1  /* $ANTLR 2.7.7 (20121221): "requirements.grammar" -> "RequirementParser.cpp"$ */
   2  #include "RequirementParser.hpp"
   3  #include <antlr/NoViableAltException.hpp>
   4  #include <antlr/SemanticException.hpp>
   5  #include <antlr/ASTFactory.hpp>
   6  
   7  #include "requirement.h"
   8  #include "reqmaker.h"
   9  #include "csutilities.h"
  10  #include <libDER/libDER.h>
  11  #include <libDER/asn1Types.h>
  12  #include <security_utilities/cfutilities.h>
  13  #include <security_utilities/hashing.h>
  14  #include <security_cdsa_utilities/cssmdata.h>	// OID coding
  15  #include <Security/SecCertificate.h>
  16  using namespace CodeSigning;
  17  typedef Requirement::Maker Maker;
  18  
  19  extern "C" {
  20  
  21  /* Decode a choice of UTCTime or GeneralizedTime to a CFAbsoluteTime. Return
  22  an absoluteTime if the date was valid and properly decoded.  Return
  23  NULL_TIME otherwise. */
  24  CFAbsoluteTime SecAbsoluteTimeFromDateContent(DERTag tag, const uint8_t *bytes,
  25  	size_t length);
  26  
  27  }
  28  
  29  
  30  ANTLR_BEGIN_NAMESPACE(Security_CodeSigning)
  31  
  32  	//
  33  	// Collect error messages.
  34  	// Note that the immediate caller takes the absence of collected error messages
  35  	// to indicate compilation success.
  36  	//
  37  	void RequirementParser::reportError(const antlr::RecognitionException &ex)
  38  	{
  39  		errors += ex.toString() + "\n";
  40  	}
  41  	
  42  	void RequirementParser::reportError(const std::string &s)
  43  	{
  44  		errors += s + "\n";
  45  	}
  46  
  47  	
  48  	//
  49  	// Parser helper functions
  50  	//
  51  	string RequirementParser::hexString(const string &s)
  52  	{
  53  		if (s.size() % 2)
  54  			throw antlr::SemanticException("odd number of digits");
  55  		const char *p = s.data();
  56  		string result;
  57  		for (unsigned n = 0; n < s.length(); n += 2) {
  58  			char c;
  59  			sscanf(p+n, "%2hhx", &c);
  60  			result.push_back(c);
  61  		}
  62  		return result;
  63  	}
  64  
  65  	void RequirementParser::hashString(const string &s, SHA1::Digest hash)
  66  	{
  67  		if (s.size() != 2 * SHA1::digestLength)
  68  			throw antlr::SemanticException("invalid hash length");
  69  		memcpy(hash, hexString(s).data(), SHA1::digestLength);
  70  	}
  71  	
  72  	static const char *matchPrefix(const string &key, const char *prefix)
  73  	{
  74  		size_t pLength = strlen(prefix);
  75  		if (!key.compare(0, pLength, prefix, 0, pLength))
  76  			return key.c_str() + pLength;
  77  		else
  78  			return NULL;
  79  	}
  80  	
  81  	void RequirementParser::certMatchOperation(Maker &maker, int32_t slot, string key)
  82  	{
  83  		if (const char *oids = matchPrefix(key, "timestamp.")) {
  84  			maker.put(opCertFieldDate);
  85  			maker.put(slot);
  86  			CssmAutoData oid(Allocator::standard()); oid.fromOid(oids);
  87  			maker.putData(oid.data(), oid.length());
  88  		} else if (matchPrefix(key, "subject.")) {
  89  			maker.put(opCertField);
  90  			maker.put(slot);
  91  			maker.put(key);
  92  		} else if (const char *oids = matchPrefix(key, "field.")) {
  93  			maker.put(opCertGeneric);
  94  			maker.put(slot);
  95  			CssmAutoData oid(Allocator::standard()); oid.fromOid(oids);
  96  			maker.putData(oid.data(), oid.length());
  97  		} else if (const char *oids = matchPrefix(key, "extension.")) {
  98  			maker.put(opCertGeneric);
  99  			maker.put(slot);
 100  			CssmAutoData oid(Allocator::standard()); oid.fromOid(oids);
 101  			maker.putData(oid.data(), oid.length());
 102  		} else if (const char *oids = matchPrefix(key, "policy.")) {
 103  			maker.put(opCertPolicy);
 104  			maker.put(slot);
 105  			CssmAutoData oid(Allocator::standard()); oid.fromOid(oids);
 106  			maker.putData(oid.data(), oid.length());
 107  		} else {
 108  			throw antlr::SemanticException(key + ": unrecognized certificate field");
 109  		}
 110  	}
 111  
 112  RequirementParser::RequirementParser(antlr::TokenBuffer& tokenBuf, int k)
 113  : antlr::LLkParser(tokenBuf,k)
 114  {
 115  }
 116  
 117  RequirementParser::RequirementParser(antlr::TokenBuffer& tokenBuf)
 118  : antlr::LLkParser(tokenBuf,2)
 119  {
 120  }
 121  
 122  RequirementParser::RequirementParser(antlr::TokenStream& lexer, int k)
 123  : antlr::LLkParser(lexer,k)
 124  {
 125  }
 126  
 127  RequirementParser::RequirementParser(antlr::TokenStream& lexer)
 128  : antlr::LLkParser(lexer,2)
 129  {
 130  }
 131  
 132  RequirementParser::RequirementParser(const antlr::ParserSharedInputState& state)
 133  : antlr::LLkParser(state,2)
 134  {
 135  }
 136  
 137  BlobCore * RequirementParser::autosense() {
 138  	BlobCore *result = NULL;
 139  	
 140  	try {      // for error handling
 141  		switch ( LA(1)) {
 142  		case LPAREN:
 143  		case NOT:
 144  		case LITERAL_always:
 145  		case LITERAL_true:
 146  		case LITERAL_never:
 147  		case LITERAL_false:
 148  		case LITERAL_identifier:
 149  		case LITERAL_cdhash:
 150  		case LITERAL_platform:
 151  		case LITERAL_notarized:
 152  		case LITERAL_legacy:
 153  		case LITERAL_anchor:
 154  		case LITERAL_certificate:
 155  		case LITERAL_cert:
 156  		case LITERAL_info:
 157  		case LITERAL_entitlement:
 158  		{
 159  			result=requirement();
 160  			break;
 161  		}
 162  		case LITERAL_guest:
 163  		case LITERAL_host:
 164  		case LITERAL_designated:
 165  		case LITERAL_library:
 166  		case LITERAL_plugin:
 167  		case INTEGER:
 168  		{
 169  			result=requirementSet();
 170  			break;
 171  		}
 172  		default:
 173  		{
 174  			throw antlr::NoViableAltException(LT(1), getFilename());
 175  		}
 176  		}
 177  	}
 178  	catch (antlr::RecognitionException& ex) {
 179  		reportError(ex);
 180  		recover(ex,_tokenSet_0);
 181  	}
 182  	return result;
 183  }
 184  
 185  Requirement * RequirementParser::requirement() {
 186  	Requirement *result = NULL;
 187  	
 188  	try {      // for error handling
 189  		result=requirementElement();
 190  		match(antlr::Token::EOF_TYPE);
 191  	}
 192  	catch (antlr::RecognitionException& ex) {
 193  		reportError(ex);
 194  		recover(ex,_tokenSet_0);
 195  	}
 196  	return result;
 197  }
 198  
 199  Requirements * RequirementParser::requirementSet() {
 200  	Requirements *result = NULL;
 201  	Requirements::Maker maker;
 202  	
 203  	try {      // for error handling
 204  		{ // ( ... )+
 205  		int _cnt4=0;
 206  		for (;;) {
 207  			if ((_tokenSet_1.member(LA(1)))) {
 208  				uint32_t t; Requirement *req;
 209  				t=requirementType();
 210  				match(ARROW);
 211  				req=requirementElement();
 212  				maker.add(t, req);
 213  			}
 214  			else {
 215  				if ( _cnt4>=1 ) { goto _loop4; } else {throw antlr::NoViableAltException(LT(1), getFilename());}
 216  			}
 217  			
 218  			_cnt4++;
 219  		}
 220  		_loop4:;
 221  		}  // ( ... )+
 222  		result = errors.empty() ? maker() : NULL;
 223  		match(antlr::Token::EOF_TYPE);
 224  	}
 225  	catch (antlr::RecognitionException& ex) {
 226  		reportError(ex);
 227  		recover(ex,_tokenSet_0);
 228  	}
 229  	return result;
 230  }
 231  
 232  uint32_t  RequirementParser::requirementType() {
 233  	uint32_t type = kSecInvalidRequirementType;
 234  	
 235  	try {      // for error handling
 236  		switch ( LA(1)) {
 237  		case LITERAL_guest:
 238  		{
 239  			match(LITERAL_guest);
 240  			type = kSecGuestRequirementType;
 241  			break;
 242  		}
 243  		case LITERAL_host:
 244  		{
 245  			match(LITERAL_host);
 246  			type = kSecHostRequirementType;
 247  			break;
 248  		}
 249  		case LITERAL_designated:
 250  		{
 251  			match(LITERAL_designated);
 252  			type = kSecDesignatedRequirementType;
 253  			break;
 254  		}
 255  		case LITERAL_library:
 256  		{
 257  			match(LITERAL_library);
 258  			type = kSecLibraryRequirementType;
 259  			break;
 260  		}
 261  		case LITERAL_plugin:
 262  		{
 263  			match(LITERAL_plugin);
 264  			type = kSecPluginRequirementType;
 265  			break;
 266  		}
 267  		case INTEGER:
 268  		{
 269  			type=integer();
 270  			break;
 271  		}
 272  		default:
 273  		{
 274  			throw antlr::NoViableAltException(LT(1), getFilename());
 275  		}
 276  		}
 277  	}
 278  	catch (antlr::RecognitionException& ex) {
 279  		reportError(ex);
 280  		recover(ex,_tokenSet_2);
 281  	}
 282  	return type;
 283  }
 284  
 285  Requirement * RequirementParser::requirementElement() {
 286  	Requirement *result = NULL;
 287  	Requirement::Maker maker;
 288  	
 289  	try {      // for error handling
 290  		expr(maker);
 291  		result = maker();
 292  		{ // ( ... )*
 293  		for (;;) {
 294  			if ((LA(1) == SEMI)) {
 295  				fluff();
 296  			}
 297  			else {
 298  				goto _loop9;
 299  			}
 300  			
 301  		}
 302  		_loop9:;
 303  		} // ( ... )*
 304  	}
 305  	catch (antlr::RecognitionException& ex) {
 306  		reportError(ex);
 307  		recover(ex,_tokenSet_3);
 308  	}
 309  	return result;
 310  }
 311  
 312  int32_t  RequirementParser::integer() {
 313  	int32_t result;
 314  	antlr::RefToken  s = antlr::nullToken;
 315  	
 316  	try {      // for error handling
 317  		s = LT(1);
 318  		match(INTEGER);
 319  		result = int32_t(atol(s->getText().c_str()));
 320  	}
 321  	catch (antlr::RecognitionException& ex) {
 322  		reportError(ex);
 323  		recover(ex,_tokenSet_4);
 324  	}
 325  	return result;
 326  }
 327  
 328  void RequirementParser::expr(
 329  	Maker &maker
 330  ) {
 331  	Maker::Label label(maker);
 332  	
 333  	try {      // for error handling
 334  		term(maker);
 335  		{ // ( ... )*
 336  		for (;;) {
 337  			if ((LA(1) == LITERAL_or)) {
 338  				match(LITERAL_or);
 339  				maker.insert<ExprOp>(label) = opOr;
 340  				term(maker);
 341  			}
