OSX/libsecurity_cdsa_client/lib/securestorage.cpp

   1 /*
   2  * Copyright (c) 2000-2001,2011-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * The contents of this file constitute Original Code as defined in and are
   5  * subject to the Apple Public Source License Version 1.2 (the 'License').
   6  * You may not use this file except in compliance with the License. Please obtain
   7  * a copy of the License at http://www.apple.com/publicsource and read it before
   8  * using this file.
   9  *
  10  * This Original Code and all software distributed under the License are
  11  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS
  12  * OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT
  13  * LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
  14  * PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the
  15  * specific language governing rights and limitations under the License.
  16  */
  17
  18
  19 #include "securestorage.h"
  20 #include <security_cdsa_client/genkey.h>
  21 //#include <Security/Access.h> //@@@CONV
  22 #include <security_utilities/osxcode.h>
  23 #include <memory>
  24
  25 using namespace CssmClient;
  26 //using namespace KeychainCore;
  27
  28 //
  29 // Manage CSPDL attachments
  30 //
  31 CSPDLImpl::CSPDLImpl(const Guid &guid)
  32 : CSPImpl(Cssm::standard()->autoModule(guid)),
  33 DLImpl(CSPImpl::module())
  34 {
  35 }
  36
  37 CSPDLImpl::CSPDLImpl(const Module &module)
  38 : CSPImpl(module),
  39 DLImpl(module)
  40 {
  41 }
  42
  43 CSPDLImpl::~CSPDLImpl()
  44 try
  45 {
  46 }
  47 catch (...)
  48 {
  49     return;     // Prevent re-throw of exception [function-try-block]
  50 }
  51
  52 Allocator &CSPDLImpl::allocator() const
  53 {
  54         DLImpl::allocator(); return CSPImpl::allocator();
  55 }
  56
  57 void CSPDLImpl::allocator(Allocator &alloc)
  58 {
  59         CSPImpl::allocator(alloc); DLImpl::allocator(alloc);
  60 }
  61
  62 bool CSPDLImpl::operator <(const CSPDLImpl &other) const
  63 {
  64         return (static_cast<const CSPImpl &>(*this) < static_cast<const CSPImpl &>(other) ||
  65                         (!(static_cast<const CSPImpl &>(other) < static_cast<const CSPImpl &>(*this))
  66                            && static_cast<const DLImpl &>(*this) < static_cast<const DLImpl &>(other)));
  67 }
  68
  69 bool CSPDLImpl::operator ==(const CSPDLImpl &other) const
  70 {
  71         return (static_cast<const CSPImpl &>(*this) == static_cast<const CSPImpl &>(other)
  72                         && static_cast<const DLImpl &>(*this) == static_cast<const DLImpl &>(other));
  73 }
  74
  75 CSSM_SERVICE_MASK CSPDLImpl::subserviceMask() const
  76 {
  77         return CSPImpl::subserviceType() | DLImpl::subserviceType();
  78 }
  79
  80 void CSPDLImpl::subserviceId(uint32 id)
  81 {
  82         CSPImpl::subserviceId(id); DLImpl::subserviceId(id);
  83 }
  84
  85
  86 //
  87 // Secure storage
  88 //
  89 SSCSPDLImpl::SSCSPDLImpl(const Guid &guid) : CSPDLImpl::CSPDLImpl(guid)
  90 {
  91 }
  92
  93 SSCSPDLImpl::SSCSPDLImpl(const Module &module) : CSPDLImpl::CSPDLImpl(module)
  94 {
  95 }
  96
  97 SSCSPDLImpl::~SSCSPDLImpl()
  98 {
  99 }
 100
 101 DbImpl *
 102 SSCSPDLImpl::newDb(const char *inDbName, const CSSM_NET_ADDRESS *inDbLocation)
 103 {
 104         return new SSDbImpl(SSCSPDL(this), inDbName, inDbLocation);
 105 }
 106
 107
 108 //
 109 // SSDbImpl -- Secure Storage Database Implementation
 110 //
