src/token.cpp

   1 /*
   2  * Copyright (c) 2004,2007 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 //
  26 // token - internal representation of a (single distinct) hardware token
  27 //
  28 #include "token.h"
  29 #include "tokendatabase.h"
  30 #include "reader.h"
  31 #include "notifications.h"
  32 #include "child.h"
  33 #include "server.h"
  34 #include <securityd_client/dictionary.h>
  35 #include <security_utilities/coderepository.h>
  36 #include <security_utilities/logging.h>
  37 #include <security_cdsa_client/mdsclient.h>
  38 #include <SecurityTokend/SecTokend.h>
  39
  40 #include <sys/types.h>
  41 #include <sys/wait.h>
  42 #include <grp.h>
  43 #include <pwd.h>
  44
  45 using namespace MDSClient;
  46
  47
  48 //
  49 // SSID -> Token map
  50 //
  51 Token::SSIDMap Token::mSubservices;
  52 // Make sure to always take mSSIDLock after we take the Token lock
  53 // itself or own it's own.
  54 Mutex Token::mSSIDLock;
  55
  56
  57 //
  58 // Token construction and destruction is trivial; the good stuff
  59 // happens in insert() and remove() below.
  60 //
  61 Token::Token()
  62         : mFaulted(false), mTokend(NULL), mResetLevel(1)
  63 {
  64         secdebug("token", "%p created", this);
  65 }
  66
  67
  68 Token::~Token()
  69 {
  70         secdebug("token", "%p (%s:%d) destroyed",
  71                 this, mGuid.toString().c_str(), mSubservice);
  72 }
  73
  74
  75 Reader &Token::reader() const
  76 {
  77         return referent< ::Reader>();
  78 }
  79
  80 TokenDaemon &Token::tokend()
  81 {
  82         StLock<Mutex> _(*this);
  83         if (mFaulted)
  84                 CssmError::throwMe(CSSM_ERRCODE_DEVICE_FAILED);
  85         if (mTokend)
  86                 return *mTokend;
  87         else
  88                 CssmError::throwMe(CSSM_ERRCODE_DEVICE_FAILED);
  89 }
  90
  91
  92 //
  93 // We don't currently use a database handle to tokend.
  94 // This is just to satisfy the TokenAcl.
  95 //
  96 GenericHandle Token::tokenHandle() const
  97 {
  98         return noDb;    // we don't currently use tokend-side DbHandles
  99 }
 100
 101
 102 //
 103 // Token is the SecurityServerAcl for the token
 104 //
 105 AclKind Token::aclKind() const
 106 {
 107         return dbAcl;
 108 }
 109
 110 Token &Token::token()
 111 {
 112         return *this;
 113 }
 114
 115
 116 //
 117 // Find Token by subservice id.
 118 // Throws if ssid is invalid (i.e. always returns non-NULL)
 119 //
 120 RefPointer<Token> Token::find(uint32 ssid)
 121 {
 122         StLock<Mutex> _(mSSIDLock);
 123         SSIDMap::const_iterator it = mSubservices.find(ssid);
 124         if (it == mSubservices.end())
 125                 CssmError::throwMe(CSSMERR_CSSM_INVALID_SUBSERVICEID);
 126         else
 127                 return it->second;
 128 }
 129
 130
 131 //
 132 // We override getAcl to provide PIN state feedback
 133 //
 134 void Token::getAcl(const char *tag, uint32 &count, AclEntryInfo *&acls)
 135 {
 136         if (pinFromAclTag(tag, "?")) {  // read from tokend - do not cache
 137                 AclEntryInfo *racls;
 138                 token().tokend().getAcl(aclKind(), tokenHandle(), tag, count, racls);
 139                 // make a chunk-copy because that's the contract we have with the caller
 140                 acls = Allocator::standard().alloc<AclEntryInfo>(count * sizeof(AclEntryInfo));
 141                 memcpy(acls, racls, count * sizeof(AclEntryInfo));
 142                 ChunkCopyWalker copy;
 143                 for (uint32 n = 0; n < count; n++)
 144                         walk(copy, acls[n]);
 145                 return;
 146         }
 147
 148         TokenAcl::cssmGetAcl(tag, count, acls);
 149 }
 150
 151
 152 //
 153 // Reset management.
 154 // A Token has a "reset level", a number that is incremented whenever a token
 155 // (hardware) reset is reported (as an error) by tokend. TokenAcls have their
 156 // own matching level, which is that of the Token's when the ACL was last synchronized
 157 // with tokend. Thus, incrementing the reset level invalidates all TokenAcls
 158 // (without the need to enumerate them all).
 159 // Note that a Token starts with a level of 1, while ACLs start at zero. This forces
 160 // them to initially load their state from tokend.
