1  /*
  2   * Copyright (c) 2019 Apple Inc. All Rights Reserved.
  3   *
  4   * @APPLE_LICENSE_HEADER_START@
  5   *
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. Please obtain a copy of the License at
 10   * http://www.opensource.apple.com/apsl/ and read it before using this
 11   * file.
 12   *
 13   * The Original Code and all software distributed under the License are
 14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 18   * Please see the License for the specific language governing rights and
 19   * limitations under the License.
 20   *
 21   * @APPLE_LICENSE_HEADER_END@
 22   */
 23  
 24  #include "legacydevid.h"
 25  #include "SecAssessment.h"
 26  #include "requirement.h"
 27  
 28  #include <Security/SecCertificatePriv.h>
 29  
 30  namespace Security {
 31  namespace CodeSigning {
 32  
 33  static const CFStringRef kLegacyPolicyPreferenceDomain = CFSTR("com.apple.security.syspolicy");
 34  static const CFStringRef kLegacyPolicyAccountCreationCutOff = CFSTR("AccountCreationCutOffDate");
 35  static const CFStringRef kLegacyPolicySecureTimestampCutOff = CFSTR("SecureTimestampCutOffDate");
 36  static const CFAbsoluteTime kLegacyPolicyAccountCreationDefaultCutOff = 576374400.0; // seconds from January 1, 2001 to April 7, 2019 GMT
 37  static const CFAbsoluteTime kLegacyPolicySecureTimestampDefaultCutOff = 581040000.0; // seconds from January 1, 2001 to June 1, 2019 GMT
 38  
 39  static CFDateRef
 40  copyCutOffDate(const CFStringRef key, CFAbsoluteTime defaultCutoff)
 41  {
 42      CFDateRef defaultDate = CFDateCreate(NULL, defaultCutoff);
 43      CFDateRef outputDate = defaultDate;
 44      CFDateRef prefDate = NULL;
 45  
 46      CFTypeRef prefVal = (CFDateRef)CFPreferencesCopyValue(key,
 47                                                            kLegacyPolicyPreferenceDomain,
 48                                                            kCFPreferencesCurrentUser,
 49                                                            kCFPreferencesAnyHost);
 50      if (prefVal && CFGetTypeID(prefVal) == CFDateGetTypeID()) {
 51          prefDate = (CFDateRef)prefVal;
 52      }
 53  
 54      if (prefDate) {
 55          CFComparisonResult res = CFDateCompare(defaultDate, prefDate, NULL);
 56          if (res > 0) {
 57              outputDate = prefDate;
 58          }
 59      }
 60  
 61      CFRetain(outputDate);
 62  
 63      if (prefVal) {
 64          CFRelease(prefVal);
 65      }
 66      if (defaultDate) {
 67          CFRelease(defaultDate);
 68      }
 69      return outputDate;
 70  }
 71  
 72  bool
 73  meetsDeveloperIDLegacyAllowedPolicy(const Requirement::Context *context)
 74  {
 75      CFRef<CFDataRef> cd;
 76      CFRef<CFErrorRef> error;
 77      CFRef<CFStringRef> teamID;
 78      bool meets_legacy_policy = false;
 79      SecCSDigestAlgorithm hashType = kSecCodeSignatureNoHash;
 80      SecCertificateRef cert = NULL;
 81      CFAbsoluteTime accountCreationTime = 0.0;
 82  
 83      if (context == NULL) {
 84          meets_legacy_policy = false;
 85          goto lb_exit;
 86      }
 87  
 88      // First check account creation date in certs
 89      // An account creation date after the cut off must be notarized so it fails the legacy policy.
