SecurityTool/macOS/verify_cert.c

   1 /*
   2  * Copyright (c) 2006,2010,2012,2014-2019 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  *
  23  * verify_cert.c
  24  */
  25
  26 #include <Security/SecTrust.h>
  27 #include <Security/SecKeychain.h>
  28 #include <Security/SecPolicy.h>
  29 #include <Security/SecPolicySearch.h>
  30 #include <Security/cssmapple.h>
  31 #include <Security/oidsalg.h>
  32 #include <stdlib.h>
  33 #include <unistd.h>
  34 #include <sys/stat.h>
  35 #include <time.h>
  36 #include "trusted_cert_ssl.h"
  37 #include "trusted_cert_utils.h"
  38 #include "verify_cert.h"
  39 #include <utilities/SecCFRelease.h>
  40 #include "security_tool.h"
  41
  42 /*
  43  * Read file as a cert, add to a CFArray, creating the array if necessary
  44  */
  45 static int addCertFile(
  46         const char *fileName,
  47         CFMutableArrayRef *array)
  48 {
  49         SecCertificateRef certRef;
  50
  51         if(readCertFile(fileName, &certRef)) {
  52                 return -1;
  53         }
  54         if(*array == NULL) {
  55                 *array = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
  56         }
  57         CFArrayAppendValue(*array, certRef);
  58         CFRelease(certRef);
  59         return 0;
  60 }
  61
  62 int
  63 verify_cert(int argc, char * const *argv)
  64 {
  65         extern char                     *optarg;
  66         extern int                      optind;
  67         OSStatus                        ortn;
  68         int                                     arg;
  69         CFMutableArrayRef       certs = NULL;
  70         CFMutableArrayRef       roots = NULL;
  71         CFMutableArrayRef       keychains = NULL;
  72         CFMutableArrayRef       policies = NULL;
  73         CFMutableDictionaryRef  properties = NULL;
  74         const CSSM_OID          *policy = &CSSMOID_APPLE_X509_BASIC;
  75         SecKeychainRef          kcRef = NULL;
  76         int                                     ourRtn = 0;
  77         bool                            quiet = false;
  78         bool                            client = false;
  79         bool                            useTLS = false;
  80         bool                            printPem = false;
  81         bool                            printText = false;
  82         bool                            printDetails = false;
  83         int                             verbose = 0;
  84         SecPolicyRef            policyRef = NULL;
  85         SecPolicyRef            revPolicyRef = NULL;
  86         SecTrustRef                     trustRef = NULL;
  87         SecPolicySearchRef      searchRef = NULL;
  88         CFErrorRef                      errorRef = NULL;
  89         const char                      *emailAddrs = NULL;
  90         const char                      *sslHost = NULL;
  91         const char                      *name = NULL;
  92         const char                      *url = NULL;
  93         CSSM_APPLE_TP_ACTION_FLAGS actionFlags = 0;
  94         bool                            forceActionFlags = false;
  95         CSSM_APPLE_TP_ACTION_DATA       actionData;
  96         CFDataRef                       cfActionData = NULL;
  97         SecTrustResultType      resultType;
  98         OSStatus                        ocrtn;
  99         struct tm                       time;
 100         CFGregorianDate         gregorianDate;
 101         CFDateRef                       dateRef = NULL;
 102         CFOptionFlags           revOptions = 0;
 103
 104         if(argc < 2) {
 105                 return SHOW_USAGE_MESSAGE;
 106         }
 107         /* permit network cert fetch unless explicitly turned off with '-L' */
 108         actionFlags |= CSSM_TP_ACTION_FETCH_CERT_FROM_NET;
 109         optind = 1;
 110         while ((arg = getopt(argc, argv, "Cc:r:p:k:e:s:d:LlNnPqR:tv")) != -1) {
 111                 switch (arg) {
 112                         case 'C':
 113                                 client = true;
 114                                 break;
 115                         case 'c':
 116                                 /* this can be specified multiple times */
 117                                 if(addCertFile(optarg, &certs)) {
 118                                         ourRtn = 1;
 119                                         goto errOut;
 120                                 }
 121                                 break;
 122                         case 'r':
 123                                 /* this can be specified multiple times */
 124                                 if(addCertFile(optarg, &roots)) {
 125                                         ourRtn = 1;
 126                                         goto errOut;
 127                                 }
 128                                 break;
 129                         case 'p':
 130                                 policy = policyStringToOid(optarg, &useTLS);
 131                                 if(policy == NULL) {
 132                                         ourRtn = 2;
 133                                         goto errOut;
 134                                 }
 135                                 break;
 136                         case 'k':
 137                                 ortn = SecKeychainOpen(optarg, &kcRef);
 138                                 if(ortn) {
 139                                         cssmPerror("SecKeychainOpen", ortn);
 140                                         ourRtn = 1;
 141                                         goto errOut;
 142                                 }
 143                                 /* this can be specified multiple times */
 144                                 if(keychains == NULL) {
 145                                         keychains = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
 146                                 }
 147                                 CFArrayAppendValue(keychains, kcRef);
 148                                 CFRelease(kcRef);
 149                                 break;
 150                         case 'L':
 151                                 actionFlags &= ~CSSM_TP_ACTION_FETCH_CERT_FROM_NET;
 152                                 forceActionFlags = true;
 153                                 break;
 154                         case 'l':
 155                                 actionFlags |= CSSM_TP_ACTION_LEAF_IS_CA;
 156                                 break;
 157                         case 'n': {
 158                                 /* Legacy macOS used 'n' as the "no keychain search list" flag.
