OSX/libsecurity_keychain/lib/TrustSettings.cpp

   1 /*
   2  * Copyright (c) 2005,2011-2015 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*
  25  * TrustSettings.h - class to manage cert trust settings.
  26  *
  27  */
  28
  29 #include "TrustSettings.h"
  30 #include "TrustSettingsSchema.h"
  31 #include <Security/SecTrustSettings.h>
  32 #include "TrustSettingsUtils.h"
  33 #include "TrustKeychains.h"
  34 #include "Certificate.h"
  35 #include "cssmdatetime.h"
  36 #include <Security/SecBase.h>
  37 #include "SecTrustedApplicationPriv.h"
  38 #include <security_utilities/errors.h>
  39 #include <security_utilities/debugging.h>
  40 #include <security_utilities/logging.h>
  41 #include <security_utilities/cfutilities.h>
  42 #include <security_utilities/alloc.h>
  43 #include <security_utilities/casts.h>
  44 #include <utilities/SecCFRelease.h>
  45 #include <Security/Authorization.h>
  46 #include <Security/cssmapplePriv.h>
  47 #include <Security/oidscert.h>
  48 #include <Security/SecCertificatePriv.h>
  49 #include <Security/SecPolicyPriv.h>
  50 #include <security_keychain/KCCursor.h>
  51 #include <security_ocspd/ocspdClient.h>
  52 #include <CoreFoundation/CoreFoundation.h>
  53 #include <security_utilities/simulatecrash_assert.h>
  54 #include <dispatch/dispatch.h>
  55 #include <sys/stat.h>
  56 #include <syslog.h>
  57
  58 #if 0
  59 #define trustSettingsDbg(args...)               syslog(LOG_ERR, ## args)
  60 #define trustSettingsEvalDbg(args...)   syslog(LOG_ERR, ## args)
  61 #else
  62 #define trustSettingsDbg(args...)               secinfo("trustSettings", ## args)
  63 #define trustSettingsEvalDbg(args...)   secinfo("trustSettingsEval", ## args)
  64 #endif
  65
  66 /*
  67  * Common error return for "malformed TrustSettings record"
  68  */
  69 #define errSecInvalidTrustedRootRecord  errSecInvalidTrustSettings
  70
  71 using namespace KeychainCore;
  72
  73 #pragma mark --- Static functions ---
  74
  75 /*
  76  * Comparator atoms to determine if an app's specified usage
  77  * matches an individual trust setting. Each returns true on a match, false
  78  * if the trust setting does not match the app's spec.
  79  *
  80  * A match fails iff:
  81  *
  82  * -- the app has specified a field, and the cert has a spec for that
  83  *    field, and the two specs do not match;
  84  *
  85  * OR
  86  *
  87  * -- the cert has a spec for the field and the app hasn't specified the field
  88  */
  89 static bool tsCheckPolicy(
  90         const CSSM_OID *appPolicy,
  91         CFDataRef certPolicy)
  92 {
  93         if(certPolicy != NULL) {
  94                 if(appPolicy == NULL) {
  95                         trustSettingsEvalDbg("tsCheckPolicy: certPolicy, !appPolicy");
  96                         return false;
  97                 }
  98                 unsigned cLen = (unsigned)CFDataGetLength(certPolicy);
  99                 const UInt8 *cData = CFDataGetBytePtr(certPolicy);
 100                 if((cLen != appPolicy->Length) || memcmp(appPolicy->Data, cData, cLen)) {
 101                         trustSettingsEvalDbg("tsCheckPolicy: policy mismatch");
 102                         return false;
 103                 }
 104         }
 105         return true;
 106 }
 107
 108 /*
 109  * This one's slightly different: the match is for *this* app, not one
 110  * specified by the app.
 111  */
 112 static bool tsCheckApp(
 113         CFDataRef certApp)
 114 {
 115         if(certApp != NULL) {
 116                 SecTrustedApplicationRef appRef;
 117                 OSStatus ortn;
 118                 ortn = SecTrustedApplicationCreateWithExternalRepresentation(certApp, &appRef);
 119                 if(ortn) {
 120                         trustSettingsDbg("tsCheckApp: bad trustedApp data");
 121                         return false;
 122                 }
 123                 ortn = SecTrustedApplicationValidateWithPath(appRef, NULL);
 124                 if(ortn) {
 125                         /* Not this app */
 126                         return false;
 127                 }
 128         }
 129
 130         return true;
 131 }
 132
 133 static bool tsCheckKeyUse(
 134         SecTrustSettingsKeyUsage appKeyUse,
 135         CFNumberRef certKeyUse)
 136 {
 137         if(certKeyUse != NULL) {
 138                 SInt32 certUse;
 139                 CFNumberGetValue(certKeyUse, kCFNumberSInt32Type, &certUse);
 140                 SecTrustSettingsKeyUsage cku = (SecTrustSettingsKeyUsage)certUse;
 141                 if(cku == kSecTrustSettingsKeyUseAny) {
 142                         /* explicitly allows anything */
 143                         return true;
 144                 }
 145                 /* cert specification must be a superset of app's intended use */
 146                 if(appKeyUse == 0) {
 147                         trustSettingsEvalDbg("tsCheckKeyUse: certKeyUsage, !appKeyUsage");
 148                         return false;
 149                 }
 150
 151                 if((cku & appKeyUse) != appKeyUse) {
 152                         trustSettingsEvalDbg("tsCheckKeyUse: keyUse mismatch");
 153                         return false;
 154                 }
 155         }
 156         return true;
 157 }
 158
 159 static bool tsCheckPolicyStr(
 160         const char *appPolicyStr,
 161         CFStringRef certPolicyStr)
 162 {
 163         if(certPolicyStr != NULL) {
 164                 if(appPolicyStr == NULL) {
 165                         trustSettingsEvalDbg("tsCheckPolicyStr: certPolicyStr, !appPolicyStr");
 166                         return false;
 167                 }
 168                 /* Let CF do the string compare */
 169                 CFStringRef cfPolicyStr = CFStringCreateWithCString(NULL, appPolicyStr,
 170                         kCFStringEncodingUTF8);
 171                 if(cfPolicyStr == NULL) {
 172                         /* I really don't see how this can happen */
 173                         trustSettingsEvalDbg("tsCheckPolicyStr: policyStr string conversion error");
 174                         return false;
 175                 }
 176
 177                 // Some trust setting strings were created with a NULL character at the
 178                 // end, which was included in the length. Strip those off before compare
 179
 180                 CFMutableStringRef certPolicyStrNoNULL = CFStringCreateMutableCopy(NULL, 0, certPolicyStr);
 181                 if (certPolicyStrNoNULL == NULL) {
 182                         /* I really don't see how this can happen either */
 183                         trustSettingsEvalDbg("tsCheckPolicyStr: policyStr string conversion error 2");
 184             CFReleaseNull(cfPolicyStr);
 185                         return false;
 186                 }
 187
 188                 CFStringFindAndReplace(certPolicyStrNoNULL, CFSTR("\00"),
 189                         CFSTR(""), CFRangeMake(0, CFStringGetLength(certPolicyStrNoNULL)), kCFCompareBackwards);
 190
 191                 CFComparisonResult res = CFStringCompare(cfPolicyStr, certPolicyStrNoNULL, 0);
 192                 CFRelease(cfPolicyStr);
 193                 CFRelease(certPolicyStrNoNULL);
 194                 if(res != kCFCompareEqualTo) {
 195                         trustSettingsEvalDbg("tsCheckPolicyStr: policyStr mismatch");
 196                         return false;
 197                 }
 198         }
 199         return true;
 200 }
 201
 202 /*
 203  * Determine if a cert's trust settings dictionary satisfies the specified
 204  * usage constraints. Returns true if so.
 205  * Only certs with a SecTrustSettingsResult of kSecTrustSettingsResultTrustRoot
 206  * or kSecTrustSettingsResultTrustAsRoot will match.
 207  */
 208 static bool qualifyUsageWithCertDict(
 209         CFDictionaryRef                 certDict,
 210         const CSSM_OID                  *policyOID,             /* optional */
 211         const char                              *policyStr,             /* optional */
 212         SecTrustSettingsKeyUsage keyUsage,      /* optional; default = any (actually "all" here) */
 213         bool                                    onlyRoots)
 214 {
 215         /* this array is optional */
 216         CFArrayRef trustSettings = (CFArrayRef)CFDictionaryGetValue(certDict,
 217                 kTrustRecordTrustSettings);
 218         CFIndex numSpecs = 0;
 219         if(trustSettings != NULL) {
 220                 numSpecs = CFArrayGetCount(trustSettings);
 221         }
 222         if(numSpecs == 0) {
 223                 /*
 224                  * Trivial case: cert has no trust settings, indicating that
 225                  * it's used for everything.
