]> git.saurik.com Git - apple/security.git/blob - OSX/libsecurity_keychain/lib/SecKeychainItem.cpp
Security-57740.51.3.tar.gz
[apple/security.git] / OSX / libsecurity_keychain / lib / SecKeychainItem.cpp
1 /*
2 * Copyright (c) 2000-2004,2011-2016 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24 #include <Security/SecBase.h>
25 #include <Security/SecKeychainItem.h>
26 #include <Security/SecKeychainItemPriv.h>
27 #include <Security/SecCertificatePriv.h>
28 #include <Security/SecItemPriv.h>
29
30 #include <security_keychain/Keychains.h>
31 #include <security_keychain/KeyItem.h>
32 #include <security_keychain/Item.h>
33 #include <security_keychain/Certificate.h>
34 #include <security_keychain/Identity.h>
35 #include <security_keychain/KCCursor.h> // @@@ Remove this when SecKeychainItemFindFirst moves to SecKeychainSearch
36
37 #include <securityd_client/dictionary.h>
38 #include <security_cdsa_utilities/Schema.h>
39 #include <Security/cssmapplePriv.h>
40 #include <syslog.h>
41
42 #include "SecBridge.h"
43 #include "KCExceptions.h"
44 #include "Access.h"
45 #include "SecKeychainItemExtendedAttributes.h"
46
47 extern "C" Boolean SecKeyIsCDSAKey(SecKeyRef ref);
48
49 //
50 // Given a polymorphic Sec type object, return
51 // its AclBearer component.
52 // Note: Login ACLs are not hooked into this layer;
53 // modules or attachments have no Sec* layer representation.
54 //
55 static
56 RefPointer<AclBearer> aclBearer(CFTypeRef itemRef)
57 {
58 // well, exactly what kind of something are you?
59 CFTypeID id = CFGetTypeID(itemRef);
60 if (id == gTypes().ItemImpl.typeID) {
61 // keychain item. If it's in a protected group, return the group key
62 if (SSGroup group = ItemImpl::required(SecKeychainItemRef(itemRef))->group())
63 return &*group;
64 } else if (id == SecKeyGetTypeID() && SecKeyIsCDSAKey((SecKeyRef)itemRef)) {
65 // key item, return the key itself.
66 if (CssmClient::Key key = KeyItem::required(SecKeyRef(itemRef))->key())
67 return &*key;
68 } else if (id == gTypes().KeychainImpl.typeID) {
69 // keychain (this yields the database ACL)
70 //@@@ not hooked up yet
71 }
72 // Guess not. Bummer
73 MacOSError::throwMe(errSecNoAccessForItem);
74 }
75
76
77 CFTypeID
78 SecKeychainItemGetTypeID(void)
79 {
80 BEGIN_SECAPI
81
82 return gTypes().ItemImpl.typeID;
83
84 END_SECAPI1(_kCFRuntimeNotATypeID)
85 }
86
87
88 OSStatus
89 SecKeychainItemCreateFromContent(SecItemClass itemClass, SecKeychainAttributeList *attrList,
90 UInt32 length, const void *data, SecKeychainRef keychainRef,
91 SecAccessRef initialAccess, SecKeychainItemRef *itemRef)
92 {
93 BEGIN_SECAPI
94
95 KCThrowParamErrIf_(length!=0 && data==NULL);
96 Item item(itemClass, attrList, length, data);
97 if (initialAccess) {
98 item->setAccess(Access::required(initialAccess));
99 }
100 Keychain keychain = nil;
101 try
102 {
103 keychain = Keychain::optional(keychainRef);
104 if ( !keychain->exists() )
105 {
106 MacOSError::throwMe(errSecNoSuchKeychain); // Might be deleted or not available at this time.
107 }
108 }
109 catch(...)
