1  /*
   2   * Copyright (c) 2002-2016 Apple Inc. All Rights Reserved.
   3   *
   4   * @APPLE_LICENSE_HEADER_START@
   5   *
   6   * This file contains Original Code and/or Modifications of Original Code
   7   * as defined in and that are subject to the Apple Public Source License
   8   * Version 2.0 (the 'License'). You may not use this file except in
   9   * compliance with the License. Please obtain a copy of the License at
  10   * http://www.opensource.apple.com/apsl/ and read it before using this
  11   * file.
  12   *
  13   * The Original Code and all software distributed under the License are
  14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18   * Please see the License for the specific language governing rights and
  19   * limitations under the License.
  20   *
  21   * @APPLE_LICENSE_HEADER_END@
  22   */
  23  
  24  #include <Security/SecCertificate.h>
  25  #include <Security/SecCertificatePriv.h>
  26  #include <security_keychain/Certificate.h>
  27  #include <security_keychain/Item.h>
  28  #include <security_keychain/KCCursor.h>
  29  #include <Security/cssmapi.h>
  30  #include <Security/cssmapple.h>
  31  #include <security_cdsa_client/cspclient.h>
  32  #include <security_cdsa_client/clclient.h>
  33  #include <security_cdsa_client/tpclient.h>
  34  #include <Security/cssmtype.h>
  35  
  36  #include "SecBridge.h"
  37  
  38  // %%% used by SecCertificate{Copy,Set}Preference
  39  #include <Security/SecKeychainItemPriv.h>
  40  #include <Security/SecIdentityPriv.h>
  41  #include <Security/SecItemPriv.h>
  42  #include <security_keychain/KCCursor.h>
  43  #include <security_cdsa_utilities/Schema.h>
  44  #include <security_cdsa_utils/cuCdsaUtils.h>
  45  #include <sys/param.h>
  46  #include <syslog.h>
  47  #include "CertificateValues.h"
  48  #include "LegacyAPICounts.h"
  49  
  50  OSStatus SecCertificateGetCLHandle_legacy(SecCertificateRef certificate, CSSM_CL_HANDLE *clHandle);
  51  extern CSSM_KEYUSE ConvertArrayToKeyUsage(CFArrayRef usage);
  52  
  53  
  54  
  55  
  56  using namespace CssmClient;
  57  
  58  CFTypeID static SecCertificateGetTypeID_osx(void)
  59  {
  60  	BEGIN_SECAPI
  61  
  62  	return gTypes().Certificate.typeID;
  63  
  64  	END_SECAPI1(_kCFRuntimeNotATypeID)
  65  }
  66  
  67  Boolean
  68  SecCertificateIsItemImplInstance(SecCertificateRef certificate)
  69  {
  70      if (certificate == NULL) {
  71          return false;
  72      }
  73  
  74      CFTypeID typeID = CFGetTypeID(certificate);
  75  
  76  	if (typeID == _kCFRuntimeNotATypeID) {
  77  		return false;
  78  	}
  79  
  80      return (typeID == SecCertificateGetTypeID_osx() ||
  81              typeID == SecKeychainItemGetTypeID()) ? true : false;
  82  }
  83  
  84  /* convert a new-world SecCertificateRef to an old-world ItemImpl instance */
  85  SecCertificateRef
  86  SecCertificateCreateItemImplInstance(SecCertificateRef certificate)
  87  {
  88  	if (!certificate) {
  89  		return NULL;
  90  	}
  91  	SecCertificateRef implCertRef = (SecCertificateRef) SecCertificateCopyKeychainItem(certificate);
  92  	if (implCertRef) {
  93  		return implCertRef;
  94  	}
  95  	CFDataRef data = SecCertificateCopyData(certificate);
  96  	if (!data) {
  97  		return NULL;
  98  	}
  99  	try {
 100  		CSSM_DATA cssmCertData;
 101  		cssmCertData.Length = (data) ? (CSSM_SIZE)CFDataGetLength(data) : 0;
 102  		cssmCertData.Data = (data) ? (uint8 *)CFDataGetBytePtr(data) : NULL;
 103  
 104  		SecPointer<Certificate> certificatePtr(new Certificate(cssmCertData, CSSM_CERT_X_509v3, CSSM_CERT_ENCODING_DER));
 105  		implCertRef = certificatePtr->handle();
 106  	}
 107  	catch (...) {}
 108  	CFRelease(data);
 109  	return implCertRef;
 110  }
 111  
 112  /* convert an old-world ItemImpl instance to a new-world SecCertificateRef */
 113  SecCertificateRef
 114  SecCertificateCreateFromItemImplInstance(SecCertificateRef certificate)
 115  {
 116  	if (!certificate) {
 117  		return NULL;
 118  	}
 119  	SecCertificateRef result = NULL;
 120  	CFDataRef data = NULL;
 121  	try {
 122  		CssmData certData = Certificate::required(certificate)->data();
 123  		if (certData.Data && certData.Length) {
 124  			data = CFDataCreate(NULL, certData.Data, certData.Length);
 125  		}
 126  		if (!data) {
 127  			if (certData.Data && !certData.Length) {
 128  				/* zero-length certs can exist, so don't bother logging this */
 129  			}
 130  			else {
 131  				syslog(LOG_ERR, "WARNING: SecKeychainSearchCopyNext failed to retrieve certificate data (length=%ld, data=0x%lX)",
 132  						(long)certData.Length, (uintptr_t)certData.Data);
 133  			}
 134  			return NULL;
 135  		}
 136  	}
 137  	catch (...) {}
 138  
 139  	result = SecCertificateCreateWithKeychainItem(NULL, data, certificate);
 140  	if (data)
 141  		CFRelease(data);
 142  	return result;
 143  }
 144  
 145  
 146  /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
 147  OSStatus
 148  SecCertificateCreateFromData(const CSSM_DATA *data, CSSM_CERT_TYPE type, CSSM_CERT_ENCODING encoding, SecCertificateRef *certificate)
 149  {
 150  	/* bridge to support old functionality */
 151  	if (!data || !data->Data || !data->Length || !certificate) {
 152  		return errSecParam;
 153  	}
 154  	SecCertificateRef certRef = NULL;
 155  
 156      // <rdar://problem/24403998> REG: Adobe {Photoshop, InDesign} CC(2015) crashes on launch
 157      // If you take the length that SecKeychainItemCopyContent gives you (a Uint32) and assign it incorrectly
 158      // to a CSSM_DATA Length field (a CSSM_SIZE, i.e., a size_t), the upper 32 bits aren't set. If those bits
 159      // are non-zero, the length is incredibly wrong.
