Security-58286.20.16.tar.gz

[apple/security.git] / OSX / libsecurity_apple_cspdl / lib / SSKey.cpp

diff --git a/OSX/libsecurity_apple_cspdl/lib/SSKey.cpp b/OSX/libsecurity_apple_cspdl/lib/SSKey.cpp
index 5eacdf9595ef08a8b747519af2c4cd08ee8e7a09..89fd9145ff8972626ce73921884e38de3ed3799d 100644 (file)
--- a/OSX/libsecurity_apple_cspdl/lib/SSKey.cpp
+++ b/OSX/libsecurity_apple_cspdl/lib/SSKey.cpp
@@ -27,6 +27,7 @@
 #include "SSDLSession.h"
 #include <security_cdsa_utilities/KeySchema.h>
 #include <security_cdsa_plugin/cssmplugin.h>
 #include "SSDLSession.h"
 #include <security_cdsa_utilities/KeySchema.h>
 #include <security_cdsa_plugin/cssmplugin.h>

+#include <security_utilities/threading.h>

 
 using namespace CssmClient;
 using namespace SecurityServer;
 
 using namespace CssmClient;
 using namespace SecurityServer;


@@ -39,6 +40,7 @@ SSKey::SSKey(SSCSPSession &session, KeyHandle keyHandle, CssmKey &ioKey,
 mAllocator(session), mKeyHandle(keyHandle),
 mClientSession(session.clientSession())
 {
 mAllocator(session), mKeyHandle(keyHandle),
 mClientSession(session.clientSession())
 {

+    StLock<Mutex> _ (mMutex); // In the constructor??? Yes. Our handlers aren't thread safe in the slightest...

        CssmKey::Header &header = ioKey.header();
        if (inKeyAttr & CSSM_KEYATTR_PERMANENT)
        {
        CssmKey::Header &header = ioKey.header();
        if (inKeyAttr & CSSM_KEYATTR_PERMANENT)
        {


@@ -124,9 +126,7 @@ mClientSession(session.clientSession())
                attributes.add(KeySchema::Unwrap,
                                           header.useFor(CSSM_KEYUSE_ANY | CSSM_KEYUSE_UNWRAP));
 
                attributes.add(KeySchema::Unwrap,
                                           header.useFor(CSSM_KEYUSE_ANY | CSSM_KEYUSE_UNWRAP));
 

-               // @@@ Fixme
-               mUniqueId = inSSDatabase->insert(mRecordType, &attributes, &blob,
-                                                                                true);
+               mUniqueId = inSSDatabase->ssInsert(mRecordType, &attributes, &blob);

        }
 
        header.cspGuid(session.plugin.myGuid()); // Set the csp guid to me.
        }
 
        header.cspGuid(session.plugin.myGuid()); // Set the csp guid to me.


@@ -142,6 +142,7 @@ mAllocator(session.allocator()), mKeyHandle(noKey), mUniqueId(uniqueId),
 mRecordType(recordType),
 mClientSession(session.clientSession())
 {
 mRecordType(recordType),
 mClientSession(session.clientSession())
 {

+    StLock<Mutex> _ (mMutex);

        CssmKey::Header &header = ioKey.header();
        memset(&header, 0, sizeof(header)); // Clear key header
 
        CssmKey::Header &header = ioKey.header();
        memset(&header, 0, sizeof(header)); // Clear key header
 


@@ -235,15 +236,23 @@ mClientSession(session.clientSession())
 }
 
 SSKey::~SSKey()
 }
 
 SSKey::~SSKey()

-{
+try {
+    StLock<Mutex> _(mMutex); // In the destructor too??? Yes. See SSCSPSession.cpp:354 for an explanation of this code's policy on threads.

        if (mKeyHandle != noKey)
                clientSession().releaseKey(mKeyHandle);
        if (mKeyHandle != noKey)
                clientSession().releaseKey(mKeyHandle);

+} catch (...) {
+    /*
+     * If the key handle have been invalidated, releaseKey will throw an exception
+     */
+    return;

 }
 
 }
 

+

 void
 SSKey::free(const AccessCredentials *accessCred, CssmKey &ioKey,
                        CSSM_BOOL deleteKey)
 {
 void
 SSKey::free(const AccessCredentials *accessCred, CssmKey &ioKey,
                        CSSM_BOOL deleteKey)
 {

+    StLock<Mutex> _(mMutex);

        freeReferenceKey(mAllocator, ioKey);
        if (deleteKey)
        {
        freeReferenceKey(mAllocator, ioKey);
        if (deleteKey)
        {


@@ -266,17 +275,20 @@ SSKey::free(const AccessCredentials *accessCred, CssmKey &ioKey,
 SecurityServer::ClientSession &
 SSKey::clientSession()
 {
 SecurityServer::ClientSession &
 SSKey::clientSession()
 {

+    StLock<Mutex> _(mMutex);

        return mClientSession;
 }
 
 KeyHandle SSKey::optionalKeyHandle() const
 {
        return mClientSession;
 }
 
 KeyHandle SSKey::optionalKeyHandle() const
 {

+    StLock<Mutex> _(mMutex);

        return mKeyHandle;
 }
 
 KeyHandle
 SSKey::keyHandle()
 {
        return mKeyHandle;
 }
 
 KeyHandle
 SSKey::keyHandle()
 {

+    StLock<Mutex> _(mMutex);

        if (mKeyHandle == noKey)
        {
                // Deal with uninstantiated keys.
        if (mKeyHandle == noKey)
        {
                // Deal with uninstantiated keys.