110 {
111 keychain = globals().storageManager.defaultKeychainUI(item);
112 }
113
114 keychain->add(item);
115 if (itemRef) {
116 *itemRef = item->handle();
117 }
118
119 END_SECAPI
120 }
121
122
123 OSStatus
124 SecKeychainItemModifyContent(SecKeychainItemRef itemRef, const SecKeychainAttributeList *attrList, UInt32 length, const void *data)
125 {
126 BEGIN_SECKCITEMAPI
127
128 Item item = ItemImpl::required(__itemImplRef);
129 item->modifyContent(attrList, length, data);
130
131 END_SECKCITEMAPI
132 }
133
134
135 OSStatus
136 SecKeychainItemCopyContent(SecKeychainItemRef itemRef, SecItemClass *itemClass, SecKeychainAttributeList *attrList, UInt32 *length, void **outData)
137 {
138 BEGIN_SECKCITEMAPI
139
140 Item item = ItemImpl::required(__itemImplRef);
141 item->getContent(itemClass, attrList, length, outData);
142
143 END_SECKCITEMAPI
144 }
145
146
147 OSStatus
148 SecKeychainItemFreeContent(SecKeychainAttributeList *attrList, void *data)
149 {
150 BEGIN_SECAPI
151
152 ItemImpl::freeContent(attrList, data);
153
154 END_SECAPI
155 }
156
157
158 OSStatus
159 SecKeychainItemModifyAttributesAndData(SecKeychainItemRef itemRef, const SecKeychainAttributeList *attrList, UInt32 length, const void *data)
160 {
161 BEGIN_SECKCITEMAPI
162
163 Item item = ItemImpl::required(__itemImplRef);
164 item->modifyAttributesAndData(attrList, length, data);
165
166 END_SECKCITEMAPI
167 }
168
169
170 OSStatus
171 SecKeychainItemCopyAttributesAndData(SecKeychainItemRef itemRef, SecKeychainAttributeInfo *info, SecItemClass *itemClass, SecKeychainAttributeList **attrList, UInt32 *length, void **outData)
172 {
173 BEGIN_SECKCITEMAPI
174
175 Item item = ItemImpl::required(__itemImplRef);
176 item->getAttributesAndData(info, itemClass, attrList, length, outData);
177
178 END_SECKCITEMAPI
179 }
180
181
182 OSStatus
183 SecKeychainItemFreeAttributesAndData(SecKeychainAttributeList *attrList, void *data)
184 {
185 BEGIN_SECAPI
186
187 ItemImpl::freeAttributesAndData(attrList, data);
188
189 END_SECAPI
190 }
191
192
193 OSStatus
194 SecKeychainItemDelete(SecKeychainItemRef itemRef)
195 {
196 BEGIN_SECKCITEMAPI
197
198 Item item = ItemImpl::required(__itemImplRef);
199 Keychain keychain = item->keychain();
200 // item must be persistent.
201 KCThrowIf_( !keychain, errSecInvalidItemRef );
202
203 /*
204 * Before deleting the item, delete any existing Extended Attributes.
205 */
206 OSStatus ortn;
207 CFArrayRef attrNames = NULL;
208 ortn = SecKeychainItemCopyAllExtendedAttributes(__itemImplRef, &attrNames, NULL);
209 if(ortn == errSecSuccess) {
210 CFIndex numAttrs = CFArrayGetCount(attrNames);
211 for(CFIndex dex=0; dex<numAttrs; dex++) {
212 CFStringRef attrName = (CFStringRef)CFArrayGetValueAtIndex(attrNames, dex);
213 /* setting value to NULL ==> delete */
214 SecKeychainItemSetExtendedAttribute(__itemImplRef, attrName, NULL);
215 }
216 }
217
218 /* now delete the item */
219 keychain->deleteItem( item );
220
221 END_SECKCITEMAPI
222 }
223
224
225 OSStatus
226 SecKeychainItemCopyKeychain(SecKeychainItemRef itemRef, SecKeychainRef* keychainRef)
227 {
228 BEGIN_SECKCITEMAPI
229
230 // make sure this item has a keychain
231 Keychain kc = ItemImpl::required(__itemImplRef)->keychain();
232 if (kc == NULL)
233 {
234 MacOSError::throwMe(errSecNoSuchKeychain);
235 }
236
237 Required(keychainRef) = kc->handle();
