1  //
  2  //  SecProtocolTypes.m
  3  //  Security
  4  //
  5  
  6  #import "utilities/SecCFRelease.h"
  7  #import "utilities/SecCFWrappers.h"
  8  
  9  #define OS_OBJECT_HAVE_OBJC_SUPPORT 1
 10  
 11  #define SEC_NULL_BAD_INPUT ((void *_Nonnull)NULL)
 12  #define SEC_NULL_OUT_OF_MEMORY SEC_NULL_BAD_INPUT
 13  
 14  #define SEC_NIL_BAD_INPUT ((void *_Nonnull)nil)
 15  #define SEC_NIL_OUT_OF_MEMORY SEC_NIL_BAD_INPUT
 16  
 17  #define SEC_CONCRETE_CLASS_NAME(external_type) SecConcrete_##external_type
 18  #define SEC_CONCRETE_PREFIX_STR "SecConcrete_"
 19  
 20  #define SEC_OBJECT_DECL_INTERNAL_OBJC(external_type)                                                    \
 21      @class SEC_CONCRETE_CLASS_NAME(external_type);                                                      \
 22      typedef SEC_CONCRETE_CLASS_NAME(external_type) *external_type##_t
 23  
 24  #define SEC_OBJECT_IMPL_INTERNAL_OBJC_WITH_PROTOCOL_AND_VISBILITY(external_type, _protocol, visibility, ...)    \
 25      @protocol OS_OBJECT_CLASS(external_type) <_protocol>                                                        \
 26      @end                                                                                                        \
 27      visibility                                                                                                  \
 28      @interface SEC_CONCRETE_CLASS_NAME(external_type) : NSObject<OS_OBJECT_CLASS(external_type)>                \
 29          _Pragma("clang diagnostic push")                                                                    \
 30          _Pragma("clang diagnostic ignored \"-Wobjc-interface-ivars\"")                                      \
 31              __VA_ARGS__                                                                                     \
 32          _Pragma("clang diagnostic pop")                                                                     \
 33      @end                                                                                                    \
 34      typedef int _useless_typedef_oio_##external_type
 35  
 36  #define SEC_OBJECT_IMPL_INTERNAL_OBJC_WITH_PROTOCOL(external_type, _protocol, ...)                      \
 37      SEC_OBJECT_IMPL_INTERNAL_OBJC_WITH_PROTOCOL_AND_VISBILITY(external_type, _protocol, ,__VA_ARGS__)
 38  
 39  #define SEC_OBJECT_IMPL_INTERNAL_OBJC(external_type, ...)                                               \
 40      SEC_OBJECT_IMPL_INTERNAL_OBJC_WITH_PROTOCOL(external_type, NSObject, ##__VA_ARGS__)
 41  
 42  #define SEC_OBJECT_IMPL_INTERNAL_OBJC_WITH_VISIBILITY(external_type, visibility, ...)                   \
 43      SEC_OBJECT_IMPL_INTERNAL_OBJC_WITH_PROTOCOL_AND_VISBILITY(external_type, NSObject, visibility, ##__VA_ARGS__)
 44  
 45  #define SEC_OBJECT_IMPL 1
 46  
 47  SEC_OBJECT_DECL_INTERNAL_OBJC(sec_array);
 48  SEC_OBJECT_DECL_INTERNAL_OBJC(sec_identity);
 49  SEC_OBJECT_DECL_INTERNAL_OBJC(sec_trust);
 50  SEC_OBJECT_DECL_INTERNAL_OBJC(sec_certificate);
 51  SEC_OBJECT_DECL_INTERNAL_OBJC(sec_protocol_configuration_builder);
 52  SEC_OBJECT_DECL_INTERNAL_OBJC(sec_object);
 53  SEC_OBJECT_DECL_INTERNAL_OBJC(sec_protocol_options);
 54  SEC_OBJECT_DECL_INTERNAL_OBJC(sec_protocol_metadata);
 55  SEC_OBJECT_DECL_INTERNAL_OBJC(sec_protocol_configuration);
