-/*
- * Copyright (c) 2014 Apple Inc. All Rights Reserved.
- *
- * @APPLE_LICENSE_HEADER_START@
- *
- * This file contains Original Code and/or Modifications of Original Code
- * as defined in and that are subject to the Apple Public Source License
- * Version 2.0 (the 'License'). You may not use this file except in
- * compliance with the License. Please obtain a copy of the License at
- * http://www.opensource.apple.com/apsl/ and read it before using this
- * file.
- *
- * The Original Code and all software distributed under the License are
- * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
- * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
- * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
- * Please see the License for the specific language governing rights and
- * limitations under the License.
- *
- * @APPLE_LICENSE_HEADER_END@
- */
-
-
-#include <stdio.h>
-#include <AssertMacros.h>
-#include <utilities/SecCFWrappers.h>
-#include <ACMDefs.h>
-#include <ACMAclDefs.h>
-#include <libaks_acl_cf_keys.h>
-
-#include "security.h"
-#include "keychain_util.h"
-#include "SecAccessControlPriv.h"
-
-static CFStringRef createStringForValue(CFTypeRef value)
-{
- CFStringRef result = NULL;
- if (CFDataGetTypeID() == CFGetTypeID(value)) {
- CFMutableStringRef stringData = CFStringCreateMutable(kCFAllocatorDefault, 0);
- CFStringAppend(stringData, CFSTR("<"));
- const UInt8 *dataPtr = CFDataGetBytePtr(value);
- for (int i = 0; i < CFDataGetLength(value); ++i) {
- CFStringAppendFormat(stringData, NULL, CFSTR("%02x"), dataPtr[i]);
- }
- CFStringAppend(stringData, CFSTR(">"));
- result = stringData;
- } else if (CFBooleanGetTypeID() == CFGetTypeID(value)) {
- if (CFEqual(value, kCFBooleanTrue))
- result = CFStringCreateWithCString(kCFAllocatorDefault, "true", kCFStringEncodingUTF8);
- else
- result = CFStringCreateWithCString(kCFAllocatorDefault, "false", kCFStringEncodingUTF8);
- } else if (CFNumberGetTypeID() == CFGetTypeID(value))
- result = CFStringCreateWithFormat(kCFAllocatorDefault, NULL, CFSTR("%@"), value);
- else if (CFStringGetTypeID() == CFGetTypeID(value))
- result = CFStringCreateCopy(kCFAllocatorDefault, value);
- else
- result = CFStringCreateWithCString(kCFAllocatorDefault, "unrecognized value", kCFStringEncodingUTF8);
-
- return result;
-}
-
-static CFStringRef createStringForKofn(CFDictionaryRef kofn)
-{
- CFMutableStringRef result = NULL;
- if (kofn != NULL && CFDictionaryGetTypeID() == CFGetTypeID(kofn))
- {
- result = CFStringCreateMutable(kCFAllocatorDefault, 0);
- CFDictionaryForEach(kofn, ^(const void *key, const void *value) {
-
- CFStringAppend(result, key);
- CFStringAppend(result, CFSTR("("));
-
- CFStringRef valueString = createStringForKofn(value) ?: createStringForValue(value);
- CFStringAppend(result, valueString);
- CFStringAppend(result, CFSTR(")"));
- CFReleaseSafe(valueString);
- });
- }
-
- return result;
-}
-
-static CFStringRef createStringForOps(CFDictionaryRef constraints)
-{
- CFMutableStringRef result = NULL;
- if (constraints != NULL)
- {
- result = CFStringCreateMutable(kCFAllocatorDefault, 0);
- CFDictionaryForEach(constraints, ^(const void *key, const void *value) {
- if (CFStringGetLength(result) > 0)
- CFStringAppend(result, CFSTR(";"));
