+++ /dev/null
-/*
- * Copyright (c) 2016 Apple Inc. All Rights Reserved.
- *
- * @APPLE_LICENSE_HEADER_START@
- *
- * This file contains Original Code and/or Modifications of Original Code
- * as defined in and that are subject to the Apple Public Source License
- * Version 2.0 (the 'License'). You may not use this file except in
- * compliance with the License. Please obtain a copy of the License at
- * http://www.opensource.apple.com/apsl/ and read it before using this
- * file.
- *
- * The Original Code and all software distributed under the License are
- * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
- * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
- * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
- * Please see the License for the specific language governing rights and
- * limitations under the License.
- *
- * @APPLE_LICENSE_HEADER_END@
- */
-
-//
-// SOSRecoveryKeyBag.c
-// sec
-//
-
-#include "SOSRecoveryKeyBag.h"
-#include "AssertMacros.h"
-#include <Security/SecureObjectSync/SOSGenCount.h>
-#include <Security/SecureObjectSync/SOSAccountPriv.h>
-#include <Security/SecureObjectSync/SOSRecoveryKeyBag.h>
-#include <utilities/SecCFWrappers.h>
-#include <utilities/SecAKSWrappers.h>
-#include <utilities/SecBuffer.h>
-#include <utilities/SecCFError.h>
-#include <utilities/der_set.h>
-#include <utilities/der_plist_internal.h>
-#include <Security/SecRandom.h>
-#include <corecrypto/ccec.h>
-#include <corecrypto/ccsha2.h>
-#include <corecrypto/ccrng.h>
-
-#include <limits.h>
-
-#include "SOSInternal.h"
-
-#define CURRENT_RKB_VERSION 1
-
-//
-// MARK: Type creation
-//
-
-struct __OpaqueSOSRecoveryKeyBag {
- CFRuntimeBase _base;
- CFStringRef accountDSID;
- SOSGenCountRef generation;
- uint64_t rkbVersion;
- CFDataRef recoveryKeyBag;
-};
-
-
-
-static void SOSRecoveryKeyBagDestroy(CFTypeRef aObj) {
- SOSRecoveryKeyBagRef rb = (SOSRecoveryKeyBagRef) aObj;
-
- CFReleaseNull(rb->accountDSID);
- CFReleaseNull(rb->generation);
- CFReleaseNull(rb->recoveryKeyBag);
-}
-
-static CFStringRef SOSRecoveryKeyBagCopyFormatDescription(CFTypeRef aObj, CFDictionaryRef formatOptions) {
- SOSRecoveryKeyBagRef rb = (SOSRecoveryKeyBagRef) aObj;
- CFStringRef gcString = SOSGenerationCountCopyDescription(rb->generation);
- CFStringRef rkbID = SOSCopyIDOfDataBufferWithLength(rb->recoveryKeyBag, 8, NULL);
-
- CFMutableStringRef description = CFStringCreateMutable(kCFAllocatorDefault, 0);
-
- CFStringAppendFormat(description, NULL, CFSTR("<SOSRecoveryKeyBag@%p DSID: %@ version: %d gencount: %@ RecoveryKeyID: %@ "), rb, rb->accountDSID, (int) rb->rkbVersion, gcString, rkbID);
- CFStringAppend(description, CFSTR(">"));
-
- CFReleaseNull(gcString);
- CFReleaseNull(rkbID);
- return description;
-}
-
-CFGiblisFor(SOSRecoveryKeyBag);
-
-// Der encoding/decoding
-const uint8_t* der_decode_RecoveryKeyBag(CFAllocatorRef allocator,
- SOSRecoveryKeyBagRef* RecoveryKeyBag, CFErrorRef *error,
- const uint8_t* der, const uint8_t *der_end) {
- if (der == NULL) return der;
- const uint8_t *result = NULL;
-
- SOSRecoveryKeyBagRef rb = CFTypeAllocate(SOSRecoveryKeyBag, struct __OpaqueSOSRecoveryKeyBag, allocator);
- require_quiet(SecAllocationError(rb, error, CFSTR("Recovery bag allocation failed")), fail);
-
- const uint8_t *sequence_end = NULL;