238
239 END_SECKCITEMAPI
240 }
241
242
243 OSStatus
244 SecKeychainItemCreateCopy(SecKeychainItemRef itemRef, SecKeychainRef destKeychainRef,
245 SecAccessRef initialAccess, SecKeychainItemRef *itemCopy)
246 {
247 BEGIN_SECKCITEMAPI
248
249 Item copy = ItemImpl::required(__itemImplRef)->copyTo(Keychain::optional(destKeychainRef), Access::optional(initialAccess));
250 if (itemCopy) {
251 *itemCopy = copy->handle();
252 }
253
254 END_SECKCITEMAPI
255 }
256
257
258 OSStatus
259 SecKeychainItemGetUniqueRecordID(SecKeychainItemRef itemRef, const CSSM_DB_UNIQUE_RECORD **uniqueRecordID)
260 {
261 BEGIN_SECKCITEMAPI
262
263 Required(uniqueRecordID) = ItemImpl::required(__itemImplRef)->dbUniqueRecord();
264
265 END_SECKCITEMAPI
266 }
267
268
269 OSStatus
270 SecKeychainItemGetDLDBHandle(SecKeychainItemRef itemRef, CSSM_DL_DB_HANDLE* dldbHandle)
271 {
272 BEGIN_SECKCITEMAPI
273
274 *dldbHandle = ItemImpl::required(__itemImplRef)->keychain()->database()->handle();
275
276 END_SECKCITEMAPI
277 }
278
279 #if 0
280 static
281 OSStatus SecAccessCreateFromObject(CFTypeRef sourceRef,
282 SecAccessRef *accessRef)
283 {
284 BEGIN_SECAPI
285
286 Required(accessRef); // preflight
287 SecPointer<Access> access = new Access(*aclBearer(sourceRef));
288 *accessRef = access->handle();
289
290 END_SECAPI
291 }
292
293
294 /*!
295 */
296 static
297 OSStatus SecAccessModifyObject(SecAccessRef accessRef, CFTypeRef sourceRef)
298 {
299 BEGIN_SECAPI
300
301 Access::required(accessRef)->setAccess(*aclBearer(sourceRef), true);
302
303 END_SECAPI
304 }
305 #endif
306
307 OSStatus
308 SecKeychainItemCopyAccess(SecKeychainItemRef itemRef, SecAccessRef* accessRef)
309 {
310 BEGIN_SECKCITEMAPI
311
312 Required(accessRef); // preflight
313 SecPointer<Access> access = new Access(*aclBearer(reinterpret_cast<CFTypeRef>(__itemImplRef)));
314 *accessRef = access->handle();
315
316 END_SECKCITEMAPI
317 }
318
319
320 OSStatus
321 SecKeychainItemSetAccess(SecKeychainItemRef itemRef, SecAccessRef accessRef)
322 {
323 BEGIN_SECKCITEMAPI
324
325 Access::required(accessRef)->setAccess(*aclBearer(reinterpret_cast<CFTypeRef>(__itemImplRef)), true);
326
327 ItemImpl::required(__itemImplRef)->postItemEvent(kSecUpdateEvent);
328
329 END_SECKCITEMAPI
330 }
331
332 OSStatus SecKeychainItemSetAccessWithPassword(SecKeychainItemRef itemRef, SecAccessRef accessRef, UInt32 passwordLength, const void * password)
333 {
334 BEGIN_SECKCITEMAPI
335
336 OSStatus result;
337
338 // try to unlock the keychain with this password first
339 SecKeychainRef kc = NULL;
340 result = SecKeychainItemCopyKeychain(__itemImplRef, &kc);
341 if(!result) {
342 SecKeychainUnlock(kc, passwordLength, password, true);
343 if(kc) {
344 CFRelease(kc);
345 }
346 }
347
348 // Create some credentials with this password
349 CssmAutoData data(Allocator::standard(), password, passwordLength);
350 AclFactory::PassphraseUnlockCredentials cred(data, Allocator::standard());
351
352 Access::required(accessRef)->editAccess(*aclBearer(reinterpret_cast<CFTypeRef>(__itemImplRef)), true, cred.getAccessCredentials());
353 ItemImpl::required(itemRef)->postItemEvent (kSecUpdateEvent);
354
355 END_SECKCITEMAPI
356 }
357
358
359 /* Sets an item's data for legacy "KC" CoreServices APIs.
360 Note this version sets the data, but doesn't update the item
361 as the KC behavior dictates.
