]> git.saurik.com Git - apple/security.git/blob - OSX/libsecurity_keychain/lib/Trust.cpp
Security-57740.1.18.tar.gz
[apple/security.git] / OSX / libsecurity_keychain / lib / Trust.cpp
1 /*
2 * Copyright (c) 2002-2015 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24 //
25 // Trust.cpp
26 //
27 #include <security_keychain/Trust.h>
28 #include <security_keychain/TrustSettingsSchema.h>
29 #include <security_cdsa_utilities/cssmdates.h>
30 #include <security_utilities/cfutilities.h>
31 #include <CoreFoundation/CoreFoundation.h>
32 #include <Security/SecCertificate.h>
33 #include <Security/SecTrust.h>
34 #include "SecBridge.h"
35 #include "TrustAdditions.h"
36 #include "TrustKeychains.h"
37 #include <security_cdsa_client/dlclient.h>
38 #include <security_keychain/Keychains.h>
39
40
41 using namespace Security;
42 using namespace KeychainCore;
43
44 //
45 // Translate CFDataRef to CssmData. The output shares the input's buffer.
46 //
47 static inline CssmData cfData(CFDataRef data)
48 {
49 return CssmData(const_cast<UInt8 *>(CFDataGetBytePtr(data)),
50 CFDataGetLength(data));
51 }
52
53 //
54 // Convert a SecPointer to a CF object.
55 //
56 static SecCertificateRef
57 convert(const SecPointer<Certificate> &certificate)
58 {
59 return *certificate;
60 }
61
62 //
63 // For now, we use a global TrustStore
64 //
65 ModuleNexus<TrustStore> Trust::gStore;
66
67 #pragma mark -- TrustKeychains --
68
69 //
70 // Singleton maintaining open references to standard system keychains,
71 // to avoid having them be opened anew every time SecTrust is used.
72 //
73
74 static ModuleNexus<TrustKeychains> trustKeychains;
75 static ModuleNexus<RecursiveMutex> trustKeychainsMutex;
76
77 extern "C" bool GetServerMode();
78
79 TrustKeychains::TrustKeychains() :
80 mRootStoreHandle(nullCSSMDLDBHandle),
81 mSystem(globals().storageManager.make(ADMIN_CERT_STORE_PATH, false))
82 {
83 if (GetServerMode()) // in server mode? Don't go through StorageManager to make a keychain
84 {
85 mRootStoreDL = new DL(gGuidAppleFileDL),
86 mRootStoreDb = new Db(*mRootStoreDL, SYSTEM_ROOT_STORE_PATH),
87 mRootStore = new Keychain(*mRootStoreDb);
88 }
89 else
90 {
91 mRootStoreDL = NULL;
92 mRootStoreDb = NULL;
93 mRootStore = new Keychain(globals().storageManager.make(SYSTEM_ROOT_STORE_PATH, false));
94 }
95 (*mRootStore)->database()->activate();
96 mRootStoreHandle = (*mRootStore)->database()->handle();
97 }
98
99 TrustKeychains::~TrustKeychains() {
100 if(mRootStoreDL) {
101 delete mRootStoreDL;
102 mRootStoreDL = NULL;
103 }
104 if(mRootStoreDb) {
105 delete mRootStoreDb;
106 mRootStoreDb = NULL;
107 }
108 if(mRootStore) {
109 delete mRootStore;
110 mRootStore = NULL;
111 }
112 }
113
114 RecursiveMutex& SecTrustKeychainsGetMutex()
115 {
116 return trustKeychainsMutex();
117 }
118
119 #pragma mark -- Trust --
120 //
121 // Construct a Trust object with suitable defaults.
122 // Use setters for additional arguments before calling evaluate().
123 //
124 Trust::Trust(CFTypeRef certificates, CFTypeRef policies)
125 : mTP(gGuidAppleX509TP), mAction(CSSM_TP_ACTION_DEFAULT),
126 mCerts(cfArrayize(certificates)), mPolicies(cfArrayize(policies)),
127 mSearchLibs(NULL), mSearchLibsSet(false), mResult(kSecTrustResultInvalid),
128 mUsingTrustSettings(false), mAnchorPolicy(useAnchorsDefault), mMutex(Mutex::recursive)
129 {
130 if (!mPolicies) {
131 mPolicies.take(CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks));
132 }
133 }
134
135
136 //
137 // Clean up a Trust object
138 //
139 Trust::~Trust()
140 {
141 clearResults();
142 if (mSearchLibs) {
143 delete mSearchLibs;
144 }
145
146 mPolicies = NULL;
147 }
148
149
150 //
151 // Get searchLibs (a vector of Keychain objects);
152 // normally initialized to default search list
153 //
154 StorageManager::KeychainList& Trust::searchLibs(bool init)
155 {
156 if (!mSearchLibs) {
157 mSearchLibs = new StorageManager::KeychainList;
158 if (init) {
159 globals().storageManager.getSearchList(*mSearchLibs);
160 }
161 }
162 return *mSearchLibs;
163 }
164
165
166 //
167 // Set searchLibs to provided vector of Keychain objects
168 //
169 void Trust::searchLibs(StorageManager::KeychainList &libs)
170 {
171 searchLibs(false) = libs;
172 mSearchLibsSet = true;
173 }
174
175
176 //
177 // Retrieve the last TP evaluation result, if any
178 //
179 CSSM_TP_VERIFY_CONTEXT_RESULT_PTR Trust::cssmResult()
180 {
181 if (mResult == kSecTrustResultInvalid)
182 MacOSError::throwMe(errSecTrustNotAvailable);
183 return &mTpResult;
184 }
185
186
187 // SecCertificateRef -> CssmData
188 static
189 CssmData cfCertificateData(SecCertificateRef certificate)
190 {
191 return Certificate::required(certificate)->data();
192 }
193
194 // SecPolicyRef -> CssmField (CFDataRef/NULL or oid/value of a SecPolicy)
195 static
196 CssmField cfField(SecPolicyRef item)
197 {
198 SecPointer<Policy> policy = Policy::required(SecPolicyRef(item));
199 return CssmField(policy->oid(), policy->value());
200 }
201
202 // SecKeychain -> CssmDlDbHandle
203 #if 0
204 static
205 CSSM_DL_DB_HANDLE cfKeychain(SecKeychainRef ref)
206 {
207 Keychain keychain = KeychainImpl::required(ref);
208 return keychain->database()->handle();
209 }
210 #endif
211
212 #if !defined(NDEBUG)
213 void showCertSKID(const void *value, void *context);
214 #endif
215
216 //
217 // Here's the big "E" - evaluation.
