OSX/libsecurity_transform/lib/SecTransform.cpp

   1 #include "SecTransform.h"
   2 #include "SecTransformInternal.h"
   3
   4 #include "Transform.h"
   5 #include "Utilities.h"
   6 #include "TransformFactory.h"
   7 #include "GroupTransform.h"
   8 #include "c++utils.h"
   9 #include "SecCollectTransform.h"
  10
  11
  12 #include <string>
  13
  14 using namespace std;
  15
  16 const CFStringRef kSecTransformInputAttributeName = CFSTR("INPUT");
  17 const CFStringRef kSecTransformOutputAttributeName = CFSTR("OUTPUT");
  18 const CFStringRef kSecTransformDebugAttributeName = CFSTR("DEBUG");
  19 const CFStringRef kSecTransformTransformName = CFSTR("NAME");
  20 //const CFStringRef kSecTransformErrorTransform = CFSTR("TRANSFORM");
  21 const CFStringRef kSecTransformErrorDomain = CFSTR("com.apple.security.transforms.error");
  22 const CFStringRef kSecTransformAbortAttributeName = CFSTR("ABORT");
  23
  24 CFErrorRef SecTransformConnectTransformsInternal(SecGroupTransformRef groupRef,
  25                                                                 SecTransformRef sourceTransformRef,
  26                                                                         CFStringRef sourceAttributeName,
  27                                                                         SecTransformRef destinationTransformRef,
  28                                                                         CFStringRef destinationAttributeName)
  29 {
  30         Transform* destination = (Transform*) CoreFoundationHolder::ObjectFromCFType(destinationTransformRef);
  31         Transform* source = (Transform*) CoreFoundationHolder::ObjectFromCFType(sourceTransformRef);
  32
  33         GroupTransform* group = (GroupTransform*) CoreFoundationHolder::ObjectFromCFType(groupRef);
  34         CFErrorRef temp = source->Connect(group, destination, destinationAttributeName, sourceAttributeName);
  35         return temp;
  36 }
  37
  38
  39 CFErrorRef SecTransformDisconnectTransforms(SecTransformRef sourceTransformRef, CFStringRef sourceAttributeName,
  40                                                                                         SecTransformRef destinationTransformRef, CFStringRef destinationAttributeName)
  41 {
  42         Transform* destination = (Transform*) CoreFoundationHolder::ObjectFromCFType(destinationTransformRef);
  43         Transform* source = (Transform*) CoreFoundationHolder::ObjectFromCFType(sourceTransformRef);
  44         return source->Disconnect(destination, sourceAttributeName, destinationAttributeName);
  45 }
  46
  47 SecGroupTransformRef SecTransformCreateGroupTransform()
  48 {
  49         return (SecGroupTransformRef) GroupTransform::Make();
  50 }
  51
  52 SecGroupTransformRef SecTransformConnectTransforms(SecTransformRef sourceTransformRef,
  53                                                    CFStringRef sourceAttributeName,
  54                                                    SecTransformRef destinationTransformRef,
  55                                                    CFStringRef destinationAttributeName,
  56                                                    SecGroupTransformRef group,
  57                                                    CFErrorRef *error)
  58 {
  59         if (group == NULL)
  60         {
  61                 if (error)
  62                 {
  63                         *error = CreateSecTransformErrorRef(kSecTransformErrorMissingParameter, "Group must not be NULL.");
  64                 }
  65
  66                 return NULL;
  67         }
  68
  69         if (destinationAttributeName == NULL)
  70         {
  71                 destinationAttributeName = kSecTransformInputAttributeName;
  72         }
  73
  74         if (sourceAttributeName == NULL)
  75         {
  76                 sourceAttributeName = kSecTransformOutputAttributeName;
  77         }
  78
  79         GroupTransform* gtr = (GroupTransform*) CoreFoundationHolder::ObjectFromCFType(group);
  80
  81         CFErrorRef temp = SecTransformConnectTransformsInternal(gtr->GetCFObject(),
  82                         sourceTransformRef, sourceAttributeName,
  83                         destinationTransformRef, destinationAttributeName);
  84
  85         if (error)
  86         {
  87         CFRetainSafe(temp);
  88                 *error = temp;
  89         }
  90
  91         if (temp) // an error happened?