 111 SSDbImpl::SSDbImpl(const SSCSPDL &cspdl, const char *inDbName,
 112                                    const CSSM_NET_ADDRESS *inDbLocation)
 113 : DbImpl(cspdl, inDbName, inDbLocation)
 114 {
 115 }
 116
 117 SSDbImpl::~SSDbImpl()
 118 {
 119 }
 120
 121 void
 122 SSDbImpl::create()
 123 {
 124         DbImpl::create();
 125 }
 126
 127 void
 128 SSDbImpl::open()
 129 {
 130         DbImpl::open();
 131 }
 132
 133 DbUniqueRecord
 134 SSDbImpl::insert(CSSM_DB_RECORDTYPE recordType,
 135                  const CSSM_DB_RECORD_ATTRIBUTE_DATA *attributes,
 136                  const CSSM_DATA *data)
 137 {
 138     return DbImpl::insert(recordType, attributes, data);
 139 }
 140
 141 SSDbUniqueRecord
 142 SSDbImpl::ssInsert(CSSM_DB_RECORDTYPE recordType,
 143                                  const CSSM_DB_RECORD_ATTRIBUTE_DATA *attributes,
 144                                  const CSSM_DATA *data,
 145                                  const CSSM_RESOURCE_CONTROL_CONTEXT *rc)
 146 {
 147         // Get the handle of the DL underlying this CSPDL.
 148         CSSM_DL_DB_HANDLE dldbh;
 149         passThrough(CSSM_APPLECSPDL_DB_GET_HANDLE, NULL,
 150                 reinterpret_cast<void **>(&dldbh));
 151
 152         // Turn off autocommit on the underlying DL and remember the old state.
 153         CSSM_BOOL autoCommit = CSSM_TRUE;
 154         check(CSSM_DL_PassThrough(dldbh, CSSM_APPLEFILEDL_TOGGLE_AUTOCOMMIT,
 155                 0, reinterpret_cast<void **>(&autoCommit)));
 156         SSGroup group(SSDb(this), rc);
 157         const CSSM_ACCESS_CREDENTIALS *cred = rc ? rc->AccessCred : NULL;
 158         try
 159         {
 160                 SSDbUniqueRecord ssdbur = ssInsert(recordType, attributes, data, group, cred);
 161                 if (autoCommit)
 162                 {
 163                         // autoCommit was on so commit now that we are done and turn
 164                         // it back on.
 165                         check(CSSM_DL_PassThrough(dldbh, CSSM_APPLEFILEDL_COMMIT, NULL, NULL));
 166                         CSSM_DL_PassThrough(dldbh, CSSM_APPLEFILEDL_TOGGLE_AUTOCOMMIT,
 167                                 reinterpret_cast<const void *>(autoCommit), NULL);
 168                 }
 169         return ssdbur;
 170         }
 171         catch(...)
 172         {
 173                 try { group->deleteKey(cred); } catch (...) {}
 174                 if (autoCommit)
 175                 {
 176                         // autoCommit was off so rollback since we failed and turn
 177                         // autoCommit back on.
 178                         CSSM_DL_PassThrough(dldbh, CSSM_APPLEFILEDL_ROLLBACK, NULL, NULL);
 179                         CSSM_DL_PassThrough(dldbh, CSSM_APPLEFILEDL_TOGGLE_AUTOCOMMIT,
 180                                 reinterpret_cast<const void *>(autoCommit), NULL);
 181                 }
 182                 throw;
 183         }
 184 }
 185
 186 SSDbUniqueRecord
 187 SSDbImpl::ssInsert(CSSM_DB_RECORDTYPE recordType,
 188                                  const CSSM_DB_RECORD_ATTRIBUTE_DATA *attributes,
 189                                  const CSSM_DATA *data, const SSGroup &group,
 190                                  const CSSM_ACCESS_CREDENTIALS *cred)
 191 {
 192         // Create an encoded dataBlob for this item.
 193         CssmDataContainer dataBlob(allocator());
 194         group->encodeDataBlob(data, cred, dataBlob);
 195
 196         // Insert the record with the new juicy dataBlob.
