OSX/libsecurity_codesigning/lib/SecRequirement.cpp

   1 /*
   2  * Copyright (c) 2006,2011-2012,2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 //
  25 // SecRequirement - API frame for SecRequirement objects
  26 //
  27 #include "cs.h"
  28 #include "Requirements.h"
  29 #include "reqparser.h"
  30 #include "reqmaker.h"
  31 #include "reqdumper.h"
  32 #include <Security/SecCertificate.h>
  33 #include <security_utilities/cfutilities.h>
  34
  35 using namespace CodeSigning;
  36
  37
  38 //
  39 // CF-standard type code function
  40 //
  41 CFTypeID SecRequirementGetTypeID(void)
  42 {
  43         BEGIN_CSAPI
  44         return gCFObjects().Requirement.typeID;
  45     END_CSAPI1(_kCFRuntimeNotATypeID)
  46 }
  47
  48
  49 //
  50 // Create a Requirement from data
  51 //
  52 OSStatus SecRequirementCreateWithData(CFDataRef data, SecCSFlags flags,
  53         SecRequirementRef *requirementRef)
  54 {
  55         BEGIN_CSAPI
  56
  57         checkFlags(flags);
  58         CodeSigning::Required(requirementRef) = (new SecRequirement(CFDataGetBytePtr(data), CFDataGetLength(data)))->handle();
  59
  60         END_CSAPI
  61 }
  62
  63
  64 //
  65 // Create a Requirement from data in a file
  66 //
  67 OSStatus SecRequirementCreateWithResource(CFURLRef resource, SecCSFlags flags,
  68         SecRequirementRef *requirementRef)
  69 {
  70         BEGIN_CSAPI
  71
  72         checkFlags(flags);
  73         CFRef<CFDataRef> data = cfLoadFile(resource);
  74         CodeSigning::Required(requirementRef) =
  75                 (new SecRequirement(CFDataGetBytePtr(data), CFDataGetLength(data)))->handle();
  76
  77         END_CSAPI
  78 }
  79
  80
  81 //
  82 // Create a Requirement from source text (compiling it)
  83 //
  84 OSStatus SecRequirementCreateWithString(CFStringRef text, SecCSFlags flags,
  85         SecRequirementRef *requirementRef)
  86 {
  87         return SecRequirementCreateWithStringAndErrors(text, flags, NULL, requirementRef);
  88 }
  89
  90 OSStatus SecRequirementCreateWithStringAndErrors(CFStringRef text, SecCSFlags flags,
  91         CFErrorRef *errors, SecRequirementRef *requirementRef)
  92 {
  93         BEGIN_CSAPI
  94
  95         checkFlags(flags);
  96         CodeSigning::Required(requirementRef) = (new SecRequirement(parseRequirement(cfString(text)), true))->handle();
  97
  98         END_CSAPI_ERRORS
  99 }
 100
 101
 102 //
 103 // Create a Requirement group.
 104 // This is the canonical point where "application group" is defined.
 105 //
 106 OSStatus SecRequirementCreateGroup(CFStringRef groupName, SecCertificateRef anchorRef,
 107         SecCSFlags flags, SecRequirementRef *requirementRef)
 108 {
 109         BEGIN_CSAPI
 110
 111         checkFlags(flags);
 112         Requirement::Maker maker;
 113         maker.put(opAnd);               // both of...