 226                  */
 227                 trustSettingsEvalDbg("qualifyUsageWithCertDict: no trust settings");
 228                 return true;
 229         }
 230         for(CFIndex addDex=0; addDex<numSpecs; addDex++) {
 231                 CFDictionaryRef tsDict = (CFDictionaryRef)CFArrayGetValueAtIndex(trustSettings,
 232                         addDex);
 233
 234                 /* per-cert specs: all optional */
 235                 CFDataRef   certPolicy     = (CFDataRef)CFDictionaryGetValue(tsDict,
 236                                                                                 kSecTrustSettingsPolicy);
 237                 CFDataRef   certApp        = (CFDataRef)CFDictionaryGetValue(tsDict,
 238                                                                                 kSecTrustSettingsApplication);
 239                 CFStringRef certPolicyStr  = (CFStringRef)CFDictionaryGetValue(tsDict,
 240                                                                                 kSecTrustSettingsPolicyString);
 241                 CFNumberRef certKeyUsage   = (CFNumberRef)CFDictionaryGetValue(tsDict,
 242                                                                                 kSecTrustSettingsKeyUsage);
 243                 CFNumberRef certResultType = (CFNumberRef)CFDictionaryGetValue(tsDict,
 244                                                                                 kSecTrustSettingsResult);
 245
 246                 if(!tsCheckPolicy(policyOID, certPolicy)) {
 247                         continue;
 248                 }
 249                 if(!tsCheckApp(certApp)) {
 250                         continue;
 251                 }
 252                 if(!tsCheckKeyUse(keyUsage, certKeyUsage)) {
 253                         continue;
 254                 }
 255                 if(!tsCheckPolicyStr(policyStr, certPolicyStr)) {
 256                         continue;
 257                 }
 258
 259                 /*
 260                  * This is a match, take whatever SecTrustSettingsResult is here,
 261                  * including the default if not specified.
 262                  */
 263                 SecTrustSettingsResult resultType = kSecTrustSettingsResultTrustRoot;
 264                 if(certResultType) {
 265                         SInt32 s;
 266                         CFNumberGetValue(certResultType, kCFNumberSInt32Type, &s);
 267                         resultType = (SecTrustSettingsResult)s;
 268                 }
 269                 switch(resultType) {
 270                         case kSecTrustSettingsResultTrustRoot:
 271                                 trustSettingsEvalDbg("qualifyUsageWithCertDict: TrustRoot MATCH");
 272                                 return true;
 273                         case kSecTrustSettingsResultTrustAsRoot:
 274                                 if(onlyRoots) {
 275                                         trustSettingsEvalDbg("qualifyUsageWithCertDict: TrustAsRoot but not root");
 276                                         return false;
 277                                 }
 278                                 trustSettingsEvalDbg("qualifyUsageWithCertDict: TrustAsRoot MATCH");
 279                                 return true;
 280                         default:
 281                                 trustSettingsEvalDbg("qualifyUsageWithCertDict: bad resultType "
 282                                         "(%lu)", (unsigned long)resultType);
 283                                 return false;
 284                 }
 285         }
 286         trustSettingsEvalDbg("qualifyUsageWithCertDict: NO MATCH");
 287         return false;
 288 }
 289
 290 /*
 291  * Create initial top-level dictionary when constructing a new TrustSettings.
 292  */
 293 static CFMutableDictionaryRef tsInitialDict()
 294 {
 295         CFMutableDictionaryRef dict = CFDictionaryCreateMutable(NULL,
 296                 kSecTrustRecordNumTopDictKeys,
 297                 &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 298
 299         /* the dictionary of per-cert entries */
 300         CFMutableDictionaryRef trustDict = CFDictionaryCreateMutable(NULL, 0,
 301                 &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 302         CFDictionaryAddValue(dict, kTrustRecordTrustList, trustDict);
 303         CFRelease(trustDict);
 304
 305         SInt32 vers = kSecTrustRecordVersionCurrent;
 306         CFNumberRef cfVers = CFNumberCreate(NULL, kCFNumberSInt32Type, &vers);
 307         CFDictionaryAddValue(dict, kTrustRecordVersion, cfVers);
 308         CFRelease(cfVers);
 309         return dict;
 310 }
 311
 312 /*
 313  * Set the modification date of a per-cert dictionary to current time.
 314  */
 315 static void tsSetModDate(
 316         CFMutableDictionaryRef dict)
 317 {
 318         CFDateRef modDate;
 319
 320         modDate = CFDateCreate(NULL, CFAbsoluteTimeGetCurrent());
 321         CFDictionarySetValue(dict, kTrustRecordModDate, modDate);
 322         CFRelease(modDate);
 323 }
 324
 325 /* make sure a presumed CFNumber can be converted to a 32-bit number */
 326 static
 327 bool tsIsGoodCfNum(CFNumberRef cfn, SInt32 *num = NULL)
 328 {
 329         if(cfn == NULL) {
 330                 /* by convention */
 331                 if(num) {
 332                         *num = 0;
 333                 }
 334                 return true;
 335         }
 336         if(CFGetTypeID(cfn) != CFNumberGetTypeID()) {
 337                 return false;
 338         }
 339
 340         SInt32 s;
 341         if(!CFNumberGetValue(cfn, kCFNumberSInt32Type, &s)) {
 342                 return false;
 343         }
 344         else {
 345                 if(num) {
 346                         *num = s;
 347                 }
 348                 return true;
 349         }
 350 }
 351
 352 TrustSettings::TrustSettings(SecTrustSettingsDomain domain)
 353                 : mPropList(NULL),
 354                   mTrustDict(NULL),
 355                   mDictVersion(0),
 356                   mDomain(domain),
 357                   mDirty(false)
 358 {
 359 }
 360
 361
 362
 363 #pragma mark --- Public methods ---
 364
 365 /*
 366  * Normal constructor, from disk.
 367  * If create is true, the absence of an on-disk TrustSettings file
 368  * results in the creation of a new empty TrustSettings. If create is
 369  * false and no on-disk TrustSettings exists, errSecNoTrustSettings is
 370  * thrown.
 371  * If trim is true, the components of the on-disk TrustSettings not
 372  * needed for cert evaluation are discarded. This is for TrustSettings
 373  * that will be cached in memory long-term.
 374  */
 375 OSStatus TrustSettings::CreateTrustSettings(
 376         SecTrustSettingsDomain  domain,
 377         bool                                    create,
 378         bool                                    trim,
 379         TrustSettings*&                 ts)
 380 {
 381         TrustSettings* t = new TrustSettings(domain);
 382
 383         Allocator &alloc = Allocator::standard();
 384         CSSM_DATA fileData = {0, NULL};
 385         OSStatus ortn = errSecSuccess;
 386         struct stat sb;
 387         const char *path;
 388
 389         /* get trust settings from file, one way or another */
 390         switch(domain) {
 391                 case kSecTrustSettingsDomainAdmin:
 392                         /*
 393                          * Quickie optimization: if it's not there, don't try to
 394                          * get it from ocspd. This is possible because the name of the
 395                          * admin file is hard coded, but the per-user files aren't.
 396                          */
 397                         path = TRUST_SETTINGS_PATH "/" ADMIN_TRUST_SETTINGS;
 398                         if(stat(path, &sb)) {
 399                                 trustSettingsDbg("TrustSettings: no admin record; skipping");
 400                                 ortn = errSecNoTrustSettings;
 401                                 break;
 402                         }
 403                         /* else drop thru, get it from ocspd */
 404                 case kSecTrustSettingsDomainUser:
 405                         /* get settings from ocspd */
 406                         ortn = ocspdTrustSettingsRead(alloc, domain, fileData);
 407                         break;
 408                 case kSecTrustSettingsDomainSystem:
 409                         /* immutable; it's safe for us to read this directly */
 410                         if(tsReadFile(SYSTEM_TRUST_SETTINGS_PATH, alloc, fileData)) {
 411                                 ortn = errSecNoTrustSettings;
 412                         }
 413                         break;
 414                 default:
 415                         delete t;
 416                         return errSecParam;
 417         }
 418         if(ortn) {
 419                 if(create) {
 420                         trustSettingsDbg("TrustSettings: creating new record for domain %d",
 421                                 (int)domain);
 422                         t->mPropList = tsInitialDict();
 423                         t->mDirty = true;
 424                 }
 425                 else {
 426                         trustSettingsDbg("TrustSettings: record not found for domain %d",
 427                                 (int)domain);
 428                         delete t;
 429                         return ortn;
 430                 }
 431         }
 432         else {
 433                 CFRef<CFDataRef> propList(CFDataCreate(NULL, fileData.Data, fileData.Length));
 434                 t->initFromData(propList);
 435                 alloc.free(fileData.Data);
 436         }
 437         t->validatePropList(trim);
 438
 439         ts = t;
 440         return errSecSuccess;
 441 }
 442
 443 /*
 444  * Create from external data, obtained by createExternal().
 445  * If externalData is NULL, we'll create an empty mTrustDict.