218 // We build most of the CSSM-layer input structures dynamically right here;
219 // they will auto-destruct when we're done. The output structures are kept
220 // around (in our data members) for later analysis.
221 // Note that evaluate() can be called repeatedly, so we must be careful to
222 // dispose of prior results.
223 //
224 void Trust::evaluate(bool disableEV)
225 {
226 bool isEVCandidate=false;
227 // begin evaluation block with stack-based mutex
228 {
229 StLock<Mutex>_(mMutex);
230 // if we have evaluated before, release prior result
231 clearResults();
232
233 // determine whether the leaf certificate is an EV candidate
234 CFArrayRef allowedAnchors = NULL;
235 if (!disableEV) {
236 allowedAnchors = allowedEVRootsForLeafCertificate(mCerts);
237 isEVCandidate = (allowedAnchors != NULL);
238 }
239 CFArrayRef filteredCerts = NULL;
240 if (isEVCandidate) {
241 secinfo("evTrust", "Trust::evaluate() certificate is EV candidate");
242 filteredCerts = potentialEVChainWithCertificates(mCerts);
243 mCerts = filteredCerts;
244 } else {
245 secinfo("evTrust", "Trust::evaluate() performing standard evaluation");
246 if (mCerts) {
247 filteredCerts = CFArrayCreateMutableCopy(NULL, 0, mCerts);
248 }
249 if (mAnchors) {
250 allowedAnchors = CFArrayCreateMutableCopy(NULL, 0, mAnchors);
251 }
252 }
253 // retain these certs as long as we potentially could have results involving them
254 // (note that assignment to a CFRef type performs an implicit retain)
255 mAllowedAnchors = allowedAnchors;
256 mFilteredCerts = filteredCerts;
257
258 if (allowedAnchors)
259 CFRelease(allowedAnchors);
260 if (filteredCerts)
261 CFRelease(filteredCerts);
262
263 if (mAllowedAnchors)
264 {
265 secinfo("trusteval", "Trust::evaluate: anchors: %ld", CFArrayGetCount(mAllowedAnchors));
266 #if !defined(NDEBUG)
267 CFArrayApplyFunction(mAllowedAnchors, CFRangeMake(0, CFArrayGetCount(mAllowedAnchors)), showCertSKID, NULL);
268 #endif
269 }
270
271 // set default search list from user's default, if caller did not explicitly supply it
272 if(!mSearchLibsSet) {
273 globals().storageManager.getSearchList(searchLibs());
274 mSearchLibsSet = true;
275 }
276
277 // build the target cert group
278 CFToVector<CssmData, SecCertificateRef, cfCertificateData> subjects(mFilteredCerts);
279 CertGroup subjectCertGroup(CSSM_CERT_X_509v3,
280 CSSM_CERT_ENCODING_BER, CSSM_CERTGROUP_DATA);
281 subjectCertGroup.count() = subjects;
282 subjectCertGroup.blobCerts() = subjects;
283
284 // build a TP_VERIFY_CONTEXT, a veritable nightmare of a data structure
285 TPBuildVerifyContext context(mAction);
286
287 /*
288 * Guarantee *some* action data...
289 * NOTE this only works with the local X509 TP. When this module can deal
290 * with other TPs, this must be revisited.