  92         {
  93                 return NULL;
  94         }
  95         else
  96         {
  97                 return group;
  98         }
  99 }
 100
 101
 102
 103 Boolean SecTransformSetAttribute(SecTransformRef transformRef,
 104                                                                 CFStringRef key,
 105                                                                 CFTypeRef value,
 106                                                                 CFErrorRef *error)
 107 {
 108         Boolean result = false; // Guilty until proven
 109         Transform* transform = (Transform*) CoreFoundationHolder::ObjectFromCFType(transformRef);
 110
 111         if (CFGetTypeID(transformRef) == GroupTransform::GetCFTypeID() && !transform->getAH(key, false))
 112         {
 113                 if (error)
 114                 {
 115                         *error = CreateSecTransformErrorRef(kSecTransformOperationNotSupportedOnGroup, "SecTransformSetAttribute on non-exported attribute: %@ (exported attributes are: %@).", key, transform->GetAllAH());
 116                 }
 117
 118                 return result;
 119         }
 120
 121         // if the caller is setting the abort attribute, a value must be supplied
 122         if (NULL == value && CFStringCompare(key, kSecTransformAbortAttributeName, 0) == kCFCompareEqualTo)
 123         {
 124                 if (error)
 125                 {
 126             // XXX:  "a parameter"?  It has one: NULL.  What it requires is a non-NULL value.
 127                         *error = CreateSecTransformErrorRef(kSecTransformInvalidArgument, "ABORT requires a parameter.");
 128                 }
 129
 130                 return result;
 131         }
 132
 133         CFErrorRef temp = transform->ExternalSetAttribute(key, value);
 134         result = (temp == NULL);
 135         if (error)
 136         {
 137         CFRetainSafe(temp);
 138         *error = temp;
 139         }
 140
 141         return result;
 142 }
 143
 144
 145
 146 CFTypeRef SecTransformGetAttribute(SecTransformRef transformRef,
 147                                                                         CFStringRef key)
 148 {
 149         // if the transform is a group, we really want to operation on its first object
 150         if (CFGetTypeID(transformRef) == GroupTransform::GetCFTypeID())
 151         {
 152                 return NULL;
 153         }
 154
 155         Transform* transform = (Transform*) CoreFoundationHolder::ObjectFromCFType(transformRef);
 156         if (transform->mIsActive) {
 157         CFErrorRef error = CreateSecTransformErrorRef(kSecTransformTransformIsExecuting, "Can not get the value of attributes during execution (attempt to fetch %@/%@)", transform->GetName(), key);
 158         CFAutorelease(error);
 159                 return error;
 160         }
 161         return transform->GetAttribute(key);
 162 }
 163
 164
 165 #pragma clang diagnostic push
 166 #pragma clang diagnostic ignored "-Wunused-function"
 167 static inline GroupTransform* MakeGroupTransformFromTransformRef(SecTransformRef tr)
 168 {
 169         GroupTransform* gt = (GroupTransform*) CoreFoundationHolder::ObjectFromCFType(tr);
 170         return gt;
 171 }
 172 #pragma clang diagnostic pop
 173
 174 static CFTypeRef InternalSecTransformExecute(SecTransformRef transformRef,
 175                                                         CFErrorRef* errorRef,
 176                                                         dispatch_queue_t deliveryQueue,
 177                                                         SecMessageBlock deliveryBlock)
 178 {
 179         if (NULL == transformRef || (deliveryBlock && !deliveryQueue))
 180         {
 181                 CFErrorRef localError = CFErrorCreate(kCFAllocatorDefault, kSecTransformErrorDomain,
 182                         kSecTransformInvalidArgument, NULL);
 183
 184                 if (NULL != errorRef)
 185                 {
 186                         *errorRef = localError;
 187                 }
 188                 else
 189                 {
 190                         CFReleaseNull(localError);
 191                 }
 192
 193                 return (CFTypeRef)NULL;
 194         }
 195
 196         // if our transform is a group, connect to its first member instead
 197         if (CFGetTypeID(transformRef) == GroupTransform::GetCFTypeID())