@@ -290,6 +302,8 @@ SSKey::keyHandle()
                        clientSession().decodeKey(mUniqueId->database().dbHandle(), blob,
                                                                          dummyHeader);
 
                        clientSession().decodeKey(mUniqueId->database().dbHandle(), blob,
                                                                          dummyHeader);
 

+        secinfo("SecAccessReference", "decoded a new key into handle %d [reference %ld]", mKeyHandle, keyReference());
+

                // @@@ Check decoded header against returned header
        }
 
                // @@@ Check decoded header against returned header
        }
 


@@ -302,6 +316,7 @@ SSKey::keyHandle()
 void
 SSKey::getOwner(CSSM_ACL_OWNER_PROTOTYPE &owner, Allocator &allocator)
 {
 void
 SSKey::getOwner(CSSM_ACL_OWNER_PROTOTYPE &owner, Allocator &allocator)
 {

+    StLock<Mutex> _ (mMutex);

        clientSession().getKeyOwner(keyHandle(), AclOwnerPrototype::overlay(owner),
                                                                allocator);
 }
        clientSession().getKeyOwner(keyHandle(), AclOwnerPrototype::overlay(owner),
                                                                allocator);
 }


@@ -310,6 +325,7 @@ void
 SSKey::changeOwner(const AccessCredentials &accessCred,
                                   const AclOwnerPrototype &newOwner)
 {
 SSKey::changeOwner(const AccessCredentials &accessCred,
                                   const AclOwnerPrototype &newOwner)
 {

+    StLock<Mutex> _ (mMutex);

        clientSession().changeKeyOwner(keyHandle(), accessCred, newOwner);
        didChangeAcl();
 }
        clientSession().changeKeyOwner(keyHandle(), accessCred, newOwner);
        didChangeAcl();
 }


@@ -318,6 +334,7 @@ void
 SSKey::getAcl(const char *selectionTag, uint32 &numberOfAclInfos,
                          AclEntryInfo *&aclInfos, Allocator &allocator)
 {
 SSKey::getAcl(const char *selectionTag, uint32 &numberOfAclInfos,
                          AclEntryInfo *&aclInfos, Allocator &allocator)
 {

+    StLock<Mutex> _ (mMutex);

        clientSession().getKeyAcl(keyHandle(), selectionTag, numberOfAclInfos,
                                                          aclInfos, allocator);
 }
        clientSession().getKeyAcl(keyHandle(), selectionTag, numberOfAclInfos,
                                                          aclInfos, allocator);
 }


@@ -325,6 +342,7 @@ SSKey::getAcl(const char *selectionTag, uint32 &numberOfAclInfos,
 void
 SSKey::changeAcl(const AccessCredentials &accessCred, const AclEdit &aclEdit)
 {
 void
 SSKey::changeAcl(const AccessCredentials &accessCred, const AclEdit &aclEdit)
 {

+    StLock<Mutex> _ (mMutex);

        clientSession().changeKeyAcl(keyHandle(), accessCred, aclEdit);
        didChangeAcl();
 }
        clientSession().changeKeyAcl(keyHandle(), accessCred, aclEdit);
        didChangeAcl();
 }


@@ -334,7 +352,7 @@ SSKey::didChangeAcl()
 {
        if (mUniqueId == true)
        {
 {
        if (mUniqueId == true)
        {

-           secdebug("keyacl", "SSKey::didChangeAcl() keyHandle: %lu updating DL entry", (unsigned long)mKeyHandle);
+           secinfo("keyacl", "SSKey::didChangeAcl() keyHandle: %lu updating DL entry", (unsigned long)mKeyHandle);

                // The key is persistent, make the change on disk.
                CssmDataContainer keyBlob(mAllocator);
                clientSession().encodeKey(keyHandle(), keyBlob);
                // The key is persistent, make the change on disk.
                CssmDataContainer keyBlob(mAllocator);
                clientSession().encodeKey(keyHandle(), keyBlob);


@@ -342,6 +360,6 @@ SSKey::didChangeAcl()
        }
        else
        {
        }
        else
        {

-           secdebug("keyacl", "SSKey::didChangeAcl() keyHandle: %lu transient key no update done", (unsigned long)mKeyHandle);
+           secinfo("keyacl", "SSKey::didChangeAcl() keyHandle: %lu transient key no update done", (unsigned long)mKeyHandle);

        }
 }
        }
 }