Security-59754.80.3.tar.gz

[apple/security.git] / OSX / libsecurity_keychain / lib / SecTrustSettings.cpp

diff --git a/OSX/libsecurity_keychain/lib/SecTrustSettings.cpp b/OSX/libsecurity_keychain/lib/SecTrustSettings.cpp
index a198ba569aeb55c26de6e57a83036d3167ad031a..c2a7e1334b2189377a107672ffa71cd3432faad8 100644 (file)
--- a/OSX/libsecurity_keychain/lib/SecTrustSettings.cpp
+++ b/OSX/libsecurity_keychain/lib/SecTrustSettings.cpp
@@ -27,9 +27,9 @@
  */
 
 #include "SecBridge.h"
-#include "SecCertificatePriv.h"
-#include "SecTrustSettings.h"
-#include "SecTrustSettingsPriv.h"
+#include <Security/SecCertificatePriv.h>
+#include <Security/SecTrustSettings.h>
+#include <Security/SecTrustSettingsPriv.h>
 #include "SecTrustSettingsCertificates.h"
 #include "SecCFRelease.h"
 #include "TrustSettingsUtils.h"
@@ -48,7 +48,7 @@
 #include <security_utilities/simpleprefs.h>
 #include <securityd_client/dictionary.h>
 #include <securityd_client/ssclient.h>
-#include <assert.h>
+#include <security_utilities/simulatecrash_assert.h>
 #include <dlfcn.h>
 #include <libproc.h>
 #include <syslog.h>
@@ -108,7 +108,7 @@ static bool tsUserTrustSettingsDisabled()
        Dictionary* dictionary = Dictionary::CreateDictionary(kSecTrustSettingsPrefsDomain, Dictionary::US_System);
        if (dictionary)
        {
-               auto_ptr<Dictionary> prefsDict(dictionary);
+               unique_ptr<Dictionary> prefsDict(dictionary);
                /* this returns false if the pref isn't there, just like we want */
                tsUserTrustDisable = prefsDict->getBoolValue(kSecTrustSettingsDisableUserTrustSettings);
        }
@@ -303,6 +303,7 @@ static void tsRegisterCallback()
 static void tsTrustSettingsChanged()
 {
        tsPurgeCache();
+    SecTrustSettingsPurgeUserAdminCertsCache();
 
        /* The only interesting data is our pid */
        NameValueDictionary nvd;
@@ -347,7 +348,7 @@ static OSStatus tsCopyTrustSettings(
                return result;
        }
 
-       auto_ptr<TrustSettings>_(ts); // make sure this gets deleted just in case something throws underneath
+       unique_ptr<TrustSettings>_(ts); // make sure this gets deleted just in case something throws underneath
 
        if(trustSettings) {
                *trustSettings = ts->copyTrustSettings(cert);
@@ -359,6 +360,59 @@ static OSStatus tsCopyTrustSettings(
        END_RCSAPI
 }
 
+/*
+ * Common code for SecTrustSettingsCopyTrustSettings(),
+ * SecTrustSettingsCopyModificationDate().
+ */
+static OSStatus tsCopyTrustSettings_cached(
+    SecCertificateRef cert,
+    SecTrustSettingsDomain domain,
+    CFArrayRef CF_RETURNS_RETAINED *trustSettings)
+{
+    BEGIN_RCSAPI
+
+    TS_REQUIRED(cert)
+
+    StLock<Mutex>    _(sutCacheLock());
+    TrustSettings* ts = tsGetGlobalTrustSettings(domain);
+
+    // rather than throw these results, just return them because we are at the top level
+    if (ts == NULL) {
+        return errSecItemNotFound;
+    }
+
+    if(trustSettings) {
+        *trustSettings = ts->copyTrustSettings(cert);
+    }
+
+    END_RCSAPI
+}
+
+static OSStatus tsContains(
+    SecCertificateRef cert,
+    SecTrustSettingsDomain domain)
+{
+    BEGIN_RCSAPI
+
+    TS_REQUIRED(cert)
+
+    StLock<Mutex>    _(sutCacheLock());
+    TrustSettings* ts = tsGetGlobalTrustSettings(domain);
+
+    // rather than throw these results, just return them because we are at the top level
+    if (ts == NULL) {
+        return errSecItemNotFound;
+    }
+
+    if (ts->contains(cert)) {
+        return errSecSuccess;
+    } else {
+        return errSecItemNotFound;
+    }
+
+    END_RCSAPI
+}
+
 static void tsAddConditionalCerts(CFMutableArrayRef certArray);
 