- CFStringAppend(result, key);
- CFStringAppend(result, CFSTR("("));
- CFStringRef valueString = createStringForKofn(value) ?: createStringForValue(value);
- CFStringAppend(result, valueString);
- CFStringAppend(result, CFSTR(")"));
- CFReleaseSafe(valueString);
- });
- }
-
- return result;
-}
-
-void
-display_sac_line(SecAccessControlRef sac, CFMutableStringRef line)
-{
- CFTypeRef protection = SecAccessControlGetProtection(sac);
- if (CFDictionaryGetTypeID() == CFGetTypeID(protection)) {
- CFStringRef protectionStr = createStringForOps(protection);
- CFStringAppend(line, protectionStr);
- CFRelease(protectionStr);
- } else if (CFStringGetTypeID() == CFGetTypeID(protection))
- CFStringAppend(line, protection);
- else
- CFStringAppend(line, CFSTR("??"));
-
- CFDictionaryRef constraints = SecAccessControlGetConstraints(sac);
- CFStringRef constraintsString = createStringForOps(constraints);
- if (constraintsString) {
- CFStringAppend(line, CFSTR(";"));
- CFStringAppend(line, constraintsString);
- }
- CFReleaseSafe(constraintsString);
-}
-
-bool
-keychain_query_parse_cstring(CFMutableDictionaryRef q, const char *query) {
- CFStringRef s;
- s = CFStringCreateWithCStringNoCopy(0, query, kCFStringEncodingUTF8, kCFAllocatorNull);
- bool result = keychain_query_parse_string(q, s);
- CFRelease(s);
- return result;
-}
-
-/* Parse a string of the form attr=value,attr=value,attr=value */
-bool
-keychain_query_parse_string(CFMutableDictionaryRef q, CFStringRef s) {
- bool inkey = true;
- bool escaped = false;
- bool error = false;
- CFStringRef key = NULL;
- CFMutableStringRef str = CFStringCreateMutable(0, 0);
- CFRange rng = { .location = 0, .length = CFStringGetLength(s) };
- CFCharacterSetRef cs_key = CFCharacterSetCreateWithCharactersInString(0, CFSTR("=\\"));
- CFCharacterSetRef cs_value = CFCharacterSetCreateWithCharactersInString(0, CFSTR(",\\"));
- while (rng.length) {
- CFRange r;
- CFStringRef sub;
- bool complete = false;
- if (escaped) {
- r.location = rng.location;
- r.length = 1;
- sub = CFStringCreateWithSubstring(0, s, r);
- escaped = false;
- } else if (CFStringFindCharacterFromSet(s, inkey ? cs_key : cs_value, rng, 0, &r)) {
- if (CFStringGetCharacterAtIndex(s, r.location) == '\\') {
- escaped = true;
- } else {
- complete = true;
- }
- CFIndex next = r.location + 1;
- r.length = r.location - rng.location;
- r.location = rng.location;
- sub = CFStringCreateWithSubstring(0, s, r);
- rng.length -= next - rng.location;
- rng.location = next;
- } else {
- sub = CFStringCreateWithSubstring(0, s, rng);
- rng.location += rng.length;
- rng.length = 0;
- complete = true;
- }
- CFStringAppend(str, sub);
- CFRelease(sub);
-
- if (complete) {
- CFStringRef value = CFStringCreateCopy(0, str);
- CFStringReplaceAll(str, CFSTR(""));
- if (inkey) {
- key = value;
- } else {
- if(key && CFStringCompare(key, kSecAttrAccessControl, kCFCompareCaseInsensitive) == kCFCompareEqualTo) {
- SecAccessControlRef sac = keychain_query_parse_sac(value);
- if(sac) {
- CFDictionarySetValue(q, key, sac);
- } else {
- fprintf(stderr, "SecItemCopyMatching returned unexpected results:");
- error = true;
- }
- } else {
- CFDictionarySetValue(q, key, value);
- }
- CFReleaseNull(value);
- CFReleaseNull(key);
- }