 198         {
 199                 GroupTransform* gtsrc = (GroupTransform*) CoreFoundationHolder::ObjectFromCFType(transformRef);
 200                 transformRef = gtsrc->GetAnyMember();
 201         }
 202
 203         Transform* transform = (Transform*) CoreFoundationHolder::ObjectFromCFType(transformRef);
 204         return transform->Execute(deliveryQueue, deliveryBlock, errorRef);
 205 }
 206
 207 CFTypeRef SecTransformExecute(SecTransformRef transformRef, CFErrorRef* errorRef)
 208 {
 209         if (NULL == transformRef)
 210         {
 211                 if (errorRef)
 212                 {
 213                         *errorRef = CreateSecTransformErrorRef(kSecTransformInvalidArgument, "NULL transform can not be executed");
 214                 }
 215                 return NULL;
 216         }
 217
 218         Transform* transform = (Transform*) CoreFoundationHolder::ObjectFromCFType(transformRef);
 219
 220         // transform->Execute will check this, but by then we have attached a collector which causes all manner of issues.
 221         if (transform->mIsActive)
 222         {
 223                 if (errorRef)
 224                 {
 225                         *errorRef = CreateSecTransformErrorRef(kSecTransformTransformIsExecuting, "The %@ transform has already executed, it may not be executed again.", transform->GetName());
 226                 }
 227                 return NULL;
 228         }
 229
 230         SecTransformRef collectTransform = transforms_assume(SecCreateCollectTransform(errorRef));
 231         SecGroupTransformRef theGroup = NULL;
 232         Boolean releaseTheGroup = false;
 233         GroupTransform* myGroup = NULL;
 234         Boolean needConnection = true;
 235
 236         // Sniff the type of the transformRef to see if it is a group
 237         if (SecGroupTransformGetTypeID() == CFGetTypeID(transformRef))
 238         {
 239                 theGroup = (SecGroupTransformRef)transformRef;
 240         }
 241         else
 242         {
 243                 // Ok TransformRef is a TransformRef so get's it group
 244
 245                 myGroup = transform->mGroup;
 246
 247                 if (NULL == myGroup)
 248                 {
 249                         theGroup = SecTransformCreateGroupTransform();
 250                         if (NULL == theGroup)
 251                         {
 252                                 if (NULL != errorRef)
 253                                 {
 254                                         *errorRef = GetNoMemoryErrorAndRetain();
 255                                 }
 256
 257                                 return (CFTypeRef)NULL;
 258
 259                         }
 260
 261                         releaseTheGroup = true;
 262
 263 #ifdef __clang_analyzer__
 264             // we've already asserted that collectTransform is non-NULL, but clang doesn't know that, we skip use of it for the analyzer
 265             SecGroupTransformRef connectResult = NULL;
 266 #else
 267                         SecGroupTransformRef connectResult =
 268                                 SecTransformConnectTransforms(transformRef,
 269                                                                                   kSecTransformOutputAttributeName,
 270                                                                                   collectTransform,
 271                                                                                   kSecTransformInputAttributeName,
 272                                                                                   theGroup, errorRef);
 273 #endif
 274
 275                         if (NULL == connectResult)
 276                         {
 277                                 return (CFTypeRef)NULL;
 278                         }
 279
 280                         needConnection = false;
 281
 282                 }
 283                 else
 284                 {
 285                         theGroup = (SecGroupTransformRef)myGroup->GetCFObject();
 286                 }
 287         }
 288
 289         if (NULL == theGroup || (SecGroupTransformGetTypeID() != CFGetTypeID(theGroup)))
 290         {
 291                 if (NULL != errorRef)
 292                 {
 293                         *errorRef = GetNoMemoryErrorAndRetain();
 294                 }
 295
 296                 return (CFTypeRef)NULL;
 297
 298         }
