
  18
  19 //
  20 // acl_protectedpw - protected-path password-based ACL subject types.
  21 //
  22 #ifdef __MWERKS__
  23 #define _CPP_ACL_PASSWORD
  24 #endif
  25
  26 #include <Security/acl_protectedpw.h>
  27 #include <Security/debugging.h>
  28 #include <algorithm>
  29
  30
  31 //
  32 // Construct a password ACL subject
  33 //
  34 ProtectedPasswordAclSubject::ProtectedPasswordAclSubject(CssmAllocator &alloc, const CssmData &password)
  35     : SimpleAclSubject(CSSM_ACL_SUBJECT_TYPE_PROTECTED_PASSWORD, CSSM_SAMPLE_TYPE_PROTECTED_PASSWORD),
  36     allocator(alloc), mPassword(alloc, password)
  37 { }
  38
  39 ProtectedPasswordAclSubject::ProtectedPasswordAclSubject(CssmAllocator &alloc, CssmManagedData &password)
  40     : SimpleAclSubject(CSSM_ACL_SUBJECT_TYPE_PROTECTED_PASSWORD, CSSM_SAMPLE_TYPE_PROTECTED_PASSWORD),
  41     allocator(alloc), mPassword(alloc, password)
  42 { }
  43
  44
  45 //
  46 // Validate a credential set against this subject
  47 //
  48 bool ProtectedPasswordAclSubject::validate(const AclValidationContext &context,
  49     const TypedList &sample) const
  50 {
  51     if (sample.length() == 1) {
  52         return true;    //@@@ validate against PP
  53     } else if (sample.length() == 2 && sample[1].type() == CSSM_LIST_ELEMENT_DATUM) {
  54         const CssmData &password = sample[1];
  55         return password == mPassword;
  56     } else
  57                 CssmError::throwMe(CSSM_ERRCODE_INVALID_SAMPLE_VALUE);
  58 }
  59
  60
  61 //
  62 // Make a copy of this subject in CSSM_LIST form
  63 //
  64 CssmList ProtectedPasswordAclSubject::toList(CssmAllocator &alloc) const
  65 {
  66     // the password itself is private and not exported to CSSM
  67         return TypedList(alloc, CSSM_ACL_SUBJECT_TYPE_PROTECTED_PASSWORD);
  68 }
  69
  70
  71 //
  72 // Create a ProtectedPasswordAclSubject
  73 //
  74 ProtectedPasswordAclSubject *ProtectedPasswordAclSubject::Maker::make(const TypedList &list) const
  75 {
  76     CssmAutoData password(CssmAllocator::standard(CssmAllocator::sensitive));
  77     if (list.length() == 1) {
  78         char pass[] = "secret";
  79         CssmData password = CssmData::wrap(pass, 6);            //@@@ get password from PP
  80         return new ProtectedPasswordAclSubject(CssmAllocator::standard(CssmAllocator::sensitive), password);
  81     } else {
  82         ListElement *password;
  83         crack(list, 1, &password, CSSM_LIST_ELEMENT_DATUM);
  84         return new ProtectedPasswordAclSubject(CssmAllocator::standard(CssmAllocator::sensitive), *password);
  85     }
  86 }
  87
  88 ProtectedPasswordAclSubject *ProtectedPasswordAclSubject::Maker::make(Version,
  89         Reader &pub, Reader &priv) const
  90 {
  91     CssmAllocator &alloc = CssmAllocator::standard(CssmAllocator::sensitive);
  92         const void *data; uint32 length; priv.countedData(data, length);
  93         return new ProtectedPasswordAclSubject(alloc, CssmAutoData(alloc, data, length));
  94 }
  95
  96
  97 //
  98 // Export the subject to a memory blob
  99 //
 100 void ProtectedPasswordAclSubject::exportBlob(Writer::Counter &pub, Writer::Counter &priv)
 101 {
 102         priv.countedData(mPassword);
 103 }
 104
 105 void ProtectedPasswordAclSubject::exportBlob(Writer &pub, Writer &priv)
 106 {
 107         priv.countedData(mPassword);
 108 }
 109
 110
 111 #ifdef DEBUGDUMP
 112
 113 void ProtectedPasswordAclSubject::debugDump() const
 114 {
 115         Debug::dump("Protected Password ");
 116         Debug::dumpData(mPassword.data(), mPassword.length());
 117 }
 118
 119 #endif //DEBUGDUMP