362 */
363 OSStatus SecKeychainItemSetData(SecKeychainItemRef itemRef, UInt32 length, const void* data)
364 {
365 BEGIN_SECKCITEMAPI
366
367 ItemImpl::required(__itemImplRef)->setData(length, data);
368
369 END_SECKCITEMAPI
370 }
371
372 /* Gets an item's data for legacy "KC" CoreServices APIs.
373 Note this version doesn't take a SecItemClass parameter.
374 */
375 OSStatus SecKeychainItemGetData(SecKeychainItemRef itemRef, UInt32 maxLength, void* data, UInt32* actualLength)
376 {
377 BEGIN_SECKCITEMAPI
378
379 /* The caller either needs to specify data and maxLength or an actualLength,
380 * so we return either the data itself or the actual length of the data or both.
381 */
382 if (!((data && maxLength) || actualLength)) {
383 MacOSError::throwMe(errSecParam);
384 }
385 CssmDataContainer aData;
386 ItemImpl::required(__itemImplRef)->getData(aData);
387 if (actualLength) {
388 *actualLength = (UInt32)aData.length();
389 }
390 if (data) {
391 // Make sure the buffer is big enough
392 if (aData.length() > maxLength) {
393 MacOSError::throwMe(errSecBufferTooSmall);
394 }
395 memcpy(data, aData.data(), aData.length());
396 }
397
398 END_SECKCITEMAPI
399 }
400
401 /* Update a keychain item for legacy "KC" CoreServices APIs.
402 The "KC" API's do a 'set attribute', then an 'update'.
403 */
404 OSStatus SecKeychainItemUpdate(SecKeychainItemRef itemRef)
405 {
406 BEGIN_SECKCITEMAPI
407
408 ItemImpl::required(__itemImplRef)->update();
409
410 END_SECKCITEMAPI
411 }
412
413 /* Add a 'floating' keychain item without UI for legacy "KC" CoreServices APIs.
414 */
415 OSStatus SecKeychainItemAddNoUI(SecKeychainRef keychainRef, SecKeychainItemRef itemRef)
416 {
417 BEGIN_SECKCITEMAPI
418
419 Item item = ItemImpl::required(__itemImplRef);
420 Keychain::optional(keychainRef)->add(item);
421
422 END_SECKCITEMAPI
423 }
424
425 /* Add a 'floating' keychain item to the default keychain with possible UI for legacy "KC" Carbon APIs.
426 */
427 OSStatus SecKeychainItemAdd(SecKeychainItemRef itemRef)
428 {
429 BEGIN_SECKCITEMAPI
430
431 Item item = ItemImpl::required(__itemImplRef);
432 Keychain defaultKeychain = globals().storageManager.defaultKeychainUI(item);
433 defaultKeychain->add(item);
434
435 END_SECKCITEMAPI
436 }
437
438 /* Creates a floating keychain item for legacy "KC" CoreServices APIs
439 */
440 OSStatus SecKeychainItemCreateNew(SecItemClass itemClass, OSType itemCreator, UInt32 length, const void* data, SecKeychainItemRef* itemRef)
441 {
442 BEGIN_SECAPI
443
444 RequiredParam(itemRef) = Item(itemClass, itemCreator, length, data, false)->handle();
445
446 END_SECAPI
447 }
448
449 /* Gets an individual attribute for legacy "KC" CoreServices APIs
450 */
451 OSStatus SecKeychainItemGetAttribute(SecKeychainItemRef itemRef, SecKeychainAttribute* attribute, UInt32* actualLength)
452 {
453 BEGIN_SECKCITEMAPI
454
455 ItemImpl::required(__itemImplRef)->getAttribute(RequiredParam(attribute), actualLength);
456
457 END_SECKCITEMAPI
458 }
459
460 /* Sets an individual attribute for legacy "KC" CoreServices APIs
461 */
462 OSStatus SecKeychainItemSetAttribute(SecKeychainItemRef itemRef, SecKeychainAttribute* attribute)
463 {
464 BEGIN_SECKCITEMAPI
465
466 ItemImpl::required(__itemImplRef)->setAttribute(RequiredParam(attribute));
467
468 END_SECKCITEMAPI
469 }
470
471 /* Finds a keychain item for legacy "KC" CoreServices APIs.