 299
 300
 301         if (needConnection)
 302         {
 303                 // Connect the collectTransform to the group
 304                 myGroup = ((GroupTransform*)CoreFoundationHolder::ObjectFromCFType(theGroup))->GetRootGroup();
 305         if (NULL == myGroup)
 306         {
 307             if (NULL != errorRef)
 308             {
 309                 *errorRef = GetNoMemoryErrorAndRetain();
 310             }
 311
 312             return (CFTypeRef)NULL;
 313         }
 314
 315                 SecTransformRef outputTransform = myGroup->FindLastTransform();
 316
 317 #ifdef __clang_analyzer__
 318         // we've already asserted that collectTransform is non-NULL, but clang doesn't know that, we skip use of it for the analyzer
 319         SecGroupTransformRef connectResult = NULL;
 320 #else
 321                 SecGroupTransformRef connectResult =
 322                 SecTransformConnectTransforms(outputTransform,
 323                                                                           kSecTransformOutputAttributeName,
 324                                                                           collectTransform,
 325                                                                           kSecTransformInputAttributeName,
 326                                                                           myGroup->GetCFObject(), errorRef);
 327
 328                 if (NULL == connectResult)
 329                 {
 330                         CFReleaseNull(collectTransform);
 331                         if (releaseTheGroup)
 332                         {
 333                                 CFReleaseNull(theGroup);
 334                         }
 335                         return (CFTypeRef)NULL;
 336                 }
 337 #endif // __clang_analyzer__
 338         }
 339
 340         __block CFTypeRef myResult = NULL;
 341         dispatch_semaphore_t mySem = dispatch_semaphore_create(0L);
 342         dispatch_queue_t myQueue = dispatch_queue_create("com.apple.security.sectransfrom.SecTransformExecute", NULL);
 343         SecMessageBlock myBlock = ^(CFTypeRef message, CFErrorRef error, Boolean isFinal)
 344         {
 345                 if (NULL != error)
 346                 {
 347                         if (NULL != errorRef)
 348                         {
 349                                 CFRetainSafe(error);
 350                                 *errorRef = error;
 351                         }
 352
 353                         if (NULL != myResult)
 354                         {
 355                                 CFReleaseNull(myResult);
 356                                 myResult = NULL;
 357                         }
 358                 }
 359
 360                 if (NULL != message)
 361                 {
 362                         myResult = message;
 363                         CFRetainSafe(myResult);
 364                 }
 365
 366                 if (isFinal)
 367                 {
 368                         dispatch_semaphore_signal(mySem);
 369                 }
 370         };
 371
 372         SecTransformExecuteAsync(theGroup, myQueue, myBlock);
 373         dispatch_semaphore_wait(mySem, DISPATCH_TIME_FOREVER);
 374         dispatch_release(mySem);
 375         dispatch_release(myQueue);
 376
 377         if (releaseTheGroup)
 378         {
 379                 CFRelease(theGroup);
 380                 theGroup = NULL;
 381         }
 382         CFRelease(collectTransform);
 383
 384         return myResult;
 385 }
 386
 387 void SecTransformExecuteAsync(SecTransformRef transformRef,
 388                                                           dispatch_queue_t deliveryQueue,
 389                                                           SecMessageBlock deliveryBlock)
 390 {
 391         CFErrorRef localError = NULL;
 392         InternalSecTransformExecute(transformRef, &localError, deliveryQueue, deliveryBlock);
 393
 394         // if we got an error (usually a transform startup error), we must deliver it
 395         if (localError != NULL)
 396         {
 397                 // The monitor treats a NULL queue as running on it's own queue, which from an appication's point of view is
 398                 // the same as a default global queue.   Chances are there is no monitor at this point, so it is best to just use the
 399                 //  global queue for this.