 446  */
 447 OSStatus TrustSettings::CreateTrustSettings(
 448         SecTrustSettingsDomain                          domain,
 449         CFDataRef                                                       externalData,
 450         TrustSettings*&                                         ts)
 451 {
 452         switch(domain) {
 453                 case kSecTrustSettingsDomainUser:
 454                 case kSecTrustSettingsDomainAdmin:
 455                 case kSecTrustSettingsDomainMemory:
 456                         break;
 457                 case kSecTrustSettingsDomainSystem:             /* no can do, that implies writing to it */
 458                 default:
 459                         return errSecParam;
 460         }
 461
 462         TrustSettings* t = new TrustSettings(domain);
 463
 464         if(externalData != NULL) {
 465                 t->initFromData(externalData);
 466         }
 467         else {
 468                 t->mPropList = tsInitialDict();
 469         }
 470         t->validatePropList(TRIM_NO);           /* never trim this */
 471         t->mDirty = true;
 472
 473         ts = t;
 474         return errSecSuccess;
 475 }
 476
 477
 478 TrustSettings::~TrustSettings()
 479 {
 480         trustSettingsDbg("TrustSettings(domain %d) destructor", (int)mDomain);
 481         CFRELEASE(mPropList);           /* may be null if trimmed */
 482         CFRELEASE(mTrustDict);          /* normally always non-NULL */
 483
 484 }
 485
 486 /* common code to init mPropList from raw data */
 487 void TrustSettings::initFromData(
 488         CFDataRef       trustSettingsData)
 489 {
 490         CFStringRef errStr = NULL;
 491
 492         mPropList = (CFMutableDictionaryRef)CFPropertyListCreateFromXMLData(
 493                 NULL,
 494                 trustSettingsData,
 495                 kCFPropertyListMutableContainersAndLeaves,
 496                 &errStr);
 497         if(mPropList == NULL) {
 498                 trustSettingsDbg("TrustSettings::initFromData decode err (%s)",
 499                         errStr ? CFStringGetCStringPtr(errStr, kCFStringEncodingUTF8) : "<no err>");
 500                 if(errStr != NULL) {
 501                         CFRelease(errStr);
 502                 }
 503                 MacOSError::throwMe(errSecInvalidTrustSettings);
 504         }
 505 }
 506
 507 /*
 508  * Flush property list data out to disk if dirty.
 509  */
 510 void TrustSettings::flushToDisk()
 511 {
 512         if(!mDirty) {
 513                 trustSettingsDbg("flushToDisk, domain %d, !dirty!", (int)mDomain);
 514                 return;
 515         }
 516         if(mPropList == NULL) {
 517                 trustSettingsDbg("flushToDisk, domain %d, trimmed!", (int)mDomain);
 518                 assert(0);
 519                 MacOSError::throwMe(errSecInternalComponent);
 520         }
 521         switch(mDomain) {
 522                 case kSecTrustSettingsDomainSystem:
 523                 case kSecTrustSettingsDomainMemory:
 524                 /* caller shouldn't even try this */
 525                 default:
 526                         trustSettingsDbg("flushToDisk, bad domain (%d)", (int)mDomain);
 527                         MacOSError::throwMe(errSecInternalComponent);
 528                 case kSecTrustSettingsDomainUser:
 529                 case kSecTrustSettingsDomainAdmin:
 530                         break;
 531         }
 532
 533         /*
 534          * Optimization: if there are no certs in the mTrustDict dictionary,
 535          * we tell ocspd to *remove* the settings for the specified domain.
 536          * Having *no* settings uses less memory and is faster than having
 537          * an empty settings file, especially for the admin domain, where we
 538          * can avoid
 539          * an RPC if the settings file is simply not there.
 540          */
 541         CFRef<CFDataRef> xmlData;
 542         CSSM_DATA cssmXmlData = {0, NULL};
 543         CFIndex numCerts = CFDictionaryGetCount(mTrustDict);
 544         if(numCerts) {
 545                 xmlData.take(CFPropertyListCreateXMLData(NULL, mPropList));
 546                 if(!xmlData) {
 547                         /* we've been very careful; this should never happen */
 548                         trustSettingsDbg("flushToDisk, domain %d: error converting to XML", (int)mDomain);
 549                         MacOSError::throwMe(errSecInternalComponent);
 550                 }
 551                 cssmXmlData.Data = (uint8 *)CFDataGetBytePtr(xmlData);
 552                 cssmXmlData.Length = CFDataGetLength(xmlData);
 553         }
 554         else {
 555                 trustSettingsDbg("flushToDisk, domain %d: DELETING trust settings", (int)mDomain);
 556         }
 557
 558         /* cook up auth stuff so ocspd can act on our behalf */
 559         AuthorizationRef authRef;
 560         OSStatus ortn;
 561         ortn = AuthorizationCreate(NULL, kAuthorizationEmptyEnvironment,
 562                         0, &authRef);
 563         if(ortn) {
 564                 trustSettingsDbg("flushToDisk, domain %d: AuthorizationCreate returned %ld",
 565                         (int)mDomain, (long)ortn);
 566                 MacOSError::throwMe(errSecInternalComponent);
 567         }
 568         AuthorizationExternalForm authExt;
 569         CSSM_DATA authBlob = {sizeof(authExt), (uint8 *)&authExt};
 570         ortn = AuthorizationMakeExternalForm(authRef, &authExt);
 571         if(ortn) {
 572                 trustSettingsDbg("flushToDisk, domain %d: AuthorizationMakeExternalForm returned %ld",
 573                         (int)mDomain, (long)ortn);
 574                 ortn = errSecInternalComponent;
 575                 goto errOut;
 576         }
 577
 578         ortn = ocspdTrustSettingsWrite(mDomain, authBlob, cssmXmlData);
 579         if(ortn) {
 580                 trustSettingsDbg("flushToDisk, domain %d: ocspdTrustSettingsWrite returned %ld",
 581                         (int)mDomain, (long)ortn);
 582                 goto errOut;
 583         }
 584         trustSettingsDbg("flushToDisk, domain %d: wrote to disk", (int)mDomain);
 585         mDirty = false;
 586 errOut:
 587         AuthorizationFree(authRef, 0);
 588         if(ortn) {
 589                 MacOSError::throwMe(ortn);
 590         }
 591 }
 592
 593 /*
 594  * Obtain external representation of TrustSettings data.
 595  */
 596 CFDataRef TrustSettings::createExternal()
 597 {
 598         assert(mPropList);
 599         CFDataRef xmlData = CFPropertyListCreateXMLData(NULL, mPropList);
 600         if(xmlData == NULL) {
 601                 trustSettingsDbg("createExternal, domain %d: error converting to XML",
 602                         (int)mDomain);
 603                 MacOSError::throwMe(errSecInternalComponent);
 604         }
 605         return xmlData;
 606 }
 607
 608 /*
 609  * Evaluate specified cert. Returns true if we found a record for the cert
 610  * matching specified constraints.
 611  * Note that a true return with a value of kSecTrustSettingsResultUnspecified for
 612  * the resultType means that a cert isn't to be trusted or untrusted
 613  * per se; it just means that we only found allowedErrors entries.
 614  *
 615  * Found "allows errors" values are added to the incoming allowedErrors
 616  * array which is reallocd as needed (and which may be NULL or non-NULL on
 617  * entry).
 618  */
 619 bool TrustSettings::evaluateCert(
 620         CFStringRef                             certHashStr,
 621         const CSSM_OID                  *policyOID,                     /* optional */
 622         const char                              *policyStr,                     /* optional */
 623         SecTrustSettingsKeyUsage keyUsage,                      /* optional */
 624         bool                                    isRootCert,                     /* for checking default setting */
 625         CSSM_RETURN                             **allowedErrors,        /* IN/OUT; reallocd as needed */
 626         uint32                                  *numAllowedErrors,      /* IN/OUT */
 627         SecTrustSettingsResult  *resultType,            /* RETURNED */
 628         bool                                    *foundAnyEntry)         /* RETURNED */
 629 {
 630         assert(mTrustDict != NULL);
 631
 632         /* get trust settings dictionary for this cert */
 633         CFDictionaryRef certDict = findDictionaryForCertHash(certHashStr);
 634 #if CERT_HASH_DEBUG
 635         /* @@@ debug only @@@ */
 636         /* print certificate hash and found dictionary reference */
 637         const size_t maxHashStrLen = 512;
 638         char *buf = (char*)malloc(maxHashStrLen);
 639         if (buf) {
 640                 if (!CFStringGetCString(certHashStr, buf, (CFIndex)maxHashStrLen, kCFStringEncodingUTF8)) {
 641                         buf[0]='\0';
 642                 }
 643                 trustSettingsEvalDbg("evaluateCert for \"%s\", found dict %p", buf, certDict);
 644                 free(buf);
 645         }
 646 #endif
 647
 648         if(certDict == NULL) {
 649                 *foundAnyEntry = false;
 650                 return false;
 651         }
 652         *foundAnyEntry = true;
 653
 654         /* to-be-returned array of allowed errors */
 655         CSSM_RETURN *allowedErrs = *allowedErrors;
 656         uint32 numAllowedErrs = *numAllowedErrors;
 657
 658         /* this means "we found something other than allowedErrors" if true */
 659         bool foundSettings = false;
 660
 661         /* to be returned in *resultType if it ends up something other than Invalid */
 662         SecTrustSettingsResult returnedResult = kSecTrustSettingsResultInvalid;
 663
 664         /*
 665          * Note since we validated the entire mPropList in our constructor, and we're careful
 666          * about what we put into it, we don't bother typechecking its contents here.
 667          * Also note that the kTrustRecordTrustSettings entry is optional.
