--- /dev/null
+/*
+ * Copyright (c) 2004-2005,2008 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_LICENSE_HEADER_END@
+ */
+/*
+ * ocspdTool.cpp - basic ocspdtool
+ *
+ * Created 11 July 2004 by Doug Mitchell.
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <utilLib/common.h>
+#include <Security/Security.h>
+#include <security_ocspd/ocspdDbSchema.h>
+#include <security_ocspd/ocspdUtils.h>
+#include <security_ocspd/ocspdClient.h>
+#include <security_cdsa_utils/cuCdsaUtils.h>
+#include <security_cdsa_utils/cuTimeStr.h>
+#include <Security/SecAsn1Coder.h>
+#include <Security/ocspTemplates.h>
+
+static void usage(char **argv)
+{
+ printf("Usage: op [option..]\n");
+ printf("Ops:\n");
+ printf(" d dump database\n");
+ printf(" f flush stale entries\n");
+ printf(" F flush ALL\n");
+ printf("Options:\n");
+ printf(" TBD\n");
+ exit(1);
+}
+
+#define OCSP_DB_FILE "/private/var/db/crls/ocspcache.db"
+
+static CSSM_DL_DB_HANDLE dlDbHandle = {0, 0};
+
+static CSSM_API_MEMORY_FUNCS memFuncs = {
+ cuAppMalloc,
+ cuAppFree,
+ cuAppRealloc,
+ cuAppCalloc,
+ NULL
+};
+
+static CSSM_VERSION vers = {2, 0};
+
+
+static CSSM_RETURN dlAttach()
+{
+ if(dlDbHandle.DLHandle != 0) {
+ return CSSM_OK;
+ }
+ if(cuCssmStartup() == CSSM_FALSE) {
+ return CSSMERR_CSSM_ADDIN_LOAD_FAILED;
+ }
+ CSSM_RETURN crtn = CSSM_ModuleLoad(&gGuidAppleFileDL,
+ CSSM_KEY_HIERARCHY_NONE,
+ NULL, // eventHandler
+ NULL); // AppNotifyCallbackCtx
+ if(crtn) {
+ return CSSMERR_CSSM_ADDIN_LOAD_FAILED;
+ }
+ crtn = CSSM_ModuleAttach (&gGuidAppleFileDL,
+ &vers,
+ &memFuncs, // memFuncs
+ 0, // SubserviceID
+ CSSM_SERVICE_DL,
+ 0, // AttachFlags
+ CSSM_KEY_HIERARCHY_NONE,
+ NULL, // FunctionTable
+ 0, // NumFuncTable
+ NULL, // reserved
+ &dlDbHandle.DLHandle);
+ if(crtn) {
+ return CSSMERR_CSSM_ADDIN_LOAD_FAILED;
+ }
+ return CSSM_OK;
+}
+
+static CSSM_RETURN dbAttach(const char *dbFile)
+{
+ CSSM_RETURN crtn = dlAttach();
+ if(crtn) {
+ return crtn;
+ }
+ if(dlDbHandle.DBHandle != 0) {
+ return CSSM_OK;
+ }
+ return CSSM_DL_DbOpen(dlDbHandle.DLHandle,
+ dbFile,
+ NULL, // DbLocation
+ CSSM_DB_ACCESS_READ,
+ NULL, // CSSM_ACCESS_CREDENTIALS *AccessCred
+ NULL, // void *OpenParameters
+ &dlDbHandle.DBHandle);
+}
+
+static const char *months[] = {
+ "Jan", "Feb", "Mar", "Apr", "May", "Jun",
+ "Jul", "Aug", "Sep", "Oct", "Nov", "Dec"
+};
+
+static void printTimeStr(const CSSM_DATA *cssmTime)
+{
+ struct tm tm;
+
+ /* ignore cssmTime->timeType for now */
+ if(cuTimeStringToTm((char *)cssmTime->Data, cssmTime->Length, &tm)) {
+ printf("***Bad time string format***\n");
+ return;
+ }
+ if(tm.tm_mon > 11) {
+ printf("***Bad time string format***\n");
+ return;
+ }
+ printf("%02d:%02d:%02d %s %d, %04d\n",
+ tm.tm_hour, tm.tm_min, tm.tm_sec,
+ months[tm.tm_mon], tm.tm_mday, tm.tm_year + 1900);
+
+}
+
+static void freeAttrData(
+ CSSM_DB_ATTRIBUTE_DATA *attrData,
+ unsigned numAttrs)
+{
+ if(attrData == NULL) {
+ return;
+ }