291 */
292 CSSM_APPLE_TP_ACTION_DATA localActionData;
293 memset(&localActionData, 0, sizeof(localActionData));
294 CssmData localActionCData((uint8 *)&localActionData, sizeof(localActionData));
295 CSSM_APPLE_TP_ACTION_DATA *actionDataP = &localActionData;
296 if (mActionData) {
297 context.actionData() = cfData(mActionData);
298 actionDataP = (CSSM_APPLE_TP_ACTION_DATA *)context.actionData().data();
299 }
300 else {
301 context.actionData() = localActionCData;
302 }
303
304 bool hasSSLPolicy = policySpecified(mPolicies, CSSMOID_APPLE_TP_SSL);
305 bool hasEAPPolicy = policySpecified(mPolicies, CSSMOID_APPLE_TP_EAP);
306
307 if (!mAnchors) {
308 // always check trust settings if caller did not provide explicit trust anchors
309 actionDataP->ActionFlags |= CSSM_TP_ACTION_TRUST_SETTINGS;
310 }
311
312 if (mNetworkPolicy == useNetworkDefault) {
313 if (hasSSLPolicy) {
314 // enable network cert fetch for SSL only: <rdar://7422356>
315 actionDataP->ActionFlags |= CSSM_TP_ACTION_FETCH_CERT_FROM_NET;
316 }
317 }
318 else if (mNetworkPolicy == useNetworkEnabled)
319 actionDataP->ActionFlags |= CSSM_TP_ACTION_FETCH_CERT_FROM_NET;
320 else if (mNetworkPolicy == useNetworkDisabled)
321 actionDataP->ActionFlags &= ~(CSSM_TP_ACTION_FETCH_CERT_FROM_NET);
322
323 if (policySpecified(mPolicies, CSSMOID_APPLE_TP_ESCROW_SERVICE)) {
324 // ignore expiration dates, per rdar://21943474
325 actionDataP->ActionFlags |= (CSSM_TP_ACTION_ALLOW_EXPIRED |
326 CSSM_TP_ACTION_ALLOW_EXPIRED_ROOT);
327 }
328
329 /*
330 * Policies (one at least, please).
331 * For revocation policies, see if any have been explicitly specified...
332 */
333 CFMutableArrayRef allPolicies = NULL;
334 uint32 numRevocationAdded = 0;
335 bool requirePerCert = (actionDataP->ActionFlags & CSSM_TP_ACTION_REQUIRE_REV_PER_CERT);
336
337 // If a new unified revocation policy was explicitly specified,
338 // convert into old-style individual OCSP and CRL policies.
339 // Note that the caller could configure revocation policy options
340 // to explicitly disable both methods, so 0 policies might be added,
341 // in which case we must no longer consider the cert an EV candidate.
342
343 allPolicies = convertRevocationPolicy(numRevocationAdded, context.allocator);
344 if (allPolicies) {
345 // caller has explicitly set the revocation policy they want to use
346 secinfo("evTrust", "Trust::evaluate() using explicit revocation policy (%d)",
347 numRevocationAdded);
348 if (numRevocationAdded == 0)
349 isEVCandidate = false;
350 }
351 else if (mAnchors && (CFArrayGetCount(mAnchors)==0) && (searchLibs().size()==0)) {
352 // caller explicitly provided empty anchors and no keychain list,
353 // and did not explicitly specify the revocation policy;
354 // override global revocation check setting for this evaluation
355 secinfo("evTrust", "Trust::evaluate() has empty anchors and no keychains");
356 allPolicies = NULL; // use only mPolicies
357 isEVCandidate = false;
358 }
359 else if (isEVCandidate || requirePerCert) {
360 // force revocation checking for this evaluation
361 secinfo("evTrust", "Trust::evaluate() forcing OCSP/CRL revocation check");
362 allPolicies = forceRevocationPolicies(true, requirePerCert,
363 numRevocationAdded, context.allocator, requirePerCert);
364 }
365 else if(!(revocationPolicySpecified(mPolicies))) {
366 // none specified in mPolicies; try preferences
367 allPolicies = addPreferenceRevocationPolicies(!(hasSSLPolicy || hasEAPPolicy),
368 !(hasSSLPolicy || hasEAPPolicy), numRevocationAdded, context.allocator);
369 }
370 if (allPolicies == NULL) {
371 // use mPolicies; no revocation checking will be performed
372 secinfo("evTrust", "Trust::evaluate() will not perform revocation check");
373 CFIndex numPolicies = CFArrayGetCount(mPolicies);
374 CFAllocatorRef allocator = CFGetAllocator(mPolicies);
375 allPolicies = CFArrayCreateMutableCopy(allocator, numPolicies, mPolicies);
376 }
377 orderRevocationPolicies(allPolicies);
378 CFToVector<CssmField, SecPolicyRef, cfField> policies(allPolicies);
379 #if 0
380 // error exit here if empty policies are not supported
381 if (policies.empty())
382 MacOSError::throwMe(CSSMERR_TP_INVALID_POLICY_IDENTIFIERS);
383 #endif
384 context.setPolicies(policies, policies);
385
386 // anchor certificates (if caller provides them, or if cert requires EV)
387 CFCopyRef<CFArrayRef> anchors(mAllowedAnchors);
388 CFToVector<CssmData, SecCertificateRef, cfCertificateData> roots(anchors);
389 if (!anchors) {
390 // no anchor certificates were provided;
391 // built-in anchors will be trusted unless explicitly disabled.
392 mUsingTrustSettings = (mAnchorPolicy < useAnchorsOnly);
393 secinfo("userTrust", "Trust::evaluate() %s",
394 (mUsingTrustSettings) ? "using UserTrust" : "has no trusted anchors!");
395 }
396 else {
397 // anchor certificates were provided;
398 // built-in anchors will NOT also be trusted unless explicitly enabled.