 160      //
 161      // Assume that there will not exist a certificate > 4GiB, and fake this length field.
 162      CSSM_SIZE length = data->Length & 0xfffffffful;
 163  
 164  	CFDataRef dataRef = CFDataCreate(NULL, data->Data, length);
 165  	if (dataRef) {
 166  		certRef = SecCertificateCreateWithData(NULL, dataRef);
 167  		CFRelease(dataRef);
 168  	}
 169  	*certificate = certRef;
 170  	return (certRef) ? errSecSuccess : errSecUnknownFormat;
 171  }
 172  
 173  /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_3, __IPHONE_NA) */
 174  OSStatus
 175  SecCertificateAddToKeychain(SecCertificateRef certificate, SecKeychainRef keychain)
 176  {
 177  	// This macro creates an ItemImpl certificate if it does not exist
 178  	BEGIN_SECCERTAPI
 179  
 180  	Item item(Certificate::required(__itemImplRef));
 181  	Keychain::optional(keychain)->add(item);
 182  
 183  	END_SECCERTAPI
 184  }
 185  
 186  /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
 187  OSStatus
 188  SecCertificateGetData(SecCertificateRef certificate, CSSM_DATA_PTR data)
 189  {
 190  	BEGIN_SECCERTAPI
 191  
 192  	if (!certificate || !data) {
 193  		__secapiresult=errSecParam;
 194  	}
 195  	else if (SecCertificateIsItemImplInstance(certificate)) {
 196  		Required(data) = Certificate::required(certificate)->data();
 197  	}
 198  	else {
 199  		data->Length = (CSSM_SIZE)SecCertificateGetLength(certificate);
 200  		data->Data = (uint8*)SecCertificateGetBytePtr(certificate);
 201  	}
 202  
 203  	END_SECCERTAPI
 204  }
 205  
 206  /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
 207  OSStatus
 208  SecCertificateGetType(SecCertificateRef certificate, CSSM_CERT_TYPE *certificateType)
 209  {
 210      // This macro creates an ItemImpl certificate if it does not exist
 211      BEGIN_SECCERTAPI
 212  
 213      Required(certificateType) = Certificate::required(__itemImplRef)->type();
 214  
 215      END_SECCERTAPI
 216  }
 217  
 218  /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
 219  OSStatus
 220  SecCertificateGetSubject(SecCertificateRef certificate, const CSSM_X509_NAME **subject)
 221  {
 222      // This macro creates an ItemImpl certificate if it does not exist
 223      BEGIN_SECCERTAPI
 224  
 225      Required(subject) = Certificate::required(__itemImplRef)->subjectName();
 226  
 227      END_SECCERTAPI
 228  }
 229  
 230  /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
 231  OSStatus
 232  SecCertificateGetIssuer(SecCertificateRef certificate, const CSSM_X509_NAME **issuer)
 233  {
 234      // This macro creates an ItemImpl certificate if it does not exist
 235      BEGIN_SECCERTAPI
 236  
 237      Required(issuer) = Certificate::required(__itemImplRef)->issuerName();
 238  
 239      END_SECCERTAPI
 240  }
 241  
 242  /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
 243  OSStatus
 244  SecCertificateGetCLHandle(SecCertificateRef certificate, CSSM_CL_HANDLE *clHandle)
 245  {
 246      // This macro creates an ItemImpl certificate if it does not exist
 247      BEGIN_SECCERTAPI
 248  
 249      Required(clHandle) = Certificate::required(__itemImplRef)->clHandle();
 250  
 251      END_SECCERTAPI
 252  }
 253  
 254  /* private function; assumes input is old-style ItemImpl certificate reference,
 255     and does not release that certificate reference!
 256   */
 257  OSStatus
 258  SecCertificateGetCLHandle_legacy(SecCertificateRef certificate, CSSM_CL_HANDLE *clHandle)
 259  {
 260      BEGIN_SECAPI
 261  
 262      Required(clHandle) = Certificate::required(certificate)->clHandle();
 263  
 264      END_SECAPI
 265  }
 266  
 267  /*
 268   * Private API to infer a display name for a SecCertificateRef which
 269   * may or may not be in a keychain.