 342  			else {
 343  				goto _loop12;
 344  			}
 345  			
 346  		}
 347  		_loop12:;
 348  		} // ( ... )*
 349  	}
 350  	catch (antlr::RecognitionException& ex) {
 351  		reportError(ex);
 352  		recover(ex,_tokenSet_5);
 353  	}
 354  }
 355  
 356  void RequirementParser::fluff() {
 357  	
 358  	try {      // for error handling
 359  		match(SEMI);
 360  	}
 361  	catch (antlr::RecognitionException& ex) {
 362  		reportError(ex);
 363  		recover(ex,_tokenSet_6);
 364  	}
 365  }
 366  
 367  void RequirementParser::term(
 368  	Maker &maker
 369  ) {
 370  	Maker::Label label(maker);
 371  	
 372  	try {      // for error handling
 373  		primary(maker);
 374  		{ // ( ... )*
 375  		for (;;) {
 376  			if ((LA(1) == LITERAL_and)) {
 377  				match(LITERAL_and);
 378  				maker.insert<ExprOp>(label) = opAnd;
 379  				primary(maker);
 380  			}
 381  			else {
 382  				goto _loop15;
 383  			}
 384  			
 385  		}
 386  		_loop15:;
 387  		} // ( ... )*
 388  	}
 389  	catch (antlr::RecognitionException& ex) {
 390  		reportError(ex);
 391  		recover(ex,_tokenSet_7);
 392  	}
 393  }
 394  
 395  void RequirementParser::primary(
 396  	Maker &maker
 397  ) {
 398  	
 399  	try {      // for error handling
 400  		switch ( LA(1)) {
 401  		case NOT:
 402  		{
 403  			match(NOT);
 404  			maker.put(opNot);
 405  			primary(maker);
 406  			break;
 407  		}
 408  		case LITERAL_always:
 409  		case LITERAL_true:
 410  		{
 411  			{
 412  			switch ( LA(1)) {
 413  			case LITERAL_always:
 414  			{
 415  				match(LITERAL_always);
 416  				break;
 417  			}
 418  			case LITERAL_true:
 419  			{
 420  				match(LITERAL_true);
 421  				break;
 422  			}
 423  			default:
 424  			{
 425  				throw antlr::NoViableAltException(LT(1), getFilename());
 426  			}
 427  			}
 428  			}
 429  			maker.put(opTrue);
 430  			break;
 431  		}
 432  		case LITERAL_never:
 433  		case LITERAL_false:
 434  		{
 435  			{
 436  			switch ( LA(1)) {
 437  			case LITERAL_never:
 438  			{
 439  				match(LITERAL_never);
 440  				break;
 441  			}
 442  			case LITERAL_false:
 443  			{
 444  				match(LITERAL_false);
 445  				break;
 446  			}
 447  			default:
 448  			{
 449  				throw antlr::NoViableAltException(LT(1), getFilename());
 450  			}
 451  			}
 452  			}
 453  			maker.put(opFalse);
 454  			break;
 455  		}
 456  		case LITERAL_anchor:
 457  		case LITERAL_certificate:
 458  		case LITERAL_cert:
 459  		{
 460  			certspec(maker);
 461  			break;
 462  		}
 463  		case LITERAL_info:
 464  		{
 465  			infospec(maker);
 466  			break;
 467  		}
 468  		case LITERAL_entitlement:
 469  		{
 470  			entitlementspec(maker);
 471  			break;
 472  		}
 473  		case LITERAL_identifier:
 474  		{
 475  			match(LITERAL_identifier);
 476  			string code;
 477  			eql();
 478  			code=identifierString();
 479  			maker.ident(code);
 480  			break;
 481  		}
 482  		case LITERAL_cdhash:
 483  		{
 484  			match(LITERAL_cdhash);
 485  			SHA1::Digest digest;
 486  			eql();
 487  			hash(digest);
 488  			maker.cdhash(digest);
 489  			break;
 490  		}
 491  		case LITERAL_platform:
 492  		{
 493  			match(LITERAL_platform);
 494  			int32_t ident;
 495  			eql();
 496  			ident=integer();
 497  			maker.platform(ident);
 498  			break;
 499  		}
 500  		case LITERAL_notarized:
 501  		{
 502  			match(LITERAL_notarized);
 503  			maker.put(opNotarized);
 504  			break;
 505  		}
 506  		case LITERAL_legacy:
 507  		{
 508  			match(LITERAL_legacy);
 509  			maker.put(opLegacyDevID);
 510  			break;
 511  		}
 512  		default:
 513  			if ((LA(1) == LPAREN) && (_tokenSet_8.member(LA(2)))) {
 514  				match(LPAREN);
 515  				expr(maker);
 516  				match(RPAREN);
 517  			}
 518  			else if ((LA(1) == LPAREN) && (LA(2) == DOTKEY || LA(2) == STRING)) {
 519  				match(LPAREN);
 520  				string name;
 521  				name=identifierString();
 522  				match(RPAREN);
 523  				maker.put(opNamedCode); maker.put(name);
 524  			}
 525  		else {
 526  			throw antlr::NoViableAltException(LT(1), getFilename());
 527  		}
 528  		}
 529  	}
 530  	catch (antlr::RecognitionException& ex) {
 531  		reportError(ex);
 532  		recover(ex,_tokenSet_9);
 533  	}
 534  }
 535  
 536  void RequirementParser::certspec(
 537  	Maker &maker
 538  ) {
 539  	
 540  	try {      // for error handling
 541  		if ((LA(1) == LITERAL_anchor) && (LA(2) == LITERAL_apple)) {
 542  			match(LITERAL_anchor);
 543  			match(LITERAL_apple);
 544  			appleanchor(maker);
 545  		}
 546  		else if ((LA(1) == LITERAL_anchor) && (LA(2) == LITERAL_generic)) {
 547  			match(LITERAL_anchor);
 548  			match(LITERAL_generic);
 549  			match(LITERAL_apple);
 550  			maker.put(opAppleGenericAnchor);
 551  		}
 552  		else if ((LA(1) == LITERAL_anchor || LA(1) == LITERAL_certificate || LA(1) == LITERAL_cert) && (LA(2) == LITERAL_trusted)) {