399 mUsingTrustSettings = (mAnchorPolicy == useAnchorsAndBuiltIns);
400 secinfo("userTrust", "Trust::evaluate() using %s %s anchors",
401 (mUsingTrustSettings) ? "UserTrust AND" : "only",
402 (isEVCandidate) ? "EV" : "caller");
403 context.anchors(roots, roots);
404 }
405
406 // dlDbList (keychain list)
407 vector<CSSM_DL_DB_HANDLE> dlDbList;
408 {
409 StLock<Mutex> _(SecTrustKeychainsGetMutex());
410 StorageManager::KeychainList& list = searchLibs();
411 for (StorageManager::KeychainList::const_iterator it = list.begin();
412 it != list.end(); it++)
413 {
414 try
415 {
416 // For the purpose of looking up intermediate certificates to establish trust,
417 // do not include the network-based LDAP or DotMac pseudo-keychains. (The only
418 // time the network should be consulted for certificates is if there is an AIA
419 // extension with a specific URL, which will be handled by the TP code.)
420 CSSM_DL_DB_HANDLE dldbHandle = (*it)->database()->handle();
421 if (dldbHandle.DLHandle) {
422 CSSM_GUID guid = {};
423 CSSM_RETURN crtn = CSSM_GetModuleGUIDFromHandle(dldbHandle.DLHandle, &guid);
424 if (crtn == CSSM_OK) {
425 if ((memcmp(&guid, &gGuidAppleLDAPDL, sizeof(CSSM_GUID))==0) ||
426 (memcmp(&guid, &gGuidAppleDotMacDL, sizeof(CSSM_GUID))==0)) {
427 continue; // don't add to dlDbList
428 }
429 }
430 }
431 // This DB is OK to search for intermediate certificates.
432 dlDbList.push_back(dldbHandle);
433 }
434 catch (...)
435 {
436 }
437 }
438 if(mUsingTrustSettings) {
439 /* Append system anchors for use with Trust Settings */
440 try {
441 CSSM_DL_DB_HANDLE rootStoreHandle = trustKeychains().rootStoreHandle();
442 if (rootStoreHandle.DBHandle)
443 dlDbList.push_back(rootStoreHandle);
444 actionDataP->ActionFlags |= CSSM_TP_ACTION_TRUST_SETTINGS;
445 }
446 catch (...) {
447 // no root store or system keychain; don't use trust settings but continue
448 mUsingTrustSettings = false;
449 }
450 try {
451 CSSM_DL_DB_HANDLE systemKcHandle = trustKeychains().systemKcHandle();
452 if (systemKcHandle.DBHandle)
453 dlDbList.push_back(systemKcHandle);
454 }
455 catch(...) {
456 /* Oh well, at least we got the root store DB */
457 }
458 }
459 context.setDlDbList((uint32)dlDbList.size(), &dlDbList[0]);
460 }
461
462 // verification time
463 char timeString[15];
464 if (mVerifyTime) {
465 CssmUniformDate(static_cast<CFDateRef>(mVerifyTime)).convertTo(
466 timeString, sizeof(timeString));
467 context.time(timeString);
468 }
469
470 // to avoid keychain open/close thrashing, hold a copy of the search list
471 StorageManager::KeychainList *holdSearchList = NULL;
472 if (searchLibs().size() > 0) {
473 holdSearchList = new StorageManager::KeychainList;
474 globals().storageManager.getSearchList(*holdSearchList);
475 }
476
477 // Go TP!
478 try {
479 mTP->certGroupVerify(subjectCertGroup, context, &mTpResult);
480 mTpReturn = errSecSuccess;
481 } catch (CommonError &err) {
482 mTpReturn = err.osStatus();
483 secinfo("trusteval", "certGroupVerify exception: %d", (int)mTpReturn);
484 }
485 mResult = diagnoseOutcome();
486
487 // see if we can use the evidence
488 if (mTpResult.count() > 0
489 && mTpResult[0].form() == CSSM_EVIDENCE_FORM_APPLE_HEADER
490 && mTpResult[0].as<CSSM_TP_APPLE_EVIDENCE_HEADER>()->Version == CSSM_TP_APPLE_EVIDENCE_VERSION
491 && mTpResult.count() == 3
492 && mTpResult[1].form() == CSSM_EVIDENCE_FORM_APPLE_CERTGROUP
493 && mTpResult[2].form() == CSSM_EVIDENCE_FORM_APPLE_CERT_INFO) {
494 evaluateUserTrust(*mTpResult[1].as<CertGroup>(),
495 mTpResult[2].as<CSSM_TP_APPLE_EVIDENCE_INFO>(), anchors);
496 } else {
497 // unexpected evidence information. Can't use it
498 secinfo("trusteval", "unexpected evidence ignored");
499 }
500
501 /* do post-processing for the evaluated certificate chain */
502 CFArrayRef fullChain = makeCFArrayFrom(convert, mCertChain);
503 CFDictionaryRef etResult = extendedTrustResults(fullChain, mResult, mTpReturn, isEVCandidate);
504 mExtendedResult = etResult; // assignment to CFRef type is an implicit retain
505 if (etResult) {
506 CFRelease(etResult);
507 }
508 if (fullChain) {
509 CFRelease(fullChain);
510 }
511
512 if (allPolicies) {
513 /* clean up revocation policies we created implicitly */
514 if(numRevocationAdded) {
515 freeAddedRevocationPolicyData(allPolicies, numRevocationAdded, context.allocator);
516 }
517 CFRelease(allPolicies);
518 }
519
520 if (holdSearchList) {
521 delete holdSearchList;
522 holdSearchList = NULL;
523 }
524 } // end evaluation block with mutex; releases all temporary allocations in this scope
525
526
527 if (isEVCandidate && mResult == kSecTrustResultRecoverableTrustFailure &&
528 (mTpReturn == CSSMERR_TP_NOT_TRUSTED || isRevocationServerMetaError(mTpReturn))) {
529 // re-do the evaluation, this time disabling EV
530 evaluate(true);
531 }
532 }
533
534 // CSSM_RETURN values that map to kSecTrustResultRecoverableTrustFailure.