 270   *
 271   * OS X only
 272   */
 273  OSStatus
 274  SecCertificateInferLabel(SecCertificateRef certificate, CFStringRef *label)
 275  {
 276      // This macro creates an ItemImpl certificate if it does not exist
 277      BEGIN_SECCERTAPI
 278  
 279      Certificate::required(__itemImplRef)->inferLabel(false, &Required(label));
 280  
 281      END_SECCERTAPI
 282  }
 283  
 284  /* OS X only (note: iOS version has different arguments and return value) */
 285  OSStatus
 286  SecCertificateCopyPublicKey(SecCertificateRef certificate, SecKeyRef *key)
 287  {
 288      // This macro creates an ItemImpl certificate if it does not exist
 289      BEGIN_SECCERTAPI
 290  
 291      Required(key) = Certificate::required(__itemImplRef)->publicKey()->handle();
 292  
 293      END_SECCERTAPI
 294  }
 295  
 296  /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
 297  OSStatus
 298  SecCertificateGetAlgorithmID(SecCertificateRef certificate, const CSSM_X509_ALGORITHM_IDENTIFIER **algid)
 299  {
 300      // This macro creates an ItemImpl certificate if it does not exist
 301      BEGIN_SECCERTAPI
 302  
 303      Required(algid) = Certificate::required(__itemImplRef)->algorithmID();
 304  
 305      END_SECCERTAPI
 306  }
 307  
 308  /* OS X only */
 309  OSStatus
 310  SecCertificateCopySubjectComponent(SecCertificateRef certificate, const CSSM_OID *component, CFStringRef *result)
 311  {
 312      // This macro creates an ItemImpl certificate if it does not exist
 313      BEGIN_SECCERTAPI
 314  
 315      Required(result) = Certificate::required(__itemImplRef)->distinguishedName(&CSSMOID_X509V1SubjectNameCStruct, component);
 316  
 317      END_SECCERTAPI
 318  }
 319  
 320  /* OS X only; deprecated SPI */
 321  OSStatus
 322  SecCertificateGetCommonName(SecCertificateRef certificate, CFStringRef *commonName)
 323  {
 324      // deprecated SPI signature; replaced by SecCertificateCopyCommonName
 325      return SecCertificateCopyCommonName(certificate, commonName);
 326  }
 327  
 328  /* OS X only; deprecated SPI */
 329  OSStatus
 330  SecCertificateGetEmailAddress(SecCertificateRef certificate, CFStringRef *emailAddress)
 331  {
 332      // This macro creates an ItemImpl certificate if it does not exist
 333      BEGIN_SECCERTAPI
 334  
 335      Required(emailAddress) = Certificate::required(__itemImplRef)->copyFirstEmailAddress();
 336  
 337      END_SECCERTAPI
 338  }
 339  
 340  /* Return a zero terminated list of CSSM_DATA_PTR's with the values of the field specified by field.
 341   * Caller must call releaseFieldValues to free the storage allocated by this call.
 342   *
 343   * OS X only
 344   */
 345  OSStatus
 346  SecCertificateCopyFieldValues(SecCertificateRef certificate, const CSSM_OID *field, CSSM_DATA_PTR **fieldValues)
 347  {
 348      // This macro creates an ItemImpl certificate if it does not exist
 349      BEGIN_SECCERTAPI
 350  
 351      Required(fieldValues) = Certificate::required(__itemImplRef)->copyFieldValues(Required(field));
 352  
 353      END_SECCERTAPI
 354  }
 355  
 356  /* OS X only */
 357  OSStatus
 358  SecCertificateReleaseFieldValues(SecCertificateRef certificate, const CSSM_OID *field, CSSM_DATA_PTR *fieldValues)
 359  {
 360      // This macro creates an ItemImpl certificate if it does not exist
 361      BEGIN_SECCERTAPI
 362  
 363      Certificate::required(__itemImplRef)->releaseFieldValues(Required(field), fieldValues);
 364  
 365      END_SECCERTAPI
 366  }
 367  
 368  /* OS X only */
 369  OSStatus
 370  SecCertificateCopyFirstFieldValue(SecCertificateRef certificate, const CSSM_OID *field, CSSM_DATA_PTR *fieldValue)
 371  {
 372      // This macro creates an ItemImpl certificate if it does not exist
 373      BEGIN_SECCERTAPI
 374  
 375      Required(fieldValue) = Certificate::required(__itemImplRef)->copyFirstFieldValue(Required(field));
 376  
 377      END_SECCERTAPI
 378  }
 379  
 380  /* OS X only */
 381  OSStatus
 382  SecCertificateReleaseFirstFieldValue(SecCertificateRef certificate, const CSSM_OID *field, CSSM_DATA_PTR fieldValue)
 383  {
 384      // This macro creates an ItemImpl certificate if it does not exist
 385      BEGIN_SECCERTAPI
 386  
 387      Certificate::required(__itemImplRef)->releaseFieldValue(Required(field), fieldValue);
 388  
 389      END_SECCERTAPI
 390  }
 391  
 392  /* OS X only */
 393  OSStatus
 394  SecCertificateFindByIssuerAndSN(CFTypeRef keychainOrArray,const CSSM_DATA *issuer,
 395  	const CSSM_DATA *serialNumber, SecCertificateRef *certificate)
 396  {
 397      if (issuer && serialNumber) {
 398          CFRef<CFMutableDictionaryRef> query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 399          CFDictionarySetValue(query, kSecClass, kSecClassCertificate);
 400          CFDictionarySetValue(query, kSecReturnRef, kCFBooleanTrue);
 401          CFDictionarySetValue(query, kSecUseDataProtectionKeychain, kCFBooleanTrue);
 402  
 403          CFRef<CFDataRef> issuerData = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, (const UInt8 *)issuer->Data, issuer->Length, kCFAllocatorNull);
