1  /*
   2   * Copyright (c) 2000-2004,2011-2014 Apple Inc. All Rights Reserved.
   3   * 
   4   * @APPLE_LICENSE_HEADER_START@
   5   * 
   6   * This file contains Original Code and/or Modifications of Original Code
   7   * as defined in and that are subject to the Apple Public Source License
   8   * Version 2.0 (the 'License'). You may not use this file except in
   9   * compliance with the License. Please obtain a copy of the License at
  10   * http://www.opensource.apple.com/apsl/ and read it before using this
  11   * file.
  12   * 
  13   * The Original Code and all software distributed under the License are
  14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18   * Please see the License for the specific language governing rights and
  19   * limitations under the License.
  20   * 
  21   * @APPLE_LICENSE_HEADER_END@
  22   */
  23  
  24  #include <Security/SecKeychain.h>
  25  #include <Security/SecKeychainPriv.h>
  26  #include <security_keychain/KCCursor.h>
  27  #include <security_cdsa_utilities/cssmdata.h>
  28  #include <security_cdsa_client/wrapkey.h>
  29  #include <security_keychain/KCExceptions.h>
  30  #include <securityd_client/ssblob.h>
  31  #include <Security/SecAccess.h>
  32  #include <Security/SecTrustedApplicationPriv.h>
  33  #include "SecBridge.h"
  34  #include "CCallbackMgr.h"
  35  #include <security_cdsa_utilities/Schema.h>
  36  #include <security_cdsa_client/mdsclient.h>
  37  #include <pwd.h>
  38  #include <os/activity.h>
  39  #include <Security/AuthorizationTagsPriv.h>
  40  #include <Security/Authorization.h>
  41  #include "TokenLogin.h"
  42  #include "LegacyAPICounts.h"
  43  
  44  extern "C" {
  45  #include "ctkloginhelper.h"
  46  }
  47  
  48  OSStatus
  49  SecKeychainMDSInstall()
  50  {
  51      BEGIN_SECAPI
  52  
  53  	   os_activity_t activity = os_activity_create("SecKeychainMDSInstall", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
  54      os_activity_scope(activity);
  55      os_release(activity);
  56  
  57  	Security::MDSClient::Directory d;
  58  	d.install();
  59  
  60  	END_SECAPI
  61  }
  62  
  63  CFTypeID
  64  SecKeychainGetTypeID(void)
  65  {
  66  	BEGIN_SECAPI
  67  
  68  	return gTypes().KeychainImpl.typeID;
  69  
  70  	END_SECAPI1(_kCFRuntimeNotATypeID)
  71  }
  72  
  73  
  74  OSStatus
  75  SecKeychainGetVersion(UInt32 *returnVers)
  76  {
  77      COUNTLEGACYAPI
  78      if (!returnVers)
  79  		return errSecSuccess;
  80  
  81  	*returnVers = 0x02028000;
  82  	return errSecSuccess;
  83  }
  84  
  85  
  86  OSStatus
  87  SecKeychainOpen(const char *pathName, SecKeychainRef *keychainRef)
  88  {
  89      BEGIN_SECAPI
  90  
  91  	   os_activity_t activity = os_activity_create("SecKeychainOpen", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
  92      os_activity_scope(activity);
  93      os_release(activity);
  94  
  95  	RequiredParam(keychainRef)=globals().storageManager.make(pathName, false)->handle();
  96  
  97  	END_SECAPI
  98  }
  99  
 100  OSStatus
 101  SecKeychainCreate(const char *pathName, UInt32 passwordLength, const void *password,
 102  	Boolean promptUser, SecAccessRef initialAccess, SecKeychainRef *keychainRef)
 103  {
 104      BEGIN_SECAPI
 105  
 106  	   os_activity_t activity = os_activity_create("SecKeychainCreate", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 107      os_activity_scope(activity);
 108      os_release(activity);
 109      
 110      KCThrowParamErrIf_(!pathName);
 111  	Keychain keychain = globals().storageManager.make(pathName, true, true);
 112  
 113  	// @@@ the call to StorageManager::make above leaves keychain the the cache.
 114  	// If the create below fails we should probably remove it.
 115  	if(promptUser)
 116  		keychain->create();
 117  	else
 118  	{
 119  		KCThrowParamErrIf_(!password);
 120  		keychain->create(passwordLength, password);
 121  	}
 122  
 123  	RequiredParam(keychainRef)=keychain->handle();
 124  
 125  	END_SECAPI
 126  }
 127  
 128  
 129  OSStatus
 130  SecKeychainDelete(SecKeychainRef keychainOrArray)
 131  {
 132      BEGIN_SECAPI
 133  
 134  	   os_activity_t activity = os_activity_create("SecKeychainDelete", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 135      os_activity_scope(activity);
 136      os_release(activity);
 137  
 138  	KCThrowIf_(!keychainOrArray, errSecInvalidKeychain);
 139  	StorageManager::KeychainList keychains;
 140  	globals().storageManager.optionalSearchList(keychainOrArray, keychains);
 141  
 142  	globals().storageManager.remove(keychains, true);
 143  
 144  	END_SECAPI
 145  }
 146  
 147  
 148  OSStatus
 149  SecKeychainSetSettings(SecKeychainRef keychainRef, const SecKeychainSettings *newSettings)
 150  {
 151      BEGIN_SECAPI
 152  
 153  	   os_activity_t activity = os_activity_create("SecKeychainSetSettings", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 154      os_activity_scope(activity);
 155      os_release(activity);
 156  
 157  	Keychain keychain = Keychain::optional(keychainRef);
 158  	if (newSettings->version==SEC_KEYCHAIN_SETTINGS_VERS1)
 159  	{
 160  		UInt32 lockInterval=newSettings->lockInterval;
 161  		bool lockOnSleep=newSettings->lockOnSleep;
 162  		keychain->setSettings(lockInterval, lockOnSleep);
 163  	}
 164  
 165  	END_SECAPI
 166  }
 167  
 168  
 169  OSStatus
 170  SecKeychainCopySettings(SecKeychainRef keychainRef, SecKeychainSettings *outSettings)
 171  {
 172      BEGIN_SECAPI
 173  
 174  	   os_activity_t activity = os_activity_create("SecKeychainCopySettings", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 175      os_activity_scope(activity);
 176      os_release(activity);
 177  
 178  	Keychain keychain = Keychain::optional(keychainRef);
 179  	if (outSettings->version==SEC_KEYCHAIN_SETTINGS_VERS1)
 180  	{
 181  		uint32 lockInterval;
 182  		bool lockOnSleep;
 183  		
 184  		keychain->getSettings(lockInterval, lockOnSleep);
 185  		outSettings->lockInterval=lockInterval;
 186  		outSettings->lockOnSleep=lockOnSleep;
 187  	}
 188  
 189  	END_SECAPI
 190  }
 191  
 192  
 193  OSStatus
 194  SecKeychainUnlock(SecKeychainRef keychainRef, UInt32 passwordLength, const void *password, Boolean usePassword)
 195  {
 196  	BEGIN_SECAPI
 197  
 198  	   os_activity_t activity = os_activity_create("SecKeychainUnlock", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 199      os_activity_scope(activity);
 200      os_release(activity);
 201  
 202  	Keychain keychain = Keychain::optional(keychainRef);
 203  
 204  	if (usePassword)
 205  		keychain->unlock(CssmData(const_cast<void *>(password), passwordLength));
 206  	else
 207  		keychain->unlock();
 208  
 209  	END_SECAPI
 210  }
 211  
 212  
 213  OSStatus
 214  SecKeychainLock(SecKeychainRef	keychainRef)
 215  {
 216  	BEGIN_SECAPI
 217  
 218  	   os_activity_t activity = os_activity_create("SecKeychainLock", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 219      os_activity_scope(activity);
 220      os_release(activity);
 221  
 222  	Keychain keychain = Keychain::optional(keychainRef);
 223  	keychain->lock();
 224  
 225  	END_SECAPI
 226  }
 227  
 228  
 229  OSStatus
 230  SecKeychainLockAll(void)
 231  {
 232  	BEGIN_SECAPI
 233  
 234  	   os_activity_t activity = os_activity_create("SecKeychainLockAll", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 235      os_activity_scope(activity);
 236      os_release(activity);
 237  
 238  	globals().storageManager.lockAll();
 239  
 240  	END_SECAPI
 241  }
 242  
 243  
 244  OSStatus SecKeychainResetLogin(UInt32 passwordLength, const void* password, Boolean resetSearchList)
 245  {
 246  	BEGIN_SECAPI
 247  
 248  	   os_activity_t activity = os_activity_create("SecKeychainResetLogin", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 249      os_activity_scope(activity);
 250      os_release(activity);
 251          //
 252          // Get the current user (using fallback method if necessary)
 253          //
 254          char* uName = getenv("USER");
 255          string userName = uName ? uName : "";
 256          if ( userName.length() == 0 )
 257          {
 258              uid_t uid = geteuid();
 259              if (!uid) uid = getuid();
 260              struct passwd *pw = getpwuid(uid);	// fallback case...