 668          */
 669         CFArrayRef trustSettings = (CFArrayRef)CFDictionaryGetValue(certDict,
 670                         kTrustRecordTrustSettings);
 671         CFIndex numSpecs = 0;
 672         if(trustSettings != NULL) {
 673                 numSpecs = CFArrayGetCount(trustSettings);
 674         }
 675         if(numSpecs == 0) {
 676                 /*
 677                  * Trivial case: cert has no trust settings, indicating that
 678                  * it's used for everything.
 679                  */
 680                 trustSettingsEvalDbg("evaluateCert: no trust settings");
 681                 /* the default... */
 682                 *resultType = kSecTrustSettingsResultTrustRoot;
 683                 return true;
 684         }
 685
 686         /*
 687          * The decidedly nontrivial part: grind thru all of the cert's trust
 688          * settings, see if the cert matches the caller's specified usage.
 689          */
 690         for(CFIndex addDex=0; addDex<numSpecs; addDex++) {
 691                 CFDictionaryRef tsDict = (CFDictionaryRef)CFArrayGetValueAtIndex(trustSettings,
 692                         addDex);
 693
 694                 /* per-cert specs: all optional */
 695                 CFDataRef   certPolicy     = (CFDataRef)CFDictionaryGetValue(tsDict,
 696                                                                                 kSecTrustSettingsPolicy);
 697                 CFDataRef   certApp        = (CFDataRef)CFDictionaryGetValue(tsDict,
 698                                                                                 kSecTrustSettingsApplication);
 699                 CFStringRef certPolicyStr  = (CFStringRef)CFDictionaryGetValue(tsDict,
 700                                                                                 kSecTrustSettingsPolicyString);
 701                 CFNumberRef certKeyUsage   = (CFNumberRef)CFDictionaryGetValue(tsDict,
 702                                                                                 kSecTrustSettingsKeyUsage);
 703                 CFNumberRef certResultType = (CFNumberRef)CFDictionaryGetValue(tsDict,
 704                                                                                 kSecTrustSettingsResult);
 705                 CFNumberRef certAllowedErr = (CFNumberRef)CFDictionaryGetValue(tsDict,
 706                                                                                 kSecTrustSettingsAllowedError);
 707
 708                 /* now, skip if we find a constraint that doesn't match intended use */
 709                 if(!tsCheckPolicy(policyOID, certPolicy)) {
 710                         continue;
 711                 }
 712                 if(!tsCheckApp(certApp)) {
 713                         continue;
 714                 }
 715                 if(!tsCheckKeyUse(keyUsage, certKeyUsage)) {
 716                         continue;
 717                 }
 718                 if(!tsCheckPolicyStr(policyStr, certPolicyStr)) {
 719                         continue;
 720                 }
 721
 722                 trustSettingsEvalDbg("evaluateCert: MATCH");
 723                 foundSettings = true;
 724
 725                 if(certAllowedErr) {
 726                         /* note we already validated this value */
 727                         SInt32 s;
 728                         CFNumberGetValue(certAllowedErr, kCFNumberSInt32Type, &s);
 729                         allowedErrs = (CSSM_RETURN *)::realloc(allowedErrs,
 730                                 ++numAllowedErrs * sizeof(CSSM_RETURN));
 731                         allowedErrs[numAllowedErrs-1] = (CSSM_RETURN) s;
 732                 }
 733
 734                 /*
 735                  * We found a match, but we only return the current result type
 736                  * to caller if we haven't already returned something other than
 737                  * kSecTrustSettingsResultUnspecified. Once we find a valid result type,
 738                  * we keep on searching, but only for additional allowed errors.
 739                  */
 740                 switch(returnedResult) {
 741                         /* found match but no valid resultType yet */
 742                         case kSecTrustSettingsResultUnspecified:
 743                         /* haven't been thru here */
 744                         case kSecTrustSettingsResultInvalid:
 745                                 if(certResultType) {
 746                                         /* note we already validated this */
 747                                         SInt32 s;
 748                                         CFNumberGetValue(certResultType, kCFNumberSInt32Type, &s);
 749                                         returnedResult = (SecTrustSettingsResult)s;
 750                                 }
 751                                 else {
 752                                         /* default is "copacetic" */
 753                                         returnedResult = kSecTrustSettingsResultTrustRoot;
 754                                 }
 755                                 break;
 756                         default:
 757                                 /* we already have a definitive resultType, don't change it */
 758                                 break;
 759                 }
 760         }       /* for each dictionary in trustSettings */
 761
 762         *allowedErrors = allowedErrs;
 763         *numAllowedErrors = numAllowedErrs;
 764         if(returnedResult != kSecTrustSettingsResultInvalid) {
 765                 *resultType = returnedResult;
 766         }
 767         return foundSettings;
 768 }
 769
 770
 771 /*
 772  * Find all certs in specified keychain list which have entries in this trust record.
 773  * Certs already in the array are not added.
 774  */
 775 void TrustSettings::findCerts(
 776         StorageManager::KeychainList    &keychains,
 777         CFMutableArrayRef                               certArray)
 778 {
 779         findQualifiedCerts(keychains,
 780                 true,           /* findAll */
 781                 false,          /* onlyRoots */
 782                 NULL, NULL, kSecTrustSettingsKeyUseAny,
 783                 certArray);
 784 }
 785
 786 void TrustSettings::findQualifiedCerts(
 787         StorageManager::KeychainList    &keychains,
 788         /*
 789          * If findAll is true, all certs are returned and the subsequent
 790          * qualifiers are ignored
 791          */
 792         bool                                                    findAll,
 793         /* if true, only return root (self-signed) certs */
 794         bool                                                    onlyRoots,
 795         const CSSM_OID                                  *policyOID,                     /* optional */
 796         const char                                              *policyString,          /* optional */
 797         SecTrustSettingsKeyUsage                keyUsage,                       /* optional */
 798         CFMutableArrayRef                               certArray)                      /* certs appended here */
 799 {
 800         StLock<Mutex> _(SecTrustKeychainsGetMutex());
 801
 802         /*
 803          * a set, hopefully with a good hash function for CFData, to keep track of what's
 804          * been added to the outgoing array.
 805          */
 806         CFRef<CFMutableSetRef> certSet(CFSetCreateMutable(NULL, 0, &kCFTypeSetCallBacks));
 807
 808         /* search: all certs, no attributes */
 809         KCCursor cursor(keychains, (SecItemClass) CSSM_DL_DB_RECORD_X509_CERTIFICATE, NULL);
 810         Item certItem;
 811         bool found;
 812         unsigned int total=0, entries=0, qualified=0;
 813         do {
 814                 found = cursor->next(certItem);
 815                 if(!found) {
 816                         break;
 817                 }
 818                 ++total;
 819
 820                 /* must convert to unified SecCertificateRef */
 821                 SecPointer<Certificate> certificate(static_cast<Certificate *>(&*certItem));
 822         CssmData certCssmData;
 823         try {
 824             certCssmData = certificate->data();
 825         }
 826         catch (...) {}
 827                 if (!(certCssmData.Data && certCssmData.Length)) {
 828                         continue;
 829                 }
 830                 CFRef<CFDataRef> cfDataRef(CFDataCreate(NULL, certCssmData.Data, certCssmData.Length));
 831                 CFRef<SecCertificateRef> certRef(SecCertificateCreateWithData(NULL, cfDataRef));
 832
 833                 /* do we have an entry for this cert? */
 834                 CFDictionaryRef certDict = findDictionaryForCert(certRef);
 835                 if(certDict == NULL) {
 836                         continue;
 837                 }
 838                 ++entries;
 839
 840                 if(!findAll) {
 841                         /* qualify */
 842                         if(!qualifyUsageWithCertDict(certDict, policyOID,
 843                                         policyString, keyUsage, onlyRoots)) {
 844                                 continue;
 845                         }
 846                 }
 847                 ++qualified;
 848
 849                 /* see if we already have this one - get in CFData form */
 850                 CSSM_DATA certData;
 851                 OSStatus ortn = SecCertificateGetData(certRef, &certData);
 852                 if(ortn) {
 853                         trustSettingsEvalDbg("findQualifiedCerts: SecCertificateGetData error");
 854                         continue;
 855                 }
 856                 CFRef<CFDataRef> cfData(CFDataCreate(NULL, certData.Data, certData.Length));
 857                 CFDataRef cfd = cfData.get();
 858                 if(CFSetContainsValue(certSet, cfd)) {
 859                         trustSettingsEvalDbg("findQualifiedCerts: dup cert");
 860                         continue;
 861                 }
 862                 else {
 863                         /* add to the tracking set, which owns the CFData now */
 864                         CFSetAddValue(certSet, cfd);
 865                         /* and add the SecCert to caller's array, which owns that now */
 866                         CFArrayAppendValue(certArray, certRef);
 867                 }
 868         } while(found);
 869
 870         trustSettingsEvalDbg("findQualifiedCerts: examined %d certs, qualified %d of %d",
 871                 total, qualified, entries);
 872 }
 873
 874 /*
 875  * Obtain trust settings for the specified cert. Returned settings array
 876  * is in the public API form; caller must release. Returns NULL
 877  * (does not throw) if the cert is not present in this TrustRecord.