 404          CFDictionarySetValue(query, kSecAttrIssuer, issuerData);
 405  
 406          CFRef<CFDataRef> serialNumberData = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, (const UInt8 *)serialNumber->Data, serialNumber->Length, kCFAllocatorNull);
 407          CFDictionarySetValue(query, kSecAttrSerialNumber, serialNumberData);
 408  
 409          OSStatus status = SecItemCopyMatching(query, (CFTypeRef*)certificate);
 410          if (status == errSecSuccess) {
 411              return status;
 412          }
 413      }
 414  
 415  	BEGIN_SECAPI
 416  
 417  	StorageManager::KeychainList keychains;
 418  	globals().storageManager.optionalSearchList(keychainOrArray, keychains);
 419  	Required(certificate) = Certificate::findByIssuerAndSN(keychains, CssmData::required(issuer), CssmData::required(serialNumber))->handle();
 420  
 421      // convert ItemImpl-based SecCertificateRef to new-world version before returning
 422  	CssmData certData = Certificate::required(*certificate)->data();
 423  	CFRef<CFDataRef> cfData(CFDataCreate(NULL, certData.Data, certData.Length));
 424  	SecCertificateRef tmpRef = *certificate;
 425  	*certificate = SecCertificateCreateWithData(NULL, cfData);
 426  	CFRelease(tmpRef);
 427  
 428  	END_SECAPI
 429  }
 430  
 431  /* OS X only */
 432  OSStatus
 433  SecCertificateFindBySubjectKeyID(CFTypeRef keychainOrArray, const CSSM_DATA *subjectKeyID,
 434  	SecCertificateRef *certificate)
 435  {
 436      if (subjectKeyID) {
 437          CFRef<CFMutableDictionaryRef> query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 438          CFDictionarySetValue(query, kSecClass, kSecClassCertificate);
 439          CFDictionarySetValue(query, kSecReturnRef, kCFBooleanTrue);
 440          CFDictionarySetValue(query, kSecUseDataProtectionKeychain, kCFBooleanTrue);
 441  
 442          CFRef<CFDataRef> subjectKeyIDData = CFDataCreateWithBytesNoCopy(kCFAllocatorDefault, (const UInt8 *)subjectKeyID->Data, subjectKeyID->Length, kCFAllocatorNull);
 443          CFDictionarySetValue(query, kSecAttrSubjectKeyID, subjectKeyIDData);
 444  
 445          OSStatus status = SecItemCopyMatching(query, (CFTypeRef*)certificate);
 446          if (status == errSecSuccess) {
 447              return status;
 448          }
 449      }
 450  
 451      BEGIN_SECAPI
 452  
 453  	StorageManager::KeychainList keychains;
 454  	globals().storageManager.optionalSearchList(keychainOrArray, keychains);
 455  	Required(certificate) = Certificate::findBySubjectKeyID(keychains, CssmData::required(subjectKeyID))->handle();
 456  
 457      // convert ItemImpl-based SecCertificateRef to new-world version before returning
 458  	CssmData certData = Certificate::required(*certificate)->data();
 459  	CFRef<CFDataRef> cfData(CFDataCreate(NULL, certData.Data, certData.Length));
 460  	SecCertificateRef tmpRef = *certificate;
 461  	*certificate = SecCertificateCreateWithData(NULL, cfData);
 462  	CFRelease(tmpRef);
 463  
 464  	END_SECAPI
 465  }
 466  
 467  /* OS X only */
 468  OSStatus
 469  SecCertificateFindByEmail(CFTypeRef keychainOrArray, const char *emailAddress, SecCertificateRef *certificate)
 470  {
 471      if (emailAddress) {
 472          CFRef<CFMutableDictionaryRef> query = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 473          CFDictionarySetValue(query, kSecClass, kSecClassCertificate);
 474          CFDictionarySetValue(query, kSecReturnRef, kCFBooleanTrue);
 475          CFDictionarySetValue(query, kSecUseDataProtectionKeychain, kCFBooleanTrue);
 476  
 477          CFRef<CFStringRef> emailAddressString = CFStringCreateWithCString(kCFAllocatorDefault, emailAddress, kCFStringEncodingUTF8);
 478          CFTypeRef keys[] = { kSecPolicyName };
 479          CFTypeRef values[] = { emailAddressString };
 480          CFRef<CFDictionaryRef> properties = CFDictionaryCreate(kCFAllocatorDefault, keys, values, 1, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 481          CFRef<SecPolicyRef> policy = SecPolicyCreateWithProperties(kSecPolicyAppleSMIME, properties);
 482          CFDictionarySetValue(query, kSecMatchPolicy, policy);
 483  
 484          OSStatus status = SecItemCopyMatching(query, (CFTypeRef*)certificate);
 485          if (status == errSecSuccess) {
 486              return status;
 487          }
 488      }
 489  
 490      BEGIN_SECAPI
 491  
 492  	StorageManager::KeychainList keychains;
 493  	globals().storageManager.optionalSearchList(keychainOrArray, keychains);
 494  	Required(certificate) = Certificate::findByEmail(keychains, emailAddress)->handle();
 495  
 496      // convert ItemImpl-based SecCertificateRef to new-world version before returning
 497  	CssmData certData = Certificate::required(*certificate)->data();
 498  	CFRef<CFDataRef> cfData(CFDataCreate(NULL, certData.Data, certData.Length));
 499  	SecCertificateRef tmpRef = *certificate;
 500  	*certificate = SecCertificateCreateWithData(NULL, cfData);