+ for(unsigned dex=0; dex<numAttrs; dex++) {
+ CSSM_DB_ATTRIBUTE_DATA *a = &attrData[dex];
+ if(a->Value == NULL) {
+ continue;
+ }
+ for(unsigned i=0; i<a->NumberOfValues; i++) {
+ CSSM_DATA_PTR d = &a->Value[i];
+ if(d->Data) {
+ APP_FREE(d->Data);
+ }
+ }
+ APP_FREE(a->Value);
+ }
+}
+
+static void printString(
+ const char *title,
+ const CSSM_DATA *str)
+{
+ unsigned i;
+ printf("%s: %lu bytes: ", title, str ? str->Length : 0);
+ if((str == NULL) || (str->Length == 0)) {
+ printf("Empty\n");
+ return;
+ }
+ char *cp = (char *)str->Data;
+ for(i=0; i<str->Length; i++) {
+ printf("%c", *cp++);
+ }
+ printf("\n");
+}
+
+static void printData(
+ const char *title,
+ const CSSM_DATA *d)
+{
+ printf("%s: %lu bytes: ", title, d ? d->Length : 0);
+ if((d == NULL) || (d->Length == 0)) {
+ printf("Empty\n");
+ return;
+ }
+ unsigned toPrint = 20;
+ bool ellipsis = false;
+ if(d->Length < toPrint) {
+ toPrint = d->Length;
+ }
+ else if(d->Length > toPrint) {
+ ellipsis = true;
+ }
+ for(unsigned dex=0; dex<toPrint; dex++) {
+ printf("%02X", d->Data[dex]);
+ if((dex % 4) == 3) {
+ printf(" ");
+ }
+ }
+ if(ellipsis) {
+ printf("...\n");
+ }
+ else {
+ printf("\n");
+ }
+}
+
+static void printCertID(
+ const CSSM_DATA &certID)
+{
+ SecAsn1CoderRef coder;
+ SecAsn1CoderCreate(&coder);
+ SecAsn1OCSPCertID asn1CertID;
+ memset(&asn1CertID, 0, sizeof(SecAsn1OCSPCertID));
+ if(SecAsn1DecodeData(coder, &certID, kSecAsn1OCSPCertIDTemplate, &asn1CertID)) {
+ printf("***ERROR decoding stored CertID\n");
+ return;
+ }
+
+ printf(" --- Parsed CertID ---\n");
+ printf(" "); printData("issuerNameHash ", &asn1CertID.issuerNameHash);
+ printf(" "); printData("issuerPubKeyHash", &asn1CertID.issuerPubKeyHash);
+ printf(" "); printData("serialNumber ", &asn1CertID.serialNumber);
+ SecAsn1CoderRelease(coder);
+}
+static void printRecord(
+ const CSSM_DB_ATTRIBUTE_DATA *attrData,
+ unsigned numAttrs,
+ const CSSM_DATA *recordData)
+{
+ printf("===== printRecord: %u attributes, %lu bytes of data =====\n", numAttrs,
+ recordData ? recordData->Length : 0);
+ for(unsigned dex=0; dex<numAttrs; dex++) {
+ const CSSM_DB_ATTRIBUTE_DATA *a = &attrData[dex];
+ char *attrName = a->Info.Label.AttributeName;
+ CSSM_DB_ATTRIBUTE_FORMAT form = a->Info.AttributeFormat;
+ if(a->NumberOfValues == 0) {
+ printf("++++++++ zero values for attribute %s ++++++++\n", attrName);
+ }
+ for(unsigned v=0; v<a->NumberOfValues; v++) {
+ if(!memcmp(attrName, "Expiration", 10)) {
+ const CSSM_DATA *td = &a->Value[v];
+ printf("Expiration: ");
+ printTimeStr(td);
+ }
+ else {
+ switch(form) {
+ case CSSM_DB_ATTRIBUTE_FORMAT_STRING:
+ printString(attrName, &a->Value[v]);
+ break;
+ case CSSM_DB_ATTRIBUTE_FORMAT_BLOB:
+ printData(attrName, &a->Value[v]);
+ break;
+ default:
+ printf("Help! How do you print format %u\n", (unsigned)form);
+ break;
+ }
+ if(!memcmp(attrName, "CertID", 6)) {
+ printCertID(a->Value[v]);
+ }
+ }
+ }
+ }
+}
+