- inkey = !inkey;
- }
- if(error)
- break;
- }
- if (key) {
- /* Dangeling key value is true?. */
- CFDictionarySetValue(q, key, kCFBooleanTrue);
- CFReleaseNull(key);
- }
- CFRelease(str);
- CFRelease(cs_key);
- CFRelease(cs_value);
- return error == false;
-}
-
-static uint32_t findLeft(CFStringRef s, uint32_t off)
-{
- for (int i = off; i < CFStringGetLength(s); ++i) {
- if (CFStringGetCharacterAtIndex(s, i) == '(')
- return i;
- }
-
- return 0;
-}
-
-static uint32_t findRight(CFStringRef s, uint32_t off)
-{
- int bracersCount = 0;
- for (int i = off; i < CFStringGetLength(s); ++i) {
- if (CFStringGetCharacterAtIndex(s, i) == '(')
- ++bracersCount;
-
- if (CFStringGetCharacterAtIndex(s, i) == ')') {
- --bracersCount;
- if (bracersCount == 0) {
- return i;
- }
- }
- }
-
- return 0;
-}
-
-static bool parseKeyAndValue(CFStringRef string, CFTypeRef *key, CFTypeRef *value);
-
-CF_RETURNS_RETAINED
-static CFTypeRef parseValue(CFStringRef string)
-{
- CFTypeRef result = NULL, key = NULL, value = NULL;
- CFMutableDictionaryRef resultDictionary = NULL;
- CFStringRef subString = NULL;
-
- uint32_t left = findLeft(string, 0);
- if (left > 0) {
- uint32_t offset = 0;
- resultDictionary = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
- for (;;) {
- uint32_t right = findRight(string, left);
- if (!right)
- break;
- CFAssignRetained(subString, CFStringCreateWithSubstring(kCFAllocatorDefault, string, CFRangeMake(offset, (right + 1) - offset)));
- require_quiet(parseKeyAndValue(subString, &key, &value), out);
- CFDictionarySetValue(resultDictionary, key, value);
- offset = right + 1;
- left = findLeft(string, offset);
- if (!left)
- break;
- }
- result = CFRetain(resultDictionary);
- } else if (CFStringGetCharacterAtIndex(string, 0) == '<' && CFStringGetCharacterAtIndex(string, CFStringGetLength(string) - 1) == '>') {
- CFMutableDataRef data = CFDataCreateMutable(kCFAllocatorDefault, 0);
- if (CFStringGetLength(string) > 2) {
- CFAssignRetained(subString, CFStringCreateWithSubstring(kCFAllocatorDefault, string, CFRangeMake(1, CFStringGetLength(string) - 2)));
- const char *asciiString = CFStringGetCStringPtr(subString, kCFStringEncodingASCII);
- uint8_t byte;
- for(uint32_t i = 0; i < strlen(asciiString); i += 2) {
- sscanf(&asciiString[i], "%02hhx", &byte);
- CFDataAppendBytes(data, &byte, sizeof(byte));
- }
- }
- result = data;
- } else if (CFStringCompare(string, CFSTR("true"), 0) == kCFCompareEqualTo) {
- CFRetainAssign(result, kCFBooleanTrue);
- } else if (CFStringCompare(string, CFSTR("false"), 0) == kCFCompareEqualTo) {
- CFRetainAssign(result, kCFBooleanFalse);
- } else if (CFStringCompare(string, CFSTR(kACMPolicyDeviceOwnerAuthentication), 0) == kCFCompareEqualTo) {
- CFRetainAssign(result, CFSTR(kACMPolicyDeviceOwnerAuthentication));
- } else {
- CFLocaleRef currentLocale = CFLocaleCopyCurrent();
- CFNumberFormatterRef formaterRef = CFNumberFormatterCreate(kCFAllocatorDefault, currentLocale, kCFNumberFormatterDecimalStyle);
- result = CFNumberFormatterCreateNumberFromString(kCFAllocatorDefault, formaterRef, string, NULL, kCFNumberFormatterParseIntegersOnly);
- CFReleaseSafe(currentLocale);
- CFReleaseSafe(formaterRef);
- }
-
- if (!result)