472 Note: This version doesn't take a SecItemClass because
473 SecKeychainSearchCreateFromAttributes() requires it.
474 @@@ This should move to SecKeychainSearch.cpp
475 */
476 OSStatus SecKeychainItemFindFirst(SecKeychainRef keychainRef, const SecKeychainAttributeList *attrList, SecKeychainSearchRef *searchRef, SecKeychainItemRef *itemRef)
477 {
478 BEGIN_SECAPI
479
480 KCCursor cursor;
481 if (keychainRef) {
482 cursor = KeychainImpl::required(keychainRef)->createCursor(attrList);
483 } else {
484 cursor = globals().storageManager.createCursor(attrList);
485 }
486
487 Item item;
488 if (!cursor->next(item))
489 return errSecItemNotFound;
490
491 *itemRef=item->handle();
492 if (searchRef) {
493 *searchRef=cursor->handle();
494 }
495
496 END_SECAPI
497 }
498
499 static OSStatus SecKeychainItemCreatePersistentReferenceFromCertificate(SecCertificateRef certRef,
500 CFDataRef *persistentItemRef, Boolean isIdentity)
501 {
502 OSStatus __secapiresult;
503 if (!certRef || !persistentItemRef) {
504 return errSecParam;
505 }
506
507 // If we already have a keychain item, we won't need to look it up by serial and issuer
508 SecKeychainItemRef kcItem = NULL;
509 if (SecCertificateIsItemImplInstance(certRef)) {
510 kcItem = (SecKeychainItemRef) CFRetain(certRef);
511 }
512 else {
513 kcItem = (SecKeychainItemRef) SecCertificateCopyKeychainItem(certRef);
514 }
515 if (kcItem) {
516 __secapiresult = errSecParam;
517 try {
518 Item item = ItemImpl::required((kcItem));
519 item->copyPersistentReference(*persistentItemRef, isIdentity);
520 __secapiresult = errSecSuccess;
521 }
522 catch(...) {}
523 CFRelease(kcItem);
524 if (__secapiresult == errSecSuccess) {
525 return __secapiresult;
526 }
527 }
528
529 // Certificate does not have a keychain item reference; look it up by serial and issuer
530 SecCertificateRef certItem = NULL;
531 if (SecCertificateIsItemImplInstance(certRef)) {
532 certItem = SecCertificateCreateFromItemImplInstance(certRef);
533 }
534 else {
535 certItem = (SecCertificateRef) CFRetain(certRef);
536 }
537
538 CFErrorRef errorRef = NULL;
539 CFDataRef serialData = SecCertificateCopySerialNumber(certItem, &errorRef);
540 if (errorRef) {
541 CFIndex err = CFErrorGetCode(errorRef);
542 CFRelease(errorRef);
543 if (serialData) { CFRelease(serialData); }
544 if (certItem) { CFRelease(certItem); }
545 return (OSStatus)err;
546 }
547 CFDataRef issuerData = SecCertificateCopyNormalizedIssuerContent(certItem, &errorRef);
548 if (errorRef) {
549 CFIndex err = CFErrorGetCode(errorRef);
550 CFRelease(errorRef);
551 if (serialData) { CFRelease(serialData); }
552 if (issuerData) { CFRelease(issuerData); }
553 if (certItem) { CFRelease(certItem); }
554 return (OSStatus)err;
555 }
556
557 try {
558 // look up ItemImpl cert in keychain by normalized issuer and serial number
559 StorageManager::KeychainList keychains;
560 globals().storageManager.optionalSearchList(NULL, keychains);
561 KCCursor cursor(Certificate::cursorForIssuerAndSN_CF(keychains, issuerData, serialData));
562 Item item;
563 if (!cursor->next(item)) {
564 MacOSError::throwMe(errSecItemNotFound);
565 }
566 item->copyPersistentReference(*persistentItemRef, false);
567 __secapiresult = errSecSuccess;
568 }
569 catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
570 catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