 261              if (pw)
 262                  userName = pw->pw_name;
 263              endpwent();
 264          }
 265          if ( userName.length() == 0 )	// did we ultimately get one?
 266          {
 267              MacOSError::throwMe(errAuthorizationInternal);
 268          }
 269  
 270          SecurityServer::ClientSession().resetKeyStorePassphrase(password ? CssmData(const_cast<void *>(password), passwordLength) : CssmData());
 271          secwarning("SecKeychainResetLogin: reset AKS passphrase");
 272  		if (password)
 273  		{
 274  			// Clear the plist and move aside (rename) the existing login.keychain
 275  			globals().storageManager.resetKeychain(resetSearchList);
 276  
 277  			// Create the login keychain without UI
 278  			globals().storageManager.login((UInt32)userName.length(), userName.c_str(), passwordLength, password, true);
 279  			
 280  			// Set it as the default
 281  			Keychain keychain = globals().storageManager.loginKeychain();
 282  			globals().storageManager.defaultKeychain(keychain);
 283  		}
 284  		else
 285  		{
 286  			// Create the login keychain, prompting for password
 287  			// (implicitly calls resetKeychain, login, and defaultKeychain)
 288  			globals().storageManager.makeLoginAuthUI(NULL, true);
 289  		}
 290          secwarning("SecKeychainResetLogin: reset osx keychain");
 291  
 292  		// Post a "list changed" event after a reset, so apps can refresh their list.
 293  		// Make sure we are not holding mLock when we post this event.
 294  		KCEventNotifier::PostKeychainEvent(kSecKeychainListChangedEvent);
 295  
 296  
 297  	END_SECAPI
 298  }
 299  
 300  OSStatus
 301  SecKeychainCopyDefault(SecKeychainRef *keychainRef)
 302  {
 303  	BEGIN_SECAPI
 304  
 305  	RequiredParam(keychainRef)=globals().storageManager.defaultKeychain()->handle();
 306  
 307  	END_SECAPI
 308  }
 309  
 310  
 311  OSStatus
 312  SecKeychainSetDefault(SecKeychainRef keychainRef)
 313  {
 314  	BEGIN_SECAPI
 315  
 316  	   os_activity_t activity = os_activity_create("SecKeychainSetDefault", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 317      os_activity_scope(activity);
 318      os_release(activity);
 319  
 320  	globals().storageManager.defaultKeychain(Keychain::optional(keychainRef));
 321  
 322  	END_SECAPI
 323  }
 324  
 325  OSStatus SecKeychainCopySearchList(CFArrayRef *searchList)
 326  {
 327  	BEGIN_SECAPI
 328  
 329  	   os_activity_t activity = os_activity_create("SecKeychainCopySearchList", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 330      os_activity_scope(activity);
 331      os_release(activity);
 332  
 333  	RequiredParam(searchList);
 334  	StorageManager &smr = globals().storageManager;
 335  	StorageManager::KeychainList keychainList;
 336  	smr.getSearchList(keychainList);
 337  	*searchList = smr.convertFromKeychainList(keychainList);
 338  
 339  	END_SECAPI
 340  }
 341  
 342  OSStatus SecKeychainSetSearchList(CFArrayRef searchList)
 343  {
 344  	BEGIN_SECAPI
 345  
 346  	   os_activity_t activity = os_activity_create("SecKeychainSetSearchList", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 347      os_activity_scope(activity);
 348      os_release(activity);
 349  
 350  	RequiredParam(searchList);
 351  	StorageManager &smr = globals().storageManager;
 352  	StorageManager::KeychainList keychainList;
 353  	smr.convertToKeychainList(searchList, keychainList);
 354  	smr.setSearchList(keychainList);
 355  
 356  	END_SECAPI
 357  }
 358  
 359  OSStatus SecKeychainCopyDomainDefault(SecPreferencesDomain domain, SecKeychainRef *keychainRef)
 360  {
 361  	BEGIN_SECAPI
 362  
 363  	   os_activity_t activity = os_activity_create("SecKeychainCopyDomainDefault", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 364      os_activity_scope(activity);
 365      os_release(activity);
 366  
 367  	RequiredParam(keychainRef)=globals().storageManager.defaultKeychain(domain)->handle();
 368  
 369  	END_SECAPI
 370  }
 371  
 372  OSStatus SecKeychainSetDomainDefault(SecPreferencesDomain domain, SecKeychainRef keychainRef)
 373  {
 374  	BEGIN_SECAPI
 375  
 376  	   os_activity_t activity = os_activity_create("SecKeychainSetDomainDefault", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 377      os_activity_scope(activity);
 378      os_release(activity);
 379  
 380  	globals().storageManager.defaultKeychain(domain, Keychain::optional(keychainRef));
 381  
 382  	END_SECAPI
 383  }
 384  
 385  OSStatus SecKeychainCopyDomainSearchList(SecPreferencesDomain domain, CFArrayRef *searchList)
 386  {
 387  	BEGIN_SECAPI
 388  
 389  	RequiredParam(searchList);
 390  	StorageManager &smr = globals().storageManager;
 391  	StorageManager::KeychainList keychainList;
 392  	smr.getSearchList(domain, keychainList);
 393  	*searchList = smr.convertFromKeychainList(keychainList);
 394  
 395  	END_SECAPI
 396  }
 397  
 398  OSStatus SecKeychainSetDomainSearchList(SecPreferencesDomain domain, CFArrayRef searchList)
 399  {
 400  	BEGIN_SECAPI
 401  
 402  	   os_activity_t activity = os_activity_create("SecKeychainSetDomainSearchList", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 403      os_activity_scope(activity);
 404      os_release(activity);
 405  
 406  	RequiredParam(searchList);
 407  	StorageManager &smr = globals().storageManager;
 408  	StorageManager::KeychainList keychainList;
 409  	smr.convertToKeychainList(searchList, keychainList);
 410  	smr.setSearchList(domain, keychainList);
 411  
 412  	END_SECAPI
 413  }
 414  
 415  OSStatus SecKeychainSetPreferenceDomain(SecPreferencesDomain domain)
 416  {
 417  	BEGIN_SECAPI
 418  
 419  	   os_activity_t activity = os_activity_create("SecKeychainSetPreferenceDomain", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 420      os_activity_scope(activity);
 421      os_release(activity);
 422  
 423  	globals().storageManager.domain(domain);
 424  
 425  	END_SECAPI
 426  }
 427  
 428  OSStatus SecKeychainGetPreferenceDomain(SecPreferencesDomain *domain)
 429  {
 430  	BEGIN_SECAPI
 431  
 432  	   os_activity_t activity = os_activity_create("SecKeychainGetPreferenceDomain", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 433      os_activity_scope(activity);
 434      os_release(activity);
 435  	
 436  	*domain = globals().storageManager.domain();
 437  	
 438  	END_SECAPI
 439  }
 440  
 441  
 442  OSStatus
 443  SecKeychainGetStatus(SecKeychainRef keychainRef, SecKeychainStatus *keychainStatus)
 444  {
 445      BEGIN_SECAPI
 446  
 447  	RequiredParam(keychainStatus) = (SecKeychainStatus)Keychain::optional(keychainRef)->status();
 448  
 449  	END_SECAPI
 450  }
 451  
 452  
 453  OSStatus
 454  SecKeychainGetPath(SecKeychainRef keychainRef, UInt32 *ioPathLength, char *pathName)
 455  {
 456      BEGIN_SECAPI
 457  
 458  	RequiredParam(pathName);
 459  	RequiredParam(ioPathLength);
 460  
 461      const char *name = Keychain::optional(keychainRef)->name();
 462  	UInt32 nameLen = (UInt32)strlen(name);
 463  	UInt32 callersLen = *ioPathLength;
 464  	*ioPathLength = nameLen;
 465  	if (nameLen+1 > callersLen)  // if the client's buffer is too small (including null-termination), throw
 466  		return errSecBufferTooSmall;
 467  	strncpy(pathName, name, nameLen);
 468      pathName[nameLen] = 0;
 469  	*ioPathLength = nameLen;   // set the length.
