1  /*
  2   * Copyright (c) 2020 Apple Inc. All Rights Reserved.
  3   *
  4   * @APPLE_LICENSE_HEADER_START@
  5   *
  6   * This file contains Original Code and/or Modifications of Original Code
  7   * as defined in and that are subject to the Apple Public Source License
  8   * Version 2.0 (the 'License'). You may not use this file except in
  9   * compliance with the License. Please obtain a copy of the License at
 10   * http://www.opensource.apple.com/apsl/ and read it before using this
 11   * file.
 12   *
 13   * The Original Code and all software distributed under the License are
 14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
 15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
 16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
 17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
 18   * Please see the License for the specific language governing rights and
 19   * limitations under the License.
 20   *
 21   * @APPLE_LICENSE_HEADER_END@
 22   *
 23   * ca_revocation_additions.m
 24   */
 25  
 26  #import <Foundation/Foundation.h>
 27  #include <Security/SecTrustSettingsPriv.h>
 28  #include <Security/SecCertificatePriv.h>
 29  #include <utilities/fileIo.h>
 30  #include <utilities/SecCFWrappers.h>
 31  
 32  #include "SecurityCommands.h"
 33  
 34  NSString* secToolAppID = @"com.apple.security";
 35  
 36  static int addCertFile(const char *fileName, NSMutableArray *array) {
 37      SecCertificateRef certRef = NULL;
 38      NSData *data = NULL;
 39      unsigned char *buf = NULL;
 40      size_t numBytes;
 41      int rtn = 0;
 42  
 43      if (readFileSizet(fileName, &buf, &numBytes)) {
 44          rtn = -1;
 45          goto errOut;
 46      }
 47  
 48      data = [NSData dataWithBytes:buf length:numBytes];
 49      certRef = SecCertificateCreateWithData(NULL, (__bridge CFDataRef)data);
 50      if (!certRef) {
 51          certRef = SecCertificateCreateWithPEM(NULL, (__bridge CFDataRef)data);
 52          if (!certRef) {
 53              rtn = -1;
 54              goto errOut;
 55          }
 56      }
 57  
 58      [array addObject:(__bridge id)certRef];
 59  
 60  errOut:
 61      /* Cleanup */
 62      free(buf);
 63      CFReleaseNull(certRef);
 64      return rtn;
 65  }
 66  
 67  static int returnCFError(CFErrorRef CF_CONSUMED error) {
 68      CFStringRef errorString = CFErrorCopyDescription(error);
 69      CFStringPerformWithCString(errorString, ^(const char *utf8Str) {
 70          fprintf(stderr, "Failed to copy CA revocation additions: %s\n", utf8Str);
 71      });
 72      CFIndex errCode = CFErrorGetCode(error);
 73      CFReleaseNull(error);
 74      return (int)errCode;
 75  }
 76  
 77  static int resetRevocationAdditions(bool resetCerts) {
 78      bool result = false;
 79      CFErrorRef error = NULL;
 80      if (resetCerts) {
 81          NSDictionary *resetCertsDict = @{ (__bridge NSString*)kSecCARevocationAdditionsKey: @[] };
 82          result = SecTrustStoreSetCARevocationAdditions(NULL, (__bridge CFDictionaryRef)resetCertsDict, &error);
 83      }
 84      if (!result) {
 85          return returnCFError(error);
 86      }
 87      return 0;
 88  }
 89  
 90  static int addRevocationAdditions(CFStringRef key, NSArray *newAdditions) {
 91      CFErrorRef error = NULL;
 92      NSDictionary *currentAdditions = CFBridgingRelease(SecTrustStoreCopyCARevocationAdditions((__bridge CFStringRef)secToolAppID, &error));
 93      if (!currentAdditions && error) {
 94          return returnCFError(error);
 95      }
 96  
 97      NSMutableArray *additionsForKey = nil;
 98      if (currentAdditions && currentAdditions[(__bridge NSString*)key]) {
 99          additionsForKey = [currentAdditions[(__bridge NSString*)key] mutableCopy];
100          [additionsForKey addObjectsFromArray:newAdditions];
101      } else {
102          additionsForKey = [newAdditions copy];
103      }
104  
105      NSDictionary *newAdditionsDict = @{ (__bridge NSString*)key: additionsForKey };
106      bool result = SecTrustStoreSetCARevocationAdditions(NULL, (__bridge CFDictionaryRef)newAdditionsDict, &error);
107      if (!result) {
108          return returnCFError(error);
109      }
110  
111      return 0;
112  }
113  
114  int add_ca_revocation_checking(int argc, char * const *argv) {
115      int arg;
116  
117      bool resetCerts = false;
118  
119      NSMutableArray *certs = [NSMutableArray array];
120      NSDictionary *plist = nil;
121  
122      /* parse args */
123      if (argc == 1) {
124          return SHOW_USAGE_MESSAGE;
125      }
126  
127      while ((arg = getopt(argc, argv, "c:r:p:")) != -1) {
128          switch(arg) {
129              case 'c':
130                  if (addCertFile(optarg, certs)) {
131                      fprintf(stderr, "Failed to read cert file\n");
132                      return 1;
133                  }
134                  break;
135              case 'r':
136                  if (!strcmp(optarg, "all")) {
137                      resetCerts = true;
138                  } else if (!strcmp(optarg, "cert")) {
139                      resetCerts = true;
140                  } else {
141                      return SHOW_USAGE_MESSAGE;
142                  }
143                  break;
144              case 'p':
145                  plist = [NSDictionary dictionaryWithContentsOfFile:[NSString stringWithCString:optarg encoding:NSUTF8StringEncoding]];
146                  break;
147              case '?':
148              default:
149                  return SHOW_USAGE_MESSAGE;
150          }
151      }
152  