535 static const CSSM_RETURN recoverableErrors[] =
536 {
537 CSSMERR_TP_INVALID_ANCHOR_CERT,
538 CSSMERR_TP_NOT_TRUSTED,
539 CSSMERR_TP_VERIFICATION_FAILURE,
540 CSSMERR_TP_VERIFY_ACTION_FAILED,
541 CSSMERR_TP_INVALID_REQUEST_INPUTS,
542 CSSMERR_TP_CERT_EXPIRED,
543 CSSMERR_TP_CERT_NOT_VALID_YET,
544 CSSMERR_TP_CERTIFICATE_CANT_OPERATE,
545 CSSMERR_TP_INVALID_CERT_AUTHORITY,
546 CSSMERR_APPLETP_INCOMPLETE_REVOCATION_CHECK,
547 CSSMERR_APPLETP_HOSTNAME_MISMATCH,
548 CSSMERR_TP_VERIFY_ACTION_FAILED,
549 CSSMERR_APPLETP_SMIME_EMAIL_ADDRS_NOT_FOUND,
550 CSSMERR_APPLETP_SMIME_NO_EMAIL_ADDRS,
551 CSSMERR_APPLETP_SMIME_BAD_EXT_KEY_USE,
552 CSSMERR_APPLETP_CS_BAD_CERT_CHAIN_LENGTH,
553 CSSMERR_APPLETP_CS_NO_BASIC_CONSTRAINTS,
554 CSSMERR_APPLETP_CS_BAD_PATH_LENGTH,
555 CSSMERR_APPLETP_CS_NO_EXTENDED_KEY_USAGE,
556 CSSMERR_APPLETP_INVALID_EXTENDED_KEY_USAGE,
557 CSSMERR_APPLETP_CODE_SIGN_DEVELOPMENT,
558 CSSMERR_APPLETP_RS_BAD_CERT_CHAIN_LENGTH,
559 CSSMERR_APPLETP_UNKNOWN_CRITICAL_EXTEN,
560 CSSMERR_APPLETP_CRL_NOT_FOUND,
561 CSSMERR_APPLETP_CRL_SERVER_DOWN,
562 CSSMERR_APPLETP_CRL_NOT_VALID_YET,
563 CSSMERR_APPLETP_OCSP_UNAVAILABLE,
564 CSSMERR_APPLETP_INCOMPLETE_REVOCATION_CHECK,
565 CSSMERR_APPLETP_NETWORK_FAILURE,
566 CSSMERR_APPLETP_OCSP_RESP_TRY_LATER,
567 CSSMERR_APPLETP_IDENTIFIER_MISSING,
568 };
569 #define NUM_RECOVERABLE_ERRORS (sizeof(recoverableErrors) / sizeof(CSSM_RETURN))
570
571 //
572 // Classify the TP outcome in terms of a SecTrustResultType
573 //
574 SecTrustResultType Trust::diagnoseOutcome()
575 {
576 StLock<Mutex>_(mMutex);
577
578 uint32 chainLength = 0;
579 if (mTpResult.count() == 3 &&
580 mTpResult[1].form() == CSSM_EVIDENCE_FORM_APPLE_CERTGROUP &&
581 mTpResult[2].form() == CSSM_EVIDENCE_FORM_APPLE_CERT_INFO)
582 {
583 const CertGroup &chain = *mTpResult[1].as<CertGroup>();
584 chainLength = chain.count();
585 }
586
587 switch (mTpReturn) {
588 case errSecSuccess: // peachy
589 if (mUsingTrustSettings)
590 {
591 if (chainLength)
592 {
593 const CSSM_TP_APPLE_EVIDENCE_INFO *infoList = mTpResult[2].as<CSSM_TP_APPLE_EVIDENCE_INFO>();
594 const TPEvidenceInfo &info = TPEvidenceInfo::overlay(infoList[chainLength-1]);
595 const CSSM_TP_APPLE_CERT_STATUS resultCertStatus = info.status();
596 bool hasUserDomainTrust = ((resultCertStatus & CSSM_CERT_STATUS_TRUST_SETTINGS_TRUST) &&
597 (resultCertStatus & CSSM_CERT_STATUS_TRUST_SETTINGS_FOUND_USER));
598 bool hasAdminDomainTrust = ((resultCertStatus & CSSM_CERT_STATUS_TRUST_SETTINGS_TRUST) &&
599 (resultCertStatus & CSSM_CERT_STATUS_TRUST_SETTINGS_FOUND_ADMIN));
600 if (hasUserDomainTrust || hasAdminDomainTrust)
601 {
602 return kSecTrustResultProceed; // explicitly allowed
603 }
604 }
605 }
606 return kSecTrustResultUnspecified; // cert evaluates OK
607 case CSSMERR_TP_INVALID_CERTIFICATE: // bad certificate
608 return kSecTrustResultFatalTrustFailure;
609 case CSSMERR_APPLETP_TRUST_SETTING_DENY: // authoritative denial
610 return kSecTrustResultDeny;
611 default:
612 break;
613 }
614
615 // a known list of returns maps to kSecTrustResultRecoverableTrustFailure
616 const CSSM_RETURN *errp=recoverableErrors;
617 for(unsigned dex=0; dex<NUM_RECOVERABLE_ERRORS; dex++, errp++) {
618 if(*errp == mTpReturn) {
619 return kSecTrustResultRecoverableTrustFailure;
620 }
621 }
622 return kSecTrustResultOtherError; // unknown
623 }
624
625
626 //
627 // Assuming a good evidence chain, check user trust
628 // settings and set mResult accordingly.