 470      		
 471  	END_SECAPI
 472  }
 473  
 474  OSStatus
 475  SecKeychainGetKeychainVersion(SecKeychainRef keychainRef, UInt32* version)
 476  {
 477      BEGIN_SECAPI
 478  
 479  	   RequiredParam(version);
 480  
 481      *version = Keychain::optional(keychainRef)->database()->dbBlobVersion();
 482  
 483      END_SECAPI
 484  }
 485  
 486  OSStatus
 487  SecKeychainAttemptMigrationWithMasterKey(SecKeychainRef keychain, UInt32 version, const char* masterKeyFilename)
 488  {
 489      BEGIN_SECAPI
 490  
 491  	   os_activity_t activity = os_activity_create("SecKeychainAttemptMigrationWithMasterKey", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 492      os_activity_scope(activity);
 493      os_release(activity);
 494  
 495      RequiredParam(masterKeyFilename);
 496      Keychain kc = Keychain::optional(keychain);
 497  
 498      SecurityServer::SystemKeychainKey keychainKey(masterKeyFilename);
 499      if(keychainKey.valid()) {
 500          // We've managed to read the key; now, create credentials using it
 501          string path = kc->name();
 502  
 503          CssmClient::Key keychainMasterKey(kc->csp(), keychainKey.key(), true);
 504          CssmClient::AclFactory::MasterKeyUnlockCredentials creds(keychainMasterKey, Allocator::standard(Allocator::sensitive));
 505  
 506          // Attempt the migrate, using our master key as the ACL override
 507          bool result = kc->keychainMigration(path, kc->database()->dbBlobVersion(), path, version, creds.getAccessCredentials());
 508          if(!result) {
 509              return errSecBadReq;
 510          }
 511          return (kc->database()->dbBlobVersion() == version ? errSecSuccess : errSecBadReq);
 512      } else {
 513          return errSecBadReq;
 514      }
 515  
 516      END_SECAPI
 517  }
 518  
 519  
 520  // @@@ Deprecated
 521  UInt16
 522  SecKeychainListGetCount(void)
 523  {
 524      BEGIN_SECAPI
 525  
 526  	return globals().storageManager.size();
 527  
 528  	END_SECAPI1(0)
 529  }
 530  
 531  
 532  // @@@ Deprecated
 533  OSStatus
 534  SecKeychainListCopyKeychainAtIndex(UInt16 index, SecKeychainRef *keychainRef)
 535  {
 536      BEGIN_SECAPI
 537  
 538  	KeychainCore::StorageManager &smgr=KeychainCore::globals().storageManager;
 539  	RequiredParam(keychainRef)=smgr[index]->handle();
 540  
 541  	END_SECAPI
 542  }
 543  
 544  
 545  // @@@ Deprecated
 546  OSStatus
 547  SecKeychainListRemoveKeychain(SecKeychainRef *keychainRef)
 548  {
 549      BEGIN_SECAPI
 550  
 551  	Required(keychainRef);
 552  	Keychain keychain = Keychain::optional(*keychainRef);
 553  	StorageManager::KeychainList keychainList;
 554  	keychainList.push_back(keychain);
 555  	globals().storageManager.remove(keychainList);
 556  	*keychainRef = NULL;
 557  
 558  	END_SECAPI
 559  }
 560  
 561  
 562  OSStatus
 563  SecKeychainAttributeInfoForItemID(SecKeychainRef keychainRef, UInt32 itemID, SecKeychainAttributeInfo **info)
 564  {
 565  	BEGIN_SECAPI
 566  
 567  	Keychain keychain = Keychain::optional(keychainRef);
 568  	keychain->getAttributeInfoForItemID(itemID, info);
 569  
 570  	END_SECAPI
 571  }
 572  
 573  
 574  OSStatus
 575  SecKeychainFreeAttributeInfo(SecKeychainAttributeInfo *info)
 576  {
 577  	BEGIN_SECAPI
 578  
 579  	KeychainImpl::freeAttributeInfo(info);
 580  
 581  	END_SECAPI
 582  }
 583  
 584  
 585  pascal OSStatus
 586  SecKeychainAddCallback(SecKeychainCallback callbackFunction, SecKeychainEventMask eventMask, void* userContext)
 587  {
 588      BEGIN_SECAPI
 589  
 590  	   os_activity_t activity = os_activity_create("SecKeychainAddCallback", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 591      os_activity_scope(activity);
 592      os_release(activity);
 593  
 594  	RequiredParam(callbackFunction);
 595  	CCallbackMgr::AddCallback(callbackFunction,eventMask,userContext);
 596  
 597  	END_SECAPI
 598  }	
 599  
 600  
 601  OSStatus
 602  SecKeychainRemoveCallback(SecKeychainCallback callbackFunction)
 603  {
 604      BEGIN_SECAPI
 605  
 606  	   os_activity_t activity = os_activity_create("SecKeychainRemoveCallback", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 607      os_activity_scope(activity);
 608      os_release(activity);
 609  
 610  	RequiredParam(callbackFunction);
 611  	CCallbackMgr::RemoveCallback(callbackFunction);
 612  
 613  	END_SECAPI
 614  }	
 615  
 616  OSStatus
 617  SecKeychainAddInternetPassword(SecKeychainRef keychainRef, UInt32 serverNameLength, const char *serverName, UInt32 securityDomainLength, const char *securityDomain, UInt32 accountNameLength, const char *accountName, UInt32 pathLength, const char *path, UInt16 port, SecProtocolType protocol, SecAuthenticationType authenticationType, UInt32 passwordLength, const void *passwordData, SecKeychainItemRef *itemRef)
 618  {
 619      BEGIN_SECAPI
 620  
 621  	   os_activity_t activity = os_activity_create("SecKeychainAddInternetPassword", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 622      os_activity_scope(activity);
 623      os_release(activity);
 624  
 625  	KCThrowParamErrIf_(passwordLength!=0 && passwordData==NULL);
 626  	// @@@ Get real itemClass
 627  	Item item(kSecInternetPasswordItemClass, 'aapl', passwordLength, passwordData, false);
 628  	
 629  	if (serverName && serverNameLength)
 630  	{
 631  		CssmData server(const_cast<void *>(reinterpret_cast<const void *>(serverName)), serverNameLength);
 632  		item->setAttribute(Schema::attributeInfo(kSecServerItemAttr), server);
 633  		// use server name as default label
 634  		item->setAttribute(Schema::attributeInfo(kSecLabelItemAttr), server);
 635  	}
 636  		
 637  	if (accountName && accountNameLength)
 638  	{
 639  		CssmData account(const_cast<void *>(reinterpret_cast<const void *>(accountName)), accountNameLength);
 640  		item->setAttribute(Schema::attributeInfo(kSecAccountItemAttr), account);
 641  	}
 642  
 643  	if (securityDomain && securityDomainLength)
 644  		item->setAttribute(Schema::attributeInfo(kSecSecurityDomainItemAttr),
 645  			CssmData(const_cast<void *>(reinterpret_cast<const void *>(securityDomain)), securityDomainLength));
 646  		
 647  	item->setAttribute(Schema::attributeInfo(kSecPortItemAttr), UInt32(port));
 648  	item->setAttribute(Schema::attributeInfo(kSecProtocolItemAttr), protocol);
 649  	item->setAttribute(Schema::attributeInfo(kSecAuthenticationTypeItemAttr), authenticationType);
 650  		
 651  	if (path && pathLength)
 652  		item->setAttribute(Schema::attributeInfo(kSecPathItemAttr),
 653  			CssmData(const_cast<void *>(reinterpret_cast<const void *>(path)), pathLength));
 654  
 655  	Keychain keychain = nil;
 656  	try
 657      {
 658          keychain = Keychain::optional(keychainRef);
 659          if ( !keychain->exists() )
 660          {
 661              MacOSError::throwMe(errSecNoSuchKeychain);	// Might be deleted or not available at this time.
 662          }
 663      }
 664      catch(...)
