+++ /dev/null
-/*
- * Copyright (c) 2002-2004,2011-2014 Apple Inc. All Rights Reserved.
- *
- * @APPLE_LICENSE_HEADER_START@
- *
- * This file contains Original Code and/or Modifications of Original Code
- * as defined in and that are subject to the Apple Public Source License
- * Version 2.0 (the 'License'). You may not use this file except in
- * compliance with the License. Please obtain a copy of the License at
- * http://www.opensource.apple.com/apsl/ and read it before using this
- * file.
- *
- * The Original Code and all software distributed under the License are
- * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
- * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
- * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
- * Please see the License for the specific language governing rights and
- * limitations under the License.
- *
- * @APPLE_LICENSE_HEADER_END@
- */
-
-//
-// TrustStore.h - Abstract interface to permanent user trust assignments
-//
-#include <security_keychain/TrustStore.h>
-#include <security_keychain/Globals.h>
-#include <security_keychain/Certificate.h>
-#include <security_keychain/KCCursor.h>
-#include <security_keychain/SecCFTypes.h>
-#include <security_cdsa_utilities/Schema.h>
-#include <security_keychain/SecTrustSettingsPriv.h>
-
-namespace Security {
-namespace KeychainCore {
-
-
-//
-// Make and break: trivial
-//
-TrustStore::TrustStore(Allocator &alloc)
- : allocator(alloc), mRootsValid(false), mRootBytes(allocator), mMutex(Mutex::recursive)
-{
-}
-
-TrustStore::~TrustStore()
-{ }
-
-//
-// Retrieve the trust setting for a (certificate, policy) pair.
-//
-SecTrustUserSetting TrustStore::find(Certificate *cert, Policy *policy,
- StorageManager::KeychainList &keychainList)
-{
- StLock<Mutex> _(mMutex);
-
- if (Item item = findItem(cert, policy, keychainList)) {
- // Make sure that the certificate is available in some keychain,
- // to provide a basis for editing the trust setting that we're returning.
- if (cert->keychain() == NULL) {
- if (cert->findInKeychain(keychainList) == NULL) {
- Keychain defaultKeychain = Keychain::optional(NULL);
- if (Keychain location = item->keychain()) {
- try {
- cert->copyTo(location); // add cert to the trust item's keychain
- } catch (...) {
- secdebug("trusteval", "failed to add certificate %p to keychain \"%s\"",
- cert, location->name());
- try {
- if (&*location != &*defaultKeychain)
- cert->copyTo(defaultKeychain); // try the default (if it's not the same)
- } catch (...) {
- // unable to add the certificate
- secdebug("trusteval", "failed to add certificate %p to keychain \"%s\"",
- cert, defaultKeychain->name());
- }
- }
- }
- }
- }
- CssmDataContainer data;
- item->getData(data);
- if (data.length() != sizeof(TrustData))
- MacOSError::throwMe(errSecInvalidTrustSetting);
- TrustData &trust = *data.interpretedAs<TrustData>();
- if (trust.version != UserTrustItem::currentVersion)
- MacOSError::throwMe(errSecInvalidTrustSetting);
- return trust.trust;
- } else {
- return kSecTrustResultUnspecified;
- }
-}
-
-
-//
-// Set an individual trust element
-//
-void TrustStore::assign(Certificate *cert, Policy *policy, SecTrustUserSetting trust)
-{
- StLock<Mutex> _(mMutex);
-
- TrustData trustData = { UserTrustItem::currentVersion, trust };
- Keychain defaultKeychain = Keychain::optional(NULL);
- Keychain trustLocation = defaultKeychain; // default keychain, unless trust entry found
- StorageManager::KeychainList searchList;
- globals().storageManager.getSearchList(searchList);
-
- if (Item item = findItem(cert, policy, searchList)) {
- // user has a trust setting in a keychain - modify that
- trustLocation = item->keychain();
- if (trust == kSecTrustResultUnspecified)
- item->keychain()->deleteItem(item);
- else
- item->modifyContent(NULL, sizeof(trustData), &trustData);
- } else {
- // no trust entry: make one
- if (trust != kSecTrustResultUnspecified) {
- Item item = new UserTrustItem(cert, policy, trustData);
- if (Keychain location = cert->keychain()) {
- try {
- location->add(item); // try the cert's keychain first
- trustLocation = location;
- } catch (...) {
- if (&*location != &*defaultKeychain)
- defaultKeychain->add(item); // try the default (if it's not the same)
- }
- } else {
- defaultKeychain->add(item); // raw cert - use default keychain
- }
- }
- }
-
- // Make sure that the certificate is available in some keychain,
- // to provide a basis for editing the trust setting that we're assigning.