 400                 dispatch_queue_t effectiveQueue = deliveryQueue ? deliveryQueue : dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, NULL);
 401                 dispatch_async(effectiveQueue, ^{
 402                         deliveryBlock(NULL, localError, true);
 403                 });
 404         }
 405 }
 406
 407 CFDictionaryRef SecTransformCopyExternalRepresentation(SecTransformRef transformRef)
 408 {
 409
 410         Transform* tr = (Transform*) CoreFoundationHolder::ObjectFromCFType(transformRef);
 411         return tr->Externalize(NULL);
 412 }
 413
 414 CFStringRef SecTransformDotForDebugging(SecTransformRef transformRef)
 415 {
 416     if (CFGetTypeID(transformRef) == SecGroupTransformGetTypeID()) {
 417         GroupTransform* tr = (GroupTransform*) CoreFoundationHolder::ObjectFromCFType(transformRef);
 418         return tr->DotForDebugging();
 419     } else {
 420         return CFSTR("Can only dot debug a group");
 421     }
 422 }
 423
 424 SecTransformRef SecTransformCreateFromExternalRepresentation(
 425                                                                 CFDictionaryRef dictionary,
 426                                                                 CFErrorRef *error)
 427 {
 428         // The incoming dictionary consists of a list of transforms and
 429         // a list of connections.  We start by making the individual
 430         // transforms and storing them in a dictionary so that we can
 431         // efficiently make connections
 432
 433         CFArrayRef transforms = (CFArrayRef) CFDictionaryGetValue(dictionary, EXTERN_TRANSFORM_TRANSFORM_ARRAY);
 434         if (transforms == NULL)
 435         {
 436                 // The dictionary we got is massively malformed!
 437                 *error = CreateSecTransformErrorRef(kSecTransformErrorInvalidInputDictionary, "%@ is missing from the dictionary.  The dictionary is malformed.", EXTERN_TRANSFORM_TRANSFORM_ARRAY);
 438                 return NULL;
 439         }
 440
 441         CFArrayRef connections = (CFArrayRef) CFDictionaryGetValue(dictionary, EXTERN_TRANSFORM_CONNECTION_ARRAY);
 442         if (connections == NULL)
 443         {
 444                 // The dictionary we got is massively malformed!
 445                 *error = CreateSecTransformErrorRef(kSecTransformErrorInvalidInputDictionary, "%@ is missing from the dictionary.  The dictionary is malformed.", EXTERN_TRANSFORM_CONNECTION_ARRAY);
 446                 return NULL;
 447         }
 448
 449         CFMutableDictionaryRef transformHolder = CFDictionaryCreateMutable(NULL, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 450         CFTypeRefHolder _(transformHolder);
 451
 452         CFIndex numTransforms = CFArrayGetCount(transforms);
 453         CFIndex n;
 454
 455         SecTransformRef aTransform = NULL;
 456
 457         for (n = 0; n < numTransforms; ++n)
 458         {
 459                 // get the basic info we need
 460                 CFDictionaryRef xTransform = (CFDictionaryRef) CFArrayGetValueAtIndex(transforms, n);
 461
 462                 CFStringRef xName = (CFStringRef) CFDictionaryGetValue(xTransform, EXTERN_TRANSFORM_NAME);
 463
 464                 CFStringRef xType = (CFStringRef) CFDictionaryGetValue(xTransform, EXTERN_TRANSFORM_TYPE);
 465
 466                 // reconstruct the transform
 467                 aTransform = TransformFactory::MakeTransformWithType(xType, error);
 468                 SecTransformSetAttribute(aTransform, kSecTransformTransformName, xName, NULL);
 469
 470                 // restore the transform state
 471                 Transform* tr = (Transform*) CoreFoundationHolder::ObjectFromCFType(aTransform);
 472                 tr->RestoreState((CFDictionaryRef) CFDictionaryGetValue(xTransform, EXTERN_TRANSFORM_STATE));
 473                 tr->SetCustomExternalData((CFDictionaryRef) CFDictionaryGetValue(xTransform, EXTERN_TRANSFORM_CUSTOM_EXPORTS_DICTIONARY));