 161 //
 162 Token::ResetGeneration Token::resetGeneration() const
 163 {
 164         return mResetLevel;
 165 }
 166
 167 void Token::resetAcls()
 168 {
 169         CommonSet tmpCommons;
 170         {
 171                 StLock<Mutex> _(*this);
 172                 mResetLevel++;
 173                 secdebug("token", "%p reset (level=%d, propagating to %ld common(s)",
 174                         this, mResetLevel, mCommons.size());
 175                 // Make a copy to avoid deadlock with TokenDbCommon lock
 176                 tmpCommons = mCommons;
 177         }
 178         for (CommonSet::const_iterator it = tmpCommons.begin(); it != tmpCommons.end();)
 179                 RefPointer<TokenDbCommon>(*it++)->resetAcls();
 180 }
 181
 182 void Token::addCommon(TokenDbCommon &dbc)
 183 {
 184         secdebug("token", "%p addCommon TokenDbCommon %p", this, &dbc);
 185         mCommons.insert(&dbc);
 186 }
 187
 188 void Token::removeCommon(TokenDbCommon &dbc)
 189 {
 190         secdebug("token", "%p removeCommon TokenDbCommon %p", this, &dbc);
 191         if (mCommons.find(&dbc) != mCommons.end())
 192                 mCommons.erase(&dbc);
 193 }
 194
 195
 196 //
 197 // Process the logical insertion of a Token into a Reader.
 198 // From the client's point of view, this is where the CSSM subservice is created,
 199 // characterized, and activated. From tokend's point of view, this is where
 200 // we're analyzing the token, determine its characteristics, and get ready to
 201 // use it.
 202 //
 203 void Token::insert(::Reader &slot)
 204 {
 205         try {
 206                 // this might take a while...
 207                 Server::active().longTermActivity();
 208
 209                 // take Token lock and hold throughout insertion
 210                 StLock<Mutex> _(*this);
 211
 212                 Syslog::debug("token inserted into reader %s", slot.name().c_str());
 213                 secdebug("token", "%p begin insertion into slot %p (reader %s)",
 214                         this, &slot, slot.name().c_str());
 215                 referent(slot);
 216                 mState = slot.pcscState();
 217
 218                 RefPointer<TokenDaemon> tokend = chooseTokend();
 219                 if (!tokend) {
 220                         secdebug("token", "%p no token daemons available - faulting this card", this);
 221                         fault(false);
 222                 }
 223
 224                 // tell the tokend object to relay faults to us
 225                 tokend->faultRelay(this);
 226
 227                 // locate or establish cache directories
 228                 if (tokend->hasTokenUid()) {
 229                         secdebug("token", "%p CHOOSING %s (score=%d, uid=\"%s\")",
 230                                 this, tokend->bundlePath().c_str(), tokend->score(), tokend->tokenUid().c_str());
 231                         mCache = new TokenCache::Token(reader().cache,
 232                                 tokend->bundleIdentifier() + ":" + tokend->tokenUid());
 233                 } else {
 234                         secdebug("token", "%p CHOOSING %s (score=%d, temporary)",
 235                                 this, tokend->bundlePath().c_str(), tokend->score());
 236                         mCache = new TokenCache::Token(reader().cache);
 237                 }
 238                 secdebug("token", "%p token cache at %s", this, mCache->root().c_str());
 239
 240                 // here's the primary parameters of the new subservice
 241                 mGuid = gGuidAppleSdCSPDL;
 242                 mSubservice = mCache->subservice();
 243
 244                 // establish work areas with tokend
 245                 char mdsDirectory[PATH_MAX];
 246                 char printName[PATH_MAX];
 247                 tokend->establish(mGuid, mSubservice,
 248                         (mCache->type() != TokenCache::Token::existing ? kSecTokendEstablishNewCache : 0) | kSecTokendEstablishMakeMDS,
 249                         mCache->cachePath().c_str(), mCache->workPath().c_str(),
 250                         mdsDirectory, printName);
 251
 252                 // establish print name
 253                 if (mCache->type() == TokenCache::Token::existing) {
 254                         mPrintName = mCache->printName();
 255                         if (mPrintName.empty())
 256                                 mPrintName = printName;
 257                 } else
 258                         mPrintName = printName;
 259                 if (mPrintName.empty()) {
 260                         // last resort - new card and tokend didn't give us one
 261                         snprintf(printName, sizeof(printName), "smart card #%d", mSubservice);
 262                         mPrintName = printName;
 263                 }
 264                 if (mCache->type() != TokenCache::Token::existing)
 265                         mCache->printName(mPrintName);          // store in cache
 266
 267                 // install MDS
 268                 secdebug("token", "%p installing MDS from %s(%s)", this,
 269                         tokend->bundlePath().c_str(),
 270                         mdsDirectory[0] ? mdsDirectory : "ALL");
 271                 string holdGuid = mGuid.toString();     // extend lifetime of .toString()