 197         return SSDbUniqueRecord(safe_cast<SSDbUniqueRecordImpl *>
 198             (&(*DbImpl::insert(recordType, attributes, &dataBlob))));
 199 }
 200
 201
 202 // DbCursorMaker
 203 DbCursorImpl *
 204 SSDbImpl::newDbCursor(const CSSM_QUERY &query, Allocator &allocator)
 205 {
 206         return new SSDbCursorImpl(Db(this), query, allocator);
 207 }
 208
 209 DbCursorImpl *
 210 SSDbImpl::newDbCursor(uint32 capacity, Allocator &allocator)
 211 {
 212         return new SSDbCursorImpl(Db(this), capacity, allocator);
 213 }
 214
 215
 216 // SSDbUniqueRecordMaker
 217 DbUniqueRecordImpl *
 218 SSDbImpl::newDbUniqueRecord()
 219 {
 220         return new SSDbUniqueRecordImpl(Db(this));
 221 }
 222
 223
 224 //
 225 // SSGroup -- Group key with acl, used to protect a group of items.
 226 //
 227 // @@@ Get this from a shared spot.
 228 CSSM_DB_NAME_ATTR(SSGroupImpl::kLabel, 6, (char*) "Label", 0, NULL, BLOB);
 229
 230 // Create a new group.
 231 SSGroupImpl::SSGroupImpl(const SSDb &ssDb,
 232                                                  const CSSM_RESOURCE_CONTROL_CONTEXT *credAndAclEntry)
 233 : KeyImpl(ssDb->csp()), mLabel(ssDb->allocator())
 234 {
 235         mLabel.Length = kLabelSize;
 236         mLabel.Data = reinterpret_cast<uint8 *>
 237                 (mLabel.mAllocator.malloc(mLabel.Length));
 238
 239         // Get our csp and set up a random number generation context.
 240         CSP csp(this->csp());
 241         Random random(csp, CSSM_ALGID_APPLE_YARROW);
 242
 243         // Generate a kLabelSize byte random number that will be the label of
 244         // the key which we store in the dataBlob.
 245         random.generate(mLabel, (uint32)mLabel.Length);
 246
 247         // Overwrite the first 4 bytes with the magic cookie for a group.
 248         reinterpret_cast<uint32 *>(mLabel.Data)[0] = h2n(uint32(kGroupMagic));
 249
 250         // @@@ Ensure that the label is unique (Chance of collision is 2^80 --
 251         // birthday paradox).
 252
 253         // Generate a permanent 3DES key that we will use to encrypt the data.
 254         GenerateKey genKey(csp, CSSM_ALGID_3DES_3KEY, 192);
 255         genKey.database(ssDb);
 256
 257         // Set the acl of the key correctly here
 258         genKey.rcc(credAndAclEntry);
 259
 260         // Generate the key
 261         genKey(*this, KeySpec(CSSM_KEYUSE_ENCRYPT|CSSM_KEYUSE_DECRYPT,
 262                                                   CSSM_KEYATTR_PERMANENT|CSSM_KEYATTR_SENSITIVE,
 263                                                   mLabel));
 264
 265         // Activate ourself so CSSM_FreeKey will get called when we go out of
 266         // scope.
 267         activate();
 268 }
 269
 270 // Lookup an existing group based on a dataBlob.
 271 SSGroupImpl::SSGroupImpl(const SSDb &ssDb, const CSSM_DATA &dataBlob)
 272 : KeyImpl(ssDb->csp()), mLabel(ssDb->allocator())
 273 {
 274         if (dataBlob.Length < kLabelSize + kIVSize)
 275                 CssmError::throwMe(CSSMERR_DL_RECORD_NOT_FOUND); // Not a SS record
 276
 277         mLabel = CssmData(dataBlob.Data, kLabelSize);
 278         if (*reinterpret_cast<const uint32 *>(mLabel.Data) != h2n (uint32(kGroupMagic)))
 279                 CssmError::throwMe(CSSMERR_DL_RECORD_NOT_FOUND); // Not a SS record
 280
 281         // Look up the symmetric key with that label.