- if (cert->keychain() == NULL) {
- if (cert->findInKeychain(searchList) == NULL) {
- try {
- cert->copyTo(trustLocation); // add cert to the trust item's keychain
- } catch (...) {
- secdebug("trusteval", "failed to add certificate %p to keychain \"%s\"",
- cert, trustLocation->name());
- try {
- if (&*trustLocation != &*defaultKeychain)
- cert->copyTo(defaultKeychain); // try the default (if it's not the same)
- } catch (...) {
- // unable to add the certificate
- secdebug("trusteval", "failed to add certificate %p to keychain \"%s\"",
- cert, defaultKeychain->name());
- }
- }
- }
- }
-}
-
-
-//
-// Search the user's configured keychains for a trust setting.
-// If found, return it (as a TrustItem). Otherwise, return NULL.
-// Note that this function throws if a "real" error is encountered.
-//
-Item TrustStore::findItem(Certificate *cert, Policy *policy,
- StorageManager::KeychainList &keychainList)
-{
- // As of OS X 10.5, user trust records are no longer stored in keychains.
- // SecTrustSetUserTrust was replaced with SecTrustSettingsSetTrustSettings,
- // which stores per-user trust in a separate root-owned file. This method,
- // however, would continue to find old trust records created prior to 10.5.
- // Since those are increasingly unlikely to exist (and cannot be edited),
- // we no longer need or want to look for them anymore.
- return ((ItemImpl*)NULL);
-
- StLock<Mutex> _(mMutex);
-
- try {
- SecKeychainAttribute attrs[2];
- CssmAutoData certIndex(Allocator::standard());
- UserTrustItem::makeCertIndex(cert, certIndex);
- attrs[0].tag = kSecTrustCertAttr;
- attrs[0].length = (UInt32)certIndex.length();
- attrs[0].data = certIndex.data();
- const CssmOid &policyOid = policy->oid();
- attrs[1].tag = kSecTrustPolicyAttr;
- attrs[1].length = (UInt32)policyOid.length();
- attrs[1].data = policyOid.data();
- SecKeychainAttributeList attrList = { 2, attrs };
- KCCursor cursor(keychainList, CSSM_DL_DB_RECORD_USER_TRUST, &attrList);
- Item item;
- if (cursor->next(item))
- return item;
- }
- catch (const CommonError &error) {}
-
- return ((ItemImpl*)NULL); // no trust schema, no records, no error
-}
-
-void TrustStore::getCssmRootCertificates(CertGroup &rootCerts)
-{
- StLock<Mutex> _(mMutex);
-
- if (!mRootsValid)
- loadRootCertificates();
- rootCerts = CertGroup(CSSM_CERT_X_509v3, CSSM_CERT_ENCODING_BER, CSSM_CERTGROUP_DATA);
- rootCerts.blobCerts() = &mRoots[0];
- rootCerts.count() = (uint32)mRoots.size();
-}
-
-//
-// Load root (anchor) certificates from disk
-//
-void TrustStore::loadRootCertificates()
-{
- StLock<Mutex> _(mMutex);
-
- CFRef<CFArrayRef> anchors;
- OSStatus ortn;
-
- /*
- * Get the current set of all positively trusted anchors.
- */
- ortn = SecTrustSettingsCopyUnrestrictedRoots(
- true, true, true, /* all domains */
- anchors.take());
- if(ortn) {
- MacOSError::throwMe(ortn);
- }
-
- // how many data bytes do we need?
- size_t size = 0;
- CFIndex numCerts = CFArrayGetCount(anchors);
- CSSM_RETURN crtn;
- for(CFIndex dex=0; dex<numCerts; dex++) {
- SecCertificateRef certRef = (SecCertificateRef)CFArrayGetValueAtIndex(anchors, dex);
- CSSM_DATA certData;
- crtn = SecCertificateGetData(certRef, &certData);
- if(crtn) {
- CssmError::throwMe(crtn);
- }
- size += certData.Length;
- }
- mRootBytes.length(size);
-
- // fill CssmData vector while copying data bytes together
- mRoots.clear();
- uint8 *base = mRootBytes.data<uint8>();
- for(CFIndex dex=0; dex<numCerts; dex++) {
- SecCertificateRef certRef = (SecCertificateRef)CFArrayGetValueAtIndex(anchors, dex);
- CSSM_DATA certData;
- SecCertificateGetData(certRef, &certData);
- memcpy(base, certData.Data, certData.Length);
- mRoots.push_back(CssmData(base, certData.Length));
- base += certData.Length;
- }
-
- secdebug("anchors", "%ld anchors loaded", (long)numCerts);
-
- mRootsValid = true; // ready to roll
-}
-
-} // end namespace KeychainCore
-} // end namespace Security
projects / apple / security.git / blobdiff