 665      {
 666          keychain = globals().storageManager.defaultKeychainUI(item);
 667      }
 668  
 669      keychain->add(item);
 670  
 671      if (itemRef)
 672  		*itemRef = item->handle();
 673  
 674      END_SECAPI
 675  }
 676  
 677  
 678  OSStatus
 679  SecKeychainFindInternetPassword(CFTypeRef keychainOrArray, UInt32 serverNameLength, const char *serverName, UInt32 securityDomainLength, const char *securityDomain, UInt32 accountNameLength, const char *accountName, UInt32 pathLength, const char *path, UInt16 port, SecProtocolType protocol, SecAuthenticationType authenticationType, UInt32 *passwordLength, void **passwordData, SecKeychainItemRef *itemRef)
 680  												
 681  {
 682      BEGIN_SECAPI
 683  
 684  	   os_activity_t activity = os_activity_create("SecKeychainFindInternetPassword", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 685      os_activity_scope(activity);
 686      os_release(activity);
 687  
 688  	StorageManager::KeychainList keychains;
 689  	globals().storageManager.optionalSearchList(keychainOrArray, keychains);
 690  	KCCursor cursor(keychains, kSecInternetPasswordItemClass, NULL);
 691  
 692  	if (serverName && serverNameLength)
 693  	{
 694  		cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecServerItemAttr),
 695  			CssmData(const_cast<char *>(serverName), serverNameLength));
 696  	}
 697  
 698  	if (securityDomain && securityDomainLength)
 699  	{
 700  		cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecSecurityDomainItemAttr),
 701  			CssmData (const_cast<char*>(securityDomain), securityDomainLength));
 702  	}
 703  
 704  	if (accountName && accountNameLength)
 705  	{
 706  		cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecAccountItemAttr),
 707  			CssmData (const_cast<char*>(accountName), accountNameLength));
 708  	}
 709  
 710  	if (port)
 711  	{
 712  		cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecPortItemAttr),
 713  			UInt32(port));
 714  	}
 715  
 716  	if (protocol)
 717  	{
 718  		cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecProtocolItemAttr),
 719  			protocol);
 720  	}
 721  
 722  	if (authenticationType)
 723  	{
 724  		cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecAuthenticationTypeItemAttr),
 725  			authenticationType);
 726  	}
 727  
 728  	if (path  && pathLength)
 729  	{
 730  		cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecPathItemAttr), path);
 731  	}
 732  
 733  	Item item;
 734  	if (!cursor->next(item))
 735  		return errSecItemNotFound;
 736  
 737  	// Get its data (only if necessary)
 738  	if (passwordData || passwordLength)
 739  	{
 740  		CssmDataContainer outData;
 741  		item->getData(outData);
 742  		if (passwordLength) {
 743  			*passwordLength=(UInt32)outData.length();
 744  		}
 745  		outData.Length=0;
 746  		if (passwordData) {
 747  			*passwordData=outData.data();
 748  		}
 749  		outData.Data=NULL;
 750  	}
 751  
 752  	if (itemRef)
 753  		*itemRef=item->handle();
 754  
 755      END_SECAPI
 756  }
 757  
 758  
 759  OSStatus
 760  SecKeychainAddGenericPassword(SecKeychainRef keychainRef, UInt32 serviceNameLength, const char *serviceName, UInt32 accountNameLength, const char *accountName, UInt32 passwordLength, const void *passwordData, SecKeychainItemRef *itemRef)
 761  {
 762  	BEGIN_SECAPI
 763  
 764  	   os_activity_t activity = os_activity_create("SecKeychainAddGenericPassword", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 765      os_activity_scope(activity);
 766      os_release(activity);
 767  
 768  	KCThrowParamErrIf_(passwordLength!=0 && passwordData==NULL);
 769  	// @@@ Get real itemClass
 770  
 771  	Item item(kSecGenericPasswordItemClass, 'aapl', passwordLength, passwordData, false);
 772  
 773  	if (serviceName && serviceNameLength)
 774  	{
 775  		CssmData service(const_cast<void *>(reinterpret_cast<const void *>(serviceName)), serviceNameLength);
 776  		item->setAttribute(Schema::attributeInfo(kSecServiceItemAttr), service);
 777          item->setAttribute(Schema::attributeInfo(kSecLabelItemAttr), service);
 778  	}
 779  
 780  	if (accountName && accountNameLength)
 781  	{
 782  		CssmData account(const_cast<void *>(reinterpret_cast<const void *>(accountName)), accountNameLength);
 783  		item->setAttribute(Schema::attributeInfo(kSecAccountItemAttr), account);
 784  	}
 785  
 786  	Keychain keychain = nil;
 787  	try
 788      {
 789          keychain = Keychain::optional(keychainRef);
 790          if ( !keychain->exists() )
 791          {
 792              MacOSError::throwMe(errSecNoSuchKeychain);	// Might be deleted or not available at this time.
 793          }
 794      }
 795      catch(...)
 796      {
 797          keychain = globals().storageManager.defaultKeychainUI(item);
 798      }
 799  
 800  	keychain->add(item);
 801  	if (itemRef)
 802  		*itemRef = item->handle();
 803  
 804      END_SECAPI
 805  }
 806  
 807  
 808  OSStatus
 809  SecKeychainFindGenericPassword(CFTypeRef keychainOrArray, UInt32 serviceNameLength, const char *serviceName, UInt32 accountNameLength, const char *accountName, UInt32 *passwordLength, void **passwordData, SecKeychainItemRef *itemRef)
 810  																			   
 811  {
 812      BEGIN_SECAPI
 813  
 814  	   os_activity_t activity = os_activity_create("SecKeychainFindGenericPassword", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 815      os_activity_scope(activity);
 816      os_release(activity);
 817  
 818  	StorageManager::KeychainList keychains;
 819  	globals().storageManager.optionalSearchList(keychainOrArray, keychains);
 820  	KCCursor cursor(keychains, kSecGenericPasswordItemClass, NULL);
 821  
 822  	if (serviceName && serviceNameLength)
 823  	{
 824  		cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecServiceItemAttr),
 825  			CssmData(const_cast<char *>(serviceName), serviceNameLength));
 826  	}
 827  
 828  	if (accountName && accountNameLength)
 829  	{
 830  		cursor->add(CSSM_DB_EQUAL, Schema::attributeInfo(kSecAccountItemAttr),
 831  			CssmData(const_cast<char *>(accountName), accountNameLength));
 832  	}
 833  
 834  	Item item;
 835  	if (!cursor->next(item))
 836  		return errSecItemNotFound;
 837  
 838  	// Get its data (only if necessary)
 839  	if (passwordData || passwordLength)
 840  	{
 841  		CssmDataContainer outData;
 842  		item->getData(outData);
 843  		if (passwordLength) {
 844  			*passwordLength=(UInt32)outData.length();
 845  		}
 846  		outData.Length=0;
 847  		if (passwordData) {
 848  			*passwordData=outData.data();
 849  		}
 850  		outData.Data=NULL;
 851  	}
 852  
 853  	if (itemRef)
 854  		*itemRef=item->handle();
 855  
 856  	END_SECAPI
 857  }
 858  
 859  
 860  OSStatus
 861  SecKeychainSetUserInteractionAllowed(Boolean state) 
 862  {
 863  	BEGIN_SECAPI
 864  
 865  	globals().setUserInteractionAllowed(state);
 866  
 867      END_SECAPI
 868  }
 869  
 870  
 871  OSStatus
 872  SecKeychainGetUserInteractionAllowed(Boolean *state) 
 873  {
 874  	BEGIN_SECAPI
 875  
 876  	Required(state)=globals().getUserInteractionAllowed();
 877  
 878      END_SECAPI
 879  }
 880  
 881  
 882  OSStatus
 883  SecKeychainGetDLDBHandle(SecKeychainRef keychainRef, CSSM_DL_DB_HANDLE *dldbHandle)
 884  {
 885      BEGIN_SECAPI
 886  
 887  	   os_activity_t activity = os_activity_create("SecKeychainGetDLDBHandle", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 888      os_activity_scope(activity);
 889      os_release(activity);
 890  
 891  	RequiredParam(dldbHandle);
 892  	
 893  	Keychain keychain = Keychain::optional(keychainRef);
 894  	*dldbHandle = keychain->database()->handle();
 895  
 896      END_SECAPI
 897  }
 898  
 899  static ModuleNexus<Mutex> gSecReturnedKeychainCSPsMutex;
 900  static ModuleNexus<std::set<CssmClient::CSP>> gSecReturnedKeychainCSPs;
 901  
 902  OSStatus
 903  SecKeychainGetCSPHandle(SecKeychainRef keychainRef, CSSM_CSP_HANDLE *cspHandle)
 904  {
 905      BEGIN_SECAPI
 906  
 907  	RequiredParam(cspHandle);
 908  
 909  	Keychain keychain = Keychain::optional(keychainRef);
 910  
 911      // Once we vend this handle, we can no longer delete this CSP object via RAII (and thus call CSSM_ModuleDetach on the CSP).
 912      // Keep a global pointer to it to force the CSP to stay live forever.