 114         maker.infoKey("Application-Group", cfString(groupName));
 115         if (anchorRef) {
 116 #if TARGET_OS_OSX
 117                 CSSM_DATA certData;
 118                 MacOSError::check(SecCertificateGetData(anchorRef, &certData));
 119                 maker.anchor(0, certData.Data, certData.Length);
 120 #else
 121         maker.anchor(0, SecCertificateGetBytePtr(anchorRef), SecCertificateGetLength(anchorRef));
 122 #endif
 123         } else {
 124                 maker.anchor();                 // canonical Apple anchor
 125         }
 126         CodeSigning::Required(requirementRef) = (new SecRequirement(maker.make(), true))->handle();
 127
 128         END_CSAPI
 129 }
 130
 131
 132 //
 133 // Extract the stable binary from from a SecRequirementRef
 134 //
 135 OSStatus SecRequirementCopyData(SecRequirementRef requirementRef, SecCSFlags flags,
 136         CFDataRef *data)
 137 {
 138         BEGIN_CSAPI
 139
 140         const Requirement *req = SecRequirement::required(requirementRef)->requirement();
 141         checkFlags(flags);
 142         CodeSigning::Required(data);
 143         *data = makeCFData(*req);
 144
 145         END_CSAPI
 146 }
 147
 148
 149 //
 150 // Generate source form for a SecRequirement (decompile/disassemble)
 151 //
 152 OSStatus SecRequirementCopyString(SecRequirementRef requirementRef, SecCSFlags flags,
 153         CFStringRef *text)
 154 {
 155         BEGIN_CSAPI
 156
 157         const Requirement *req = SecRequirement::required(requirementRef)->requirement();
 158         checkFlags(flags);
 159         CodeSigning::Required(text);
 160         *text = makeCFString(Dumper::dump(req));
 161
 162         END_CSAPI
 163 }
 164
 165
 166 //
 167 CFStringRef kSecRequirementKeyInfoPlist = CFSTR("requirement:eval:info");
 168 CFStringRef kSecRequirementKeyEntitlements = CFSTR("requirement:eval:entitlements");
 169 CFStringRef kSecRequirementKeyIdentifier = CFSTR("requirement:eval:identifier");
 170 CFStringRef kSecRequirementKeyPackageChecksum = CFSTR("requirement:eval:package_checksum");
 171 CFStringRef kSecRequirementKeyChecksumAlgorithm = CFSTR("requirement:eval:package_checksum_algorithm");
 172 CFStringRef kSecRequirementKeySecureTimestamp = CFSTR("requirement:eval:secure_timestamp");
 173 CFStringRef kSecRequirementKeyTeamIdentifier = CFSTR("requirement:eval:team_identifier");
 174
 175 OSStatus SecRequirementEvaluate(SecRequirementRef requirementRef,
 176         CFArrayRef certificateChain, CFDictionaryRef context,
 177         SecCSFlags flags)
 178 {
 179         BEGIN_CSAPI
 180
 181         const Requirement *req = SecRequirement::required(requirementRef)->requirement();
 182         checkFlags(flags);
 183         CodeSigning::Required(certificateChain);
 184
 185         SecCSDigestAlgorithm checksumAlgorithm = kSecCodeSignatureNoHash;
 186         if (context) {
 187                 CFRef<CFNumberRef> num = (CFNumberRef)CFDictionaryGetValue(context, kSecRequirementKeyChecksumAlgorithm);
 188                 if (num) {
 189                         checksumAlgorithm = (SecCSDigestAlgorithm)cfNumber<uint32_t>(num);
 190                 }
 191         }
 192
 193         const char *teamID = NULL;
 194         if (context && CFDictionaryGetValue(context, kSecRequirementKeyTeamIdentifier)) {
 195                 CFStringRef str = (CFStringRef)CFDictionaryGetValue(context, kSecRequirementKeyTeamIdentifier);
 196                 teamID = CFStringGetCStringPtr(str, kCFStringEncodingUTF8);
 197         }
 198
 199         Requirement::Context ctx(certificateChain,              // mandatory
 200                 context ? CFDictionaryRef(CFDictionaryGetValue(context, kSecRequirementKeyInfoPlist)) : NULL,
 201                 context ? CFDictionaryRef(CFDictionaryGetValue(context, kSecRequirementKeyEntitlements)) : NULL,
 202                 (context && CFDictionaryGetValue(context, kSecRequirementKeyIdentifier)) ?
 203                         cfString(CFStringRef(CFDictionaryGetValue(context, kSecRequirementKeyIdentifier))) : "",
 204                 NULL,   // can't specify a CodeDirectory here
 205                 context ? CFDataRef(CFDictionaryGetValue(context, kSecRequirementKeyPackageChecksum)) : NULL,
 206         checksumAlgorithm,
 207                 false, // can't get forced platform this way
 208                 context ? CFDateRef(CFDictionaryGetValue(context, kSecRequirementKeySecureTimestamp)) : NULL,
 209                 teamID
 210         );
 211         req->validate(ctx);
 212
 213         END_CSAPI
 214 }
 215
 216
 217 //
 218 // Assemble a requirement set (as a CFData) from a dictionary of requirement objects.
 219 // An empty set is allowed.
 220 //
 221 OSStatus SecRequirementsCreateFromRequirements(CFDictionaryRef requirements, SecCSFlags flags,
 222         CFDataRef *requirementSet)
 223 {
 224         BEGIN_CSAPI
 225
 226         checkFlags(flags);
 227         if (requirements == NULL)
 228                 return errSecCSObjectRequired;
 229         CFIndex count = CFDictionaryGetCount(requirements);
 230         vector<CFNumberRef> keys_vector(count, NULL);
 231         vector<SecRequirementRef> reqs_vector(count, NULL);
 232         CFDictionaryGetKeysAndValues(requirements, (const void **)keys_vector.data(), (const void **)reqs_vector.data());
 233         Requirements::Maker maker;
 234         for (CFIndex n = 0; n < count; n++) {
 235                 const Requirement *req = SecRequirement::required(reqs_vector[n])->requirement();
 236                 maker.add(cfNumber<Requirements::Type>(keys_vector[n]), req->clone());
 237         }
 238         Requirements *reqset = maker.make();                                    // malloc'ed
 239         CodeSigning::Required(requirementSet) = makeCFDataMalloc(*reqset);      // takes ownership of reqs
 240
 241         END_CSAPI
 242 }
 243
 244
 245 //
 246 // Break a requirement set (given as a CFData) into its constituent requirements
 247 // and return it as a CFDictionary.