 159                                    iOS interprets it as the name option, with one argument.
 160                                 */
 161                                 char *o = argv[optind];
 162                                 if (o && o[0] != '-') {
 163                                         name = o;
 164                                         ++optind;
 165                                         break;
 166                                 }
 167                         }       /* intentional fall-through to "no keychains" case, if no arg */
 168                         case 'N':
 169                                 /* No keychains, signalled by empty keychain array */
 170                                 if(keychains != NULL) {
 171                                         fprintf(stderr, "-k and -%c are mutually exclusive\n", arg);
 172                                         ourRtn = 2;
 173                                         goto errOut;
 174                                 }
 175                                 keychains = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
 176                                 break;
 177                         case 'e':
 178                                 emailAddrs = optarg;
 179                                 break;
 180                         case 's':
 181                                 sslHost = optarg;
 182                                 break;
 183                         case 'q':
 184                                 quiet = true;
 185                                 break;
 186                         case 'd':
 187                                 memset(&time, 0, sizeof(struct tm));
 188                                 if (strptime(optarg, "%Y-%m-%d-%H:%M:%S", &time) == NULL) {
 189                                         if (strptime(optarg, "%Y-%m-%d", &time) == NULL) {
 190                                                 fprintf(stderr, "Date processing error\n");
 191                                                 ourRtn = 2;
 192                                                 goto errOut;
 193                                         }
 194                                 }
 195                                 gregorianDate.second = time.tm_sec;
 196                                 gregorianDate.minute = time.tm_min;
 197                                 gregorianDate.hour = time.tm_hour;
 198                                 gregorianDate.day = time.tm_mday;
 199                                 gregorianDate.month = time.tm_mon + 1;
 200                                 gregorianDate.year = time.tm_year + 1900;
 201
 202                                 if (dateRef == NULL) {
 203                                         dateRef = CFDateCreate(NULL, CFGregorianDateGetAbsoluteTime(gregorianDate, NULL));
 204                                 }
 205                                 break;
 206                         case 'R':
 207                                 revOptions |= revCheckOptionStringToFlags(optarg);
 208                                 break;
 209                         case 'P':
 210                                 printPem = true;
 211                                 break;
 212                         case 't':
 213                                 printText = true;
 214                                 break;
 215                         case 'v':
 216                                 printDetails = true;
 217                                 verbose++;
 218                                 break;
 219                         default:
 220                                 ourRtn = 2;
 221                                 goto errOut;
 222                 }
 223         }
 224         if(optind != argc) {
 225                 if (argc > optind) {
 226                         url = argv[argc-1];
 227                 }
 228                 if (url && *url != '\0') {
 229                         useTLS = true;
 230                         ourRtn = evaluate_ssl(url, verbose, &trustRef);
 231                         goto post_evaluate;
 232                 } else {
 233                         ourRtn = 2;
 234                 }
 235                 goto errOut;
 236         }
 237
 238         if(certs == NULL) {
 239                 if(roots == NULL) {
 240                         fprintf(stderr, "***No certs specified.\n");
 241                         ourRtn = 2;
 242                         goto errOut;
 243                 }
 244                 if(CFArrayGetCount(roots) != 1) {
 245                         fprintf(stderr, "***Multiple roots and no certs not allowed.\n");
 246                         ourRtn = 2;