+static void dumpOcspdDb(char *dbFile)
+{
+ CSSM_QUERY query;
+ CSSM_DB_UNIQUE_RECORD_PTR recordPtr = NULL;
+ CSSM_RETURN crtn;
+ CSSM_HANDLE resultHand;
+ CSSM_DB_RECORD_ATTRIBUTE_DATA recordAttrs;
+ CSSM_DATA recordData = {0, NULL};
+ CSSM_DB_ATTRIBUTE_DATA attrData[OCSPD_NUM_DB_ATTRS];
+ CSSM_DB_ATTRIBUTE_INFO certIDInfo = OCSPD_DBATTR_CERT_ID ;
+ CSSM_DB_ATTRIBUTE_INFO uriInfo = OCSPD_DBATTR_URI ;
+ CSSM_DB_ATTRIBUTE_INFO expireInfo = OCSPD_DBATTR_EXPIRATION ;
+
+ if(dbAttach(dbFile)) {
+ printf("***Error opening %s. Aborting.\n", dbFile);
+ return;
+ }
+
+ recordAttrs.DataRecordType = OCSPD_DB_RECORDTYPE;
+ recordAttrs.NumberOfAttributes = OCSPD_NUM_DB_ATTRS;
+ recordAttrs.AttributeData = attrData;
+ attrData[0].Info = certIDInfo;
+ attrData[1].Info = uriInfo;
+ attrData[2].Info = expireInfo;
+
+ /* just search by recordType, no predicates */
+ query.RecordType = OCSPD_DB_RECORDTYPE;
+ query.Conjunctive = CSSM_DB_NONE;
+ query.NumSelectionPredicates = 0;
+ query.SelectionPredicate = NULL;
+ query.QueryLimits.TimeLimit = 0; // FIXME - meaningful?
+ query.QueryLimits.SizeLimit = 1; // FIXME - meaningful?
+ query.QueryFlags = CSSM_QUERY_RETURN_DATA;
+
+ crtn = CSSM_DL_DataGetFirst(dlDbHandle,
+ &query,
+ &resultHand,
+ &recordAttrs,
+ &recordData,
+ &recordPtr);
+ switch(crtn) {
+ case CSSM_OK:
+ break; // proceed
+ case CSSMERR_DL_ENDOFDATA:
+ printf("***No records found in %s.\n", dbFile);
+ /* OK, no certs */
+ return;
+ default:
+ printError("DataGetFirst", crtn);
+ return;
+ }
+
+ printRecord(attrData, OCSPD_NUM_DB_ATTRS, &recordData);
+ freeAttrData(attrData, 3);
+ CSSM_DL_FreeUniqueRecord(dlDbHandle, recordPtr);
+ if(recordData.Data) {
+ APP_FREE(recordData.Data);
+ recordData.Data = NULL;
+ }
+
+ /* now the rest of them */
+ for(;;) {
+ crtn = CSSM_DL_DataGetNext(dlDbHandle,
+ resultHand,
+ &recordAttrs,
+ NULL,
+ &recordPtr);
+ switch(crtn) {
+ case CSSM_OK:
+ printRecord(attrData, OCSPD_NUM_DB_ATTRS, &recordData);
+ freeAttrData(attrData, 3);
+ CSSM_DL_FreeUniqueRecord(dlDbHandle, recordPtr);
+ if(recordData.Data) {
+ APP_FREE(recordData.Data);
+ recordData.Data = NULL;
+ }
+ break; // and go again
+ case CSSMERR_DL_ENDOFDATA:
+ /* normal termination */
+ break;
+ default:
+ printError("DataGetNext", crtn);
+ return;
+ }
+ if(crtn != CSSM_OK) {
+ break;
+ }
+ }
+ CSSM_DL_DataAbortQuery(dlDbHandle, resultHand);
+ return;
+}
+
+static void cleanOcspdDb(char *dbFile)
+{
+ CSSM_QUERY query;
+ CSSM_DB_UNIQUE_RECORD_PTR recordPtr = NULL;
+ CSSM_RETURN crtn;
+ CSSM_HANDLE resultHand;
+ unsigned numRecords = 0;
+
+ if(dbAttach(dbFile)) {
+ printf("***Error opening %s. Aborting.\n", dbFile);
+ return;
+ }
+
+ /* just search by recordType, no predicates, no returned attrs, no returned data*/
+ query.RecordType = OCSPD_DB_RECORDTYPE;
+ query.Conjunctive = CSSM_DB_NONE;
+ query.NumSelectionPredicates = 0;
+ query.SelectionPredicate = NULL;
+ query.QueryLimits.TimeLimit = 0; // FIXME - meaningful?