 553  			{
 554  			switch ( LA(1)) {
 555  			case LITERAL_certificate:
 556  			{
 557  				match(LITERAL_certificate);
 558  				break;
 559  			}
 560  			case LITERAL_cert:
 561  			{
 562  				match(LITERAL_cert);
 563  				break;
 564  			}
 565  			case LITERAL_anchor:
 566  			{
 567  				match(LITERAL_anchor);
 568  				break;
 569  			}
 570  			default:
 571  			{
 572  				throw antlr::NoViableAltException(LT(1), getFilename());
 573  			}
 574  			}
 575  			}
 576  			match(LITERAL_trusted);
 577  			maker.trustedAnchor();
 578  		}
 579  		else if ((LA(1) == LITERAL_certificate || LA(1) == LITERAL_cert) && (_tokenSet_10.member(LA(2)))) {
 580  			{
 581  			switch ( LA(1)) {
 582  			case LITERAL_certificate:
 583  			{
 584  				match(LITERAL_certificate);
 585  				break;
 586  			}
 587  			case LITERAL_cert:
 588  			{
 589  				match(LITERAL_cert);
 590  				break;
 591  			}
 592  			default:
 593  			{
 594  				throw antlr::NoViableAltException(LT(1), getFilename());
 595  			}
 596  			}
 597  			}
 598  			int32_t slot;
 599  			slot=certSlot();
 600  			{
 601  			switch ( LA(1)) {
 602  			case EQL:
 603  			case EQQL:
 604  			case LBRACK:
 605  			case HASHCONSTANT:
 606  			case DOTKEY:
 607  			case STRING:
 608  			case PATHNAME:
 609  			{
 610  				certslotspec(maker, slot);
 611  				break;
 612  			}
 613  			case LITERAL_trusted:
 614  			{
 615  				match(LITERAL_trusted);
 616  				maker.trustedAnchor(slot);
 617  				break;
 618  			}
 619  			default:
 620  			{
 621  				throw antlr::NoViableAltException(LT(1), getFilename());
 622  			}
 623  			}
 624  			}
 625  		}
 626  		else if ((LA(1) == LITERAL_anchor) && (_tokenSet_11.member(LA(2)))) {
 627  			match(LITERAL_anchor);
 628  			certslotspec(maker, Requirement::anchorCert);
 629  		}
 630  		else {
 631  			throw antlr::NoViableAltException(LT(1), getFilename());
 632  		}
 633  		
 634  	}
 635  	catch (antlr::RecognitionException& ex) {
 636  		reportError(ex);
 637  		recover(ex,_tokenSet_9);
 638  	}
 639  }
 640  
 641  void RequirementParser::infospec(
 642  	Maker &maker
 643  ) {
 644  	string key;
 645  	
 646  	try {      // for error handling
 647  		match(LITERAL_info);
 648  		key=bracketKey();
 649  		maker.put(opInfoKeyField); maker.put(key);
 650  		match_suffix(maker);
 651  	}
 652  	catch (antlr::RecognitionException& ex) {
 653  		reportError(ex);
 654  		recover(ex,_tokenSet_9);
 655  	}
 656  }
 657  
 658  void RequirementParser::entitlementspec(
 659  	Maker &maker
 660  ) {
 661  	string key;
 662  	
 663  	try {      // for error handling
 664  		match(LITERAL_entitlement);
 665  		key=bracketKey();
 666  		maker.put(opEntitlementField); maker.put(key);
 667  		match_suffix(maker);
 668  	}
 669  	catch (antlr::RecognitionException& ex) {
 670  		reportError(ex);
 671  		recover(ex,_tokenSet_9);
 672  	}
 673  }
 674  
 675  void RequirementParser::eql() {
 676  	
 677  	try {      // for error handling
 678  		switch ( LA(1)) {
 679  		case EQL:
 680  		{
 681  			match(EQL);
 682  			break;
 683  		}
 684  		case EQQL:
 685  		{
 686  			match(EQQL);
 687  			break;
 688  		}
 689  		case HASHCONSTANT:
 690  		case DOTKEY:
 691  		case STRING:
 692  		case PATHNAME:
 693  		case INTEGER:
 694  		{
 695  			empty();
 696  			break;
 697  		}
 698  		default:
 699  		{
 700  			throw antlr::NoViableAltException(LT(1), getFilename());
 701  		}
 702  		}
 703  	}
 704  	catch (antlr::RecognitionException& ex) {
 705  		reportError(ex);
 706  		recover(ex,_tokenSet_12);
 707  	}
 708  }
 709  
 710  string  RequirementParser::identifierString() {
 711  	string result;
 712  	antlr::RefToken  dk = antlr::nullToken;
 713  	antlr::RefToken  s = antlr::nullToken;
 714  	
 715  	try {      // for error handling
 716  		switch ( LA(1)) {
 717  		case DOTKEY:
 718  		{
 719  			dk = LT(1);
 720  			match(DOTKEY);
 721  			result = dk->getText();
 722  			break;
 723  		}
 724  		case STRING:
 725  		{
 726  			s = LT(1);
 727  			match(STRING);
 728  			result = s->getText();
 729  			break;
 730  		}
 731  		default:
 732  		{
 733  			throw antlr::NoViableAltException(LT(1), getFilename());
 734  		}
 735  		}
 736  	}
 737  	catch (antlr::RecognitionException& ex) {
 738  		reportError(ex);
 739  		recover(ex,_tokenSet_9);
 740  	}
 741  	return result;
 742  }
 743  
 744  void RequirementParser::hash(
 745  	SHA1::Digest digest
 746  ) {
 747  	antlr::RefToken  hash = antlr::nullToken;
 748  	
 749  	try {      // for error handling
 750  		hash = LT(1);
 751  		match(HASHCONSTANT);
 752  		hashString(hash->getText(), digest);
 753  	}
 754  	catch (antlr::RecognitionException& ex) {
 755  		reportError(ex);
 756  		recover(ex,_tokenSet_9);
 757  	}
 758  }
 759  
 760  void RequirementParser::appleanchor(
 761  	Maker &maker
 762  ) {
 763  	