 878  */
 879 CFArrayRef TrustSettings::copyTrustSettings(
 880         SecCertificateRef       certRef)
 881 {
 882         CFDictionaryRef certDict = NULL;
 883
 884         /* find the on-disk usage constraints for this cert */
 885         certDict = findDictionaryForCert(certRef);
 886         if(certDict == NULL) {
 887                 trustSettingsDbg("copyTrustSettings: dictionary not found");
 888                 return NULL;
 889         }
 890         CFArrayRef diskTrustSettings = (CFArrayRef)CFDictionaryGetValue(certDict,
 891                 kTrustRecordTrustSettings);
 892         CFIndex numSpecs = 0;
 893         if(diskTrustSettings != NULL) {
 894                 /* this field is optional */
 895                 numSpecs = CFArrayGetCount(diskTrustSettings);
 896         }
 897
 898         /*
 899          * Convert to API-style array of dictionaries.
 900          * We give the caller an array even if it's empty.
 901          */
 902         CFRef<CFMutableArrayRef> outArray(CFArrayCreateMutable(NULL, numSpecs,
 903                 &kCFTypeArrayCallBacks));
 904         for(CFIndex dex=0; dex<numSpecs; dex++) {
 905                 CFDictionaryRef diskTsDict =
 906                         (CFDictionaryRef)CFArrayGetValueAtIndex(diskTrustSettings, dex);
 907                 /* already validated... */
 908                 assert(CFGetTypeID(diskTsDict) == CFDictionaryGetTypeID());
 909
 910                 CFTypeRef   certPolicy = (CFTypeRef)  CFDictionaryGetValue(diskTsDict, kSecTrustSettingsPolicy);
 911                 CFStringRef     policyName = (CFStringRef)CFDictionaryGetValue(diskTsDict, kSecTrustSettingsPolicyName);
 912                 CFDataRef   certApp    = (CFDataRef)  CFDictionaryGetValue(diskTsDict, kSecTrustSettingsApplication);
 913                 CFStringRef policyStr  = (CFStringRef)CFDictionaryGetValue(diskTsDict, kSecTrustSettingsPolicyString);
 914                 CFNumberRef allowedErr = (CFNumberRef)CFDictionaryGetValue(diskTsDict, kSecTrustSettingsAllowedError);
 915                 CFNumberRef resultType = (CFNumberRef)CFDictionaryGetValue(diskTsDict, kSecTrustSettingsResult);
 916                 CFNumberRef keyUsage   = (CFNumberRef)CFDictionaryGetValue(diskTsDict, kSecTrustSettingsKeyUsage);
 917
 918                 if((certPolicy == NULL) &&
 919                    (certApp == NULL) &&
 920                    (policyStr == NULL) &&
 921                    (allowedErr == NULL) &&
 922                    (resultType == NULL) &&
 923                    (keyUsage == NULL)) {
 924                         /* weird but legal */
 925                         continue;
 926                 }
 927                 CFRef<CFMutableDictionaryRef> outTsDict(CFDictionaryCreateMutable(NULL,
 928                         0,                      // capacity
 929                         &kCFTypeDictionaryKeyCallBacks,
 930                         &kCFTypeDictionaryValueCallBacks));
 931
 932                 if(certPolicy != NULL) {
 933                         SecPolicyRef policyRef = NULL;
 934                         if (CFDataGetTypeID() == CFGetTypeID(certPolicy)) {
 935                                 /* convert OID as CFDataRef to SecPolicyRef */
 936                                 CSSM_OID policyOid = { int_cast<CFIndex, CSSM_SIZE>(CFDataGetLength((CFDataRef)certPolicy)),
 937                                         (uint8 *)CFDataGetBytePtr((CFDataRef)certPolicy) };
 938                                 OSStatus ortn = SecPolicyCopy(CSSM_CERT_X_509v3, &policyOid, &policyRef);
 939                                 if(ortn) {
 940                                         trustSettingsDbg("copyTrustSettings: OID conversion error");
 941                                         abort("Bad Policy OID in trusted root list", errSecInvalidTrustedRootRecord);
 942                                 }
 943                         } else if (CFStringGetTypeID() == CFGetTypeID(certPolicy)) {
 944                                 policyRef = SecPolicyCreateWithProperties(certPolicy, NULL);
 945                         }
 946                         if (policyRef) {
 947                                 CFDictionaryAddValue(outTsDict, kSecTrustSettingsPolicy, policyRef);
 948                                 CFRelease(policyRef);                   // owned by dictionary
 949                         }
 950                 }
 951
 952                 if (policyName != NULL) {
 953                         /*
 954                          * copy, since policyName is in our mutable dictionary and could change out from
 955                          * under the caller
 956                          */
 957                         CFStringRef str = CFStringCreateCopy(NULL, policyName);
 958                         CFDictionaryAddValue(outTsDict, kSecTrustSettingsPolicyName, str);
 959                         CFRelease(str);                 // owned by dictionary
 960                 }
 961
 962                 if(certApp != NULL) {
 963                         /* convert app as CFDataRef to SecTrustedApplicationRef */
 964                         SecTrustedApplicationRef appRef;
 965                         OSStatus ortn = SecTrustedApplicationCreateWithExternalRepresentation(certApp, &appRef);
 966                         if(ortn) {
 967                                 trustSettingsDbg("copyTrustSettings: App conversion error");
 968                                 abort("Bad application data in trusted root list", errSecInvalidTrustedRootRecord);
 969                         }
 970                         CFDictionaryAddValue(outTsDict, kSecTrustSettingsApplication, appRef);
 971                         CFRelease(appRef);                      // owned by dictionary
 972                 }
 973
 974                 /* remaining 4 are trivial */
 975                 if(policyStr != NULL) {
 976                         /*
 977                          * copy, since policyStr is in our mutable dictionary and could change out from
 978                          * under the caller
 979                          */
 980                         CFStringRef str = CFStringCreateCopy(NULL, policyStr);
 981                         CFDictionaryAddValue(outTsDict, kSecTrustSettingsPolicyString, str);
 982                         CFRelease(str);                 // owned by dictionary
 983                 }
 984                 if(allowedErr != NULL) {
 985                         /* there is no mutable CFNumber, so.... */
 986                         CFDictionaryAddValue(outTsDict, kSecTrustSettingsAllowedError, allowedErr);
 987                 }
 988                 if(resultType != NULL) {
 989                         CFDictionaryAddValue(outTsDict, kSecTrustSettingsResult, resultType);
 990                 }
 991                 if(keyUsage != NULL) {
 992                         CFDictionaryAddValue(outTsDict, kSecTrustSettingsKeyUsage, keyUsage);
 993                 }
 994                 CFArrayAppendValue(outArray, outTsDict);
 995                 /* outTsDict autoreleases; owned by outArray now */
 996         }
 997         CFRetain(outArray);             // now that it's good to go....
 998         return outArray;
 999 }
1000
1001 CFDateRef TrustSettings::copyModDate(
1002         SecCertificateRef       certRef)
1003 {
1004         CFDictionaryRef certDict = NULL;
1005
1006         /* find the on-disk usage constraints dictionary for this cert */
1007         certDict = findDictionaryForCert(certRef);
1008         if(certDict == NULL) {
1009                 trustSettingsDbg("copyModDate: dictionary not found");
1010                 return NULL;
1011         }
1012         CFDateRef modDate = (CFDateRef)CFDictionaryGetValue(certDict, kTrustRecordModDate);
1013         if(modDate == NULL) {
1014                 return NULL;
1015         }
1016
1017         /* this only works becuase there is no mutable CFDateRef */
1018         CFRetain(modDate);
1019         return modDate;
1020 }
1021
1022 bool TrustSettings::contains(SecCertificateRef certRef)
1023 {
1024     if(findDictionaryForCert(certRef) != NULL) {
1025         return true;
1026     }
1027     return false;
1028 }
1029
1030 /*
1031  * Modify cert's trust settings, or add a new cert to the record.
1032  */
1033 void TrustSettings::setTrustSettings(
1034         SecCertificateRef       certRef,
1035         CFTypeRef                       trustSettingsDictOrArray)
1036 {
1037         /* to validate, we need to know if the cert is self-signed */
1038         OSStatus ortn;
1039         Boolean isSelfSigned = false;
1040
1041         if(certRef == kSecTrustSettingsDefaultRootCertSetting) {
1042                 /*
1043                  * Validate settings as if this were root, specifically,
1044                  * kSecTrustSettingsResultTrustRoot (explicitly or by
1045                  * default) is OK.