 501  	CFRelease(tmpRef);
 502  
 503  	END_SECAPI
 504  }
 505  
 506  /* OS X only */
 507  OSStatus
 508  SecKeychainSearchCreateForCertificateByIssuerAndSN(CFTypeRef keychainOrArray, const CSSM_DATA *issuer,
 509  	const CSSM_DATA *serialNumber, SecKeychainSearchRef *searchRef)
 510  {
 511      BEGIN_SECAPI
 512  
 513  	Required(searchRef);
 514  
 515  	StorageManager::KeychainList keychains;
 516  	globals().storageManager.optionalSearchList(keychainOrArray, keychains);
 517  	KCCursor cursor(Certificate::cursorForIssuerAndSN(keychains, CssmData::required(issuer), CssmData::required(serialNumber)));
 518  	*searchRef = cursor->handle();
 519  
 520  	END_SECAPI
 521  }
 522  
 523  /* OS X only */
 524  OSStatus
 525  SecKeychainSearchCreateForCertificateByIssuerAndSN_CF(CFTypeRef keychainOrArray, CFDataRef issuer,
 526  	CFDataRef serialNumber, SecKeychainSearchRef *searchRef)
 527  {
 528      BEGIN_SECAPI
 529  
 530  	Required(searchRef);
 531  
 532  	StorageManager::KeychainList keychains;
 533  	globals().storageManager.optionalSearchList(keychainOrArray, keychains);
 534  	Required(issuer);
 535  	Required(serialNumber);
 536  	KCCursor cursor(Certificate::cursorForIssuerAndSN_CF(keychains, issuer, serialNumber));
 537  	*searchRef = cursor->handle();
 538  
 539  	END_SECAPI
 540  }
 541  
 542  /* OS X only */
 543  OSStatus
 544  SecKeychainSearchCreateForCertificateBySubjectKeyID(CFTypeRef keychainOrArray, const CSSM_DATA *subjectKeyID,
 545  	SecKeychainSearchRef *searchRef)
 546  {
 547      BEGIN_SECAPI
 548  
 549  	Required(searchRef);
 550  
 551  	StorageManager::KeychainList keychains;
 552  	globals().storageManager.optionalSearchList(keychainOrArray, keychains);
 553  	KCCursor cursor(Certificate::cursorForSubjectKeyID(keychains, CssmData::required(subjectKeyID)));
 554  	*searchRef = cursor->handle();
 555  
 556  	END_SECAPI
 557  }
 558  
 559  /* OS X only */
 560  OSStatus
 561  SecKeychainSearchCreateForCertificateByEmail(CFTypeRef keychainOrArray, const char *emailAddress,
 562  	SecKeychainSearchRef *searchRef)
 563  {
 564      BEGIN_SECAPI
 565  
 566  	Required(searchRef);
 567  
 568  	StorageManager::KeychainList keychains;
 569  	globals().storageManager.optionalSearchList(keychainOrArray, keychains);
 570  	KCCursor cursor(Certificate::cursorForEmail(keychains, emailAddress));
 571  	*searchRef = cursor->handle();
 572  
 573  	END_SECAPI
 574  }
 575  
 576  /* OS X only */
 577  CSSM_RETURN
 578  SecDigestGetData (CSSM_ALGORITHMS alg, CSSM_DATA* digest, const CSSM_DATA* data)
 579  {
 580  	BEGIN_SECAPI
 581  	// sanity checking
 582  	if (!digest || !digest->Data || !digest->Length || !data || !data->Data || !data->Length)
 583  		return errSecParam;
 584  
 585  	CSP csp(gGuidAppleCSP);
 586  	Digest context(csp, alg);
 587  	CssmData input(data->Data, data->Length);
 588  	CssmData output(digest->Data, digest->Length);
 589  
 590  	context.digest(input, output);
 591  	digest->Length = output.length();
 592  
 593  	return CSSM_OK;
 594  	END_SECAPI1(1);
 595  }
 596  
 597  /* OS X only: DEPRECATED_IN_MAC_OS_X_VERSION_10_7_AND_LATER */
 598  OSStatus
 599  SecCertificateCopyPreference(
 600      CFStringRef name,
 601      CSSM_KEYUSE keyUsage,
 602      SecCertificateRef *certificate)
 603  {
 604      BEGIN_SECAPI
 605  
 606  	Required(name);
 607  	Required(certificate);
 608  	StorageManager::KeychainList keychains;
 609  	globals().storageManager.getSearchList(keychains);
 610  	KCCursor cursor(keychains, kSecGenericPasswordItemClass, NULL);
 611  
 612  	char idUTF8[MAXPATHLEN];
 613      if (!CFStringGetCString(name, idUTF8, sizeof(idUTF8)-1, kCFStringEncodingUTF8))
 614          idUTF8[0] = (char)'\0';
 615      CssmData service(const_cast<char *>(idUTF8), strlen(idUTF8));
 616      FourCharCode itemType = 'cprf';
 617      cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecServiceItemAttr), service);
 618  	cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecTypeItemAttr), itemType);
 619      if (keyUsage) {
 620          cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecScriptCodeItemAttr), (sint32)keyUsage);
 621      }
 622  
 623      Item prefItem;
 624      if (!cursor->next(prefItem)) {
 625          MacOSError::throwMe(errSecItemNotFound);
 626      }
 627  
 628  	// get persistent certificate reference
 629  	SecKeychainAttribute itemAttrs[] = { { kSecGenericItemAttr, 0, NULL } };
 630  	SecKeychainAttributeList itemAttrList = { sizeof(itemAttrs) / sizeof(itemAttrs[0]), itemAttrs };
 631  	prefItem->getContent(NULL, &itemAttrList, NULL, NULL);
 632  
 633  	// find certificate, given persistent reference data
 634  	CFDataRef pItemRef = CFDataCreateWithBytesNoCopy(NULL, (const UInt8 *)itemAttrs[0].data, itemAttrs[0].length, kCFAllocatorNull);
 635  	SecKeychainItemRef certItemRef = nil;
 636  	OSStatus status = SecKeychainItemCopyFromPersistentReference(pItemRef, &certItemRef); //%%% need to make this a method of ItemImpl