 764  	try {      // for error handling
 765  		switch ( LA(1)) {
 766  		case antlr::Token::EOF_TYPE:
 767  		case LITERAL_guest:
 768  		case LITERAL_host:
 769  		case LITERAL_designated:
 770  		case LITERAL_library:
 771  		case LITERAL_plugin:
 772  		case LITERAL_or:
 773  		case LITERAL_and:
 774  		case RPAREN:
 775  		case INTEGER:
 776  		case SEMI:
 777  		{
 778  			empty();
 779  			maker.put(opAppleAnchor);
 780  			break;
 781  		}
 782  		case LITERAL_generic:
 783  		{
 784  			match(LITERAL_generic);
 785  			maker.put(opAppleGenericAnchor);
 786  			break;
 787  		}
 788  		case DOTKEY:
 789  		case STRING:
 790  		{
 791  			string name;
 792  			name=identifierString();
 793  			maker.put(opNamedAnchor); maker.put(name);
 794  			break;
 795  		}
 796  		default:
 797  		{
 798  			throw antlr::NoViableAltException(LT(1), getFilename());
 799  		}
 800  		}
 801  	}
 802  	catch (antlr::RecognitionException& ex) {
 803  		reportError(ex);
 804  		recover(ex,_tokenSet_9);
 805  	}
 806  }
 807  
 808  int32_t  RequirementParser::certSlot() {
 809  	int32_t slot = 0;
 810  	
 811  	try {      // for error handling
 812  		switch ( LA(1)) {
 813  		case INTEGER:
 814  		{
 815  			slot=integer();
 816  			break;
 817  		}
 818  		case NEG:
 819  		{
 820  			match(NEG);
 821  			slot=integer();
 822  			slot = -slot;
 823  			break;
 824  		}
 825  		case LITERAL_leaf:
 826  		{
 827  			match(LITERAL_leaf);
 828  			slot = Requirement::leafCert;
 829  			break;
 830  		}
 831  		case LITERAL_root:
 832  		{
 833  			match(LITERAL_root);
 834  			slot = Requirement::anchorCert;
 835  			break;
 836  		}
 837  		default:
 838  		{
 839  			throw antlr::NoViableAltException(LT(1), getFilename());
 840  		}
 841  		}
 842  	}
 843  	catch (antlr::RecognitionException& ex) {
 844  		reportError(ex);
 845  		recover(ex,_tokenSet_13);
 846  	}
 847  	return slot;
 848  }
 849  
 850  void RequirementParser::certslotspec(
 851  	Maker &maker, int32_t slot
 852  ) {
 853  	string key;
 854  	
 855  	try {      // for error handling
 856  		switch ( LA(1)) {
 857  		case EQL:
 858  		case EQQL:
 859  		case HASHCONSTANT:
 860  		case DOTKEY:
 861  		case STRING:
 862  		case PATHNAME:
 863  		{
 864  			eql();
 865  			SHA1::Digest digest;
 866  			certificateDigest(digest);
 867  			maker.anchor(slot, digest);
 868  			break;
 869  		}
 870  		case LBRACK:
 871  		{
 872  			key=bracketKey();
 873  			certMatchOperation(maker, slot, key);
 874  			match_suffix(maker);
 875  			break;
 876  		}
 877  		default:
 878  		{
 879  			throw antlr::NoViableAltException(LT(1), getFilename());
 880  		}
 881  		}
 882  	}
 883  	catch (antlr::RecognitionException& ex) {
 884  		reportError(ex);
 885  		recover(ex,_tokenSet_9);
 886  	}
 887  }
 888  
 889  void RequirementParser::empty() {
 890  	
 891  	try {      // for error handling
 892  	}
 893  	catch (antlr::RecognitionException& ex) {
 894  		reportError(ex);
 895  		recover(ex,_tokenSet_14);
 896  	}
 897  }
 898  
 899  void RequirementParser::certificateDigest(
 900  	SHA1::Digest digest
 901  ) {
 902  	
 903  	try {      // for error handling
 904  		switch ( LA(1)) {
 905  		case HASHCONSTANT:
 906  		{
 907  			hash(digest);
 908  			break;
 909  		}
 910  		case DOTKEY:
 911  		case STRING:
 912  		case PATHNAME:
 913  		{
 914  			string path;
 915  			path=pathstring();
 916  			if (CFRef<CFDataRef> certData = cfLoadFile(path))
 917  							hashOfCertificate(CFDataGetBytePtr(certData), CFDataGetLength(certData), digest);
 918  						  else
 919  							throw antlr::SemanticException(path + ": not found");
 920  						
 921  			break;
 922  		}
 923  		default:
 924  		{
 925  			throw antlr::NoViableAltException(LT(1), getFilename());
 926  		}
 927  		}
 928  	}
 929  	catch (antlr::RecognitionException& ex) {
 930  		reportError(ex);
 931  		recover(ex,_tokenSet_9);
 932  	}
 933  }
 934  
 935  string  RequirementParser::bracketKey() {
 936  	string key;
 937  	
 938  	try {      // for error handling
 939  		match(LBRACK);
 940  		key=stringvalue();
 941  		match(RBRACK);
 942  	}
 943  	catch (antlr::RecognitionException& ex) {
 944  		reportError(ex);
 945  		recover(ex,_tokenSet_15);
 946  	}
 947  	return key;
 948  }
 949  
 950  void RequirementParser::match_suffix(
 951  	Maker &maker
 952  ) {
 953  	
 954  	try {      // for error handling
 955  		switch ( LA(1)) {
 956  		case antlr::Token::EOF_TYPE:
 957  		case LITERAL_guest:
 958  		case LITERAL_host:
 959  		case LITERAL_designated:
 960  		case LITERAL_library:
 961  		case LITERAL_plugin:
 962  		case LITERAL_or:
 963  		case LITERAL_and:
 964  		case RPAREN:
 965  		case LITERAL_exists:
 966  		case INTEGER:
 967  		case SEMI:
 968  		{
 969  			empty();
 970  			{
 971  			switch ( LA(1)) {
 972  			case LITERAL_exists:
 973  			{