+ query.QueryLimits.SizeLimit = 1; // FIXME - meaningful?
+ query.QueryFlags = 0;
+
+ crtn = CSSM_DL_DataGetFirst(dlDbHandle,
+ &query,
+ &resultHand,
+ NULL,
+ NULL,
+ &recordPtr);
+ switch(crtn) {
+ case CSSM_OK:
+ break; // proceed
+ case CSSMERR_DL_ENDOFDATA:
+ printf("***No records found in %s.\n", dbFile);
+ /* OK, no certs */
+ return;
+ default:
+ printError("DataGetFirst", crtn);
+ return;
+ }
+
+ crtn = CSSM_DL_DataDelete(dlDbHandle, recordPtr);
+ if(crtn) {
+ cssmPerror("CSSM_DL_DataDelete", crtn);
+ }
+ CSSM_DL_FreeUniqueRecord(dlDbHandle, recordPtr);
+ if(crtn) {
+ return;
+ }
+ numRecords++;
+
+ /* now the rest of them */
+ for(;;) {
+ crtn = CSSM_DL_DataGetNext(dlDbHandle,
+ resultHand,
+ NULL,
+ NULL,
+ &recordPtr);
+ switch(crtn) {
+ case CSSM_OK:
+ crtn = CSSM_DL_DataDelete(dlDbHandle, recordPtr);
+ if(crtn) {
+ cssmPerror("CSSM_DL_DataDelete", crtn);
+ }
+ CSSM_DL_FreeUniqueRecord(dlDbHandle, recordPtr);
+ if(crtn) {
+ return;
+ }
+ numRecords++;
+ break; // and go again
+ case CSSMERR_DL_ENDOFDATA:
+ /* normal termination */
+ break;
+ default:
+ printError("DataGetNext", crtn);
+ return;
+ }
+ if(crtn != CSSM_OK) {
+ break;
+ }
+ }
+ CSSM_DL_DataAbortQuery(dlDbHandle, resultHand);
+ printf("...%u records deleted\n", numRecords);
+ return;
+}
+
+int main(int argc, char **argv)
+{
+ if(argc < 2) {
+ usage(argv);
+ }
+
+ extern int optind;
+ // extern char *optarg;
+ int arg;
+
+ optind = 2;
+ while ((arg = getopt(argc, argv, "h")) != -1) {
+ switch (arg) {
+ case 'h':
+ case '?':
+ default:
+ usage(argv);
+ }
+ }
+ if(optind != argc) {
+ usage(argv);
+ }
+ switch (argv[1][0]) {
+ case 'd':
+ dumpOcspdDb((char *)OCSP_DB_FILE);
+ break;
+ case 'f':
+ ocspdCacheFlushStale();
+ printf("...stale entries flushed\n");
+ break;
+ case 'F':
+ cleanOcspdDb((char *)OCSP_DB_FILE);
+ break;
+ default:
+ usage(argv);
+ }
+ return 0;
+}
+
projects / apple / security.git / blobdiff