 282         DbCursor cursor(new DbDbCursorImpl(ssDb, 0, Allocator::standard()));
 283         cursor->recordType(CSSM_DL_DB_RECORD_SYMMETRIC_KEY);
 284         cursor->add(CSSM_DB_EQUAL, kLabel, mLabel);
 285
 286         DbUniqueRecord keyId;
 287         CssmDataContainer keyData(ssDb->allocator());
 288         if (!cursor->next(NULL, &keyData, keyId))
 289                 CssmError::throwMe(CSSMERR_DL_RECORD_NOT_FOUND); // The key can't be found
 290
 291         // Set the key part of ourself.
 292         static_cast<CSSM_KEY &>(*this) =
 293                 *reinterpret_cast<const CSSM_KEY *>(keyData.Data);
 294
 295         // Activate ourself so CSSM_FreeKey will get called when we go out of
 296         // scope.
 297         activate();
 298 }
 299
 300 bool
 301 SSGroupImpl::isGroup(const CSSM_DATA &dataBlob)
 302 {
 303         return dataBlob.Length >= kLabelSize + kIVSize
 304                 && *reinterpret_cast<const uint32 *>(dataBlob.Data) == h2n(uint32(kGroupMagic));
 305 }
 306
 307 const CssmData
 308 SSGroupImpl::label() const
 309 {
 310         return mLabel;
 311 }
 312
 313 void
 314 SSGroupImpl::decodeDataBlob(const CSSM_DATA &dataBlob,
 315                                                         const CSSM_ACCESS_CREDENTIALS *cred,
 316                                                         Allocator &allocator, CSSM_DATA &data)
 317 {
 318         // First get the IV and the cipherText from the blob.
 319         CssmData iv(&dataBlob.Data[kLabelSize], kIVSize);
 320         CssmData cipherText(&dataBlob.Data[kLabelSize + kIVSize],
 321                                                 dataBlob.Length - (kLabelSize + kIVSize));
 322
 323         CssmDataContainer plainText1(allocator);
 324         CssmDataContainer plainText2(allocator);
 325         // Decrypt the data
 326         // @@@ Don't use staged decrypt once the AppleCSPDL can do combo
 327         // encryption.
 328         // Setup decryption context
 329         Decrypt decrypt(csp(), algorithm());
 330         decrypt.mode(CSSM_ALGMODE_CBCPadIV8);
 331         decrypt.padding(CSSM_PADDING_PKCS1);
 332         decrypt.initVector(iv);
 333         decrypt.key(Key(this));
 334         decrypt.cred(AccessCredentials::overlay(cred));
 335         decrypt.decrypt(&cipherText, 1, &plainText1, 1);
 336         decrypt.final(plainText2);
 337
 338         // Use DL allocator for allocating memory for data.
 339         CSSM_SIZE length = plainText1.Length + plainText2.Length;
 340         data.Data = allocator.alloc<uint8>((UInt32)length);
 341         data.Length = length;
 342         memcpy(data.Data, plainText1.Data, plainText1.Length);
 343         memcpy(&data.Data[plainText1.Length], plainText2.Data, plainText2.Length);
 344 }
 345
 346 void
 347 SSGroupImpl::encodeDataBlob(const CSSM_DATA *data,
 348                                                         const CSSM_ACCESS_CREDENTIALS *cred,
 349                                                         CssmDataContainer &dataBlob)
 350 {
 351         // Get our csp and set up a random number generation context.
 352         CSP csp(this->csp());
 353         Random random(csp, CSSM_ALGID_APPLE_YARROW);
 354
 355         // Encrypt data using key and encode it in a dataBlob.
 356
 357         // First calculate a random IV.
 358         uint8 ivBuf[kIVSize];
 359         CssmData iv(ivBuf, kIVSize);
 360         random.generate(iv, kIVSize);
 361
 362         // Setup encryption context
 363         Encrypt encrypt(csp, algorithm());
 364         encrypt.mode(CSSM_ALGMODE_CBCPadIV8);
 365         encrypt.padding(CSSM_PADDING_PKCS1);
 366         encrypt.initVector(iv);
 367         encrypt.key(Key(this));
 368         encrypt.cred(AccessCredentials::overlay(cred));
 369
 370         // Encrypt the data
 371         const CssmData nothing;
 372         const CssmData *plainText = data ? CssmData::overlay(data) : &nothing;
 373         // @@@ Don't use staged encrypt once the AppleCSPDL can do combo
 374         // encryption.