571 catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
572 catch (...) { __secapiresult=errSecInternalComponent; }
573
574 if (serialData)
575 CFRelease(serialData);
576 if (issuerData)
577 CFRelease(issuerData);
578 if (certItem)
579 CFRelease(certItem);
580
581 return __secapiresult;
582 }
583
584 OSStatus SecKeychainItemCreatePersistentReference(SecKeychainItemRef itemRef, CFDataRef *persistentItemRef)
585 {
586 /* We're in the unified world, where SecCertificateRef is not a SecKeychainItemRef. */
587 if (!itemRef || !persistentItemRef) {
588 return errSecParam;
589 }
590 // first, query the iOS keychain
591 {
592 const void *keys[] = { kSecValueRef, kSecReturnPersistentRef, kSecAttrNoLegacy };
593 const void *values[] = { itemRef, kCFBooleanTrue, kCFBooleanTrue };
594 CFRef<CFDictionaryRef> query = CFDictionaryCreate(kCFAllocatorDefault, keys, values,
595 sizeof(keys) / sizeof(*keys),
596 &kCFTypeDictionaryKeyCallBacks,
597 &kCFTypeDictionaryValueCallBacks);
598 OSStatus status = SecItemCopyMatching(query, (CFTypeRef *)persistentItemRef);
599 if (status == errSecSuccess) {
600 return status;
601 }
602 }
603 // otherwise, handle certificate
604 SecCertificateRef certRef = NULL;
605 CFTypeID itemType = CFGetTypeID(itemRef);
606 bool isIdentity = false;
607 if (itemType == SecIdentityGetTypeID()) {
608 SecIdentityCopyCertificate((SecIdentityRef)itemRef, &certRef);
609 isIdentity = true;
610 }
611 else if (itemType == SecCertificateGetTypeID()) {
612 certRef = (SecCertificateRef) CFRetain(itemRef);
613 }
614 if (certRef) {
615 OSStatus status = SecKeychainItemCreatePersistentReferenceFromCertificate(certRef, persistentItemRef, isIdentity);
616 CFRelease(certRef);
617 return status;
618 }
619 // otherwise, not a certificate, so proceed as usual for keychain item
620
621 BEGIN_SECAPI
622 Item item = ItemImpl::required(itemRef);
623 item->copyPersistentReference(*persistentItemRef, false);
624 END_SECAPI
625 }
626
627 OSStatus SecKeychainItemCopyFromPersistentReference(CFDataRef persistentItemRef, SecKeychainItemRef *itemRef)
628 {
629 BEGIN_SECAPI
630
631 KCThrowParamErrIf_(!persistentItemRef || !itemRef);
632 // first, query the iOS keychain
633 {
634 const void *keys[] = { kSecValuePersistentRef, kSecReturnRef, kSecAttrNoLegacy};
635 const void *values[] = { persistentItemRef, kCFBooleanTrue, kCFBooleanTrue };
636 CFRef<CFDictionaryRef> query = CFDictionaryCreate(kCFAllocatorDefault, keys, values,
637 sizeof(keys) / sizeof(*keys),
638 &kCFTypeDictionaryKeyCallBacks,
639 &kCFTypeDictionaryValueCallBacks);
640 OSStatus status = SecItemCopyMatching(query, (CFTypeRef *)itemRef);
641 if (status == errSecSuccess) {
642 return status;
643 }
644 }
645 // otherwise, proceed as usual for keychain item
646 CFTypeRef result = NULL;
647 bool isIdentityRef = false;
648 Item item = ItemImpl::makeFromPersistentReference(persistentItemRef, &isIdentityRef);
649 if (isIdentityRef) {
650 // item was stored as an identity, attempt to reconstitute it
651 SecPointer<Certificate> certificatePtr(static_cast<Certificate *>(item.get()));
652 StorageManager::KeychainList keychains;
653 globals().storageManager.optionalSearchList(NULL, keychains);
654 SecPointer<Identity> identityPtr(new Identity(keychains, certificatePtr));
655 result = identityPtr->handle();
656 KCThrowIf_( !result, errSecItemNotFound );