 247                         goto errOut;
 248                 }
 249
 250                 /* no certs and one root: verify the root */
 251                 certs = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
 252                 CFArrayAppendValue(certs, CFArrayGetValueAtIndex(roots, 0));
 253                 actionFlags |= CSSM_TP_ACTION_LEAF_IS_CA;
 254         }
 255
 256         /* cook up a SecPolicyRef */
 257         properties = CFDictionaryCreateMutable(kCFAllocatorDefault, 0,
 258                         &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 259         if (!properties) {
 260                 cssmPerror("CFDictionaryCreateMutable", errSecMemoryError);
 261                 ourRtn = 1;
 262                 goto errOut;
 263         } else {
 264                 /* if a policy name was specified to match, set it in the dictionary */
 265                 const char *nameStr = name;
 266                 if (!nameStr) { nameStr = (sslHost) ? sslHost : ((emailAddrs) ? emailAddrs : NULL); }
 267                 CFStringRef nameRef = (nameStr) ?  CFStringCreateWithBytes(NULL,
 268                         (const UInt8 *)nameStr, (CFIndex)strlen(nameStr), kCFStringEncodingUTF8, false) : NULL;
 269                 if (nameRef) {
 270                         CFDictionarySetValue(properties, kSecPolicyName, nameRef);
 271                         CFRELEASE(nameRef);
 272                 }
 273                 CFStringRef policyID = NULL;
 274                 if (compareOids(policy, &CSSMOID_APPLE_TP_SSL)) {
 275                         policyID = kSecPolicyAppleSSL;
 276                 } else if (compareOids(policy, &CSSMOID_APPLE_TP_EAP)) {
 277                         policyID = kSecPolicyAppleEAP;
 278                 } else if (compareOids(policy, &CSSMOID_APPLE_TP_APPLEID_SHARING)) {
 279                         policyID = kSecPolicyAppleIDValidation;
 280                 } else if (compareOids(policy, &CSSMOID_APPLE_TP_SMIME)) {
 281                         policyID = kSecPolicyAppleSMIME;
 282                 }
 283                 if (policyID) {
 284                         policyRef = SecPolicyCreateWithProperties(policyID, properties);
 285                 }
 286         }
 287         if (!policyRef) {
 288                 /* all other policies not handled above */
 289                 ortn = SecPolicySearchCreate(CSSM_CERT_X_509v3,
 290                         policy,
 291                         NULL,                           // policy opts
 292                         &searchRef);
 293                 if(ortn) {
 294                         cssmPerror("SecPolicySearchCreate", ortn);
 295                         ourRtn = 1;
 296                         goto errOut;
 297                 }
 298                 ortn = SecPolicySearchCopyNext(searchRef, &policyRef);
 299                 if(ortn) {
 300                         cssmPerror("SecPolicySearchCopyNext", ortn);
 301                         ourRtn = 1;
 302                         goto errOut;
 303                 }
 304         }
 305
 306         /* create policies array */
 307         policies = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
 308         CFArrayAppendValue(policies, policyRef);
 309         /* add optional SecPolicyRef for revocation, if specified */
 310         if(revOptions != 0) {
 311                 revPolicyRef = SecPolicyCreateRevocation(revOptions);
 312                 CFArrayAppendValue(policies, revPolicyRef);
 313         }
 314
 315         /* create trust reference from certs and policies */
 316         ortn = SecTrustCreateWithCertificates(certs, policies, &trustRef);
 317         if(ortn) {
 318                 cssmPerror("SecTrustCreateWithCertificates", ortn);
 319                 ourRtn = 1;
 320                 goto errOut;
 321         }
 322
 323         /* roots (anchors) are optional */
 324         if(roots != NULL) {
 325                 ortn = SecTrustSetAnchorCertificates(trustRef, roots);
 326                 if(ortn) {
 327                         cssmPerror("SecTrustSetAnchorCertificates", ortn);
 328                         ourRtn = 1;
 329                         goto errOut;
 330                 }
 331         }
 332         if(actionFlags || forceActionFlags) {
 333                 memset(&actionData, 0, sizeof(actionData));
 334                 actionData.Version = CSSM_APPLE_TP_ACTION_VERSION;
 335                 actionData.ActionFlags = actionFlags;
 336                 cfActionData = CFDataCreate(NULL, (UInt8 *)&actionData, sizeof(actionData));
 337                 ortn = SecTrustSetParameters(trustRef, CSSM_TP_ACTION_DEFAULT, cfActionData);