 /*
@@ -726,7 +780,7 @@ OSStatus SecTrustSettingsSetTrustSettingsExternal(
                return result;
        }
 
-       auto_ptr<TrustSettings>_(ts);
+       unique_ptr<TrustSettings>_(ts);
 
        if(certRef != NULL) {
                ts->setTrustSettings(certRef, trustSettingsDictOrArray);
@@ -737,6 +791,25 @@ OSStatus SecTrustSettingsSetTrustSettingsExternal(
        END_RCSAPI
 }
 
+void SecTrustSettingsPurgeCache(void) {
+    tsPurgeCache();
+}
+
+OSStatus SecTrustSettingsCopyTrustSettings_Cached(
+    SecCertificateRef certRef,
+    SecTrustSettingsDomain domain,
+    CFArrayRef CF_RETURNS_RETAINED *trustSettings)                /* RETURNED */
+{
+    TS_REQUIRED(certRef)
+    TS_REQUIRED(trustSettings)
+
+    OSStatus result = tsCopyTrustSettings_cached(certRef, domain, trustSettings);
+    if (result == errSecSuccess && *trustSettings == NULL) {
+        result = errSecItemNotFound; /* documented result if no trust settings exist */
+    }
+    return result;
+}
+
 #pragma mark --- API functions ---
 
 OSStatus SecTrustSettingsCopyTrustSettings(
@@ -791,7 +864,7 @@ OSStatus SecTrustSettingsSetTrustSettings(
                return result;
        }
 
-       auto_ptr<TrustSettings>_(ts);
+       unique_ptr<TrustSettings>_(ts);
 
        ts->setTrustSettings(certRef, trustSettingsDictOrArray);
        ts->flushToDisk();
@@ -821,7 +894,7 @@ OSStatus SecTrustSettingsRemoveTrustSettings(
                return result;
        }
 
-       auto_ptr<TrustSettings>_(ts);
+       unique_ptr<TrustSettings>_(ts);
 
        /* deleteTrustSettings throws if record not found */
        trustSettingsDbg("SecTrustSettingsRemoveTrustSettings: deleting from domain %d",
@@ -853,7 +926,7 @@ OSStatus SecTrustSettingsCopyCertificates(
                return status;
        }
 
-       auto_ptr<TrustSettings>_(ts);
+       unique_ptr<TrustSettings>_(ts);
 
        CFMutableArrayRef outArray = CFArrayCreateMutable(NULL, 0, &kCFTypeArrayCallBacks);
     
@@ -1002,6 +1075,16 @@ OSStatus SecTrustSettingsCopyCertificatesForUserAdminDomains(
     return result;
 }
 
+bool SecTrustSettingsUserAdminDomainsContain(SecCertificateRef certRef)
+{
+    TS_REQUIRED(certRef)
+    if (tsContains(certRef, kSecTrustSettingsDomainAdmin) == errSecSuccess ||
+        tsContains(certRef, kSecTrustSettingsDomainUser) == errSecSuccess) {
+        return true;
+    }
+    return false;
+}
+
 /*
  * Obtain an external, portable representation of the specified
  * domain's TrustSettings. Caller must CFRelease the returned data.
@@ -1022,7 +1105,7 @@ OSStatus SecTrustSettingsCreateExternalRepresentation(
                return result;
        }
 
-       auto_ptr<TrustSettings>_(ts);
+       unique_ptr<TrustSettings>_(ts);
 
        *trustSettings = ts->createExternal();
        return errSecSuccess;
@@ -1052,7 +1135,7 @@ OSStatus SecTrustSettingsImportExternalRepresentation(
                return result;
        }
 
-       auto_ptr<TrustSettings>_(ts);
+       unique_ptr<TrustSettings>_(ts);
 
        ts->flushToDisk();
        tsTrustSettingsChanged();