 637  	prefItem->freeContent(&itemAttrList, NULL);
 638  	if (pItemRef)
 639  		CFRelease(pItemRef);
 640  	if (status)
 641  		return status;
 642  
 643  	*certificate = (SecCertificateRef)certItemRef;
 644  
 645  	if (certItemRef && (CFGetTypeID(certItemRef) == SecIdentityGetTypeID())) {
 646  		// SecKeychainItemCopyFromPersistentReference handed out an identity reference
 647  		*certificate = NULL;
 648  		status = SecIdentityCopyCertificate((SecIdentityRef)certItemRef, certificate);
 649  		CFRelease(certItemRef);
 650  		return status;
 651  	}
 652  
 653      END_SECAPI
 654  }
 655  
 656  /* OS X only */
 657  SecCertificateRef
 658  SecCertificateCopyPreferred(
 659  	CFStringRef name,
 660  	CFArrayRef keyUsage)
 661  {
 662  	// This function will look for a matching preference in the following order:
 663  	// - matches the name and the supplied key use
 664  	// - matches the name and the special 'ANY' key use
 665  	// - matches the name with no key usage constraint
 666  
 667  	SecCertificateRef certRef = NULL;
 668  	CSSM_KEYUSE keyUse = ConvertArrayToKeyUsage(keyUsage);
 669  	OSStatus status = SecCertificateCopyPreference(name, keyUse, &certRef);
 670  	if (status != errSecSuccess && keyUse != CSSM_KEYUSE_ANY)
 671  		status = SecCertificateCopyPreference(name, CSSM_KEYUSE_ANY, &certRef);
 672  	if (status != errSecSuccess && keyUse != 0)
 673  		status = SecCertificateCopyPreference(name, 0, &certRef);
 674  
 675  	return certRef;
 676  }
 677  
 678  /* OS X only; not exported */
 679  static OSStatus
 680  SecCertificateFindPreferenceItemWithNameAndKeyUsage(
 681  	CFTypeRef keychainOrArray,
 682  	CFStringRef name,
 683  	int32_t keyUsage,
 684  	SecKeychainItemRef *itemRef)
 685  {
 686      BEGIN_SECAPI
 687  
 688  	StorageManager::KeychainList keychains;
 689  	globals().storageManager.optionalSearchList(keychainOrArray, keychains);
 690  	KCCursor cursor(keychains, kSecGenericPasswordItemClass, NULL);
 691  
 692  	char idUTF8[MAXPATHLEN];
 693      idUTF8[0] = (char)'\0';
 694  	if (name)
 695  	{
 696  		if (!CFStringGetCString(name, idUTF8, sizeof(idUTF8)-1, kCFStringEncodingUTF8))
 697  			idUTF8[0] = (char)'\0';
 698  	}
 699      size_t idUTF8Len = strlen(idUTF8);
 700      if (!idUTF8Len)
 701          MacOSError::throwMe(errSecParam);
 702  
 703      CssmData service(const_cast<char *>(idUTF8), idUTF8Len);
 704      cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecServiceItemAttr), service);
 705  	cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecTypeItemAttr), (FourCharCode)'cprf');
 706      if (keyUsage) {
 707          cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecScriptCodeItemAttr), (sint32)keyUsage);
 708      }
 709  
 710  	Item item;
 711  	if (!cursor->next(item))
 712  		MacOSError::throwMe(errSecItemNotFound);
 713  
 714  	if (itemRef)
 715  		*itemRef=item->handle();
 716  
 717      END_SECAPI
 718  }
 719  
 720  /* OS X only; not exported */
 721  static
 722  OSStatus SecCertificateDeletePreferenceItemWithNameAndKeyUsage(
 723  	CFTypeRef keychainOrArray,
 724  	CFStringRef name,
 725  	int32_t keyUsage)
 726  {
 727  	// when a specific key usage is passed, we'll only match & delete that pref;
 728  	// when a key usage of 0 is passed, all matching prefs should be deleted.
 729  	// maxUsages represents the most matches there could theoretically be, so
 730  	// cut things off at that point if we're still finding items (if they can't
 731  	// be deleted for some reason, we'd never break out of the loop.)
 732  
 733  	OSStatus status = errSecSuccess;
 734  	SecKeychainItemRef item = NULL;
 735  	int count = 0, maxUsages = 12;
 736  	while (++count <= maxUsages &&
 737  			(status = SecCertificateFindPreferenceItemWithNameAndKeyUsage(keychainOrArray, name, keyUsage, &item)) == errSecSuccess) {
 738  		status = SecKeychainItemDelete(item);
 739  		CFRelease(item);
 740  		item = NULL;
 741  	}
 742  
 743  	// it's not an error if the item isn't found
 744  	return (status == errSecItemNotFound) ? errSecSuccess : status;
 745  }
 746  
 747  /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_5, __IPHONE_NA) */
 748  OSStatus SecCertificateSetPreference(
 749      SecCertificateRef certificate,
 750      CFStringRef name,
 751      CSSM_KEYUSE keyUsage,
 752      CFDateRef date)
 753  {
 754  	if (!name) {
 755  		return errSecParam;
 756  	}
 757  	if (!certificate) {
 758  		// treat NULL certificate as a request to clear the preference
 759  		// (note: if keyUsage is 0, this clears all key usage prefs for name)
 760  		return SecCertificateDeletePreferenceItemWithNameAndKeyUsage(NULL, name, keyUsage);
 761  	}
 762  
 763      // This macro creates an ItemImpl certificate if it does not exist
 764      BEGIN_SECCERTAPI
 765  
 766  	// determine the account attribute
 767  	//
 768  	// This attribute must be synthesized from certificate label + pref item type + key usage,
 769  	// as only the account and service attributes can make a generic keychain item unique.