- der = ccder_decode_sequence_tl(&sequence_end, der, der_end);
- require_quiet(sequence_end == der_end, fail);
-
- der = der_decode_string(kCFAllocatorDefault, kCFPropertyListImmutable, &rb->accountDSID, error, der, sequence_end);
- rb->generation = SOSGenCountCreateFromDER(kCFAllocatorDefault, error, &der, sequence_end);
- der = ccder_decode_uint64(&rb->rkbVersion, der, sequence_end);
- der = der_decode_data(allocator, kCFPropertyListImmutable, &rb->recoveryKeyBag, error, der, sequence_end);
-
- require_quiet(SecRequirementError(der == der_end, error, CFSTR("Extra space in sequence")), fail);
- if (RecoveryKeyBag) CFTransferRetained(*RecoveryKeyBag, rb);
- result = der;
-fail:
- CFReleaseNull(rb);
- return result;
-}
-
-static bool SOSRecoveryKeyBagIsComplete(SOSRecoveryKeyBagRef RecoveryKeyBag, CFErrorRef *error) {
- if(!RecoveryKeyBag) {
- SOSCreateError(kSOSErrorEncodeFailure, CFSTR("NULL RecoveryKeyBag"), NULL, error);
- return false;
- }
- bool retval = true;
- if(!RecoveryKeyBag->recoveryKeyBag) {
- SOSCreateError(kSOSErrorEncodeFailure, CFSTR("RecoveryKeyBag has no public key"), NULL, error);
- retval = false;
- }
- if(!RecoveryKeyBag->accountDSID) {
- SOSCreateError(kSOSErrorEncodeFailure, CFSTR("RecoveryKeyBag has no DSID"), NULL, error);
- retval = false;
- }
- if(!RecoveryKeyBag->generation) {
- SOSCreateError(kSOSErrorEncodeFailure, CFSTR("RecoveryKeyBag has no generation"), NULL, error);
- retval = false;
- }
- return retval;
-}
-
-size_t der_sizeof_RecoveryKeyBag(SOSRecoveryKeyBagRef RecoveryKeyBag, CFErrorRef *error) {
- size_t result = 0;
- if(SOSRecoveryKeyBagIsComplete(RecoveryKeyBag, error)) {
- size_t partSize = der_sizeof_string(RecoveryKeyBag->accountDSID, NULL);
- partSize += SOSGenCountGetDEREncodedSize(RecoveryKeyBag->generation, NULL);
- partSize += ccder_sizeof_uint64(RecoveryKeyBag->rkbVersion);
- partSize += der_sizeof_data(RecoveryKeyBag->recoveryKeyBag, NULL);
- result = ccder_sizeof(CCDER_CONSTRUCTED_SEQUENCE, partSize);
- }
- return result;
-}
-
-uint8_t* der_encode_RecoveryKeyBag(SOSRecoveryKeyBagRef RecoveryKeyBag, CFErrorRef *error,
- const uint8_t *der, uint8_t *der_end) {
- uint8_t *result = NULL;
- if (der_end == NULL) return der_end;
- if(SOSRecoveryKeyBagIsComplete(RecoveryKeyBag, error)) {
- der_end = ccder_encode_constructed_tl(CCDER_CONSTRUCTED_SEQUENCE, der_end, der,
- der_encode_string(RecoveryKeyBag->accountDSID, error, der,
- SOSGenCountEncodeToDER(RecoveryKeyBag->generation, error, der,
- ccder_encode_uint64(RecoveryKeyBag->rkbVersion, der,
- der_encode_data(RecoveryKeyBag->recoveryKeyBag, error, der, der_end)))));
-
- require_quiet(der_end == der, errOut);
- result = der_end;
- }
-errOut:
- return result;
-}
-
-SOSRecoveryKeyBagRef SOSRecoveryKeyBagCreateForAccount(CFAllocatorRef allocator, CFTypeRef account, CFDataRef pubData, CFErrorRef *error) {
- SOSRecoveryKeyBagRef retval = NULL;
- SOSGenCountRef gencount = NULL;
- require_action_quiet(account, errOut, SOSCreateError(kSOSErrorEncodeFailure, CFSTR("Null Account Object"), NULL, error));
- CFStringRef dsid = NULL;
- dsid = asString(SOSAccountGetValue((__bridge SOSAccount*)account, kSOSDSIDKey, NULL), error);
- require_action_quiet(dsid, errOut, SOSCreateError(kSOSErrorEncodeFailure, CFSTR("Couldn't get dsid for recovery keybag components"), NULL, error));
-