629 //
630 void Trust::evaluateUserTrust(const CertGroup &chain,
631 const CSSM_TP_APPLE_EVIDENCE_INFO *infoList, CFCopyRef<CFArrayRef> anchors)
632 {
633 StLock<Mutex>_(mMutex);
634 // extract cert chain as Certificate objects
635 mCertChain.resize(chain.count());
636 for (uint32 n = 0; n < mCertChain.size(); n++) {
637 const TPEvidenceInfo &info = TPEvidenceInfo::overlay(infoList[n]);
638 if (info.recordId()) {
639 Keychain keychain = keychainByDLDb(info.DlDbHandle);
640 DbUniqueRecord uniqueId(keychain->database()->newDbUniqueRecord());
641 secinfo("trusteval", "evidence %lu from keychain \"%s\"", (unsigned long)n, keychain->name());
642 *static_cast<CSSM_DB_UNIQUE_RECORD_PTR *>(uniqueId) = info.UniqueRecord;
643 uniqueId->activate(); // transfers ownership
644 Item ii = keychain->item(CSSM_DL_DB_RECORD_X509_CERTIFICATE, uniqueId);
645 Certificate* cert = dynamic_cast<Certificate*>(ii.get());
646 if (cert == NULL) {
647 CssmError::throwMe(CSSMERR_CSSM_INVALID_POINTER);
648 }
649 mCertChain[n] = cert;
650 } else if (info.status(CSSM_CERT_STATUS_IS_IN_INPUT_CERTS)) {
651 secinfo("trusteval", "evidence %lu from input cert %lu", (unsigned long)n, (unsigned long)info.index());
652 assert(info.index() < uint32(CFArrayGetCount(mCerts)));
653 SecCertificateRef cert = SecCertificateRef(CFArrayGetValueAtIndex(mCerts,
654 info.index()));
655 mCertChain[n] = Certificate::required(cert);
656 } else if (info.status(CSSM_CERT_STATUS_IS_IN_ANCHORS)) {
657 secinfo("trusteval", "evidence %lu from anchor cert %lu", (unsigned long)n, (unsigned long)info.index());
658 assert(info.index() < uint32(CFArrayGetCount(anchors)));
659 SecCertificateRef cert = SecCertificateRef(CFArrayGetValueAtIndex(anchors,
660 info.index()));
661 mCertChain[n] = Certificate::required(cert);
662 } else {
663 // unknown source; make a new Certificate for it
664 secinfo("trusteval", "evidence %lu from unknown source", (unsigned long)n);
665 mCertChain[n] =
666 new Certificate(chain.blobCerts()[n],
667 CSSM_CERT_X_509v3, CSSM_CERT_ENCODING_BER);
668 }
669 }
670
671 // now walk the chain, leaf-to-root, checking for user settings
672 TrustStore &store = gStore();
673 SecPointer<Policy> policy = (CFArrayGetCount(mPolicies)) ?
674 Policy::required(SecPolicyRef(CFArrayGetValueAtIndex(mPolicies, 0))) : NULL;
675 for (mResultIndex = 0;
676 mResult == kSecTrustResultUnspecified && mResultIndex < mCertChain.size() && policy;
677 mResultIndex++) {
678 if (!mCertChain[mResultIndex]) {
679 assert(false);
680 continue;
681 }
682 mResult = store.find(mCertChain[mResultIndex], policy, searchLibs());
683 secinfo("trusteval", "trustResult=%d from cert %d", (int)mResult, (int)mResultIndex);
684 }
685 }
686
687
688 //
689 // Release TP evidence information.
690 // This information is severely under-defined by CSSM, so we proceed
691 // as follows:
692 // (a) If the evidence matches an Apple-defined pattern, use specific
693 // knowledge of that format.
694 // (b) Otherwise, assume that the void * are flat blocks of memory.