 272                 MDS_InstallDefaults mdsDefaults = {
 273                         holdGuid.c_str(),
 274                         mSubservice,
 275                         tokend->hasTokenUid() ? tokend->tokenUid().c_str() : "",
 276                         this->printName().c_str()
 277                 };
 278                 mds().install(&mdsDefaults,
 279                         tokend->bundlePath().c_str(),
 280                         mdsDirectory[0] ? mdsDirectory : NULL,
 281                         NULL);
 282
 283                 {
 284                         // commit to insertion
 285                         StLock<Mutex> _(mSSIDLock);
 286                         assert(mSubservices.find(mSubservice) == mSubservices.end());
 287                         mSubservices.insert(make_pair(mSubservice, this));
 288                 }
 289
 290                 // assign mTokend right before notification - mustn't be set if
 291                 // anything goes wrong during insertion
 292                 mTokend = tokend;
 293
 294                 notify(kNotificationCDSAInsertion);
 295
 296                 Syslog::notice("reader %s inserted token \"%s\" (%s) subservice %ld using driver %s",
 297                         slot.name().c_str(), mPrintName.c_str(),
 298                         mTokend->hasTokenUid() ? mTokend->tokenUid().c_str() : "NO UID",
 299                         mSubservice, mTokend->bundleIdentifier().c_str());
 300                 secdebug("token", "%p inserted as %s:%d", this, mGuid.toString().c_str(), mSubservice);
 301         } catch (const CommonError &err) {
 302                 Syslog::notice("token in reader %s cannot be used (error %ld)", slot.name().c_str(), err.osStatus());
 303                 secdebug("token", "exception during insertion processing");
 304                 fault(false);
 305         } catch (...) {
 306                 // exception thrown during insertion processing. Mark faulted
 307                 Syslog::notice("token in reader %s cannot be used", slot.name().c_str());
 308                 secdebug("token", "exception during insertion processing");
 309                 fault(false);
 310         }
 311 }
 312
 313
 314 //
 315 // Process the logical removal of a Token from a Reader.
 316 // Most of the time, this is asynchronous - someone has yanked the physical
 317 // token out of a physical slot, and we're left with changing our universe
 318 // to conform to the new realities. Reality #1 is that we can't talk to the
 319 // physical token anymore.
 320 //
 321 // Note that if we're in FAULT mode, there really isn't a TokenDaemon around
 322 // to kick. We're just holding on to represent the fact that there *is* a (useless)
 323 // token in the slot, and now it's been finally yanked. Good riddance.
 324 //
 325 void Token::remove()
 326 {
 327         StLock<Mutex> _(*this);
 328         Syslog::notice("reader %s removed token \"%s\" (%s) subservice %ld",
 329                         reader().name().c_str(), mPrintName.c_str(),
 330                         mTokend
 331                                 ? (mTokend->hasTokenUid() ? mTokend->tokenUid().c_str() : "NO UID")
 332                                 : "NO tokend",
 333                         mSubservice);
 334         secdebug("token", "%p begin removal from slot %p (reader %s)",
 335                 this, &reader(), reader().name().c_str());
 336         if (mTokend)
 337                 mTokend->faultRelay(NULL);              // unregister (no more faults, please)
 338         mds().uninstall(mGuid.toString().c_str(), mSubservice);
 339         secdebug("token", "%p mds uninstall complete", this);
 340         this->kill();
 341         secdebug("token", "%p kill complete", this);
 342         notify(kNotificationCDSARemoval);
 343         secdebug("token", "%p removal complete", this);
 344 }
 345
 346
 347 //
 348 // Set the token to fault state.
 349 // This essentially "cuts off" all operations on an inserted token and makes
 350 // them fail. It also sends a FAULT notification via CSSM to any clients.
 351 // Only one fault is actually processed; multiple calls are ignored.
 352 //
 353 // Note that a faulted token is not REMOVED; it's still physically present.
 354 // No fault is declared when a token is actually removed.
 355 //
 356 void Token::fault(bool async)
 357 {
 358         StLock<Mutex> _(*this);
 359         if (!mFaulted) {        // first one
 360                 secdebug("token", "%p %s FAULT", this, async ? "ASYNCHRONOUS" : "SYNCHRONOUS");
 361
 362                 // mark faulted
 363                 mFaulted = true;
 364
 365                 // send CDSA notification
 366                 notify(kNotificationCDSAFailure);
 367
 368                 // cast off our TokenDaemon for good
 369 //>>>           mTokend = NULL;
 370         }
 371
 372         // if this is a synchronous fault, abort this operation now
 373         if (!async)
 374                 CssmError::throwMe(CSSM_ERRCODE_DEVICE_FAILED);
 375 }
 376
 377
 378 void Token::relayFault(bool async)
 379 {
 380         secdebug("token", "%p fault relayed from tokend", this);
 381         this->fault(async);
 382 }
 383
 384
 385 //
 386 // This is the "kill" hook for Token as a Node<> object.
