OSX/libsecurity_cdsa_utilities/lib/acl_protectedpw.cpp

   1 /*
   2  * Copyright (c) 2000-2006,2011,2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 //
  26 // acl_protectedpw - protected-path password-based ACL subject types.
  27 //
  28 #include <security_cdsa_utilities/acl_protectedpw.h>
  29 #include <security_utilities/debugging.h>
  30 #include <algorithm>
  31
  32
  33 //
  34 // Construct a password ACL subject
  35 //
  36 ProtectedPasswordAclSubject::ProtectedPasswordAclSubject(Allocator &alloc, const CssmData &password)
  37     : SimpleAclSubject(CSSM_ACL_SUBJECT_TYPE_PROTECTED_PASSWORD),
  38     allocator(alloc), mPassword(alloc, password)
  39 { }
  40
  41 ProtectedPasswordAclSubject::ProtectedPasswordAclSubject(Allocator &alloc, CssmManagedData &password)
  42     : SimpleAclSubject(CSSM_ACL_SUBJECT_TYPE_PROTECTED_PASSWORD),
  43     allocator(alloc), mPassword(alloc, password)
  44 { }
  45
  46
  47 //
  48 // Validate a credential set against this subject
  49 //
  50 bool ProtectedPasswordAclSubject::validates(const AclValidationContext &context,
  51     const TypedList &sample) const
  52 {
  53     if (sample.length() == 1) {
  54         return true;    //@@@ validate against PP
  55     } else if (sample.length() == 2 && sample[1].type() == CSSM_LIST_ELEMENT_DATUM) {
  56         const CssmData &password = sample[1];
  57         return password == mPassword;
  58     } else
  59                 CssmError::throwMe(CSSM_ERRCODE_INVALID_SAMPLE_VALUE);
  60 }
  61
  62
  63 //
  64 // Make a copy of this subject in CSSM_LIST form
  65 //
  66 CssmList ProtectedPasswordAclSubject::toList(Allocator &alloc) const
  67 {
  68     // the password itself is private and not exported to CSSM
  69         return TypedList(alloc, CSSM_ACL_SUBJECT_TYPE_PROTECTED_PASSWORD);
  70 }
  71
  72
  73 //
  74 // Create a ProtectedPasswordAclSubject
  75 //
  76 ProtectedPasswordAclSubject *ProtectedPasswordAclSubject::Maker::make(const TypedList &list) const
  77 {
  78     CssmAutoData password(Allocator::standard(Allocator::sensitive));
  79     if (list.length() == 1) {
  80         char pass[] = "secret";
  81         CssmData password = CssmData::wrap(pass, 6);            //@@@ get password from PP
  82         return new ProtectedPasswordAclSubject(Allocator::standard(Allocator::sensitive), password);
  83     } else {
  84         ListElement *password;
  85         crack(list, 1, &password, CSSM_LIST_ELEMENT_DATUM);
  86         return new ProtectedPasswordAclSubject(Allocator::standard(Allocator::sensitive), *password);
  87     }
  88 }
  89
  90 ProtectedPasswordAclSubject *ProtectedPasswordAclSubject::Maker::make(Version,
  91         Reader &pub, Reader &priv) const
  92 {
  93     Allocator &alloc = Allocator::standard(Allocator::sensitive);
  94         const void *data; size_t length; priv.countedData(data, length);
  95         return new ProtectedPasswordAclSubject(alloc, CssmAutoData(alloc, data, length));
  96 }
  97
  98
  99 //
 100 // Export the subject to a memory blob
 101 //
 102 void ProtectedPasswordAclSubject::exportBlob(Writer::Counter &pub, Writer::Counter &priv)
 103 {
 104         priv.countedData(mPassword);
 105 }
 106
 107 void ProtectedPasswordAclSubject::exportBlob(Writer &pub, Writer &priv)
 108 {
 109         priv.countedData(mPassword);
 110 }
 111
 112
 113 #ifdef DEBUGDUMP
 114
 115 void ProtectedPasswordAclSubject::debugDump() const
 116 {
 117         Debug::dump("Protected Password ");
 118         Debug::dumpData(mPassword.data(), mPassword.length());
 119 }
 120
 121 #endif //DEBUGDUMP