- fprintf(stderr, "Failed to parse value: %s\n", CFStringGetCStringPtr(string, kCFStringEncodingUTF8));
-
-out:
- CFReleaseSafe(key);
- CFReleaseSafe(value);
- CFReleaseSafe(subString);
- CFReleaseSafe(resultDictionary);
-
- return result;
-}
-
-static bool parseKeyAndValue(CFStringRef string, CFTypeRef *key, CFTypeRef *value)
-{
- bool ok = false;
- CFStringRef keyString = NULL;
- CFStringRef valueString = NULL;
- CFTypeRef parsedValue = NULL;
-
- uint32_t left = findLeft(string, 0);
- require_action_quiet(left != 0, out, fprintf(stderr, "Failed to find '(' in: %s\n", CFStringGetCStringPtr(string, kCFStringEncodingUTF8)));
- uint32_t right = findRight(string, left);
- require_action_quiet(right != 0, out, fprintf(stderr, "Failed to find ')' in: %s\n", CFStringGetCStringPtr(string, kCFStringEncodingUTF8)));
- require_action_quiet(right == ((uint32_t)CFStringGetLength(string) - 1), out, fprintf(stderr, "Failed to find ')' in: %s\n", CFStringGetCStringPtr(string, kCFStringEncodingUTF8)));
-
- keyString = CFStringCreateWithSubstring(kCFAllocatorDefault, string, CFRangeMake(0, left));
- valueString = CFStringCreateWithSubstring(kCFAllocatorDefault, string, CFRangeMake(left + 1, right - left - 1));
- require_quiet(parsedValue = parseValue(valueString), out);
- CFRetainAssign(*key, keyString);
- CFRetainAssign(*value, parsedValue);
- ok = true;
-
-out:
- CFReleaseSafe(parsedValue);
- CFReleaseSafe(keyString);
- CFReleaseSafe(valueString);
-
- return ok;
-}
-
-SecAccessControlRef
-keychain_query_parse_sac(CFStringRef s) {
- SecAccessControlRef sac = NULL, result = NULL;
- CFTypeRef key = NULL, value = NULL;
- CFArrayRef tokens = CFStringCreateArrayBySeparatingStrings(NULL, s, CFSTR(";"));
-
- // process protection part
- CFStringRef protection = CFArrayGetValueAtIndex(tokens, 0);
-
- CFErrorRef error = NULL;
- require_quiet(sac = SecAccessControlCreate(kCFAllocatorDefault, &error), out);
- require_quiet(SecAccessControlSetProtection(sac, protection, &error), out);
-
- CFIndex tokensCnt = CFArrayGetCount(tokens);
- for(CFIndex i = 1; i < tokensCnt; ++i) {
- require_action_quiet(parseKeyAndValue(CFArrayGetValueAtIndex(tokens, i), &key, &value), out, fprintf(stderr, "Error constructing SecAccessConstraint object\n") );
-
- if (CFEqual(key, CFSTR(kACMKeyAclParamRequirePasscode)))
- SecAccessControlSetRequirePassword(sac, CFEqual(value, kCFBooleanTrue)?true:false);
- else
- SecAccessControlAddConstraintForOperation(sac, key, value, NULL);
- }
-
- SecAccessConstraintRef constraintForDelete = SecAccessControlGetConstraint(sac, kAKSKeyOpDelete);
- if (!constraintForDelete) {
- if(!SecAccessControlAddConstraintForOperation(sac, kAKSKeyOpDelete, kCFBooleanTrue, &error)) {
- fprintf(stderr, "adding delete operation to sac object failed \n");
- }
- }
-
- SecAccessConstraintRef constraintForEncrypt = SecAccessControlGetConstraint(sac, kAKSKeyOpEncrypt);
- if (!constraintForEncrypt) {
- if(!SecAccessControlAddConstraintForOperation(sac, kAKSKeyOpEncrypt, kCFBooleanTrue, &error)) {
- fprintf(stderr, "adding encrypt operation to sac object failed \n");
- }
- }
-
- CFRetainAssign(result, sac);
-
-out:
- CFReleaseSafe(tokens);
- CFReleaseSafe(key);
- CFReleaseSafe(value);
- CFReleaseSafe(sac);
-
- return result;
-}
projects / apple / security.git / blobdiff