1046                  */
1047                 isSelfSigned = true;
1048         }
1049         else {
1050                 ortn = SecCertificateIsSelfSigned(certRef, &isSelfSigned);
1051                 if(ortn) {
1052                         MacOSError::throwMe(ortn);
1053                 }
1054         }
1055
1056         /* caller's app/policy spec OK? */
1057         CFRef<CFArrayRef> trustSettings(validateApiTrustSettings(
1058                 trustSettingsDictOrArray, isSelfSigned));
1059
1060         /* caller is responsible for ensuring these */
1061         assert(mPropList != NULL);
1062         assert(mDomain != kSecTrustSettingsDomainSystem);
1063
1064         /* extract issuer and serial number from the cert, if it's a cert */
1065         CFRef<CFDataRef> issuer;
1066         CFRef<CFDataRef> serial;
1067         if(certRef != kSecTrustSettingsDefaultRootCertSetting) {
1068                 copyIssuerAndSerial(certRef, issuer.take(), serial.take());
1069         }
1070         else {
1071                 UInt8 dummy;
1072                 issuer = CFDataCreate(NULL, &dummy, 0);
1073                 serial = CFDataCreate(NULL, &dummy, 0);
1074         }
1075
1076         /* SHA1 digest as string */
1077         CFRef<CFStringRef> certHashStr(SecTrustSettingsCertHashStrFromCert(certRef));
1078         if(!certHashStr) {
1079                 trustSettingsDbg("TrustSettings::setTrustSettings: CertHashStrFromCert error");
1080                 MacOSError::throwMe(errSecItemNotFound);
1081         }
1082
1083         /*
1084          * Find entry for this cert, if present.
1085          */
1086         CFMutableDictionaryRef certDict =
1087                 (CFMutableDictionaryRef)findDictionaryForCertHash(certHashStr);
1088         if(certDict == NULL) {
1089                 /* create new dictionary */
1090                 certDict = CFDictionaryCreateMutable(NULL, kSecTrustRecordNumCertDictKeys,
1091                         &kCFCopyStringDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
1092                 if(certDict == NULL) {
1093                         MacOSError::throwMe(errSecAllocate);
1094                 }
1095                 CFDictionaryAddValue(certDict, kTrustRecordIssuer, issuer);
1096                 CFDictionaryAddValue(certDict, kTrustRecordSerialNumber, serial);
1097                 if(CFArrayGetCount(trustSettings) != 0) {
1098                         /* skip this if the settings array is empty */
1099                         CFDictionaryAddValue(certDict, kTrustRecordTrustSettings, trustSettings);
1100                 }
1101                 tsSetModDate(certDict);
1102
1103                 /* add this new cert dictionary to top-level mTrustDict */
1104                 CFDictionaryAddValue(mTrustDict, static_cast<CFStringRef>(certHashStr), certDict);
1105
1106                 /* mTrustDict owns the dictionary now */
1107                 CFRelease(certDict);
1108         }
1109         else {
1110                 /* update */
1111                 tsSetModDate(certDict);
1112                 if(CFArrayGetCount(trustSettings) != 0) {
1113                         CFDictionarySetValue(certDict, kTrustRecordTrustSettings, trustSettings);
1114                 }
1115                 else {
1116                         /* empty settings array: remove from dictionary */
1117                         CFDictionaryRemoveValue(certDict, kTrustRecordTrustSettings);
1118                 }
1119         }
1120         mDirty = true;
1121 }
1122
1123 /*
1124  * Delete a certificate's trust settings.
1125  */
1126 void TrustSettings::deleteTrustSettings(
1127         SecCertificateRef       certRef)
1128 {
1129         CFDictionaryRef certDict = NULL;
1130
1131         /* caller is responsible for ensuring these */
1132         assert(mPropList != NULL);
1133         assert(mDomain != kSecTrustSettingsDomainSystem);
1134
1135         /* SHA1 digest as string */
1136         CFRef<CFStringRef> certHashStr(SecTrustSettingsCertHashStrFromCert(certRef));
1137         if(!certHashStr) {
1138                 MacOSError::throwMe(errSecItemNotFound);
1139         }
1140
1141         /* present in top-level mTrustDict? */
1142         certDict = findDictionaryForCertHash(certHashStr);
1143         if(certDict != NULL) {
1144                 CFDictionaryRemoveValue(mTrustDict, static_cast<CFStringRef>(certHashStr));
1145                 mDirty = true;
1146         }
1147         else {
1148                 /*
1149                  * Throwing this error is the only reason we don't blindly do
1150                  * a CFDictionaryRemoveValue() without first doing
1151                  * findDictionaryForCertHash().
1152                  */
1153                 trustSettingsDbg("TrustSettings::deleteRoot: cert dictionary not found");
1154                 MacOSError::throwMe(errSecItemNotFound);
1155         }
1156 }
1157
1158 #pragma mark --- Private methods ---
1159
1160 /*
1161  * Find a given cert's entry in the top-level mTrustDict. Return the
1162  * entry as a dictionary. Returned dictionary is not refcounted.
1163  * The mutability of the returned dictionary is the same as the mutability
1164  * of the underlying StickRecord::mPropList, which the caller is just
1165  * going to have to know (and cast accordingly if a mutable dictionary
1166  * is needed).
1167  */
1168 CFDictionaryRef TrustSettings::findDictionaryForCert(
1169         SecCertificateRef       certRef)
1170 {
1171         CFRef<CFStringRef> certHashStr(SecTrustSettingsCertHashStrFromCert(certRef));
1172         if (certHashStr.get() == NULL)
1173         {
1174                 return NULL;
1175         }
1176
1177         return findDictionaryForCertHash(static_cast<CFStringRef>(certHashStr.get()));
1178 }
1179
1180 /*
1181  * Find entry in mTrustDict given cert hash string.
1182  */
1183 CFDictionaryRef TrustSettings::findDictionaryForCertHash(
1184         CFStringRef             certHashStr)
1185 {
1186         assert(mTrustDict != NULL);
1187         return (CFDictionaryRef)CFDictionaryGetValue(mTrustDict, certHashStr);
1188 }
1189
1190 /*
1191  * Validate incoming trust settings, which may be NULL, a dictionary, or
1192  * an array of dictionaries. Convert from the API-style dictionaries
1193  * to the internal style suitable for writing to disk as part of
1194  * mPropList.
1195  *
1196  * We return a refcounted CFArray in any case if the incoming parameter is good.
1197  */
1198 CFArrayRef TrustSettings::validateApiTrustSettings(
1199         CFTypeRef trustSettingsDictOrArray,
1200         Boolean isSelfSigned)
1201 {
1202         CFArrayRef tmpInArray = NULL;
1203
1204         if(trustSettingsDictOrArray == NULL) {
1205                 /* trivial case, only valid for roots */
1206                 if(!isSelfSigned) {
1207                         trustSettingsDbg("validateApiUsageConstraints: !isSelfSigned, no settings");
1208                         MacOSError::throwMe(errSecParam);
1209                 }
1210                 return CFArrayCreate(NULL, NULL, 0, &kCFTypeArrayCallBacks);
1211         }
1212         else if(CFGetTypeID(trustSettingsDictOrArray) == CFDictionaryGetTypeID()) {
1213                 /* array-ize it */
1214                 tmpInArray = CFArrayCreate(NULL, &trustSettingsDictOrArray, 1,
1215                         &kCFTypeArrayCallBacks);
1216         }
1217         else if(CFGetTypeID(trustSettingsDictOrArray) == CFArrayGetTypeID()) {
1218                 /* as is, refcount - we'll release later */
1219                 tmpInArray = (CFArrayRef)trustSettingsDictOrArray;
1220                 CFRetain(tmpInArray);
1221         }
1222         else {
1223                 trustSettingsDbg("validateApiUsageConstraints: bad trustSettingsDictOrArray");
1224                 MacOSError::throwMe(errSecParam);
1225         }
1226
1227         CFIndex numSpecs = CFArrayGetCount(tmpInArray);
1228         CFMutableArrayRef outArray = CFArrayCreateMutable(NULL, numSpecs, &kCFTypeArrayCallBacks);
1229         CSSM_OID oid;
1230         OSStatus ortn = errSecSuccess;
1231         SecPolicyRef certPolicy;
1232         SecTrustedApplicationRef certApp;
1233         CFTypeRef oidData = NULL;
1234
1235         /* convert */
1236         for(CFIndex dex=0; dex<numSpecs; dex++) {
1237                 CFStringRef policyName = NULL;
1238                 CFDataRef   appData = NULL;
1239                 CFStringRef policyStr = NULL;
1240                 CFNumberRef allowedErr = NULL;
1241                 CFNumberRef resultType = NULL;
1242                 CFNumberRef keyUsage = NULL;
1243                 SInt32 resultNum;
1244                 SecTrustSettingsResult result;
1245
1246                 /* each element is a dictionary */
1247                 CFDictionaryRef ucDict = (CFDictionaryRef)CFArrayGetValueAtIndex(tmpInArray, dex);
1248                 if(CFGetTypeID(ucDict) != CFDictionaryGetTypeID()) {
1249                         trustSettingsDbg("validateAppPolicyArray: malformed usageConstraint dictionary");
1250                         ortn = errSecParam;
1251                         break;
1252                 }
1253
1254                 /* policy - optional */
1255                 certPolicy = (SecPolicyRef)CFDictionaryGetValue(ucDict, kSecTrustSettingsPolicy);
1256                 if(certPolicy != NULL) {
1257                         if(CFGetTypeID(certPolicy) != SecPolicyGetTypeID()) {
1258                                 trustSettingsDbg("validateAppPolicyArray: malformed certPolicy");
1259                                 ortn = errSecParam;
1260                                 break;
1261                         }
1262                         ortn = SecPolicyGetOID(certPolicy, &oid);
1263                         if (ortn) {
1264                                 /* newer policies don't have CSSM OIDs but they do have string OIDs */
1265                                 oidData = CFRetain(SecPolicyGetOidString(certPolicy));
1266                         } else {
1267                                 oidData = CFDataCreate(NULL, oid.Data, oid.Length);
1268                         }
1269
1270                         if (!oidData) {
1271                                 trustSettingsDbg("validateAppPolicyArray: SecPolicyGetOID error");
1272                                 break;
1273                         }
1274                         policyName = SecPolicyGetName(certPolicy);
1275                 }
1276
1277                 /* application - optional */