 974  				match(LITERAL_exists);
 975  				break;
 976  			}
 977  			case antlr::Token::EOF_TYPE:
 978  			case LITERAL_guest:
 979  			case LITERAL_host:
 980  			case LITERAL_designated:
 981  			case LITERAL_library:
 982  			case LITERAL_plugin:
 983  			case LITERAL_or:
 984  			case LITERAL_and:
 985  			case RPAREN:
 986  			case INTEGER:
 987  			case SEMI:
 988  			{
 989  				break;
 990  			}
 991  			default:
 992  			{
 993  				throw antlr::NoViableAltException(LT(1), getFilename());
 994  			}
 995  			}
 996  			}
 997  			maker.put(matchExists);
 998  			break;
 999  		}
1000  		case LITERAL_absent:
1001  		{
1002  			match(LITERAL_absent);
1003  			maker.put(matchAbsent);
1004  			break;
1005  		}
1006  		case SUBS:
1007  		{
1008  			match(SUBS);
1009  			string value;
1010  			value=datavalue();
1011  			maker.put(matchContains); maker.put(value);
1012  			break;
1013  		}
1014  		default:
1015  			if ((LA(1) == EQL || LA(1) == EQQL) && (_tokenSet_16.member(LA(2)))) {
1016  				{
1017  				switch ( LA(1)) {
1018  				case EQL:
1019  				{
1020  					match(EQL);
1021  					break;
1022  				}
1023  				case EQQL:
1024  				{
1025  					match(EQQL);
1026  					break;
1027  				}
1028  				default:
1029  				{
1030  					throw antlr::NoViableAltException(LT(1), getFilename());
1031  				}
1032  				}
1033  				}
1034  				MatchOperation mop = matchEqual; string value;
1035  				{
1036  				switch ( LA(1)) {
1037  				case STAR:
1038  				{
1039  					match(STAR);
1040  					mop = matchEndsWith;
1041  					break;
1042  				}
1043  				case HEXCONSTANT:
1044  				case DOTKEY:
1045  				case STRING:
1046  				{
1047  					break;
1048  				}
1049  				default:
1050  				{
1051  					throw antlr::NoViableAltException(LT(1), getFilename());
1052  				}
1053  				}
1054  				}
1055  				value=datavalue();
1056  				{
1057  				switch ( LA(1)) {
1058  				case STAR:
1059  				{
1060  					match(STAR);
1061  					mop = (mop == matchEndsWith) ? matchContains : matchBeginsWith;
1062  					break;
1063  				}
1064  				case antlr::Token::EOF_TYPE:
1065  				case LITERAL_guest:
1066  				case LITERAL_host:
1067  				case LITERAL_designated:
1068  				case LITERAL_library:
1069  				case LITERAL_plugin:
1070  				case LITERAL_or:
1071  				case LITERAL_and:
1072  				case RPAREN:
1073  				case INTEGER:
1074  				case SEMI:
1075  				{
1076  					break;
1077  				}
1078  				default:
1079  				{
1080  					throw antlr::NoViableAltException(LT(1), getFilename());
1081  				}
1082  				}
1083  				}
1084  				maker.put(mop); maker.put(value);
1085  			}
1086  			else if ((LA(1) == EQL || LA(1) == EQQL) && (LA(2) == LITERAL_timestamp)) {
1087  				{
1088  				switch ( LA(1)) {
1089  				case EQL:
1090  				{
1091  					match(EQL);
1092  					break;
1093  				}
1094  				case EQQL:
1095  				{
1096  					match(EQQL);
1097  					break;
1098  				}
1099  				default:
1100  				{
1101  					throw antlr::NoViableAltException(LT(1), getFilename());
1102  				}
1103  				}
1104  				}
1105  				MatchOperation mop = matchOn; int64_t value;
1106  				value=timestamp();
1107  				maker.put(mop); maker.put(value);
1108  			}
1109  			else if ((LA(1) == LESS) && ((LA(2) >= HEXCONSTANT && LA(2) <= STRING))) {
1110  				match(LESS);
1111  				string value;
1112  				value=datavalue();
1113  				maker.put(matchLessThan); maker.put(value);
1114  			}
1115  			else if ((LA(1) == GT) && ((LA(2) >= HEXCONSTANT && LA(2) <= STRING))) {
1116  				match(GT);
1117  				string value;
1118  				value=datavalue();
1119  				maker.put(matchGreaterThan); maker.put(value);
1120  			}
1121  			else if ((LA(1) == LE) && ((LA(2) >= HEXCONSTANT && LA(2) <= STRING))) {
1122  				match(LE);
1123  				string value;
1124  				value=datavalue();
1125  				maker.put(matchLessEqual); maker.put(value);
1126  			}
1127  			else if ((LA(1) == GE) && ((LA(2) >= HEXCONSTANT && LA(2) <= STRING))) {
1128  				match(GE);
1129  				string value;
1130  				value=datavalue();
1131  				maker.put(matchGreaterEqual); maker.put(value);
1132  			}
1133  			else if ((LA(1) == LESS) && (LA(2) == LITERAL_timestamp)) {
1134  				match(LESS);
1135  				int64_t value;
1136  				value=timestamp();
1137  				maker.put(matchBefore); maker.put(value);
1138  			}
1139  			else if ((LA(1) == GT) && (LA(2) == LITERAL_timestamp)) {
1140  				match(GT);
1141  				int64_t value;
1142  				value=timestamp();
1143  				maker.put(matchAfter); maker.put(value);
1144  			}
1145  			else if ((LA(1) == LE) && (LA(2) == LITERAL_timestamp)) {
1146  				match(LE);
1147  				int64_t value;
1148  				value=timestamp();
1149  				maker.put(matchOnOrBefore); maker.put(value);
1150  			}
1151  			else if ((LA(1) == GE) && (LA(2) == LITERAL_timestamp)) {
1152  				match(GE);
1153  				int64_t value;
1154  				value=timestamp();
1155  				maker.put(matchOnOrAfter); maker.put(value);