657 }
658 if (!result) {
659 result = item->handle();
660 }
661 *itemRef = (SecKeychainItemRef) result;
662
663 /* see if we should convert outgoing item to a unified SecCertificateRef */
664 SecItemClass tmpItemClass = Schema::itemClassFor(item->recordType());
665 if (tmpItemClass == kSecCertificateItemClass && !isIdentityRef) {
666 SecPointer<Certificate> certificate(static_cast<Certificate *>(&*item));
667 CssmData certData = certificate->data();
668 CFDataRef data = NULL;
669 if (certData.Data && certData.Length) {
670 data = CFDataCreate(NULL, certData.Data, certData.Length);
671 }
672 if (!data) {
673 *itemRef = NULL;
674 if (certData.Data && !certData.Length) {
675 syslog(LOG_ERR, "WARNING: SecKeychainItemCopyFromPersistentReference skipped a zero-length certificate (data=0x%lX)",
676 (uintptr_t)certData.Data);
677 return errSecDataNotAvailable;
678 }
679 else {
680 syslog(LOG_ERR, "WARNING: SecKeychainItemCopyFromPersistentReference failed to retrieve certificate data (length=%ld, data=0x%lX)",
681 (long)certData.Length, (uintptr_t)certData.Data);
682 return errSecInternal;
683 }
684 }
685 SecKeychainItemRef tmpRef = *itemRef;
686 *itemRef = (SecKeychainItemRef) SecCertificateCreateWithKeychainItem(NULL, data, tmpRef);
687 if (data)
688 CFRelease(data);
689 if (tmpRef)
690 CFRelease(tmpRef);
691 }
692
693 END_SECAPI
694 }
695
696 OSStatus SecKeychainItemCopyRecordIdentifier(SecKeychainItemRef itemRef, CFDataRef *recordIdentifier)
697 {
698 BEGIN_SECKCITEMAPI
699
700 CSSM_DATA data;
701 RequiredParam (recordIdentifier);
702 Item item = ItemImpl::required(__itemImplRef);
703 item->copyRecordIdentifier (data);
704 *recordIdentifier = ::CFDataCreate(kCFAllocatorDefault, (UInt8*) data.Data, data.Length);
705 free (data.Data);
706
707 END_SECKCITEMAPI
708 }
709
710 OSStatus
711 SecKeychainItemCopyFromRecordIdentifier(SecKeychainRef keychainRef,
712 SecKeychainItemRef *itemRef,
713 CFDataRef recordIdentifier)
714 {
715 BEGIN_SECAPI
716
717 // make a local Keychain reference
718 RequiredParam (keychainRef);
719 Keychain keychain = KeychainImpl::optional (keychainRef);
720 RequiredParam (itemRef);
721 RequiredParam (recordIdentifier);
722
723 Db db(keychain->database());
724
725 // make a raw database call to get the data
726 CSSM_DL_DB_HANDLE dbHandle = db.handle ();
727 CSSM_DB_UNIQUE_RECORD uniqueRecord;
728
729 // according to source, we should be able to reconsitute the uniqueRecord
730 // from the data we earlier retained
731
732 // prepare the record id
733 memset (&uniqueRecord, 0, sizeof (uniqueRecord));
734 uniqueRecord.RecordIdentifier.Data = (uint8*) CFDataGetBytePtr (recordIdentifier);
735 uniqueRecord.RecordIdentifier.Length = CFDataGetLength (recordIdentifier);
736
737 // convert this unique id to a CSSM_DB_UNIQUE_RECORD that works for the CSP/DL
738 CSSM_DB_UNIQUE_RECORD_PTR outputUniqueRecordPtr;
739 CSSM_RETURN result;
740 result = CSSM_DL_PassThrough (dbHandle, CSSM_APPLECSPDL_DB_CONVERT_RECORD_IDENTIFIER, &uniqueRecord, (void**) &outputUniqueRecordPtr);
741 KCThrowIf_(result != 0, errSecItemNotFound);
742
743 // from this, get the record type
744 CSSM_DB_RECORD_ATTRIBUTE_DATA attributeData;
745 memset (&attributeData, 0, sizeof (attributeData));
746
747 result = CSSM_DL_DataGetFromUniqueRecordId (dbHandle, outputUniqueRecordPtr, &attributeData, NULL);