 770  	// For 'iprf' type items (but not 'cprf'), we append a trailing space. This insures that
 771  	// we can save a certificate preference if an identity preference already exists for the
 772  	// given service name, and vice-versa.
 773  	// If the key usage is 0 (i.e. the normal case), we omit the appended key usage string.
 774  	//
 775      CFStringRef labelStr = nil;
 776  	Certificate::required(__itemImplRef)->inferLabel(false, &labelStr);
 777  	if (!labelStr) {
 778          MacOSError::throwMe(errSecDataTooLarge); // data is "in a format which cannot be displayed"
 779  	}
 780  	CFIndex accountUTF8Len = CFStringGetMaximumSizeForEncoding(CFStringGetLength(labelStr), kCFStringEncodingUTF8) + 1;
 781  	const char *templateStr = "%s [key usage 0x%X]";
 782  	const int keyUsageMaxStrLen = 8;
 783  	accountUTF8Len += strlen(templateStr) + keyUsageMaxStrLen;
 784  	char *accountUTF8 = (char *)malloc(accountUTF8Len);
 785  	if (!accountUTF8) {
 786  		MacOSError::throwMe(errSecMemoryError);
 787  	}
 788      if (!CFStringGetCString(labelStr, accountUTF8, accountUTF8Len-1, kCFStringEncodingUTF8))
 789  		accountUTF8[0] = (char)'\0';
 790  	if (keyUsage)
 791  		snprintf(accountUTF8, accountUTF8Len-1, templateStr, accountUTF8, keyUsage);
 792      CssmDataContainer account(const_cast<char *>(accountUTF8), strlen(accountUTF8));
 793      free(accountUTF8);
 794      CFRelease(labelStr);
 795  
 796  	// service attribute (name provided by the caller)
 797  	CFIndex serviceUTF8Len = CFStringGetMaximumSizeForEncoding(CFStringGetLength(name), kCFStringEncodingUTF8) + 1;;
 798  	char *serviceUTF8 = (char *)malloc(serviceUTF8Len);
 799  	if (!serviceUTF8) {
 800  		MacOSError::throwMe(errSecMemoryError);
 801  	}
 802      if (!CFStringGetCString(name, serviceUTF8, serviceUTF8Len-1, kCFStringEncodingUTF8))
 803          serviceUTF8[0] = (char)'\0';
 804      CssmDataContainer service(const_cast<char *>(serviceUTF8), strlen(serviceUTF8));
 805      free(serviceUTF8);
 806  
 807      // look for existing preference item, in case this is an update
 808  	StorageManager::KeychainList keychains;
 809  	globals().storageManager.getSearchList(keychains);
 810  	KCCursor cursor(keychains, kSecGenericPasswordItemClass, NULL);
 811      FourCharCode itemType = 'cprf';
 812      cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecServiceItemAttr), service);
 813  	cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecTypeItemAttr), itemType);
 814      if (keyUsage) {
 815          cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecScriptCodeItemAttr), (sint32)keyUsage);
 816      }
 817  
 818      Item item(kSecGenericPasswordItemClass, 'aapl', 0, NULL, false);
 819      bool add = (!cursor->next(item));
 820  	// at this point, we either have a new item to add or an existing item to update
 821  
 822      // set item attribute values
 823      item->setAttribute(Schema::attributeInfo(kSecServiceItemAttr), service);
 824      item->setAttribute(Schema::attributeInfo(kSecTypeItemAttr), itemType);
 825      item->setAttribute(Schema::attributeInfo(kSecAccountItemAttr), account);
 826      item->setAttribute(Schema::attributeInfo(kSecScriptCodeItemAttr), (sint32)keyUsage);
 827      item->setAttribute(Schema::attributeInfo(kSecLabelItemAttr), service);
 828  
 829  	// generic attribute (store persistent certificate reference)
 830  	CFDataRef pItemRef = nil;
 831  	Certificate::required(__itemImplRef)->copyPersistentReference(pItemRef);
 832  	if (!pItemRef) {
 833  		MacOSError::throwMe(errSecInvalidItemRef);
 834      }
 835  	const UInt8 *dataPtr = CFDataGetBytePtr(pItemRef);
 836  	CFIndex dataLen = CFDataGetLength(pItemRef);
 837  	CssmData pref(const_cast<void *>(reinterpret_cast<const void *>(dataPtr)), dataLen);
 838  	item->setAttribute(Schema::attributeInfo(kSecGenericItemAttr), pref);
 839  	CFRelease(pItemRef);
 840  
 841      if (add) {
 842          Keychain keychain = nil;
 843          try {
 844              keychain = globals().storageManager.defaultKeychain();
 845              if (!keychain->exists())
 846                  MacOSError::throwMe(errSecNoSuchKeychain);	// Might be deleted or not available at this time.
 847          }
 848          catch(...) {
 849              keychain = globals().storageManager.defaultKeychainUI(item);
 850          }
 851  
 852  		try {
 853  			keychain->add(item);
 854  		}
 855  		catch (const MacOSError &err) {
 856  			if (err.osStatus() != errSecDuplicateItem)
 857  				throw; // if item already exists, fall through to update
 858  		}
 859      }
 860  	item->update();
 861  
 862      END_SECCERTAPI
 863  }
 864  
 865  /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA) */
 866  OSStatus SecCertificateSetPreferred(
 867  	SecCertificateRef certificate,
 868  	CFStringRef name,
 869  	CFArrayRef keyUsage)
 870  {
 871  	COUNTLEGACYAPI
 872  	CSSM_KEYUSE keyUse = ConvertArrayToKeyUsage(keyUsage);
 873  	return SecCertificateSetPreference(certificate, name, keyUse, NULL);
 874  }
 875  
 876  /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA) */
 877  CFDictionaryRef SecCertificateCopyValues(SecCertificateRef certificate, CFArrayRef keys, CFErrorRef *error)
 878  {
 879  	CFDictionaryRef result = NULL;
 880  	OSStatus __secapiresult;
 881  	SecCertificateRef tmpcert = NULL;
 882  
 883  	// convert input to a new-style certificate reference if necessary,
 884  	// since the implementation of CertificateValues calls SecCertificate API functions
 885  	// which now assume a unified certificate reference.