153      /* handle reset operation */
154      if (resetCerts) {
155          return resetRevocationAdditions(resetCerts);
156      }
157  
158      /* set plist */
159      if (plist) {
160          CFErrorRef error = NULL;
161          bool result = SecTrustStoreSetCARevocationAdditions(NULL, (__bridge CFDictionaryRef)plist, &error);
162          if (!result) {
163              return returnCFError(error);
164          } else {
165              return 0;
166          }
167      }
168  
169      /* add certs */
170      int status = 0;
171      if ([certs count]) {
172          NSMutableArray<NSDictionary *>*valuesForCAsKey = [NSMutableArray arrayWithCapacity:[certs count]];
173          [certs enumerateObjectsUsingBlock:^(id  _Nonnull obj, NSUInteger idx, BOOL * _Nonnull stop) {
174              SecCertificateRef cert = (__bridge SecCertificateRef)obj;
175              NSData* hash = CFBridgingRelease(SecCertificateCopySubjectPublicKeyInfoSHA256Digest(cert));
176              NSDictionary *value = @{ (__bridge NSString*)kSecCARevocationHashAlgorithmKey:@"sha256",
177                                       (__bridge NSString*)kSecCARevocationSPKIHashKey:hash };
178              [valuesForCAsKey addObject:value];
179          }];
180          status = addRevocationAdditions(kSecCARevocationAdditionsKey, valuesForCAsKey);
181      }
182      if (status != 0) {
183          fprintf(stderr, "failed to add cert revocation additions\n");
184          return status;
185      }
186  
187      return 0;
188  }
189  
190  static int printRevocationAdditions(CFStringRef key, NSDictionary *allAdditions) {
191      if (!allAdditions || !allAdditions[(__bridge NSString*)key] ||
192          [allAdditions[(__bridge NSString*)key] count] == 0) {
193          CFStringPerformWithCString(key, ^(const char *utf8Str) {
194              fprintf(stdout, "No revocation additions for %s\n", utf8Str);
195          });
196          return 0;
197      }
198  
199      NSArray *additionsForKey = allAdditions[(__bridge NSString*)key];
200      NSMutableString *additionsString = [NSMutableString stringWithFormat:@"\t%@ : [",key];
201      [additionsForKey enumerateObjectsUsingBlock:^(id  _Nonnull obj, NSUInteger idx, BOOL * _Nonnull stop) {
202          if ([obj isKindOfClass:[NSString class]]) {
203              if (idx == 0) {
204                  [additionsString appendFormat:@"\"%@\"",obj];
205              } else {
206                  [additionsString appendFormat:@", \"%@\"", obj];
207              }
208          } else if ([obj isKindOfClass:[NSDictionary class]]) {
209              if (idx == 0) {
210                  [additionsString appendString:@"\n\t    "];
211              } else {
212                  [additionsString appendString:@"\t    "];
213              }
214              [additionsString appendFormat:@"\"%@:", obj[(__bridge NSString*)kSecCARevocationHashAlgorithmKey]];
215              NSString *hashHex = CFBridgingRelease(CFDataCopyHexString((__bridge CFDataRef)obj[(__bridge NSString*)kSecCARevocationSPKIHashKey]));
216              [additionsString appendString:hashHex];
217              if ([additionsForKey count] == idx + 1) { // last entry
218                  [additionsString appendString:@"\"\n"];
219              } else {
220                  [additionsString appendString:@"\",\n"];
221              }
222          }
223      }];
224      [additionsString appendString:@"]\n"];
225      CFStringPerformWithCString((__bridge CFStringRef)additionsString, ^(const char *utf8Str) {
226          fprintf(stdout, "\n%s\n", utf8Str);
227      });
228  
229      return 0;
230  }
231  
232  int show_ca_revocation_checking(int argc, char * const *argv) {
233      int arg;
234      bool allAdditions = false;
235      NSString *identifier = nil;
236      bool certAdditions = false;
237  
238      /* parse args */
239      while ((arg = getopt(argc, argv, "ai:c")) != -1) {
240          switch(arg) {
241              case 'a':
242                  allAdditions = true;
243                  break;
244              case 'i':
245                  identifier = [NSString stringWithCString:optarg encoding:NSUTF8StringEncoding];
246                  break;
247              case 'c':
248                  certAdditions = true;
249                  break;
250              case '?':
251              default:
252                  return SHOW_USAGE_MESSAGE;
253          }
254      }
255  
256      if (allAdditions) {
257          identifier = nil;
258          fprintf(stdout, "Showing revocation additions for all apps\n");
259      } else if (!identifier) {
260          identifier = secToolAppID;
261      }
262  
263      if (identifier) {
264          CFStringPerformWithCString((__bridge CFStringRef)identifier, ^(const char *utf8Str) {
265              fprintf(stdout, "Showing revocation additions for %s\n", utf8Str);
266          });
267      }
268  
269      CFErrorRef error = NULL;
270      NSDictionary *results = CFBridgingRelease(SecTrustStoreCopyCARevocationAdditions((__bridge CFStringRef)identifier, &error));
271  
272      /* Copy failed, return error */
273      if (!results && error) {
274          return returnCFError(error);
275      }
276  
277      /* print cert revocation additions */
278      int status = 0;
279      if (certAdditions) {
280          status = printRevocationAdditions(kSecCARevocationAdditionsKey, results);
281      }
282      if (status != 0) {
283          fprintf(stderr, "failed to print revocation additions\n");
284          return status;
285      }
286  
287  
288      return 0;
289  }