695 //
696 void Trust::releaseTPEvidence(TPVerifyResult &result, Allocator &allocator)
697 {
698 if (result.count() > 0) { // something to do
699 if (result[0].form() == CSSM_EVIDENCE_FORM_APPLE_HEADER) {
700 // Apple defined evidence form -- use intimate knowledge
701 if (result[0].as<CSSM_TP_APPLE_EVIDENCE_HEADER>()->Version == CSSM_TP_APPLE_EVIDENCE_VERSION
702 && result.count() == 3
703 && result[1].form() == CSSM_EVIDENCE_FORM_APPLE_CERTGROUP
704 && result[2].form() == CSSM_EVIDENCE_FORM_APPLE_CERT_INFO) {
705 // proper format
706 CertGroup& certs = *result[1].as<CertGroup>();
707 CSSM_TP_APPLE_EVIDENCE_INFO *evidence = result[2].as<CSSM_TP_APPLE_EVIDENCE_INFO>();
708 uint32 count = certs.count();
709 allocator.free(result[0].data()); // just a struct
710 certs.destroy(allocator); // certgroup contents
711 allocator.free(result[1].data()); // the CertGroup itself
712 for (uint32 n = 0; n < count; n++)
713 allocator.free(evidence[n].StatusCodes);
714 allocator.free(result[2].data()); // array of (flat) info structs
715 } else {
716 secinfo("trusteval", "unrecognized Apple TP evidence format");
717 // drop it -- better leak than kill
718 }
719 } else {
720 // unknown format -- blindly assume flat blobs
721 secinfo("trusteval", "destroying unknown TP evidence format");
722 for (uint32 n = 0; n < result.count(); n++)
723 {
724 allocator.free(result[n].data());
725 }
726 }
727
728 allocator.free (result.Evidence);
729 }
730 }
731
732
733 //
734 // Clear evaluation results unless state is initial (invalid)
735 //
736 void Trust::clearResults()
737 {
738 StLock<Mutex>_(mMutex);
739 if (mResult != kSecTrustResultInvalid) {
740 releaseTPEvidence(mTpResult, mTP.allocator());
741 mResult = kSecTrustResultInvalid;
742 mExtendedResult = NULL;
743 }
744 }
745
746
747 //
748 // Build evidence information
749 //
750 void Trust::buildEvidence(CFArrayRef &certChain, TPEvidenceInfo * &statusChain)
751 {
752 StLock<Mutex>_(mMutex);
753 if (mResult == kSecTrustResultInvalid)
754 MacOSError::throwMe(errSecTrustNotAvailable);
755 certChain = mEvidenceReturned =
756 makeCFArrayFrom(convert, mCertChain);
757 if(mTpResult.count() >= 3) {
758 statusChain = mTpResult[2].as<TPEvidenceInfo>();
759 }
760 else {
761 statusChain = NULL;
762 }
763 }
764
765
766 //
767 // Return extended result dictionary
768 //
769 void Trust::extendedResult(CFDictionaryRef &result)
770 {
771 if (mResult == kSecTrustResultInvalid)
772 MacOSError::throwMe(errSecTrustNotAvailable);
773 if (mExtendedResult)
774 CFRetain(mExtendedResult); // retain before handing out to caller
775 result = mExtendedResult;
776 }
777
778
779 //
780 // Return properties array (a CFDictionaryRef for each certificate in chain)
781 //
782 CFArrayRef Trust::properties()
783 {
784 // Builds and returns an array which the caller must release.
785 StLock<Mutex>_(mMutex);
786 CFMutableArrayRef properties = CFArrayCreateMutable(NULL, 0,
787 &kCFTypeArrayCallBacks);
788 if (mResult == kSecTrustResultInvalid) // chain not built or evaluated
789 return properties;
790
791 /* Get evidence pointer */
792 CSSM_TP_APPLE_EVIDENCE_INFO *evidence = NULL;
793 uint32 evidenceChainLen = 0;
794 if (mTpResult.count() > 0) {
795 if (mTpResult[0].form() == CSSM_EVIDENCE_FORM_APPLE_HEADER) {
796 if (mTpResult[0].as<CSSM_TP_APPLE_EVIDENCE_HEADER>()->Version == CSSM_TP_APPLE_EVIDENCE_VERSION
797 && mTpResult.count() == 3
798 && mTpResult[1].form() == CSSM_EVIDENCE_FORM_APPLE_CERTGROUP
799 && mTpResult[2].form() == CSSM_EVIDENCE_FORM_APPLE_CERT_INFO) {
800 // proper format
801 CertGroup& certs = *mTpResult[1].as<CertGroup>();
802 evidence = mTpResult[2].as<CSSM_TP_APPLE_EVIDENCE_INFO>();
803 evidenceChainLen = certs.count();
804 }
805 }
806 }
807
808 // Walk the chain from leaf to anchor, building properties dictionaries
809 for (uint32 idx=0; idx < mCertChain.size(); idx++) {
810 CFMutableDictionaryRef dict = CFDictionaryCreateMutable(NULL, 0,
811 &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
812 if (dict) {
813 CFStringRef title = NULL;
814 mCertChain[idx]->inferLabel(false, &title);
815 if (title) {
816 CFDictionarySetValue(dict, (const void *)kSecPropertyTypeTitle, (const void *)title);
817 CFRelease(title);
818 }
819 if (idx == 0 && mTpReturn != errSecSuccess) {
820 CFStringRef error = SecCopyErrorMessageString(mTpReturn, NULL);
821 if (error) {
822 CFDictionarySetValue(dict, (const void *)kSecPropertyTypeError, (const void *)error);
823 CFRelease(error);
824 }
825 }
826 if (idx < evidenceChainLen) {
827 uint32 numCodes = evidence[idx].NumStatusCodes;
828 sint32 reason = evidence[idx].StatusCodes[numCodes]; // stored at end of status codes array
829 if (reason > 0) {
830 CFNumberRef cfreason = CFNumberCreate(kCFAllocatorDefault, kCFNumberSInt32Type, &reason);
831 if (cfreason) {
832 CFDictionarySetValue(dict, (const void *)kSecTrustRevocationReason, (const void *)cfreason);
833 CFRelease(cfreason);
834 }
835 }
836 }
837 CFArrayAppendValue(properties, (const void *)dict);
838 CFRelease(dict);
839 }
840 }
841
842 return properties;
843 }
844
845 //
846 // Return dictionary of evaluation results
847 //
848 CFDictionaryRef Trust::results()
849 {
850 // Builds and returns a dictionary which the caller must release.