 375         CssmDataContainer cipherText1, cipherText2;
 376         encrypt.encrypt(plainText, 1, &cipherText1, 1);
 377         encrypt.final(cipherText2);
 378
 379         // Create a dataBlob containing the label followed by the IV followed
 380         // by the cipherText.
 381         CSSM_SIZE length = (kLabelSize + kIVSize
 382                                          + cipherText1.Length + cipherText2.Length);
 383         dataBlob.Data = dataBlob.mAllocator.alloc<uint8>((UInt32)length);
 384         dataBlob.Length = length;
 385         memcpy(dataBlob.Data, mLabel.Data, kLabelSize);
 386         memcpy(&dataBlob.Data[kLabelSize], iv.Data, kIVSize);
 387         memcpy(&dataBlob.Data[kLabelSize + kIVSize],
 388                    cipherText1.Data, cipherText1.Length);
 389         memcpy(&dataBlob.Data[kLabelSize + kIVSize + cipherText1.Length],
 390                    cipherText2.Data, cipherText2.Length);
 391 }
 392
 393
 394 //
 395 // SSDbCursorImpl -- Secure Storage Database Cursor Implementation.
 396 //
 397 SSDbCursorImpl::SSDbCursorImpl(const Db &db, const CSSM_QUERY &query,
 398                                                            Allocator &allocator)
 399 : DbDbCursorImpl(db, query, allocator)
 400 {
 401 }
 402
 403 SSDbCursorImpl::SSDbCursorImpl(const Db &db, uint32 capacity,
 404                                                            Allocator &allocator)
 405 : DbDbCursorImpl(db, capacity, allocator)
 406 {
 407 }
 408
 409 bool
 410 SSDbCursorImpl::next(DbAttributes *attributes, ::CssmDataContainer *data,
 411                                          DbUniqueRecord &uniqueId)
 412 {
 413         return next(attributes, data, uniqueId, NULL);
 414 }
 415
 416 bool
 417 SSDbCursorImpl::next(DbAttributes *attributes, ::CssmDataContainer *data,
 418                                          DbUniqueRecord &uniqueId,
 419                                          const CSSM_ACCESS_CREDENTIALS *cred)
 420 {
 421     if (!data) {
 422         return DbDbCursorImpl::next(attributes, data, uniqueId);
 423     }
 424
 425         DbAttributes noAttrs, *attrs;
 426         attrs = attributes ? attributes : &noAttrs;
 427
 428         // To comply with previous behavior, this method will not find symmetric or public/private keys
 429         // if you ask for the data of each item.
 430
 431         // Get the datablob for this record
 432         CssmDataContainer dataBlob(allocator());
 433         for (;;)
 434         {
 435                 if (!DbDbCursorImpl::next(attrs, &dataBlob, uniqueId))
 436                         return false;
 437
 438                 CSSM_DB_RECORDTYPE rt = attrs->recordType();
 439                 if (rt == CSSM_DL_DB_RECORD_SYMMETRIC_KEY ||
 440                     rt == CSSM_DL_DB_RECORD_PRIVATE_KEY ||
 441                     rt == CSSM_DL_DB_RECORD_PUBLIC_KEY)
 442                 {
 443                         // This is a key. Free it, and then check if we should return the item (but not the data)
 444                         database()->csp()->freeKey(*reinterpret_cast<CssmKey *>(dataBlob.Data));
 445
 446                         if(!data) {
 447                                 break;
 448                         }
 449                 } else {
 450                         // This is a non-key item. Return it.
 451                         break;
 452                 }
 453         }
 454
 455         // If the caller requested any data, return the data.
 456         if(data) {
 457                 if (!SSGroupImpl::isGroup(dataBlob))
 458                 {
 459                         data->Data = dataBlob.Data;
 460                         data->Length = dataBlob.Length;
 461                         dataBlob.Data = NULL;
 462                         dataBlob.Length = 0;
 463                         return true;
 464                 }
 465
 466                 // Get the group for dataBlob
 467                 SSGroup group(database(), dataBlob);
 468
 469         // TODO: Add attrs to cred
 470
 471                 // Decode the dataBlob, pass in the DL allocator.