 913      CssmClient::CSP returnedKeychainCSP = keychain->csp();
 914      {
 915          StLock<Mutex> _(gSecReturnedKeychainCSPsMutex());
 916          gSecReturnedKeychainCSPs().insert(returnedKeychainCSP);
 917      }
 918  	*cspHandle = returnedKeychainCSP->handle();
 919  
 920  	END_SECAPI
 921  }
 922  
 923  
 924  OSStatus
 925  SecKeychainCopyAccess(SecKeychainRef keychainRef, SecAccessRef *accessRef)
 926  {
 927  	BEGIN_SECAPI
 928  
 929  	MacOSError::throwMe(errSecUnimplemented);//%%%for now
 930  
 931  	END_SECAPI
 932  }
 933  
 934  
 935  OSStatus
 936  SecKeychainSetAccess(SecKeychainRef keychainRef, SecAccessRef accessRef)
 937  {
 938  	BEGIN_SECAPI
 939  
 940  	MacOSError::throwMe(errSecUnimplemented);//%%%for now
 941  
 942  	END_SECAPI
 943  }
 944  
 945  
 946  #pragma mark ---- Private API ----
 947  
 948  
 949  OSStatus
 950  SecKeychainChangePassword(SecKeychainRef keychainRef, UInt32 oldPasswordLength, const void *oldPassword,  UInt32 newPasswordLength, const void *newPassword)
 951  {
 952      BEGIN_SECAPI
 953  
 954  	   os_activity_t activity = os_activity_create("SecKeychainChangePassword", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 955      os_activity_scope(activity);
 956      os_release(activity);
 957  
 958  	Keychain keychain = Keychain::optional(keychainRef);
 959          keychain->changePassphrase (oldPasswordLength, oldPassword,  newPasswordLength, newPassword);
 960  
 961      END_SECAPI
 962  }
 963  
 964  
 965  OSStatus
 966  SecKeychainCopyLogin(SecKeychainRef *keychainRef)
 967  {
 968      BEGIN_SECAPI
 969  
 970  	   os_activity_t activity = os_activity_create("SecKeychainCopyLogin", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 971      os_activity_scope(activity);
 972      os_release(activity);
 973  
 974  	RequiredParam(keychainRef)=globals().storageManager.loginKeychain()->handle();
 975  
 976      END_SECAPI
 977  }
 978  
 979  
 980  OSStatus
 981  SecKeychainLogin(UInt32 nameLength, const void* name, UInt32 passwordLength, const void* password)
 982  {
 983      BEGIN_SECAPI
 984  
 985  	   os_activity_t activity = os_activity_create("SecKeychainLogin", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
 986      os_activity_scope(activity);
 987      os_release(activity);
 988  
 989  	try
 990  	{
 991  		if (password) {
 992              globals().storageManager.login(nameLength, name,  passwordLength, password, false);
 993          } else {
 994              globals().storageManager.stashLogin();
 995          }
 996  	}
 997  	catch (CommonError &e)
 998  	{
 999          secnotice("KCLogin", "SecKeychainLogin failed: %d, password was%s supplied", (int)e.osStatus(), password?"":" not");
1000  		if (e.osStatus() == CSSMERR_DL_OPERATION_AUTH_DENIED)
1001  		{
1002  			return errSecAuthFailed;
1003  		}
1004  		else
1005  		{
1006  			return e.osStatus();
1007  		}
1008  	}
1009  
1010      catch (...) {
1011          __secapiresult=errSecInternalComponent;
1012      }
1013      secnotice("KCLogin", "SecKeychainLogin result: %d, password was%s supplied", (int)__secapiresult, password?"":" not");
1014  
1015      END_SECAPI
1016  }
1017  
1018  OSStatus SecKeychainStash()
1019  {
1020      BEGIN_SECAPI
1021  
1022  	   os_activity_t activity = os_activity_create("SecKeychainStash", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1023      os_activity_scope(activity);
1024      os_release(activity);
1025      
1026  	try
1027  	{
1028  		globals().storageManager.stashKeychain();
1029  	}
1030  	catch (CommonError &e)
1031  	{
1032  		if (e.osStatus() == CSSMERR_DL_OPERATION_AUTH_DENIED)
1033  		{
1034  			return errSecAuthFailed;
1035  		}
1036  		else
1037  		{
1038  			return e.osStatus();
1039  		}
1040  	}
1041  	
1042      END_SECAPI
1043  }
1044  
1045  OSStatus
1046  SecKeychainLogout()
1047  {
1048      BEGIN_SECAPI
1049  
1050  	   os_activity_t activity = os_activity_create("SecKeychainLogout", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1051      os_activity_scope(activity);
1052      os_release(activity);
1053  
1054  	globals().storageManager.logout();
1055  
1056      END_SECAPI
1057  }
1058  
1059  /* (non-exported C utility routine) 'Makes' a keychain based on a full path
1060  */
1061  static Keychain make(const char *name)
1062  {
1063  	return globals().storageManager.make(name);
1064  }
1065  
1066  /*  'Makes' a keychain based on a full path for legacy "KC" CoreServices APIs.
1067      Note this version doesn't take an accessRef or password.
1068      The "KC" create API takes a keychainRef...
1069  */
1070  OSStatus SecKeychainMakeFromFullPath(const char *fullPathName, SecKeychainRef *keychainRef)
1071  {
1072      BEGIN_SECAPI
1073  
1074  	RequiredParam(fullPathName);
1075          RequiredParam(keychainRef)=make(fullPathName)->handle();
1076  	END_SECAPI
1077  }
1078  
1079  
1080  /* Determines if the keychainRef is a valid keychain.
1081  */
1082  OSStatus SecKeychainIsValid(SecKeychainRef keychainRef, Boolean* isValid)
1083  {
1084      BEGIN_SECAPI
1085  
1086  	*isValid = false;
1087          if (KeychainImpl::optional(keychainRef)->dlDbIdentifier().ssuid().guid() == gGuidAppleCSPDL)
1088              *isValid = true;
1089  	END_SECAPI
1090  }
1091  
1092  /* Removes a keychain from the keychain search list for legacy "KC" CoreServices APIs.
1093  */
1094  OSStatus SecKeychainRemoveFromSearchList(SecKeychainRef keychainRef)
1095  {
1096      BEGIN_SECAPI
1097  
1098  	   os_activity_t activity = os_activity_create("SecKeychainRemoveFromSearchList", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1099      os_activity_scope(activity);
1100      os_release(activity);
1101          StorageManager::KeychainList singleton;
1102          singleton.push_back(KeychainImpl::required(keychainRef));
1103          globals().storageManager.remove(singleton);
1104  	END_SECAPI
1105  }
1106  
1107  /* Create a keychain based on a keychain Ref for legacy "KC" CoreServices APIs.
1108  */
1109  OSStatus SecKeychainCreateNew(SecKeychainRef keychainRef, UInt32 passwordLength, const char* inPassword)
1110  {
1111      BEGIN_SECAPI
1112  
1113  	   os_activity_t activity = os_activity_create("SecKeychainCreateNew", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1114      os_activity_scope(activity);
1115      os_release(activity);
1116          RequiredParam(inPassword);
1117          KeychainImpl::required(keychainRef)->create(passwordLength, inPassword);
1118  	END_SECAPI
1119  }
1120  
1121  /* Modify a keychain so that it can be synchronized.
1122  */
1123  OSStatus SecKeychainRecodeKeychain(SecKeychainRef keychainRef, CFArrayRef dbBlobArray, CFDataRef extraData)
1124  {
1125  	BEGIN_SECAPI
1126  
1127  	   os_activity_t activity = os_activity_create("SecKeychainRecodeKeychain", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1128      os_activity_scope(activity);
1129      os_release(activity);
1130  
1131  	// do error checking for required parameters
1132  	RequiredParam(dbBlobArray);
1133  	RequiredParam(extraData);
1134  
1135  	const CssmData extraCssmData(const_cast<UInt8 *>(CFDataGetBytePtr(extraData)),
1136  		CFDataGetLength(extraData));
1137  
1138  	CFIndex dbBlobArrayCount = CFArrayGetCount(dbBlobArray);
1139  	size_t space = sizeof(uint8) + (dbBlobArrayCount * sizeof(SecurityServer::DbHandle));
1140  	void *dataPtr = (void*)malloc(space);
1141  	if ( !dataPtr )
1142  		return errSecAllocate;
1143  	//
1144  	// Get a DbHandle(IPCDbHandle) from securityd for each blob in the array that we'll authenticate with.
1145  	//
1146  	uint8* sizePtr = (uint8*)dataPtr;
1147  	*sizePtr = dbBlobArrayCount;
1148  	SecurityServer::DbHandle *currDbHandle = (SecurityServer::DbHandle *)(sizePtr+1);
1149  	CFIndex index;
1150  	SecurityServer::ClientSession ss(Allocator::standard(), Allocator::standard());
1151  	for (index=0; index < dbBlobArrayCount; index++)
1152  	{
1153  		CFDataRef cfBlobData = (CFDataRef)CFArrayGetValueAtIndex(dbBlobArray, index);
1154  		const CssmData thisKCData(const_cast<UInt8 *>(CFDataGetBytePtr(cfBlobData)), CFDataGetLength(cfBlobData));
1155  		//
1156  		// Since it's to a DbHandle that's not on our disk (it came from user's iDisk),
1157  		// it's OK to use the mIdentifier and access credentials of the keychain we're recoding.