1156  			}
1157  		else {
1158  			throw antlr::NoViableAltException(LT(1), getFilename());
1159  		}
1160  		}
1161  	}
1162  	catch (antlr::RecognitionException& ex) {
1163  		reportError(ex);
1164  		recover(ex,_tokenSet_9);
1165  	}
1166  }
1167  
1168  string  RequirementParser::datavalue() {
1169  	string result;
1170  	antlr::RefToken  hex = antlr::nullToken;
1171  	
1172  	try {      // for error handling
1173  		switch ( LA(1)) {
1174  		case DOTKEY:
1175  		case STRING:
1176  		{
1177  			result=stringvalue();
1178  			break;
1179  		}
1180  		case HEXCONSTANT:
1181  		{
1182  			hex = LT(1);
1183  			match(HEXCONSTANT);
1184  			result = hexString(hex->getText());
1185  			break;
1186  		}
1187  		default:
1188  		{
1189  			throw antlr::NoViableAltException(LT(1), getFilename());
1190  		}
1191  		}
1192  	}
1193  	catch (antlr::RecognitionException& ex) {
1194  		reportError(ex);
1195  		recover(ex,_tokenSet_17);
1196  	}
1197  	return result;
1198  }
1199  
1200  int64_t  RequirementParser::timestamp() {
1201  	int64_t result;
1202  	antlr::RefToken  s = antlr::nullToken;
1203  	
1204  	try {      // for error handling
1205  		match(LITERAL_timestamp);
1206  		s = LT(1);
1207  		match(STRING);
1208  		result = (int64_t)SecAbsoluteTimeFromDateContent(ASN1_GENERALIZED_TIME, (uint8_t const *)s->getText().c_str(), s->getText().length());
1209  	}
1210  	catch (antlr::RecognitionException& ex) {
1211  		reportError(ex);
1212  		recover(ex,_tokenSet_9);
1213  	}
1214  	return result;
1215  }
1216  
1217  string  RequirementParser::stringvalue() {
1218  	string result;
1219  	antlr::RefToken  dk = antlr::nullToken;
1220  	antlr::RefToken  s = antlr::nullToken;
1221  	
1222  	try {      // for error handling
1223  		switch ( LA(1)) {
1224  		case DOTKEY:
1225  		{
1226  			dk = LT(1);
1227  			match(DOTKEY);
1228  			result = dk->getText();
1229  			break;
1230  		}
1231  		case STRING:
1232  		{
1233  			s = LT(1);
1234  			match(STRING);
1235  			result = s->getText();
1236  			break;
1237  		}
1238  		default:
1239  		{
1240  			throw antlr::NoViableAltException(LT(1), getFilename());
1241  		}
1242  		}
1243  	}
1244  	catch (antlr::RecognitionException& ex) {
1245  		reportError(ex);
1246  		recover(ex,_tokenSet_18);
1247  	}
1248  	return result;
1249  }
1250  
1251  string  RequirementParser::pathstring() {
1252  	string result;
1253  	antlr::RefToken  dk = antlr::nullToken;
1254  	antlr::RefToken  s = antlr::nullToken;
1255  	antlr::RefToken  pn = antlr::nullToken;
1256  	
1257  	try {      // for error handling
1258  		switch ( LA(1)) {
1259  		case DOTKEY:
1260  		{
1261  			dk = LT(1);
1262  			match(DOTKEY);
1263  			result = dk->getText();
1264  			break;
1265  		}
1266  		case STRING:
1267  		{
1268  			s = LT(1);
1269  			match(STRING);
1270  			result = s->getText();
1271  			break;
1272  		}
1273  		case PATHNAME:
1274  		{
1275  			pn = LT(1);
1276  			match(PATHNAME);
1277  			result = pn->getText();
1278  			break;
1279  		}
1280  		default:
1281  		{
1282  			throw antlr::NoViableAltException(LT(1), getFilename());
1283  		}
1284  		}
1285  	}
1286  	catch (antlr::RecognitionException& ex) {
1287  		reportError(ex);
1288  		recover(ex,_tokenSet_9);
1289  	}
1290  	return result;
1291  }
1292  
1293  void RequirementParser::initializeASTFactory( antlr::ASTFactory& )
1294  {
1295  }
1296  const char* RequirementParser::tokenNames[] = {
1297  	"<0>",
1298  	"EOF",
1299  	"<2>",
1300  	"NULL_TREE_LOOKAHEAD",
1301  	"ARROW",
1302  	"\"guest\"",
1303  	"\"host\"",
1304  	"\"designated\"",
1305  	"\"library\"",
1306  	"\"plugin\"",
1307  	"\"or\"",
1308  	"\"and\"",
1309  	"LPAREN",
1310  	"RPAREN",
1311  	"NOT",
1312  	"\"always\"",
1313  	"\"true\"",
1314  	"\"never\"",
1315  	"\"false\"",
1316  	"\"identifier\"",
1317  	"\"cdhash\"",
1318  	"\"platform\"",
1319  	"\"notarized\"",
1320  	"\"legacy\"",
1321  	"\"anchor\"",
1322  	"\"apple\"",
1323  	"\"generic\"",
1324  	"\"certificate\"",
1325  	"\"cert\"",
1326  	"\"trusted\"",
1327  	"\"info\"",
1328  	"\"entitlement\"",
1329  	"\"exists\"",
1330  	"\"absent\"",
1331  	"EQL",
1332  	"EQQL",
1333  	"STAR",
1334  	"SUBS",
1335  	"LESS",
1336  	"GT",
1337  	"LE",
1338  	"GE",
1339  	"LBRACK",
1340  	"RBRACK",
1341  	"NEG",
1342  	"\"leaf\"",
1343  	"\"root\"",
1344  	"HASHCONSTANT",
1345  	"HEXCONSTANT",
1346  	"DOTKEY",
1347  	"STRING",
1348  	"PATHNAME",
1349  	"INTEGER",
1350  	"\"timestamp\"",
1351  	"SEMI",
1352  	"IDENT",
1353  	"HEX",
1354  	"COMMA",
1355  	"WS",
1356  	"SHELLCOMMENT",
1357  	"C_COMMENT",
1358  	"CPP_COMMENT",
1359  	0
1360  };
1361  
1362  const unsigned long RequirementParser::_tokenSet_0_data_[] = { 2UL, 0UL, 0UL, 0UL };
1363  // EOF 
1364  const antlr::BitSet RequirementParser::_tokenSet_0(_tokenSet_0_data_,4);