851 StLock<Mutex>_(mMutex);
852 CFMutableDictionaryRef results = CFDictionaryCreateMutable(NULL, 0,
853 &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
854
855 // kSecTrustResultValue
856 CFNumberRef numValue = CFNumberCreate(NULL, kCFNumberSInt32Type, &mResult);
857 if (numValue) {
858 CFDictionarySetValue(results, (const void *)kSecTrustResultValue, (const void *)numValue);
859 CFRelease(numValue);
860 }
861 if (mResult == kSecTrustResultInvalid || !mExtendedResult)
862 return results; // we have nothing more to add
863
864 // kSecTrustEvaluationDate
865 CFTypeRef evaluationDate;
866 if (CFDictionaryGetValueIfPresent(mExtendedResult, kSecTrustEvaluationDate, &evaluationDate))
867 CFDictionarySetValue(results, (const void *)kSecTrustEvaluationDate, (const void *)evaluationDate);
868
869 // kSecTrustExtendedValidation, kSecTrustOrganizationName
870 CFTypeRef organizationName;
871 if (CFDictionaryGetValueIfPresent(mExtendedResult, kSecEVOrganizationName, &organizationName)) {
872 CFDictionarySetValue(results, (const void *)kSecTrustOrganizationName, (const void *)organizationName);
873 CFDictionarySetValue(results, (const void *)kSecTrustExtendedValidation, (const void *)kCFBooleanTrue);
874 }
875
876 // kSecTrustRevocationChecked, kSecTrustRevocationValidUntilDate
877 CFTypeRef expirationDate;
878 if (CFDictionaryGetValueIfPresent(mExtendedResult, kSecTrustExpirationDate, &expirationDate)) {
879 CFDictionarySetValue(results, (const void *)kSecTrustRevocationValidUntilDate, (const void *)expirationDate);
880 CFDictionarySetValue(results, (const void *)kSecTrustRevocationChecked, (const void *)kCFBooleanTrue);
881 }
882
883 return results;
884 }
885
886
887
888 //* ===========================================================================
889 //* We need a way to compare two CSSM_DL_DB_HANDLEs WITHOUT using a operator
890 //* overload
891 //* ===========================================================================
892 static
893 bool Compare_CSSM_DL_DB_HANDLE(const CSSM_DL_DB_HANDLE &h1, const CSSM_DL_DB_HANDLE &h2)
894 {
895 return (h1.DLHandle == h2.DLHandle && h1.DBHandle == h2.DBHandle);
896 }
897
898
899
900 //
901 // Given a DL_DB_HANDLE, locate the Keychain object (from the search list)
902 //
903 Keychain Trust::keychainByDLDb(const CSSM_DL_DB_HANDLE &handle)
904 {
905 StLock<Mutex>_(mMutex);
906 StorageManager::KeychainList& list = searchLibs();
907 for (StorageManager::KeychainList::const_iterator it = list.begin();
908 it != list.end(); it++)
909 {
910 try
911 {
912
913 if (Compare_CSSM_DL_DB_HANDLE((*it)->database()->handle(), handle))
914 return *it;
915 }
916 catch (...)
917 {
918 }
919 }
920 if(mUsingTrustSettings) {
921 try {
922 if(Compare_CSSM_DL_DB_HANDLE(trustKeychains().rootStoreHandle(), handle)) {
923 return trustKeychains().rootStore();
924 }
925 if(Compare_CSSM_DL_DB_HANDLE(trustKeychains().systemKcHandle(), handle)) {
926 return trustKeychains().systemKc();
927 }
928 }
929 catch(...) {
930 /* one of those is missing; proceed */
931 }
932 }
933
934 // could not find in search list - internal error
935
936 // we now throw an error here rather than assert and silently fail. That way our application won't crash...
937 MacOSError::throwMe(errSecInternal);
938 }