1158  		//
1159  		Keychain kc = KeychainImpl::required(keychainRef);
1160  		*currDbHandle = ss.decodeDb(kc->dlDbIdentifier(), kc->defaultCredentials(), thisKCData); /* returns a DbHandle (IPCDbHandle) */
1161  		
1162  		currDbHandle++;
1163  	}
1164  	// do the work
1165  	Keychain keychain = Keychain::optional(keychainRef);
1166  	const CssmData data(const_cast<UInt8 *>((uint8*)dataPtr), space);
1167  	Boolean recodeFailed = false;
1168  	
1169  	int errCode=errSecSuccess;
1170  	
1171  	try
1172      {
1173  		keychain->recode(data, extraCssmData);
1174  	}
1175  	catch (MacOSError e)
1176  	{
1177  		errCode = e.osStatus();
1178  		recodeFailed = true;
1179  	}
1180  	catch (UnixError ue)
1181  	{
1182  		errCode = ue.unixError();
1183  	}
1184  	
1185  	currDbHandle = (SecurityServer::DbHandle *)(sizePtr+1);
1186  	for (index=0; index < dbBlobArrayCount; index++)
1187  	{
1188  		ss.releaseDb(*currDbHandle);
1189  		currDbHandle++;
1190  	}
1191  	if ( dataPtr )
1192  		free(dataPtr);
1193  	
1194  	if ( recodeFailed )
1195  	{
1196  		return errCode;
1197  	}
1198  	
1199  	END_SECAPI
1200  }
1201  
1202  OSStatus SecKeychainCopySignature(SecKeychainRef keychainRef, CFDataRef *keychainSignature) 
1203  {
1204  	BEGIN_SECAPI
1205  
1206  	   os_activity_t activity = os_activity_create("SecKeychainCopySignature", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1207      os_activity_scope(activity);
1208      os_release(activity);
1209  
1210  	// do error checking for required parameters
1211  	RequiredParam(keychainSignature);
1212  
1213  	// make a keychain object "wrapper" for this keychain ref
1214  	Keychain keychain = Keychain::optional(keychainRef);
1215  	CssmAutoData data(keychain->database()->allocator());
1216  	keychain->copyBlob(data.get());
1217  
1218  	// get the cssmDBBlob
1219  	const SecurityServer::DbBlob *cssmDBBlob =
1220  		data.get().interpretedAs<const SecurityServer::DbBlob>();
1221  
1222  	// convert from CDSA standards to CF standards
1223  	*keychainSignature = CFDataCreate(kCFAllocatorDefault,
1224  		cssmDBBlob->randomSignature.bytes,
1225  		sizeof(SecurityServer::DbBlob::Signature));
1226  
1227  	END_SECAPI
1228  }
1229  
1230  OSStatus SecKeychainCopyBlob(SecKeychainRef keychainRef, CFDataRef *dbBlob)
1231  {
1232  	BEGIN_SECAPI
1233  
1234  	   os_activity_t activity = os_activity_create("SecKeychainCopyBlob", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1235      os_activity_scope(activity);
1236      os_release(activity);
1237  
1238  	// do error checking for required parameters
1239  	RequiredParam(dbBlob);
1240  
1241  	// make a keychain object "wrapper" for this keychain ref
1242  	Keychain keychain = Keychain::optional(keychainRef);
1243  	CssmAutoData data(keychain->database()->allocator());
1244  	keychain->copyBlob(data.get());
1245  
1246  	// convert from CDSA standards to CF standards
1247  	*dbBlob = CFDataCreate(kCFAllocatorDefault, data, data.length());
1248  
1249  	END_SECAPI
1250  }
1251  
1252  // make a new keychain with pre-existing secrets
1253  OSStatus SecKeychainCreateWithBlob(const char* fullPathName, CFDataRef dbBlob, SecKeychainRef *kcRef)
1254  {
1255  	BEGIN_SECAPI
1256  
1257  	   os_activity_t activity = os_activity_create("SecKeychainCreateWithBlob", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1258      os_activity_scope(activity);
1259      os_release(activity);
1260  	
1261  	KCThrowParamErrIf_(!fullPathName);
1262  	KCThrowParamErrIf_(!dbBlob);
1263  	
1264  	Keychain keychain = globals().storageManager.make(fullPathName);
1265  
1266  	CssmData blob(const_cast<unsigned char *>(CFDataGetBytePtr(dbBlob)), CFDataGetLength(dbBlob));
1267  
1268  	// @@@ the call to StorageManager::make above leaves keychain the the cache.
1269  	// If the create below fails we should probably remove it.
1270  	keychain->createWithBlob(blob);
1271  
1272  	RequiredParam(kcRef)=keychain->handle();
1273  
1274  	//
1275  
1276  	END_SECAPI
1277  }
1278  
1279  // add a non-file based DB to the keychain list
1280  OSStatus SecKeychainAddDBToKeychainList (SecPreferencesDomain domain, const char* dbName,
1281  										 const CSSM_GUID *guid, uint32 subServiceType)
1282  {
1283  	BEGIN_SECAPI
1284  
1285  	   os_activity_t activity = os_activity_create("SecKeychainAddDBToKeychainList", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1286      os_activity_scope(activity);
1287      os_release(activity);
1288  
1289  	RequiredParam(dbName);
1290  	StorageManager &smr = globals().storageManager;
1291  	smr.addToDomainList(domain, dbName, *guid, subServiceType);
1292  
1293  	END_SECAPI
1294  }
1295  
1296  // determine if a non-file based DB is in the keychain list
1297  OSStatus SecKeychainDBIsInKeychainList (SecPreferencesDomain domain, const char* dbName,
1298  										const CSSM_GUID *guid, uint32 subServiceType)
1299  {
1300  	BEGIN_SECAPI
1301  
1302  	   RequiredParam(dbName);
1303  	StorageManager &smr = globals().storageManager;
1304  	smr.isInDomainList(domain, dbName, *guid, subServiceType);
1305  	END_SECAPI
1306  }
1307  
1308  // remove a non-file based DB from the keychain list
1309  OSStatus SecKeychainRemoveDBFromKeychainList (SecPreferencesDomain domain, const char* dbName,
1310  											  const CSSM_GUID *guid, uint32 subServiceType)
1311  {
1312  	BEGIN_SECAPI
1313  
1314  	   os_activity_t activity = os_activity_create("SecKeychainRemoveDBFromKeychainList", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1315      os_activity_scope(activity);
1316      os_release(activity);
1317  	RequiredParam(dbName);
1318  	StorageManager &smr = globals().storageManager;
1319  	smr.removeFromDomainList(domain, dbName, *guid, subServiceType);
1320  	END_SECAPI
1321  }
1322  
1323  
1324  // set server mode -- must be called before any other Sec* etc. call
1325  void SecKeychainSetServerMode()
1326  {
1327  	gServerMode = true;
1328  }
1329  
1330  
1331  
1332  OSStatus SecKeychainSetBatchMode (SecKeychainRef kcRef, Boolean mode, Boolean rollback)
1333  {
1334  	BEGIN_SECAPI
1335  
1336  	   os_activity_t activity = os_activity_create("SecKeychainSetBatchMode", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1337      os_activity_scope(activity);
1338      os_release(activity);
1339  	RequiredParam(kcRef);
1340  	Keychain keychain = Keychain::optional(kcRef);
1341  	keychain->setBatchMode(mode, rollback);
1342  	END_SECAPI
1343  }
1344  
1345  
1346  
1347  OSStatus SecKeychainCleanupHandles()
1348  {
1349  	BEGIN_SECAPI
1350  
1351  	   END_SECAPI // which causes the handle cache cleanup routine to run
1352  }
1353  
1354  OSStatus SecKeychainVerifyKeyStorePassphrase(uint32_t retries)
1355  {
1356      BEGIN_SECAPI
1357  
1358  	   os_activity_t activity = os_activity_create("SecKeychainVerifyKeyStorePassphrase", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1359      os_activity_scope(activity);
1360      os_release(activity);
1361      SecurityServer::ClientSession().verifyKeyStorePassphrase(retries);
1362      END_SECAPI
1363  }
1364  
1365  OSStatus SecKeychainChangeKeyStorePassphrase()
1366  {
1367      BEGIN_SECAPI
1368  
1369  	   os_activity_t activity = os_activity_create("SecKeychainChangeKeyStorePassphrase", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1370      os_activity_scope(activity);
1371      os_release(activity);
1372      SecurityServer::ClientSession().changeKeyStorePassphrase();
1373      END_SECAPI
1374  }
1375  
1376  static OSStatus SecKeychainGetMasterKey(SecKeychainRef userKeychainRef, CFDataRef *masterKey, CFStringRef password)