 472                 group->decodeDataBlob(dataBlob, cred, database()->allocator(), *data);
 473         }
 474         return true;
 475 }
 476
 477 bool
 478 SSDbCursorImpl::nextKey(DbAttributes *attributes, Key &key,
 479                                                 DbUniqueRecord &uniqueId)
 480 {
 481         DbAttributes noAttrs, *attrs;
 482         attrs = attributes ? attributes : &noAttrs;
 483         CssmDataContainer keyData(database()->allocator());
 484         for (;;)
 485         {
 486                 if (!DbDbCursorImpl::next(attrs, &keyData, uniqueId))
 487                         return false;
 488                 // Keep going until we find a key type record.
 489                 CSSM_DB_RECORDTYPE rt = attrs->recordType();
 490                 if (rt == CSSM_DL_DB_RECORD_SYMMETRIC_KEY
 491                         || rt == CSSM_DL_DB_RECORD_PRIVATE_KEY
 492                         || rt == CSSM_DL_DB_RECORD_PUBLIC_KEY)
 493                         break;
 494         }
 495
 496         key = Key(database()->csp(), *reinterpret_cast<CSSM_KEY *>(keyData.Data));
 497         return true;
 498 }
 499
 500 void
 501 SSDbCursorImpl::activate()
 502 {
 503         return DbDbCursorImpl::activate();
 504 }
 505
 506 void
 507 SSDbCursorImpl::deactivate()
 508 {
 509         return DbDbCursorImpl::deactivate();
 510 }
 511
 512
 513 //
 514 // SSDbUniqueRecordImpl -- Secure Storage UniqueRecord Implementation.
 515 //
 516 SSDbUniqueRecordImpl::SSDbUniqueRecordImpl(const Db &db)
 517 : DbUniqueRecordImpl(db)
 518 {
 519 }
 520
 521 SSDbUniqueRecordImpl::~SSDbUniqueRecordImpl()
 522 {
 523 }
 524
 525 void
 526 SSDbUniqueRecordImpl::deleteRecord()
 527 {
 528         deleteRecord(NULL);
 529 }
 530
 531 void
 532 SSDbUniqueRecordImpl::deleteRecord(const CSSM_ACCESS_CREDENTIALS *cred)
 533 {
 534         // Get the datablob for this record
 535         // @@@ Fixme so we don't need to call DbUniqueRecordImpl::get
 536         CssmDataContainer dataBlob(allocator());
 537         DbAttributes attributes;
 538
 539         DbUniqueRecordImpl::get(&attributes, &dataBlob);
 540         CSSM_KEY_PTR keyPtr = (CSSM_KEY_PTR) dataBlob.data();
 541
 542         // delete data part first:
 543         // (1) don't leave data without keys around
 544         // (2) delete orphaned data anyway
 545         DbUniqueRecordImpl::deleteRecord();
 546
 547         // @@@ Use transactions?
