OSX/utilities/src/SecAKSWrappers.h

   1 /*
   2  * Copyright (c) 2013-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 #ifndef _SECAKSWRAPPERS_H_
  26 #define _SECAKSWRAPPERS_H_
  27
  28 #include <TargetConditionals.h>
  29 #include <utilities/SecCFError.h>
  30 #include <AssertMacros.h>
  31 #include <dispatch/dispatch.h>
  32
  33 #include <CoreFoundation/CFData.h>
  34
  35 #if RC_HORIZON
  36 #define TARGET_HAS_KEYSTORE 0
  37 #elif TARGET_OS_SIMULATOR
  38 #define TARGET_HAS_KEYSTORE 0
  39 #elif TARGET_OS_OSX
  40 #if TARGET_CPU_X86
  41 #define TARGET_HAS_KEYSTORE 0
  42 #else
  43 #define TARGET_HAS_KEYSTORE 1
  44 #endif
  45 #elif TARGET_OS_EMBEDDED
  46 #define TARGET_HAS_KEYSTORE 1
  47 #else
  48 #error "unknown keystore status for this platform"
  49 #endif
  50
  51 #if !TARGET_HAS_KEYSTORE
  52
  53 #include <IOKit/IOReturn.h>
  54
  55 // Make the compiler happy so this will compile.
  56 #define device_keybag_handle 0
  57 #define session_keybag_handle 0
  58
  59 #define bad_keybag_handle -1
  60
  61 enum keybag_state {
  62     keybag_state_unlocked = 0,
  63     keybag_state_locked = 1 << 0,
  64     keybag_state_no_pin = 1 << 1,
  65     keybag_state_been_unlocked = 1 << 2,
  66 };
  67 typedef uint32_t keybag_state_t;
  68 typedef int32_t keybag_handle_t;
  69
  70 static kern_return_t aks_get_lock_state(keybag_handle_t handle, keybag_state_t *state) {
  71     if (state) *state = keybag_state_no_pin & keybag_state_been_unlocked;
  72     return kIOReturnSuccess;
  73 }
  74
  75 #else
  76
  77 #include <libaks.h>
  78
  79 #endif
  80
  81 //
  82 // MARK: User lock state
  83 //
  84
  85 enum {
  86     user_keybag_handle = TARGET_OS_EMBEDDED ? device_keybag_handle : session_keybag_handle,
  87 };
  88
  89 extern const char * const kUserKeybagStateChangeNotification;
  90
  91 static inline bool SecAKSGetLockedState(keybag_state_t *state, CFErrorRef* error)
  92 {
  93     kern_return_t status = aks_get_lock_state(user_keybag_handle, state);
  94
  95     return SecKernError(status, error, CFSTR("aks_get_lock_state failed: %d"), status);
  96 }
  97
  98 // returns true if any of the bits in bits is set in the current state of the user bag
  99 static inline bool SecAKSLockedAnyStateBitIsSet(bool* isSet, keybag_state_t bits, CFErrorRef* error)
 100 {
 101     keybag_state_t state;
 102     bool success = SecAKSGetLockedState(&state, error);
 103
 104     require_quiet(success, exit);
 105
 106     if (isSet)
 107         *isSet = (state & bits);
 108
 109 exit:
 110     return success;
 111
 112 }
 113
 114 static inline bool SecAKSGetIsLocked(bool* isLocked, CFErrorRef* error)
 115 {
 116     return SecAKSLockedAnyStateBitIsSet(isLocked, keybag_state_locked, error);
 117 }
 118
 119 static inline bool SecAKSGetIsUnlocked(bool* isUnlocked, CFErrorRef* error)
 120 {
 121     bool isLocked = false;
 122     bool success = SecAKSGetIsLocked(&isLocked, error);
 123
 124     if (success && isUnlocked)
 125         *isUnlocked = !isLocked;
 126
 127     return success;
 128 }
 129
 130 static inline bool SecAKSGetHasBeenUnlocked(bool* hasBeenUnlocked, CFErrorRef* error)
 131 {
 132     return SecAKSLockedAnyStateBitIsSet(hasBeenUnlocked, keybag_state_been_unlocked, error);
 133 }
 134
 135 bool SecAKSDoWhileUserBagLocked(CFErrorRef *error, dispatch_block_t action);
 136 //
 137 // if you can't use the block version above, use these.
 138 // !!!!!Remember to balance them!!!!!!
 139 //
 140 bool SecAKSUnLockUserKeybag(CFErrorRef *error);
 141 bool SecAKSLockUserKeybag(uint64_t timeout, CFErrorRef *error);
 142
 143
 144 CFDataRef SecAKSCopyBackupBagWithSecret(size_t size, uint8_t *secret, CFErrorRef *error);
 145
 146 #endif