 90      // No account creation date or an account creation date before the cut off requires additional checking
 91      cert = context->cert(Requirement::leafCert);
 92      if (SecCertificateGetDeveloperIDDate(cert, &accountCreationTime, &error.aref())) {
 93          //There is an account creation date
 94          CFRef<CFDateRef> accountCreationDate = CFDateCreate(NULL, accountCreationTime);
 95          CFRef<CFDateRef> accountCreationCutoffDate = copyCutOffDate(kLegacyPolicyAccountCreationCutOff,
 96                                                                      kLegacyPolicyAccountCreationDefaultCutOff);
 97          secinfo("meetsDeveloperIDLegacyAllowedPolicy", "Account Creation Date Cutoff: %@", accountCreationCutoffDate.get());
 98          secinfo("meetsDeveloperIDLegacyAllowedPolicy", "Account Creation date: %@", accountCreationDate.get());
 99  
100          CFComparisonResult res = CFDateCompare(accountCreationDate, accountCreationCutoffDate, NULL);
101          if (res >= 0) {
102              // The account was created on or after our cut off so it doesn't meet legacy policy
103              meets_legacy_policy = false;
104              secinfo("meetsDeveloperIDLegacyAllowedPolicy", "Account creation date %@ is after cut-off %@", accountCreationDate.get(), accountCreationCutoffDate.get());
105              goto lb_exit;
106          }
107          // Account creation date before the cut off means we fall through
108      } else {
109          CFIndex errorCode = CFErrorGetCode(error);
110          if (errorCode != errSecMissingRequiredExtension) {
111              secerror("Unexpected error checking account creation date: %ld", errorCode);
112              meets_legacy_policy = false;
113              goto lb_exit;
114          }
115          // there was no account creation date so fall through
116      }
117  
118      // Next check secure time stamp
119      if (context->secureTimestamp) {
120          CFRef<CFDateRef> secureTimestampCutoffDate = copyCutOffDate(kLegacyPolicySecureTimestampCutOff,
121                                                                      kLegacyPolicySecureTimestampDefaultCutOff);
122          secinfo("meetsDeveloperIDLegacyAllowedPolicy", "Secure Timestamp Cutoff Date cutoff: %@", secureTimestampCutoffDate.get());
123          secinfo("meetsDevleoperIDLegacyAllowedPolicy", "Secure Timestamp: %@", context->secureTimestamp);
124          CFComparisonResult res = CFDateCompare(context->secureTimestamp, secureTimestampCutoffDate, NULL);
125          if (res >= 0) {
126              // Secure timestamp is on or after the cut of so it doesn't meet legacy policy
127              meets_legacy_policy = false;
128              secinfo("meetsDeveloperIDLegacyAllowedPolicy", "Secure timestamp %@ is after cut-off %@", context->secureTimestamp, secureTimestampCutoffDate.get());
129          } else {
130              // Secure timestamp is before the cut off so we meet the legacy policy
131              meets_legacy_policy = true;
132          }
133      }
134  
135      if (!meets_legacy_policy) {
136          // Just check against the legacy lists, both by hash and team ID.
137          if (context->directory) {
138              cd.take(context->directory->cdhash());
139              hashType = (SecCSDigestAlgorithm)context->directory->hashType;
140          } else if (context->packageChecksum) {
141              cd = context->packageChecksum;
142              hashType = context->packageAlgorithm;
143          }
144  
145          if (cd.get() == NULL) {
146              // No cdhash means we can't check the legacy lists
147              meets_legacy_policy = false;
148              goto lb_exit;
149          }
150  
151          if (context->teamIdentifier) {
152              teamID.take(CFStringCreateWithCString(kCFAllocatorDefault, context->teamIdentifier, kCFStringEncodingUTF8));
153          }
154  
155          secnotice("legacy_list", "checking the legacy list for %d, %@, %@", hashType, cd.get(), teamID.get());
156      #if TARGET_OS_OSX
157          if (SecAssessmentLegacyCheck(cd, hashType, teamID, &error.aref())) {
158              meets_legacy_policy = true;
159          } else {
160              meets_legacy_policy = false;
161              if (error.get() != NULL) {
162                  secerror("Error checking with notarization daemon: %ld", CFErrorGetCode(error));
163              }
164          }
165      #endif
166      }
167  lb_exit:
168      secnotice("legacy_list", "meetsDeveloperIDLegacyAllowedPolicy = %d", meets_legacy_policy);
169      return meets_legacy_policy;
170  }
171  
172  }
173  }