1278                 certApp = (SecTrustedApplicationRef)CFDictionaryGetValue(ucDict, kSecTrustSettingsApplication);
1279                 if(certApp != NULL) {
1280                         if(CFGetTypeID(certApp) != SecTrustedApplicationGetTypeID()) {
1281                                 trustSettingsDbg("validateAppPolicyArray: malformed certApp");
1282                                 ortn = errSecParam;
1283                                 break;
1284                         }
1285                         ortn = SecTrustedApplicationCopyExternalRepresentation(certApp, &appData);
1286                         if(ortn) {
1287                                 trustSettingsDbg("validateAppPolicyArray: "
1288                                         "SecTrustedApplicationCopyExternalRepresentation error");
1289                                 break;
1290                         }
1291                 }
1292
1293                 policyStr  = (CFStringRef)CFDictionaryGetValue(ucDict, kSecTrustSettingsPolicyString);
1294                 if(policyStr != NULL) {
1295                         if(CFGetTypeID(policyStr) != CFStringGetTypeID()) {
1296                                 trustSettingsDbg("validateAppPolicyArray: malformed policyStr");
1297                                 ortn = errSecParam;
1298                                 break;
1299                         }
1300                 }
1301                 allowedErr = (CFNumberRef)CFDictionaryGetValue(ucDict, kSecTrustSettingsAllowedError);
1302                 if(!tsIsGoodCfNum(allowedErr)) {
1303                         trustSettingsDbg("validateAppPolicyArray: malformed allowedErr");
1304                         ortn = errSecParam;
1305                         break;
1306                 }
1307                 resultType = (CFNumberRef)CFDictionaryGetValue(ucDict, kSecTrustSettingsResult);
1308                 if(!tsIsGoodCfNum(resultType, &resultNum)) {
1309                         trustSettingsDbg("validateAppPolicyArray: malformed resultType");
1310                         ortn = errSecParam;
1311                         break;
1312                 }
1313                 result = (SecTrustSettingsResult) resultNum;
1314                 /* validate result later */
1315
1316                 keyUsage   = (CFNumberRef)CFDictionaryGetValue(ucDict, kSecTrustSettingsKeyUsage);
1317                 if(!tsIsGoodCfNum(keyUsage)) {
1318                         trustSettingsDbg("validateAppPolicyArray: malformed keyUsage");
1319                         ortn = errSecParam;
1320                         break;
1321                 }
1322
1323                 if(!oidData && !appData && !policyStr &&
1324                    !allowedErr && !resultType && !keyUsage) {
1325                         /* nothing here - weird, but legal - skip it */
1326                         continue;
1327                 }
1328
1329                 /* create dictionary for this usageConstraint */
1330                 CFMutableDictionaryRef outDict = CFDictionaryCreateMutable(NULL,
1331                         2,
1332                         &kCFTypeDictionaryKeyCallBacks,
1333                         &kCFTypeDictionaryValueCallBacks);
1334                 if(oidData) {
1335                         CFDictionaryAddValue(outDict, kSecTrustSettingsPolicy, oidData);
1336                         CFReleaseNull(oidData);                 // owned by dictionary
1337                 }
1338                 if(policyName) {
1339                         CFDictionaryAddValue(outDict, kSecTrustSettingsPolicyName, policyName);
1340                         /* still owned by ucDict */
1341                 }
1342                 if(appData) {
1343                         CFDictionaryAddValue(outDict, kSecTrustSettingsApplication, appData);
1344                         CFRelease(appData);                     // owned by dictionary
1345                 }
1346                 if(policyStr) {
1347                         CFDictionaryAddValue(outDict, kSecTrustSettingsPolicyString, policyStr);
1348                         /* still owned by ucDict */
1349                 }
1350                 if(allowedErr) {
1351                         CFDictionaryAddValue(outDict, kSecTrustSettingsAllowedError, allowedErr);
1352                 }
1353
1354                 ortn = errSecSuccess;
1355
1356                 if(resultType) {
1357                         /* let's be really picky on this one */
1358                         switch(result) {
1359                                 case kSecTrustSettingsResultInvalid:
1360                                         ortn = errSecParam;
1361                                         break;
1362                                 case kSecTrustSettingsResultTrustRoot:
1363                                         if(!isSelfSigned) {
1364                                                 trustSettingsDbg("validateAppPolicyArray: TrustRoot, !isSelfSigned");
1365                                                 ortn = errSecParam;
1366                                         }
1367                                         break;
1368                                 case kSecTrustSettingsResultTrustAsRoot:
1369                                         if(isSelfSigned) {
1370                                                 trustSettingsDbg("validateAppPolicyArray: TrustAsRoot, isSelfSigned");
1371                                                 ortn = errSecParam;
1372                                         }
1373                                         break;
1374                                 case kSecTrustSettingsResultDeny:
1375                                 case kSecTrustSettingsResultUnspecified:
1376                                         break;
1377                                 default:
1378                                         trustSettingsDbg("validateAppPolicyArray: bogus resultType");
1379                                         ortn = errSecParam;
1380                                         break;
1381                         }
1382                         if(ortn) {
1383                                 break;
1384                         }
1385                         CFDictionaryAddValue(outDict, kSecTrustSettingsResult, resultType);
1386                 }
1387                 else {
1388                         /* no resultType; default of TrustRoot only valid for root */
1389                         if(!isSelfSigned) {
1390                                 trustSettingsDbg("validateAppPolicyArray: default result, !isSelfSigned");
1391                                 ortn = errSecParam;
1392                                 break;
1393                         }
1394                 }
1395
1396                 if(keyUsage) {
1397                         CFDictionaryAddValue(outDict, kSecTrustSettingsKeyUsage, keyUsage);
1398                 }
1399
1400                 /* append dictionary to output */
1401                 CFArrayAppendValue(outArray, outDict);
1402                 /* array owns the dictionary now */
1403                 CFRelease(outDict);
1404
1405         }       /* for each usage constraint dictionary */
1406
1407         CFReleaseNull(oidData);
1408         CFRelease(tmpInArray);
1409         if(ortn) {
1410                 CFRelease(outArray);
1411                 MacOSError::throwMe(ortn);
1412         }
1413         return outArray;
1414 }
1415
1416 /*
1417  * Validate an trust settings array obtained from disk.
1418  * Returns true if OK, else returns false.
1419  */
1420 bool TrustSettings::validateTrustSettingsArray(
1421         CFArrayRef trustSettings)
1422 {
1423         CFIndex numSpecs = CFArrayGetCount(trustSettings);
1424         for(CFIndex dex=0; dex<numSpecs; dex++) {
1425                 CFDictionaryRef ucDict = (CFDictionaryRef)CFArrayGetValueAtIndex(trustSettings,
1426                         dex);
1427                 if(CFGetTypeID(ucDict) != CFDictionaryGetTypeID()) {
1428                         trustSettingsDbg("validateAppPolicyArray: malformed app/policy dictionary");
1429                         return false;
1430                 }
1431                 CFDataRef certPolicy = (CFDataRef)CFDictionaryGetValue(ucDict, kSecTrustSettingsPolicy);
1432                 if((certPolicy != NULL) && (CFGetTypeID(certPolicy) != CFDataGetTypeID())) {
1433                         trustSettingsDbg("validateAppPolicyArray: malformed certPolicy");
1434                         return false;
1435                 }
1436                 CFDataRef certApp = (CFDataRef)CFDictionaryGetValue(ucDict, kSecTrustSettingsApplication);
1437                 if((certApp != NULL) && (CFGetTypeID(certApp) != CFDataGetTypeID())) {
1438                         trustSettingsDbg("validateAppPolicyArray: malformed certApp");
1439                         return false;
1440                 }
1441                 CFStringRef policyStr = (CFStringRef)CFDictionaryGetValue(ucDict, kSecTrustSettingsPolicyString);
1442                 if((policyStr != NULL) && (CFGetTypeID(policyStr) != CFStringGetTypeID())) {
1443                         trustSettingsDbg("validateAppPolicyArray: malformed policyStr");
1444                         return false;
1445                 }
1446                 CFNumberRef cfNum = (CFNumberRef)CFDictionaryGetValue(ucDict, kSecTrustSettingsAllowedError);
1447                 if(!tsIsGoodCfNum(cfNum)) {
1448                         trustSettingsDbg("validateAppPolicyArray: malformed allowedErr");
1449                         return false;
1450                 }
1451                 cfNum = (CFNumberRef)CFDictionaryGetValue(ucDict, kSecTrustSettingsResult);
1452                 if(!tsIsGoodCfNum(cfNum)) {
1453                         trustSettingsDbg("validateAppPolicyArray: malformed resultType");
1454                         return false;
1455                 }
1456                 cfNum = (CFNumberRef)CFDictionaryGetValue(ucDict, kSecTrustSettingsKeyUsage);
1457                 if(!tsIsGoodCfNum(cfNum)) {
1458                         trustSettingsDbg("validateAppPolicyArray: malformed keyUsage");
1459                         return false;
1460                 }
1461         }       /* for each usageConstraint dictionary */
1462         return true;
1463 }
1464
1465 /*
1466  * Validate mPropList after it's read from disk or supplied as an external
1467  * representation. Allows subsequent use of mTrustDict to proceed with
1468  * relative impunity.