 886  	if (SecCertificateIsItemImplInstance(certificate)) {
 887  		tmpcert = SecCertificateCreateFromItemImplInstance(certificate);
 888  	}
 889  	if (certificate && !tmpcert) {
 890  		tmpcert = (SecCertificateRef) CFRetain(certificate);
 891  	}
 892  	try
 893  	{
 894  		CertificateValues cv(tmpcert);
 895  		result = cv.copyFieldValues(keys,error);
 896  		__secapiresult=0;
 897  	}
 898  	catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
 899  	catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
 900  	catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
 901  	catch (...) { __secapiresult=errSecInternalComponent; }
 902  	if (tmpcert) { CFRelease(tmpcert); }
 903  	return result;
 904  }
 905  
 906  /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA) */
 907  CFStringRef SecCertificateCopyLongDescription(CFAllocatorRef alloc, SecCertificateRef certificate, CFErrorRef *error)
 908  {
 909  	return SecCertificateCopyShortDescription(alloc, certificate, error);
 910  }
 911  
 912  /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA) */
 913  CFStringRef SecCertificateCopyShortDescription(CFAllocatorRef alloc, SecCertificateRef certificate, CFErrorRef *error)
 914  {
 915  	CFStringRef result = NULL;
 916  	OSStatus __secapiresult = SecCertificateInferLabel(certificate, &result);
 917  	if (error!=NULL && __secapiresult!=errSecSuccess)
 918  	{
 919  		*error = CFErrorCreate(kCFAllocatorDefault, kCFErrorDomainOSStatus,
 920  			__secapiresult ? __secapiresult : CSSM_ERRCODE_INTERNAL_ERROR, NULL);
 921  	}
 922  	return result;
 923  }
 924  
 925  /* OS X only: __OSX_AVAILABLE_STARTING(__MAC_10_7, __IPHONE_NA) */
 926  CFDataRef SecCertificateCopySerialNumber(SecCertificateRef certificate, CFErrorRef *error)
 927  {
 928  	CFDataRef result = NULL;
 929  	OSStatus __secapiresult;
 930  	try
 931  	{
 932  		CertificateValues cv(certificate);
 933  		result = cv.copySerialNumber(error);
 934  		__secapiresult=0;
 935  	}
 936  	catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
 937  	catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
 938  	catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
 939  	catch (...) { __secapiresult=errSecInternalComponent; }
 940  	return result;
 941  }
 942  
 943  /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_7, __MAC_10_12_4, __IPHONE_NA, __IPHONE_NA) */
 944  CFDataRef SecCertificateCopyNormalizedIssuerContent(SecCertificateRef certificate, CFErrorRef *error)
 945  {
 946  	CFDataRef result = NULL;
 947  	OSStatus __secapiresult;
 948  	try
 949  	{
 950  		CertificateValues cv(certificate);
 951  		result = cv.copyNormalizedIssuerContent(error);
 952  		__secapiresult=0;
 953  	}
 954  	catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
 955  	catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
 956  	catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
 957  	catch (...) { __secapiresult=errSecInternalComponent; }
 958  	return result;
 959  }
 960  
 961  /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_7, __MAC_10_12_4, __IPHONE_NA, __IPHONE_NA) */
 962  CFDataRef SecCertificateCopyNormalizedSubjectContent(SecCertificateRef certificate, CFErrorRef *error)
 963  {
 964  	CFDataRef result = NULL;
 965  	OSStatus __secapiresult;
 966  	try
 967  	{
 968  		CertificateValues cv(certificate);
 969  		result = cv.copyNormalizedSubjectContent(error);
 970  		__secapiresult=0;
 971  	}
 972  	catch (const MacOSError &err) { __secapiresult=err.osStatus(); }
 973  	catch (const CommonError &err) { __secapiresult=SecKeychainErrFromOSStatus(err.osStatus()); }
 974  	catch (const std::bad_alloc &) { __secapiresult=errSecAllocate; }
 975  	catch (...) { __secapiresult=errSecInternalComponent; }
 976  	return result;
 977  }
 978  
 979  /* OS X only: __OSX_AVAILABLE_BUT_DEPRECATED(__MAC_10_7, __MAC_10_9, __IPHONE_NA, __IPHONE_NA) */
 980  bool SecCertificateIsValidX(SecCertificateRef certificate, CFAbsoluteTime verifyTime)
 981  {
 982      /*
 983       * deprecated function name
 984       */
 985  	return SecCertificateIsValid(certificate, verifyTime);
 986  }
 987  
 988  /* OS X only */
 989  CFDataRef SecCertificateCopyPublicKeySHA1DigestFromCertificateData(CFAllocatorRef allocator,
 990                                                                     CFDataRef der_certificate)
 991  {
 992      CFDataRef result = NULL;
 993      SecCertificateRef iosCertRef = SecCertificateCreateWithData(allocator, der_certificate);
 994      if (NULL == iosCertRef)
 995      {
 996          return result;
 997      }
 998  
 999      result = SecCertificateCopyPublicKeySHA1Digest(iosCertRef);
1000      CFRelease(iosCertRef);
1001      return result;
1002  }
1003