748 KCThrowIf_(result != 0, errSecItemNotFound);
749 CSSM_DB_RECORDTYPE recordType = attributeData.DataRecordType;
750
751 // make the unique record item -- precursor to creation of a SecKeychainItemRef
752 DbUniqueRecord unique(db);
753 CSSM_DB_UNIQUE_RECORD_PTR *uniquePtr = unique;
754 *uniquePtr = outputUniqueRecordPtr;
755
756 unique->activate ();
757 Item item = keychain->item (recordType, unique);
758 if (itemRef)
759 {
760 *itemRef = item->handle();
761 }
762
763 END_SECAPI
764 }
765
766 OSStatus SecKeychainItemCreateFromEncryptedContent(SecItemClass itemClass,
767 UInt32 length, const void *data, SecKeychainRef keychainRef,
768 SecAccessRef initialAccess, SecKeychainItemRef *itemRef, CFDataRef *localID)
769 {
770 BEGIN_SECAPI
771
772 KCThrowParamErrIf_(length!=0 && data==NULL);
773 RequiredParam (localID);
774 RequiredParam (keychainRef);
775
776 Item item(itemClass, (uint32) 0, length, data, true);
777 if (initialAccess)
778 item->setAccess(Access::required(initialAccess));
779
780 Keychain keychain = Keychain::optional(keychainRef);
781 if (!keychain->exists())
782 {
783 MacOSError::throwMe(errSecNoSuchKeychain); // Might be deleted or not available at this time.
784 }
785
786 item->doNotEncrypt ();
787 try
788 {
789 keychain->add(item);
790 }
791 catch (const CommonError &err)
792 {
793 if (err.osStatus () == errSecNoSuchClass)
794 {
795 // the only time this should happen is if the item is a certificate (for keychain syncing)
796 if (itemClass == CSSM_DL_DB_RECORD_X509_CERTIFICATE)
797 {
798 // create the certificate relation
799 Db db(keychain->database());
800
801 db->createRelation(CSSM_DL_DB_RECORD_X509_CERTIFICATE,
802 "CSSM_DL_DB_RECORD_X509_CERTIFICATE",
803 Schema::X509CertificateSchemaAttributeCount,
804 Schema::X509CertificateSchemaAttributeList,
805 Schema::X509CertificateSchemaIndexCount,
806 Schema::X509CertificateSchemaIndexList);
807 keychain->keychainSchema()->didCreateRelation(
808 CSSM_DL_DB_RECORD_X509_CERTIFICATE,
809 "CSSM_DL_DB_RECORD_X509_CERTIFICATE",
810 Schema::X509CertificateSchemaAttributeCount,
811 Schema::X509CertificateSchemaAttributeList,
812 Schema::X509CertificateSchemaIndexCount,
813 Schema::X509CertificateSchemaIndexList);
814
815 // add the item again
816 keychain->add(item);
817 }
818 }
819 else
820 {
821 throw;
822 }
823 }
824
825 if (itemRef)
826 *itemRef = item->handle();
827
828 CSSM_DATA recordID;
829 item->copyRecordIdentifier (recordID);
830
831 *localID = CFDataCreate(kCFAllocatorDefault, (UInt8*) recordID.Data, recordID.Length);
832 free (recordID.Data);
833
834 END_SECAPI
835 }
836
837 OSStatus SecKeychainItemCopyAttributesAndEncryptedData(SecKeychainItemRef itemRef, SecKeychainAttributeInfo *info,
838 SecItemClass *itemClass, SecKeychainAttributeList **attrList,
839 UInt32 *length, void **outData)
840 {
841 BEGIN_SECKCITEMAPI
842
843 Item item = ItemImpl::required(__itemImplRef);
844 item->doNotEncrypt ();
845 item->getAttributesAndData(info, itemClass, attrList, length, outData);
846
847 END_SECKCITEMAPI
848 }
849
850 OSStatus SecKeychainItemModifyEncryptedData(SecKeychainItemRef itemRef, UInt32 length, const void *data)
851 {
852 BEGIN_SECKCITEMAPI
853
854 Item item = ItemImpl::required(__itemImplRef);
855 item->doNotEncrypt ();
856 item->modifyAttributesAndData(NULL, length, data);
857
858 END_SECKCITEMAPI
859 }