 248 //
 249 OSStatus SecRequirementsCopyRequirements(CFDataRef requirementSet, SecCSFlags flags,
 250         CFDictionaryRef *requirements)
 251 {
 252         BEGIN_CSAPI
 253
 254         checkFlags(flags);
 255         if (requirementSet == NULL)
 256                 return errSecCSObjectRequired;
 257         const Requirements *reqs = (const Requirements *)CFDataGetBytePtr(requirementSet);
 258         if (!reqs->validateBlob())
 259                 MacOSError::throwMe(errSecCSReqInvalid);
 260         CFRef<CFMutableDictionaryRef> dict = makeCFMutableDictionary();
 261         unsigned count = reqs->count();
 262         for (unsigned n = 0; n < count; n++) {
 263                 CFRef<SecRequirementRef> req = (new SecRequirement(reqs->blob<Requirement>(n)))->handle();
 264                 CFDictionaryAddValue(dict, CFTempNumber(reqs->type(n)), req);
 265         }
 266         CodeSigning::Required(requirements) = dict.yield();
 267
 268         END_CSAPI
 269 }
 270
 271
 272 //
 273 // Generically parse a string as some kind of requirement-related source form.
 274 // If properly recognized, return the result as a CF object:
 275 //      SecRequirementRef for a single requirement
 276 //      CFDataRef for a requirement set
 277 //
 278 OSStatus SecRequirementsCreateWithString(CFStringRef text, SecCSFlags flags,
 279         CFTypeRef *result, CFErrorRef *errors)
 280 {
 281         BEGIN_CSAPI
 282
 283         checkFlags(flags, kSecCSParseRequirement | kSecCSParseRequirementSet);
 284         if (text == NULL || result == NULL)
 285                 return errSecCSObjectRequired;
 286         std::string s = cfString(text);
 287         switch (flags & (kSecCSParseRequirement | kSecCSParseRequirementSet)) {
 288         case kSecCSParseRequirement:            // single only
 289                 *result = (new SecRequirement(parseRequirement(s), true))->handle();
 290                 break;
 291         case kSecCSParseRequirementSet:         // single only
 292                 {
 293                         const Requirements *reqs = parseRequirements(s);
 294                         *result = makeCFDataMalloc(*reqs);
 295                         break;
 296                 }
 297         case 0:
 298         case kSecCSParseRequirement | kSecCSParseRequirementSet:
 299                 {
 300                         const BlobCore *any = parseGeneric(s);
 301                         if (any->is<Requirement>())
 302                                 *result = (new SecRequirement(Requirement::specific(any), true))->handle();
 303                         else
 304                                 *result = makeCFDataMalloc(*any);
 305                         break;
 306                 }
 307         }
 308
 309         END_CSAPI_ERRORS
 310 }
 311
 312
 313 //
 314 // Convert a SecRequirementRef or a CFDataRef containing a requirement set to text.
 315 // Requirement sets will be formatted as multiple lines (one per requirement). They can be empty.
 316 // A single requirement will return a single line that is NOT newline-terminated.
 317 //
 318 OSStatus SecRequirementsCopyString(CFTypeRef input, SecCSFlags flags, CFStringRef *text)
 319 {
 320         BEGIN_CSAPI
 321
 322         checkFlags(flags);
 323         if (input == NULL)
 324                 return errSecCSObjectRequired;
 325         if (CFGetTypeID(input) == SecRequirementGetTypeID()) {
 326                 return SecRequirementCopyString(SecRequirementRef(input), flags, text);
 327         } else if (CFGetTypeID(input) == CFDataGetTypeID()) {
 328                 const Requirements *reqs = (const Requirements *)CFDataGetBytePtr(CFDataRef(input));
 329                 if (!reqs->validateBlob(CFDataGetLength(CFDataRef(input))))
 330                         return errSecCSReqInvalid;
 331                 CodeSigning::Required(text) = makeCFString(Dumper::dump(reqs, false));
 332         } else
 333                 return errSecCSInvalidObjectRef;
 334
 335         END_CSAPI
 336 }