1365  const unsigned long RequirementParser::_tokenSet_1_data_[] = { 992UL, 1048576UL, 0UL, 0UL };
1366  // "guest" "host" "designated" "library" "plugin" INTEGER 
1367  const antlr::BitSet RequirementParser::_tokenSet_1(_tokenSet_1_data_,4);
1368  const unsigned long RequirementParser::_tokenSet_2_data_[] = { 16UL, 0UL, 0UL, 0UL };
1369  // ARROW 
1370  const antlr::BitSet RequirementParser::_tokenSet_2(_tokenSet_2_data_,4);
1371  const unsigned long RequirementParser::_tokenSet_3_data_[] = { 994UL, 1048576UL, 0UL, 0UL };
1372  // EOF "guest" "host" "designated" "library" "plugin" INTEGER 
1373  const antlr::BitSet RequirementParser::_tokenSet_3(_tokenSet_3_data_,4);
1374  const unsigned long RequirementParser::_tokenSet_4_data_[] = { 536883186UL, 6194188UL, 0UL, 0UL };
1375  // EOF ARROW "guest" "host" "designated" "library" "plugin" "or" "and" 
1376  // RPAREN "trusted" EQL EQQL LBRACK HASHCONSTANT DOTKEY STRING PATHNAME 
1377  // INTEGER SEMI 
1378  const antlr::BitSet RequirementParser::_tokenSet_4(_tokenSet_4_data_,4);
1379  const unsigned long RequirementParser::_tokenSet_5_data_[] = { 9186UL, 5242880UL, 0UL, 0UL };
1380  // EOF "guest" "host" "designated" "library" "plugin" RPAREN INTEGER SEMI 
1381  const antlr::BitSet RequirementParser::_tokenSet_5(_tokenSet_5_data_,4);
1382  const unsigned long RequirementParser::_tokenSet_6_data_[] = { 994UL, 5242880UL, 0UL, 0UL };
1383  // EOF "guest" "host" "designated" "library" "plugin" INTEGER SEMI 
1384  const antlr::BitSet RequirementParser::_tokenSet_6(_tokenSet_6_data_,4);
1385  const unsigned long RequirementParser::_tokenSet_7_data_[] = { 10210UL, 5242880UL, 0UL, 0UL };
1386  // EOF "guest" "host" "designated" "library" "plugin" "or" RPAREN INTEGER 
1387  // SEMI 
1388  const antlr::BitSet RequirementParser::_tokenSet_7(_tokenSet_7_data_,4);
1389  const unsigned long RequirementParser::_tokenSet_8_data_[] = { 3657420800UL, 0UL, 0UL, 0UL };
1390  // LPAREN NOT "always" "true" "never" "false" "identifier" "cdhash" "platform" 
1391  // "notarized" "legacy" "anchor" "certificate" "cert" "info" "entitlement" 
1392  const antlr::BitSet RequirementParser::_tokenSet_8(_tokenSet_8_data_,4);
1393  const unsigned long RequirementParser::_tokenSet_9_data_[] = { 12258UL, 5242880UL, 0UL, 0UL };
1394  // EOF "guest" "host" "designated" "library" "plugin" "or" "and" RPAREN 
1395  // INTEGER SEMI 
1396  const antlr::BitSet RequirementParser::_tokenSet_9(_tokenSet_9_data_,4);
1397  const unsigned long RequirementParser::_tokenSet_10_data_[] = { 0UL, 1077248UL, 0UL, 0UL };
1398  // NEG "leaf" "root" INTEGER 
1399  const antlr::BitSet RequirementParser::_tokenSet_10(_tokenSet_10_data_,4);
1400  const unsigned long RequirementParser::_tokenSet_11_data_[] = { 0UL, 951308UL, 0UL, 0UL };
1401  // EQL EQQL LBRACK HASHCONSTANT DOTKEY STRING PATHNAME 
1402  const antlr::BitSet RequirementParser::_tokenSet_11(_tokenSet_11_data_,4);
1403  const unsigned long RequirementParser::_tokenSet_12_data_[] = { 0UL, 1998848UL, 0UL, 0UL };
1404  // HASHCONSTANT DOTKEY STRING PATHNAME INTEGER 
1405  const antlr::BitSet RequirementParser::_tokenSet_12(_tokenSet_12_data_,4);
1406  const unsigned long RequirementParser::_tokenSet_13_data_[] = { 536870912UL, 951308UL, 0UL, 0UL };
1407  // "trusted" EQL EQQL LBRACK HASHCONSTANT DOTKEY STRING PATHNAME 
1408  const antlr::BitSet RequirementParser::_tokenSet_13(_tokenSet_13_data_,4);
1409  const unsigned long RequirementParser::_tokenSet_14_data_[] = { 12258UL, 6193153UL, 0UL, 0UL };
1410  // EOF "guest" "host" "designated" "library" "plugin" "or" "and" RPAREN 
1411  // "exists" HASHCONSTANT DOTKEY STRING PATHNAME INTEGER SEMI 
1412  const antlr::BitSet RequirementParser::_tokenSet_14(_tokenSet_14_data_,4);
1413  const unsigned long RequirementParser::_tokenSet_15_data_[] = { 12258UL, 5243887UL, 0UL, 0UL };
1414  // EOF "guest" "host" "designated" "library" "plugin" "or" "and" RPAREN 
1415  // "exists" "absent" EQL EQQL SUBS LESS GT LE GE INTEGER SEMI 
1416  const antlr::BitSet RequirementParser::_tokenSet_15(_tokenSet_15_data_,4);
1417  const unsigned long RequirementParser::_tokenSet_16_data_[] = { 0UL, 458768UL, 0UL, 0UL };
1418  // STAR HEXCONSTANT DOTKEY STRING 
1419  const antlr::BitSet RequirementParser::_tokenSet_16(_tokenSet_16_data_,4);
1420  const unsigned long RequirementParser::_tokenSet_17_data_[] = { 12258UL, 5242896UL, 0UL, 0UL };
1421  // EOF "guest" "host" "designated" "library" "plugin" "or" "and" RPAREN 
1422  // STAR INTEGER SEMI 
1423  const antlr::BitSet RequirementParser::_tokenSet_17(_tokenSet_17_data_,4);
1424  const unsigned long RequirementParser::_tokenSet_18_data_[] = { 12258UL, 5244944UL, 0UL, 0UL };
1425  // EOF "guest" "host" "designated" "library" "plugin" "or" "and" RPAREN 
1426  // STAR RBRACK INTEGER SEMI 
1427  const antlr::BitSet RequirementParser::_tokenSet_18(_tokenSet_18_data_,4);
1428  
1429  
1430  ANTLR_END_NAMESPACE