+/*
+ * Copyright (c) 2000-2001,2003-2004,2011,2014 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+
+//
+// manager - CSSM manager/supervisor objects.
+//
+#include "manager.h"
+#include "module.h"
+#include <security_utilities/debugging.h>
+
+
+//
+// Constructing a CssmManager instance.
+// This does almost nothing - the actual intialization happens in the initialize() method.
+//
+CssmManager::CssmManager()
+{
+ initCount = 0; // not yet initialized
+}
+
+CssmManager::~CssmManager()
+{
+ if (initCount > 0)
+ secdebug("cssm", "CSSM forcibly shutting down");
+}
+
+
+//
+// CSSM initialization.
+// THREADS: This function must run in an uncontested environment.
+//
+void CssmManager::initialize (const CSSM_VERSION &version,
+ CSSM_PRIVILEGE_SCOPE scope,
+ const Guid &callerGuid,
+ CSSM_KEY_HIERARCHY keyHierarchy,
+ CSSM_PVC_MODE &pvcPolicy)
+{
+ StLock<Mutex> _(mLock);
+
+ // check version first
+ checkVersion(version);
+
+ if (initCount) {
+ // re-initialization processing as per CSSM spec
+ if (pvcPolicy != mPvcPolicy) {
+ pvcPolicy = mPvcPolicy; // return old value
+ CssmError::throwMe(CSSMERR_CSSM_PVC_ALREADY_CONFIGURED);
+ }
+ initCount++;
+ secdebug("cssm", "re-initializing CSSM (%d levels)", initCount);
+ return;
+ }
+
+ // we don't support thread scope privileges
+ if (scope == CSSM_PRIVILEGE_SCOPE_THREAD)
+ CssmError::throwMe(CSSMERR_CSSM_SCOPE_NOT_SUPPORTED);
+
+ // keep the init arguments for future use - these become instance constants
+ mPrivilegeScope = scope;
+ mKeyHierarchy = keyHierarchy;
+ mPvcPolicy = pvcPolicy;
+ mCallerGuid = callerGuid;
+
+ // we are ready now
+ initCount = 1;
+ secdebug("cssm", "CSSM initialized");
+}
+
+
+//
+// CSSM Termination processing.
+// Returns true if this was the final (true) termination, false if a nested Init was undone.
+//
+bool CssmManager::terminate()
+{
+ StLock<Mutex> _(mLock);
+ switch (initCount) {
+ case 0:
+ CssmError::throwMe(CSSMERR_CSSM_NOT_INITIALIZED);
+ case 1:
+ secdebug("cssm", "Terminating CSSM");
+ if (!moduleMap.empty())
+ CssmError::throwMe(CSSM_ERRCODE_FUNCTION_FAILED); // @#can't terminate with modules loaded
+ initCount = 0; // mark uninitialized
+ return true;
+ default:
+ initCount--; // nested INIT, just count down
+ secdebug("cssm", "CSSM nested termination (%d remaining)", initCount);
+ return false;
+ }
+}
+
+
+#if defined(RESTRICTED_CSP_LOADING)
+static const char * const allowedCSPs[] = {
+ "/System/Library/Security/AppleCSP.bundle",
+ "/System/Library/Security/AppleCSPDL.bundle",
+ NULL
+};
+#endif
+
+
+//
+// Load a module (well, try).
+//
+void CssmManager::loadModule(const Guid &guid,
+ CSSM_KEY_HIERARCHY,
+ const ModuleCallback &callback)
+{
+ StLock<Mutex> _(mLock);
+ ModuleMap::iterator it = moduleMap.find(guid);
+ Module *module;
+ if (it == moduleMap.end()) {
+ MdsComponent info(guid);
+#if defined(RESTRICTED_CSP_LOADING)
+ // An abominable temporary hack for legal reasons. They made me do it!
+ if (info.supportsService(CSSM_SERVICE_CSP)) {
+ string loadPath = info.path();
+ for (const char * const *pp = allowedCSPs; *pp; pp++)
+ if (loadPath == *pp)
+ goto allowed;
+ CssmError::throwMe(CSSM_ERRCODE_MODULE_MANIFEST_VERIFY_FAILED);
+ allowed: ;
+ }
+#endif
+ secdebug("cssm", "loading module %s(%s) from %s",
+ info.name().c_str(), info.description().c_str(), info.path().c_str());
+ module = new Module(this, info, loader(info.path()));
+ moduleMap[guid] = module;
+ } else {
+ module = it->second;
+ secdebug("cssm", "%p reloaded module %s(%s) at %s",
+ module, module->name().c_str(), module->description().c_str(),
+ module->path().c_str());
+ }
+
+ // We are not playing the "key hierarchy" game around here.
+ // if we did, this is where we'd check the manifest.
+
+ module->add(callback);
+}
+
+
+//
+// Unload a module.
+// THREADS: Locking Manager(1), Module(2).
+//
+void CssmManager::unloadModule(const Guid &guid,
+ const ModuleCallback &callback)
+{
+ StLock<Mutex> _(mLock);
+ Module *module = getModule(guid);
+ if (module->unload(callback)) {
+ secdebug("cssm", "%p module %s(%s) final unload",
+ module, module->name().c_str(), module->description().c_str());
+ moduleMap.erase(guid);
+ delete module;
+ } else
+ secdebug("cssm", "%p module %s(%s) load count now %u", module,
+ module->name().c_str(), module->description().c_str(), module->callbackCount());
+}
+
+
+//
+// Introductions
+//
+void CssmManager::introduce(const Guid &,
+ CSSM_KEY_HIERARCHY)
+{
+ StLock<Mutex> _(mLock);
+ CssmError::throwMe(CSSM_ERRCODE_FUNCTION_NOT_IMPLEMENTED);
+}
+
+void CssmManager::unIntroduce(const Guid &)
+{
+ StLock<Mutex> _(mLock);
+ CssmError::throwMe(CSSM_ERRCODE_FUNCTION_NOT_IMPLEMENTED);
+}
+
+
+//
+// Support.
+// THREADS: These utilities run under lock protection by the caller.
+//
+void CssmManager::checkVersion(const CSSM_VERSION &version)
+{
+ if (version.Major != 2)
+ CssmError::throwMe(CSSM_ERRCODE_INCOMPATIBLE_VERSION);
+ if (version.Minor != 0)
+ CssmError::throwMe(CSSM_ERRCODE_INCOMPATIBLE_VERSION);
+}
+
+Module *CssmManager::getModule(const Guid &guid)
+{
+ ModuleMap::iterator it = moduleMap.find(guid);
+ if (it == moduleMap.end())
+ CssmError::throwMe(CSSMERR_CSSM_MODULE_NOT_LOADED);
+ return it->second;
+}
projects / apple / security.git / blobdiff