 338                 if(ortn) {
 339                         cssmPerror("SecTrustSetParameters", ortn);
 340                         ourRtn = 1;
 341                         goto errOut;
 342                 }
 343         }
 344         if(keychains) {
 345                 ortn = SecTrustSetKeychains(trustRef, keychains);
 346                 if(ortn) {
 347                         cssmPerror("SecTrustSetKeychains", ortn);
 348                         ourRtn = 1;
 349                         goto errOut;
 350                 }
 351         }
 352         if(dateRef != NULL) {
 353                 ortn = SecTrustSetVerifyDate(trustRef, dateRef);
 354                 if(ortn) {
 355                         cssmPerror("SecTrustSetVerifyDate", ortn);
 356                         ourRtn = 1;
 357                         goto errOut;
 358                 }
 359         }
 360
 361         /* GO */
 362         (void)SecTrustEvaluateWithError(trustRef, &errorRef);
 363 post_evaluate:
 364         ortn = SecTrustGetTrustResult(trustRef, &resultType);
 365         if(ortn) {
 366                 /* should never fail - error on this doesn't mean the cert verified badly */
 367                 cssmPerror("SecTrustEvaluate", ortn);
 368                 ourRtn = 1;
 369                 goto errOut;
 370         }
 371         switch(resultType) {
 372                 case kSecTrustResultUnspecified:
 373                         /* cert chain valid, no special UserTrust assignments */
 374                 case kSecTrustResultProceed:
 375                         /* cert chain valid AND user explicitly trusts this */
 376                         break;
 377                 case kSecTrustResultDeny:
 378                         if(!quiet) {
 379                                 fprintf(stderr, "SecTrustEvaluate result: kSecTrustResultDeny\n");
 380                         }
 381                         ourRtn = 1;
 382                         break;
 383                 default:
 384                         ourRtn = 1;
 385                         if(!quiet) {
 386                                 /* See what the TP had to say about this */
 387                                 ortn = SecTrustGetCssmResultCode(trustRef, &ocrtn);
 388                                 if(ortn) {
 389                                         cssmPerror("SecTrustGetCssmResultCode", ortn);
 390                                 }
 391                                 else  {
 392                                         cssmPerror("Cert Verify Result", ocrtn);
 393                                 }
 394                         }
 395                         break;
 396         }
 397         if((ourRtn == 0) & !quiet) {
 398                 printf("...certificate verification successful.\n");
 399         }
 400         if (printPem || printText || verbose) {
 401                 fprintf(stdout, "---\nCertificate chain\n");
 402                 printCertChain(trustRef, printPem, printText);
 403         }
 404         if (verbose) {
 405                 printErrorDetails(trustRef);
 406         }
 407         if (useTLS) {
 408                 printExtendedResults(trustRef);
 409         }
 410         if (printDetails) {
 411                 CFArrayRef properties = SecTrustCopyProperties(trustRef);
 412                 if (verbose > 1) {
 413                         fprintf(stderr, "---\nCertificate chain properties\n");
 414                         CFShow(properties); // output goes to stderr
 415                 }
 416                 if (properties) {
 417                         CFRelease(properties);
 418                 }
 419                 CFDictionaryRef result = SecTrustCopyResult(trustRef);
 420                 if (result) {
 421                         fprintf(stderr, "---\nTrust evaluation results\n");
 422                         CFShow(result); // output goes to stderr
 423                         CFRelease(result);
 424                 }
 425                 if (errorRef) {
 426                         fprintf(stdout, "---\nTrust evaluation errors\n");
 427                         CFShow(errorRef);
 428                 }
 429         }
 430
 431 errOut:
 432         /* cleanup */
 433         CFRELEASE(certs);
 434         CFRELEASE(roots);
 435         CFRELEASE(keychains);
 436         CFRELEASE(properties);
 437         CFRELEASE(policies);
 438         CFRELEASE(revPolicyRef);
 439         CFRELEASE(dateRef);
 440         CFRELEASE(policyRef);
 441         CFRELEASE(trustRef);
 442         CFRELEASE(searchRef);
 443         CFRELEASE(errorRef);
 444         CFRELEASE(cfActionData);
 445         return ourRtn;
 446 }