- gencount = SOSGenerationCreate();
-
- require_action_quiet(pubData && dsid && gencount, errOut, SOSCreateError(kSOSErrorEncodeFailure, CFSTR("Couldn't get recovery keybag components"), NULL, error));
- retval = CFTypeAllocate(SOSRecoveryKeyBag, struct __OpaqueSOSRecoveryKeyBag, allocator);
- require_action_quiet(retval, errOut, SOSCreateError(kSOSErrorEncodeFailure, CFSTR("Couldn't get memory for recoveryKeyBag"), NULL, error));
- retval->rkbVersion = CURRENT_RKB_VERSION;
- retval->accountDSID = CFStringCreateCopy(allocator, dsid);
- CFRetainAssign(retval->generation, gencount);
- retval->recoveryKeyBag = CFDataCreateCopy(allocator, pubData);
-errOut:
- CFReleaseNull(gencount);
- return retval;
-}
-
-CFDataRef SOSRecoveryKeyCopyKeyForAccount(CFAllocatorRef allocator, CFTypeRef account, SOSRecoveryKeyBagRef recoveryKeyBag, CFErrorRef *error) {
- CFDataRef retval = NULL;
- require_action_quiet(recoveryKeyBag && recoveryKeyBag->recoveryKeyBag && recoveryKeyBag->accountDSID,
- errOut, SOSCreateError(kSOSErrorDecodeFailure, CFSTR("Null recoveryKeyBag Object"), NULL, error));
- CFStringRef dsid = NULL;
- dsid = asString(SOSAccountGetValue((__bridge SOSAccount *)(account), kSOSDSIDKey, NULL), error);
-
- require_action_quiet(dsid, errOut, SOSCreateError(kSOSErrorDecodeFailure, CFSTR("No DSID in Account"), NULL, error));
- require_action_quiet(CFEqual(dsid, recoveryKeyBag->accountDSID), errOut, SOSCreateError(kSOSErrorDecodeFailure, CFSTR("Account/RecoveryKeybag DSID miss-match"), NULL, error));
- retval = CFDataCreateCopy(allocator, recoveryKeyBag->recoveryKeyBag);
-errOut:
- return retval;
-}
-
-
-CFDataRef SOSRecoveryKeyBagCopyEncoded(SOSRecoveryKeyBagRef RecoveryKeyBag, CFErrorRef* error) {
- CFDataRef result = NULL;
- CFMutableDataRef encoded = NULL;
-
- size_t encodedSize = der_sizeof_RecoveryKeyBag(RecoveryKeyBag, error);
- require_quiet(encodedSize, fail);
-
- encoded = CFDataCreateMutableWithScratch(kCFAllocatorDefault, encodedSize);
- require_quiet(SecAllocationError(encoded, error, CFSTR("Failed to create scratch")), fail);
-
- uint8_t *encode_to = CFDataGetMutableBytePtr(encoded);
- uint8_t *encode_to_end = encode_to + CFDataGetLength(encoded);
- require_quiet(encode_to == der_encode_RecoveryKeyBag(RecoveryKeyBag, error, encode_to, encode_to_end), fail);
-
- CFTransferRetained(result, encoded);
-
-fail:
- CFReleaseSafe(encoded);
- return result;
-}
-
-
-
-SOSRecoveryKeyBagRef SOSRecoveryKeyBagCreateFromData(CFAllocatorRef allocator, CFDataRef data, CFErrorRef *error) {
- SOSRecoveryKeyBagRef result = NULL;
- SOSRecoveryKeyBagRef decodedBag = NULL;
-
- const uint8_t *der = CFDataGetBytePtr(data);
- const uint8_t *der_end = der + CFDataGetLength(data);
-
- der = der_decode_RecoveryKeyBag(allocator, &decodedBag, error, der, der_end);
-
- require_quiet(SecRequirementError(der == der_end, error, CFSTR("Didn't consume all data supplied")), fail);
-
- CFTransferRetained(result, decodedBag);
-
-fail:
- CFReleaseNull(decodedBag);
- return result;
-}
-
-CFDataRef SOSRecoveryKeyBagGetKeyData(SOSRecoveryKeyBagRef rkbg, CFErrorRef *error) {
- return rkbg->recoveryKeyBag;
-}
-
-bool SOSRecoveryKeyBagDSIDIs(SOSRecoveryKeyBagRef rkbg, CFStringRef dsid) {
- if(!rkbg) return false;
- return CFEqualSafe(rkbg->accountDSID, dsid);
-}
-
-
-
-
projects / apple / security.git / blobdiff