1469  */
1470 void TrustSettings::validatePropList(bool trim)
1471 {
1472         /* top level dictionary */
1473         if(!mPropList) {
1474                 trustSettingsDbg("TrustSettings::validatePropList missing mPropList");
1475                 abort("missing propList", errSecInvalidTrustedRootRecord);
1476         }
1477
1478         if(CFGetTypeID(mPropList) != CFDictionaryGetTypeID()) {
1479                 trustSettingsDbg("TrustSettings::validatePropList: malformed mPropList");
1480                 abort("malformed propList", errSecInvalidTrustedRootRecord);
1481         }
1482
1483         /* That dictionary has two entries */
1484         CFNumberRef cfVers = (CFNumberRef)CFDictionaryGetValue(mPropList, kTrustRecordVersion);
1485         if((cfVers == NULL) || (CFGetTypeID(cfVers) != CFNumberGetTypeID())) {
1486                 trustSettingsDbg("TrustSettings::validatePropList: malformed version");
1487                 abort("malformed version", errSecInvalidTrustedRootRecord);
1488         }
1489         if(!CFNumberGetValue(cfVers, kCFNumberSInt32Type, &mDictVersion)) {
1490                 trustSettingsDbg("TrustSettings::validatePropList: malformed version");
1491                 abort("malformed version", errSecInvalidTrustedRootRecord);
1492         }
1493         if((mDictVersion > kSecTrustRecordVersionCurrent) ||
1494            (mDictVersion == kSecTrustRecordVersionInvalid)) {
1495                 trustSettingsDbg("TrustSettings::validatePropList: incompatible version");
1496                 abort("incompatible version", errSecInvalidTrustedRootRecord);
1497         }
1498         /* other backwards-compatibility handling done later, if needed, per mDictVersion */
1499
1500         mTrustDict = (CFMutableDictionaryRef)CFDictionaryGetValue(mPropList, kTrustRecordTrustList);
1501         if(mTrustDict != NULL) {
1502                 CFRetain(mTrustDict);
1503         }
1504         if((mTrustDict == NULL) || (CFGetTypeID(mTrustDict) != CFDictionaryGetTypeID())) {
1505                 trustSettingsDbg("TrustSettings::validatePropList: malformed mTrustDict");
1506                 abort("malformed TrustArray", errSecInvalidTrustedRootRecord);
1507         }
1508
1509         /* grind through the per-cert entries */
1510         CFIndex numCerts = CFDictionaryGetCount(mTrustDict);
1511         const void *dictKeys[numCerts];
1512         const void *dictValues[numCerts];
1513         CFDictionaryGetKeysAndValues(mTrustDict, dictKeys, dictValues);
1514
1515         for(CFIndex dex=0; dex<numCerts; dex++) {
1516                 /* get per-cert dictionary */
1517                 CFMutableDictionaryRef certDict = (CFMutableDictionaryRef)dictValues[dex];
1518                 if((certDict == NULL) || (CFGetTypeID(certDict) != CFDictionaryGetTypeID())) {
1519                         trustSettingsDbg("TrustSettings::validatePropList: malformed certDict");
1520                         abort("malformed certDict", errSecInvalidTrustedRootRecord);
1521                 }
1522
1523                 /*
1524                  * That dictionary has exactly four entries.
1525                  * If we're trimming, all we need is the actual trust settings.
1526                  */
1527
1528                 /* issuer */
1529                 CFDataRef cfd = (CFDataRef)CFDictionaryGetValue(certDict, kTrustRecordIssuer);
1530                 if(cfd == NULL) {
1531                         trustSettingsDbg("TrustSettings::validatePropList: missing issuer");
1532                         abort("missing issuer", errSecInvalidTrustedRootRecord);
1533                 }
1534                 if(CFGetTypeID(cfd) != CFDataGetTypeID()) {
1535                         trustSettingsDbg("TrustSettings::validatePropList: malformed issuer");
1536                         abort("malformed issuer", errSecInvalidTrustedRootRecord);
1537                 }
1538                 if(trim) {
1539                         CFDictionaryRemoveValue(certDict, kTrustRecordIssuer);
1540                 }
1541
1542                 /* serial number */
1543                 cfd = (CFDataRef)CFDictionaryGetValue(certDict, kTrustRecordSerialNumber);
1544                 if(cfd == NULL) {
1545                         trustSettingsDbg("TrustSettings::validatePropList: missing serial number");
1546                         abort("missing serial number", errSecInvalidTrustedRootRecord);
1547                 }
1548                 if(CFGetTypeID(cfd) != CFDataGetTypeID()) {
1549                         trustSettingsDbg("TrustSettings::validatePropList: malformed serial number");
1550                         abort("malformed serial number", errSecInvalidTrustedRootRecord);
1551                 }
1552                 if(trim) {
1553                         CFDictionaryRemoveValue(certDict, kTrustRecordSerialNumber);
1554                 }
1555
1556                 /* modification date */
1557                 CFDateRef modDate = (CFDateRef)CFDictionaryGetValue(certDict, kTrustRecordModDate);
1558                 if(modDate == NULL) {
1559                         trustSettingsDbg("TrustSettings::validatePropList: missing modDate");
1560                         abort("missing modDate", errSecInvalidTrustedRootRecord);
1561                 }
1562                 if(CFGetTypeID(modDate) != CFDateGetTypeID()) {
1563                         trustSettingsDbg("TrustSettings::validatePropList: malformed modDate");
1564                         abort("malformed modDate", errSecInvalidTrustedRootRecord);
1565                 }
1566                 if(trim) {
1567                         CFDictionaryRemoveValue(certDict, kTrustRecordModDate);
1568                 }
1569
1570                 /* the actual trust settings */
1571                 CFArrayRef trustSettings = (CFArrayRef)CFDictionaryGetValue(certDict,
1572                                 kTrustRecordTrustSettings);
1573                 if(trustSettings == NULL) {
1574                         /* optional; this cert's entry is good */
1575                         continue;
1576                 }
1577                 if(CFGetTypeID(trustSettings) != CFArrayGetTypeID()) {
1578                         trustSettingsDbg("TrustSettings::validatePropList: malformed useConstraint"
1579                                 "array");
1580                         abort("malformed useConstraint array", errSecInvalidTrustedRootRecord);
1581                 }
1582
1583                 /* Now validate the usageConstraint array contents */
1584                 if(!validateTrustSettingsArray(trustSettings)) {
1585                         abort("malformed useConstraint array", errSecInvalidTrustedRootRecord);
1586                 }
1587         } /* for each cert dictionary  in top-level array */
1588
1589         if(trim) {
1590                 /* we don't need the top-level dictionary any more */
1591                 CFRelease(mPropList);
1592                 mPropList = NULL;
1593         }
1594 }
1595
1596 /*
1597  * Obtain non-normalized issuer and serial number for specified cert, both
1598  * returned as CFDataRefs owned by caller.
1599  */
1600 void TrustSettings::copyIssuerAndSerial(
1601         SecCertificateRef       certRef,
1602         CFDataRef                       *issuer,                /* optional, RETURNED */
1603         CFDataRef                       *serial)                /* RETURNED */
1604 {
1605         CFRef<SecCertificateRef> certificate = SecCertificateCreateItemImplInstance(certRef);
1606
1607         SecPointer<Certificate> cert = Certificate::required(certificate);
1608         CSSM_DATA_PTR fieldVal;
1609
1610         if(issuer != NULL) {
1611                 fieldVal = cert->copyFirstFieldValue(CSSMOID_X509V1IssuerNameStd);
1612                 *issuer = CFDataCreate(NULL, fieldVal->Data, fieldVal->Length);
1613                 cert->releaseFieldValue(CSSMOID_X509V1IssuerNameStd, fieldVal);
1614         }
1615
1616         fieldVal = cert->copyFirstFieldValue(CSSMOID_X509V1SerialNumber);
1617         *serial = CFDataCreate(NULL, fieldVal->Data, fieldVal->Length);
1618         cert->releaseFieldValue(CSSMOID_X509V1SerialNumber, fieldVal);
1619 }
1620
1621 void TrustSettings::abort(
1622         const char *why,
1623         OSStatus err)
1624 {
1625         Syslog::error("TrustSettings: %s", why);
1626         MacOSError::throwMe(err);
1627 }
1628