1377  {
1378      BEGIN_SECAPI
1379  
1380  	   os_activity_t activity = os_activity_create("SecKeychainGetMasterKey", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1381      os_activity_scope(activity);
1382      os_release(activity);
1383  
1384      // make a keychain object "wrapper" for this keychain ref
1385  	Keychain keychain = Keychain::optional(userKeychainRef);
1386  
1387      CssmClient::Db db = keychain->database();
1388  	
1389  	// create the keychain, using appropriate credentials
1390  	Allocator &alloc = db->allocator();
1391  	AutoCredentials cred(alloc);	// will leak, but we're quitting soon :-)
1392  
1393      char passphrase[1024];
1394      CFStringGetCString(password, passphrase, sizeof(passphrase), kCFStringEncodingUTF8);
1395      
1396      // use this passphrase
1397      cred += TypedList(alloc, CSSM_SAMPLE_TYPE_KEYCHAIN_LOCK,
1398                        new(alloc) ListElement(CSSM_SAMPLE_TYPE_PASSWORD),
1399                        new(alloc) ListElement(StringData(passphrase)));
1400  	db->authenticate(CSSM_DB_ACCESS_READ, &cred);
1401  
1402  	CSSM_DL_DB_HANDLE dlDb = db->handle();
1403  	CssmData dlDbData = CssmData::wrap(dlDb);
1404  	CssmKey refKey;
1405  	KeySpec spec(CSSM_KEYUSE_ANY,
1406                   CSSM_KEYATTR_RETURN_REF | CSSM_KEYATTR_EXTRACTABLE);
1407  
1408      DeriveKey derive(keychain->csp(), CSSM_ALGID_KEYCHAIN_KEY, CSSM_ALGID_3DES_3KEY, 3 * 64);
1409  	derive(&dlDbData, spec, refKey);
1410  	
1411  	// now extract the raw keybits
1412  	CssmKey rawKey;
1413  	WrapKey wrap(keychain->csp(), CSSM_ALGID_NONE);
1414  	wrap(refKey, rawKey);
1415      
1416      *masterKey = CFDataCreate(kCFAllocatorDefault, rawKey.keyData(), rawKey.length());
1417      
1418      END_SECAPI
1419  }
1420  
1421  static const char     *kAutologinPWFilePath = "/etc/kcpassword";
1422  static const uint32_t kObfuscatedPasswordSizeMultiple = 12;
1423  static const uint32_t buffer_size = 512;
1424  static const uint8_t  kObfuscationKey[] = {0x7d, 0x89, 0x52, 0x23, 0xd2, 0xbc, 0xdd, 0xea, 0xa3, 0xb9, 0x1f};
1425  
1426  static void obfuscate(void *buffer, size_t bufferLength)
1427  {
1428  	uint8_t       *pBuf = (uint8_t *) buffer;
1429  	const uint8_t *pKey = kObfuscationKey, *eKey = pKey + sizeof( kObfuscationKey );
1430  
1431  	while (bufferLength--) {
1432  		*pBuf = *pBuf ^ *pKey;
1433  		++pKey;
1434  		++pBuf;
1435  		if (pKey == eKey)
1436  			pKey = kObfuscationKey;
1437  	}
1438  }
1439  
1440  static bool _SASetAutologinPW(CFStringRef inAutologinPW)
1441  {
1442  	bool    result = false;
1443  	struct stat sb;
1444  
1445  	// Delete the kcpassword file if it exists already
1446  	if (stat(kAutologinPWFilePath, &sb) == 0)
1447  		unlink( kAutologinPWFilePath );
1448  
1449      // NIL incoming password ==> clear auto login password (above) without setting a new one. In other words: turn auto login off.
1450      if (inAutologinPW != NULL) {
1451  		char buffer[buffer_size];
1452  		const char *pwAsUTF8String = CFStringGetCStringPtr(inAutologinPW, kCFStringEncodingUTF8);
1453  		if (pwAsUTF8String == NULL) {
1454  			if (CFStringGetCString(inAutologinPW, buffer, buffer_size, kCFStringEncodingUTF8)) pwAsUTF8String = buffer;
1455  		}
1456  
1457  		if (pwAsUTF8String != NULL) {
1458  			size_t pwLength = strlen(pwAsUTF8String) + 1;
1459  			size_t obfuscatedPWLength;
1460  			char *obfuscatedPWBuffer;
1461  
1462  			// The size of the obfuscated password should be the smallest multiple of
1463  			// kObfuscatedPasswordSizeMultiple greater than or equal to pwLength.
1464  			obfuscatedPWLength = (((pwLength - 1) / kObfuscatedPasswordSizeMultiple) + 1) * kObfuscatedPasswordSizeMultiple;
1465  			obfuscatedPWBuffer = (char *) malloc(obfuscatedPWLength);
1466  
1467  			// Copy the password (including null terminator) to beginning of obfuscatedPWBuffer
1468  			bcopy(pwAsUTF8String, obfuscatedPWBuffer, pwLength);
1469  
1470  			// Pad remainder of obfuscatedPWBuffer with random bytes
1471  			{
1472  				char *p;
1473  				char *endOfBuffer = obfuscatedPWBuffer + obfuscatedPWLength;
1474  
1475  				for (p = obfuscatedPWBuffer + pwLength; p < endOfBuffer; ++p)
1476  					*p = random() & 0x000000FF;
1477  			}
1478  
1479  			obfuscate(obfuscatedPWBuffer, obfuscatedPWLength);
1480  
1481  			int pwFile = open(kAutologinPWFilePath, O_CREAT | O_WRONLY | O_NOFOLLOW, S_IRUSR | S_IWUSR);
1482  			if (pwFile >= 0) {
1483  				size_t wrote = write(pwFile, obfuscatedPWBuffer, obfuscatedPWLength);
1484  				if (wrote == obfuscatedPWLength)
1485  					result = true;
1486  				close(pwFile);
1487  			}
1488  
1489  			chmod(kAutologinPWFilePath, S_IRUSR | S_IWUSR);
1490  			free(obfuscatedPWBuffer);
1491  		}
1492  	}
1493  
1494      return result;
1495  }
1496  
1497  OSStatus SecKeychainStoreUnlockKey(SecKeychainRef userKeychainRef, SecKeychainRef systemKeychainRef, CFStringRef username, CFStringRef password) {
1498  	COUNTLEGACYAPI
1499      SecTrustedApplicationRef itemPath;
1500      SecAccessRef ourAccessRef = NULL;
1501      
1502      OSStatus result = errSecParam;
1503      
1504  	if (userKeychainRef == NULL) {
1505  		// We don't have a specific user keychain, fall back
1506  		if (_SASetAutologinPW(password))
1507  			result = errSecSuccess;
1508  
1509  		return result;
1510  	}
1511  
1512      CFDataRef masterKey = NULL;
1513      result = SecKeychainGetMasterKey(userKeychainRef, &masterKey, password);
1514      if (errSecSuccess != result) {
1515          return result;
1516      }
1517      
1518      result = SecKeychainStash();
1519      if (errSecSuccess != result) {
1520          if (masterKey != NULL) CFRelease(masterKey);
1521          return result;
1522      }
1523      
1524      CFMutableArrayRef trustedApplications = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
1525      if (noErr == SecTrustedApplicationCreateApplicationGroup("com.apple.security.auto-login", NULL, &itemPath) && itemPath)
1526          CFArrayAppendValue(trustedApplications, itemPath);
1527      
1528      if (trustedApplications && (CFArrayGetCount(trustedApplications) > 0)) {
1529          if (errSecSuccess == (result = SecAccessCreate(CFSTR("Auto-Login applications"), trustedApplications, &ourAccessRef))) {
1530  			SecKeychainRef internalSystemKeychainRef = NULL;
1531              if (NULL == systemKeychainRef) {
1532  				SecKeychainCopyDomainDefault(kSecPreferencesDomainSystem, &internalSystemKeychainRef);
1533              } else {
1534                  internalSystemKeychainRef = systemKeychainRef;
1535              }
1536              
1537              const void *queryKeys[] =   { kSecClass,
1538                  kSecAttrService,
1539                  kSecAttrAccount,
1540                  kSecUseKeychain,
1541              };
1542              const void *queryValues[] = { kSecClassGenericPassword,
1543                  CFSTR("com.apple.loginwindow.auto-login"),
1544                  username,
1545  				internalSystemKeychainRef,
1546              };
1547              
1548              const void *updateKeys[] =   { kSecAttrAccess,
1549                  kSecValueData,
1550              };
1551              const void *updateValues[] = { ourAccessRef,
1552                  masterKey,
1553              };
1554              
1555              CFDictionaryRef query = CFDictionaryCreate(kCFAllocatorDefault, queryKeys, queryValues, sizeof(queryValues)/sizeof(*queryValues), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