 387 //
 388 void Token::kill()
 389 {
 390         // Avoid holding the lock across call to resetAcls
 391         // This can cause deadlock on card removal
 392         {
 393                 StLock<Mutex> _(*this);
 394                 if (mTokend)
 395                 {
 396                         mTokend = NULL;                                 // cast loose our tokend (if any)
 397                         // Take us out of the map
 398                         StLock<Mutex> _(mSSIDLock);
 399                         SSIDMap::iterator it = mSubservices.find(mSubservice);
 400                         assert(it != mSubservices.end() && it->second == this);
 401                         if (it != mSubservices.end() && it->second == this)
 402                                 mSubservices.erase(it);
 403                 }
 404         }
 405
 406         resetAcls();                                    // release our TokenDbCommons
 407         PerGlobal::kill();                              // generic action
 408
 409 }
 410
 411
 412 //
 413 // Send CDSA-layer notifications for this token.
 414 // These events are usually received by CDSA plugins working with securityd.
 415 //
 416 void Token::notify(NotificationEvent event)
 417 {
 418     NameValueDictionary nvd;
 419         CssmSubserviceUid ssuid(mGuid, NULL, h2n (mSubservice),
 420                 h2n(CSSM_SERVICE_DL | CSSM_SERVICE_CSP));
 421         nvd.Insert(new NameValuePair(SSUID_KEY, CssmData::wrap(ssuid)));
 422     CssmData data;
 423     nvd.Export(data);
 424
 425         // inject notification into Security event system
 426     Listener::notify(kNotificationDomainCDSA, event, data);
 427
 428         // clean up
 429     free (data.data());
 430 }
 431
 432
 433 //
 434 // Choose a token daemon for our card.
 435 //
 436 // Right now, we probe tokends sequentially. If there are many tokends, it would be
 437 // faster to launch them in parallel (relying on PCSC transactions to separate them);
 438 // but it's not altogether clear whether this would slow things down on low-memory
 439 // systems by forcing (excessive) swapping. There is room for future experimentation.
 440 //
 441 RefPointer<TokenDaemon> Token::chooseTokend()
 442 {
 443         //@@@ CodeRepository should learn to update from disk changes to be re-usable
 444         CodeRepository<Bundle> candidates("Security/tokend", ".tokend", "TOKENDAEMONPATH", false);
 445         candidates.update();
 446         //@@@ we could sort by reverse "maxScore" and avoid launching those who won't cut it anyway...
 447
 448         RefPointer<TokenDaemon> leader;
 449         for (CodeRepository<Bundle>::const_iterator it = candidates.begin();
 450                         it != candidates.end(); it++) {
 451                 try {
 452                         // any pre-launch screening of candidate *it goes here
 453
 454                         RefPointer<TokenDaemon> tokend = new TokenDaemon(*it,
 455                                 reader().name(), reader().pcscState(), reader().cache);
 456
 457                         if (tokend->state() == ServerChild::dead)       // ah well, this one's no good
 458                                 continue;
 459
 460                         // probe the (single) tokend
 461                         if (!tokend->probe())           // non comprende...
 462                                 continue;
 463
 464                         // we got a contender!
 465                         if (!leader || tokend->score() > leader->score())
 466                                 leader = tokend;                // a new front runner, he is...
 467                 } catch (...) {
 468                         secdebug("token", "exception setting up %s (moving on)", (*it)->canonicalPath().c_str());
 469                 }
 470         }
 471         return leader;
 472 }
 473
 474
 475 //
 476 // Token::Access mediates calls through TokenDaemon to the actual daemon out there.
 477 //
 478 Token::Access::Access(Token &myToken)
 479         : token(myToken)
 480 {
 481         mTokend = &token.tokend();      // throws if faulted or otherwise inappropriate
 482 }
 483
 484 Token::Access::~Access()
 485 {
 486 }
 487
 488
 489 //
 490 // Debug dump support
 491 //
 492 #if defined(DEBUGDUMP)
 493
 494 void Token::dumpNode()
 495 {
 496         PerGlobal::dumpNode();
 497         Debug::dump(" %s[%d] tokend=%p",
 498                 mGuid.toString().c_str(), mSubservice, mTokend.get());
 499 }
 500
 501 #endif //DEBUGDUMP