 474
 475                 CFIndex cnt = CFDictionaryGetCount(transformHolder);
 476
 477                 // add the transform to the dictionary
 478                 CFDictionaryAddValue(transformHolder, xName, aTransform);
 479
 480                 if (CFDictionaryGetCount(transformHolder) <= cnt)
 481                 {
 482                         if (error)
 483                         {
 484                                 *error = CreateSecTransformErrorRef(kSecTransformErrorInvalidInputDictionary,
 485                                                         "Out of memory, or damaged input dictonary (duplicate label %@?)", xName);
 486                         }
 487             CFSafeRelease(aTransform);
 488                         return NULL;
 489                 }
 490         }
 491
 492         CFIndex numConnections = CFArrayGetCount(connections);
 493         if (numConnections == 0)
 494         {
 495                 return aTransform;
 496         }
 497
 498         SecGroupTransformRef gt = SecTransformCreateGroupTransform();
 499
 500         for (n = 0; n < numConnections; ++n)
 501         {
 502                 CFDictionaryRef connection = (CFDictionaryRef) CFArrayGetValueAtIndex(connections, n);
 503                 CFStringRef fromTransformName = (CFStringRef) CFDictionaryGetValue(connection, EXTERN_TRANSFORM_FROM_NAME);
 504                 CFStringRef fromAttribute = (CFStringRef) CFDictionaryGetValue(connection, EXTERN_TRANSFORM_FROM_ATTRIBUTE);
 505                 CFStringRef toTransformName = (CFStringRef) CFDictionaryGetValue(connection, EXTERN_TRANSFORM_TO_NAME);
 506                 CFStringRef toAttribute = (CFStringRef) CFDictionaryGetValue(connection, EXTERN_TRANSFORM_TO_ATTRIBUTE);
 507
 508                 SecTransformRef fromTransform = (SecTransformRef) CFDictionaryGetValue(transformHolder, fromTransformName);
 509                 if (!fromTransform) {
 510                         if (error) {
 511                                 *error = CreateSecTransformErrorRef(kSecTransformErrorInvalidInputDictionary, "Can't connect %@ to %@ because %@ was not found", fromTransformName, toTransformName, fromTransformName);
 512                         }
 513                         return NULL;
 514                 }
 515                 SecTransformRef toTransform = (SecTransformRef) CFDictionaryGetValue(transformHolder, toTransformName);
 516                 if (!toTransform) {
 517                         if (error) {
 518                                 *error = CreateSecTransformErrorRef(kSecTransformErrorInvalidInputDictionary, "Can't connect %@ to %@ because %@ was not found", fromTransformName, toTransformName, toTransformName);
 519                         }
 520                         return NULL;
 521                 }
 522
 523                 aTransform = SecTransformConnectTransforms(fromTransform, fromAttribute, toTransform, toAttribute, gt, error);
 524         }
 525
 526         return gt;
 527 }
 528
 529
 530
 531 SecTransformRef SecTransformFindByName(SecTransformRef transform, CFStringRef name)
 532 {
 533         Transform *t = (Transform*)CoreFoundationHolder::ObjectFromCFType(transform);
 534     GroupTransform *g = t->GetRootGroup();
 535
 536     if (g) {
 537         return g->FindByName(name);
 538     } else {
 539         // There is no group, so if transform isn't our guy nobody is.
 540         return (CFStringCompare(name, t->GetName(), 0) == kCFCompareEqualTo) ? transform : NULL;
 541     }
 542 }
 543
 544
 545
 546 CFTypeID SecGroupTransformGetTypeID()
 547 {
 548         return GroupTransform::GetCFTypeID();
 549 }
 550
 551 CFTypeID SecTransformGetTypeID()
 552 {
 553         // Obviously this is wrong (returns same CFTypeID as SecTransformGetTypeID) Needs to be fixed
 554         return GroupTransform::GetCFTypeID();
 555 }