1556              CFDictionaryRef update = CFDictionaryCreate(kCFAllocatorDefault, updateKeys, updateValues, sizeof(updateValues)/sizeof(*updateValues), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
1557              
1558              result = SecItemUpdate(query, update);
1559              
1560              if (errSecSuccess != result) {
1561                  const void *addKeys[] =   { kSecClass,
1562                      kSecAttrService,
1563                      kSecAttrAccount,
1564                      kSecUseKeychain,
1565                      kSecAttrAccess,
1566                      kSecValueData,
1567                  };
1568                  const void *addValues[] = { kSecClassGenericPassword,
1569                      CFSTR("com.apple.loginwindow.auto-login"),
1570                      username,
1571  					internalSystemKeychainRef,
1572                      ourAccessRef,
1573                      masterKey,
1574                  };
1575                  
1576                  CFDictionaryRef add = CFDictionaryCreate(kCFAllocatorDefault, addKeys, addValues, sizeof(addValues)/sizeof(*addValues), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
1577                  result = SecItemAdd(add, NULL);
1578                  if (NULL != add) CFRelease(add);
1579              }
1580  
1581              if (NULL != query) CFRelease(query);
1582              if (NULL != update) CFRelease(update);
1583  
1584  			// If the caller wanted us to locate the system keychain reference, it's okay to go ahead and free our magically created one
1585  			if (systemKeychainRef == NULL) CFRelease(internalSystemKeychainRef);
1586          }
1587      }
1588  
1589      if (NULL != masterKey) CFRelease(masterKey);
1590      if (NULL != trustedApplications) CFRelease(trustedApplications);
1591      if (NULL != ourAccessRef) CFRelease(ourAccessRef);
1592  
1593      return result;
1594  }
1595  
1596  OSStatus SecKeychainGetUserPromptAttempts(uint32_t * attempts)
1597  {
1598      BEGIN_SECAPI
1599  
1600      os_activity_t activity = os_activity_create("SecKeychainGetUserPromptAttempts", OS_ACTIVITY_CURRENT, OS_ACTIVITY_FLAG_IF_NONE_PRESENT);
1601      os_activity_scope(activity);
1602      os_release(activity);
1603  
1604      if(attempts) {
1605          SecurityServer::ClientSession().getUserPromptAttempts(*attempts);
1606      }
1607  
1608      END_SECAPI
1609  }
1610  
1611  OSStatus SecKeychainStoreUnlockKeyWithPubKeyHash(CFDataRef pubKeyHash, CFStringRef tokenID, CFDataRef wrapPubKeyHash,
1612                                                   SecKeychainRef userKeychain, CFStringRef password)
1613  {
1614  	COUNTLEGACYAPI
1615  	CFRef<CFStringRef> pwd;
1616  	OSStatus result;
1617  
1618  	if (password == NULL || CFStringGetLength(password) == 0) {
1619  		AuthorizationRef authorizationRef;
1620  		result = AuthorizationCreate(NULL, NULL, kAuthorizationFlagDefaults, &authorizationRef);
1621  		if (result != errAuthorizationSuccess) {
1622  			secnotice("SecKeychain", "failed to create authorization");
1623  			return result;
1624  		}
1625  
1626  		AuthorizationItem myItems = {"com.apple.ctk.pair", 0, NULL, 0};
1627  		AuthorizationRights myRights = {1, &myItems};
1628  
1629  		char pathName[PATH_MAX];
1630  		UInt32 pathLength = PATH_MAX;
1631  		result = SecKeychainGetPath(userKeychain, &pathLength, pathName);
1632  		if (result != errSecSuccess) {
1633  			secnotice("SecKeychain", "failed to create authorization");
1634  			return result;
1635  		}
1636  
1637  		Boolean checkPwd = TRUE;
1638  		Boolean ignoreSession = TRUE;
1639  		AuthorizationItem envItems[] = {
1640  			{AGENT_HINT_KEYCHAIN_PATH, pathLength, pathName, 0},
1641  			{AGENT_HINT_KEYCHAIN_CHECK, sizeof(checkPwd), &checkPwd},
1642  			{AGENT_HINT_IGNORE_SESSION, sizeof(ignoreSession), &ignoreSession}
1643  		};
1644  
1645  		AuthorizationEnvironment environment  = {3, envItems};
1646  		AuthorizationFlags flags = kAuthorizationFlagDefaults | kAuthorizationFlagInteractionAllowed | kAuthorizationFlagExtendRights;
1647  		result = AuthorizationCopyRights(authorizationRef, &myRights, &environment, flags, NULL);
1648          secnotice("SecKeychain", "Authorization result: %d", (int)result);
1649  
1650  		if (result == errAuthorizationSuccess) {
1651  			AuthorizationItemSet *items;
1652  			result = AuthorizationCopyInfo(authorizationRef, kAuthorizationEnvironmentPassword, &items);
1653              secnotice("SecKeychain", "Items copy result: %d", (int)result);
1654  			if (result == errAuthorizationSuccess) {
1655                  secnotice("SecKeychain", "Items count: %d", items->count);
1656  				if (items->count > 0) {
1657  					pwd = CFStringCreateWithCString(kCFAllocatorDefault, (const char *)items->items[0].value, kCFStringEncodingUTF8);
1658                      if (pwd) {
1659                          secnotice("SecKeychain", "Got kcpass");
1660                      }
1661  				}
1662  				AuthorizationFreeItemSet(items);
1663  			}
1664  		}
1665  		AuthorizationFree(authorizationRef, kAuthorizationFlagDefaults);
1666  		if (result != errAuthorizationSuccess) {
1667  			secnotice("SecKeychain", "did not get authorization to pair the card");
1668  			return result;
1669  		}
1670  	} else {
1671  		pwd.take(password);
1672  	}
1673  
1674  	if (!pwd) {
1675  		secnotice("SecKeychain", "did not get kcpass");
1676  		return errSecInternalComponent;
1677  	}
1678  
1679  	CFRef<CFDataRef> masterKey;
1680  	result = SecKeychainGetMasterKey(userKeychain, masterKey.take(), pwd);
1681  	if (result != errSecSuccess) {
1682  		secnotice("SecKeychain", "Failed to get master key: %d", (int) result);
1683  		return result;
1684  	}
1685  
1686  	CFRef<CFDataRef> scBlob;
1687  	result = TokenLoginGetScBlob(wrapPubKeyHash, tokenID, pwd, scBlob.take());
1688  	if (result != errSecSuccess) {
1689  		secnotice("SecKeychain", "Failed to get stash: %d", (int) result);
1690  		return result;
1691  	}
1692  
1693  	result = TokenLoginCreateLoginData(tokenID, pubKeyHash, wrapPubKeyHash, masterKey, scBlob);
1694  	if (result != errSecSuccess) {
1695  		secnotice("SecKeychain", "Failed to create login data: %d", (int) result);
1696  		return result;
1697  	}
1698  
1699  	secnotice("SecKeychain", "SecKeychainStoreUnlockKeyWithPubKeyHash result %d", (int) result);
1700      
1701      // create SC KEK
1702      // this might fail if KC password is different from user's password
1703      uid_t uid = geteuid();
1704      if (!uid) {
1705          uid = getuid();
1706      }
1707      struct passwd *passwd = getpwuid(uid);
1708      if (passwd) {
1709          CFRef<CFStringRef> username = CFStringCreateWithCString(kCFAllocatorDefault, passwd->pw_name, kCFStringEncodingUTF8);
1710          OSStatus kekRes = TKAddSecureToken(username, pwd, tokenID, wrapPubKeyHash);
1711          if (kekRes != noErr) {
1712              secnotice("SecKeychain", "Failed to register SC token: %d", (int) kekRes); // do not fail because KC functionality be still OK
1713          }
1714      } else {
1715          secnotice("SecKeychain", "Unable to get name for uid %d", uid);
1716      }
1717  	return result;
1718  }
1719  
1720  OSStatus SecKeychainEraseUnlockKeyWithPubKeyHash(CFDataRef pubKeyHash)
1721  {
1722  	COUNTLEGACYAPI
1723      OSStatus result = TokenLoginDeleteUnlockData(pubKeyHash);
1724      if (result != errSecSuccess) {
1725          secnotice("SecKeychain", "Failed to erase stored wrapped unlock key: %d", (int) result);
1726      }
1727      return result;
1728  }