 548         if (SSGroupImpl::isGroup(dataBlob))
 549         try {
 550                 // Get the group for dataBlob
 551                 SSGroup group(database(), dataBlob);
 552                 // Delete the group (key)
 553                 group->deleteKey(cred);
 554         } catch (const CssmError &err) {
 555                 switch (err.error) {
 556                 case CSSMERR_DL_RECORD_NOT_FOUND:
 557                         // Zombie item (no group key). Finally at peace! No error
 558                         break;
 559                 default:
 560
 561                         if (attributes.recordType() == CSSM_DL_DB_RECORD_PUBLIC_KEY ||
 562                                 attributes.recordType() == CSSM_DL_DB_RECORD_PRIVATE_KEY ||
 563                                 attributes.recordType() == CSSM_DL_DB_RECORD_SYMMETRIC_KEY)
 564                         {
 565                                 allocator().free(keyPtr->KeyData.Data);
 566                         }
 567
 568                         throw;
 569                 }
 570         }
 571
 572         if (attributes.recordType() == CSSM_DL_DB_RECORD_PUBLIC_KEY ||
 573                 attributes.recordType() == CSSM_DL_DB_RECORD_PRIVATE_KEY ||
 574                 attributes.recordType() == CSSM_DL_DB_RECORD_SYMMETRIC_KEY)
 575         {
 576                 allocator().free(keyPtr->KeyData.Data);
 577         }
 578 }
 579
 580 void
 581 SSDbUniqueRecordImpl::modify(CSSM_DB_RECORDTYPE recordType,
 582                                                          const CSSM_DB_RECORD_ATTRIBUTE_DATA *attributes,
 583                                                          const CSSM_DATA *data,
 584                                                          CSSM_DB_MODIFY_MODE modifyMode)
 585 {
 586         modify(recordType, attributes, data, modifyMode, NULL);
 587 }
 588
 589 void
 590 SSDbUniqueRecordImpl::modify(CSSM_DB_RECORDTYPE recordType,
 591                                                          const CSSM_DB_RECORD_ATTRIBUTE_DATA *attributes,
 592                                                          const CSSM_DATA *data,
 593                                                          CSSM_DB_MODIFY_MODE modifyMode,
 594                                                          const CSSM_ACCESS_CREDENTIALS *cred)
 595 {
 596         if (!data)
 597         {
 598                 DbUniqueRecordImpl::modify(recordType, attributes, NULL, modifyMode);
 599                 return;
 600         }
 601
 602         // Get the datablob for this record
 603         // @@@ Fixme so we don't need to call DbUniqueRecordImpl::get
 604         CssmDataContainer oldDataBlob(allocator());
 605         DbUniqueRecordImpl::get(NULL, &oldDataBlob);
 606
 607         if (!SSGroupImpl::isGroup(oldDataBlob))
 608         {
 609                 DbUniqueRecordImpl::modify(recordType, attributes, data, modifyMode);
 610                 return;
 611         }
 612
 613         // Get the group for oldDataBlob
 614         SSGroup group(database(), oldDataBlob);
 615
 616         // Create a new dataBlob.
 617         CssmDataContainer dataBlob(allocator());
 618         group->encodeDataBlob(data, cred, dataBlob);
 619         DbUniqueRecordImpl::modify(recordType, attributes, &dataBlob, modifyMode);
 620 }
 621
 622 void
 623 SSDbUniqueRecordImpl::get(DbAttributes *attributes, ::CssmDataContainer *data)
 624 {
 625         get(attributes, data, NULL);
 626 }
 627
 628 void
 629 SSDbUniqueRecordImpl::get(DbAttributes *attributes, ::CssmDataContainer *data,
 630                                                   const CSSM_ACCESS_CREDENTIALS *cred)
 631 {
 632         if (!data)
 633         {
 634                 DbUniqueRecordImpl::get(attributes, NULL);
 635                 return;
 636         }
 637
 638         // Get the datablob for this record
 639         // @@@ Fixme so we don't need to call DbUniqueRecordImpl::get
 640         CssmDataContainer dataBlob(allocator());
 641         DbUniqueRecordImpl::get(attributes, &dataBlob);
 642
 643         if (!SSGroupImpl::isGroup(dataBlob))
 644         {
 645                 data->Data = dataBlob.Data;
 646                 data->Length = dataBlob.Length;
 647                 dataBlob.Data = NULL;
 648                 dataBlob.Length = 0;
 649                 return;
 650         }
 651
 652         // Get the group for dataBlob
 653         SSGroup group(database(), dataBlob);
 654
 655         // Decode the dataBlob, pass in the DL allocator.
 656         group->decodeDataBlob(dataBlob, cred, allocator(), *data);
 657 }
 658
 659 SSGroup
 660 SSDbUniqueRecordImpl::group()
 661 {
 662         // Get the datablob for this record
 663         // @@@ Fixme so we don't need to call DbUniqueRecordImpl::get
 664         CssmDataContainer dataBlob(allocator());
 665         DbUniqueRecordImpl::get(NULL, &dataBlob);
 666         return SSGroup(database(), dataBlob);
 667 }