 56  
 57  #import "SecProtocolInternal.h"
 58  #import <Security/SecProtocolPriv.h>
 59  #import "SecProtocolTypesPriv.h"
 60  
 61  #import <Foundation/Foundation.h>
 62  #import <CoreFoundation/CoreFoundation.h>
 63  #import <CoreFoundation/CFPriv.h>
 64  
 65  #import <os/log.h>
 66  #import <xpc/private.h>
 67  
 68  #import <os/object.h>
 69  
 70  #ifndef SEC_ANALYZER_HIDE_DEADSTORE
 71  #  ifdef __clang_analyzer__
 72  #    define SEC_ANALYZER_HIDE_DEADSTORE(var) do { if (var) {} } while (0)
 73  #  else // __clang_analyzer__
 74  #    define SEC_ANALYZER_HIDE_DEADSTORE(var) do {} while (0)
 75  #  endif // __clang_analyzer__
 76  #endif // SEC_ANALYZER_HIDE_DEADSTORE
 77  
 78  SEC_OBJECT_IMPL_INTERNAL_OBJC(sec_array,
 79  {
 80      xpc_object_t xpc_array;
 81  });
 82  
 83  @implementation SEC_CONCRETE_CLASS_NAME(sec_array)
 84  
 85  - (instancetype)init
 86  {
 87      if ((self = [super init])) {
 88          self->xpc_array = xpc_array_create(NULL, 0);
 89      } else {
 90          return SEC_NIL_OUT_OF_MEMORY;
 91      }
 92      return self;
 93  }
 94  
 95  - (void)dealloc
 96  {
 97      if (self->xpc_array != nil) {
 98          xpc_array_apply(self->xpc_array, ^bool(size_t index, __unused xpc_object_t value) {
 99              void *pointer = xpc_array_get_pointer(self->xpc_array, index);
100              sec_object_t object = (sec_object_t)CFBridgingRelease(pointer);
101              SEC_ANALYZER_HIDE_DEADSTORE(object);
102              object = nil;
103              return true;
104          });
105          self->xpc_array = nil;
106      }
107  }
108  
109  sec_array_t
110  sec_array_create(void)
111  {
112      return [[SEC_CONCRETE_CLASS_NAME(sec_array) alloc] init];
113  }
114  
115  void
116  sec_array_append(sec_array_t array, sec_object_t object)
117  {
118      if (array != NULL &&
119          array->xpc_array != NULL && xpc_get_type(array->xpc_array) == XPC_TYPE_ARRAY &&
120          object != NULL) {
121          void *retained_pointer = __DECONST(void *, CFBridgingRetain(object));
122          xpc_array_set_pointer(array->xpc_array, XPC_ARRAY_APPEND, retained_pointer);
123          // 'Leak' the retain, and save the pointer into the array
124      }
125  }
126  
127  size_t
128  sec_array_get_count(sec_array_t array)
129  {
130      if (array != NULL &&
131          array->xpc_array != NULL && xpc_get_type(array->xpc_array) == XPC_TYPE_ARRAY) {
132          return xpc_array_get_count(array->xpc_array);
133      }
134      return 0;
135  }
136  
137  bool
138  sec_array_apply(sec_array_t array, sec_array_applier_t applier)
139  {
140      if (array != NULL &&
141          array->xpc_array != NULL && xpc_get_type(array->xpc_array) == XPC_TYPE_ARRAY) {
142          return xpc_array_apply(array->xpc_array, ^bool(size_t index, __unused xpc_object_t value) {
143              void *pointer = xpc_array_get_pointer(array->xpc_array, index);
144              return applier(index, (__bridge sec_object_t)(pointer));
145          });
146      }
147      return false;
148  }
149  
150  @end
151  
152  SEC_OBJECT_IMPL_INTERNAL_OBJC(sec_identity,
153  {
154      SecIdentityRef identity;
155      CFArrayRef certs;
156      sec_protocol_private_key_sign_t sign_block;
157      sec_protocol_private_key_decrypt_t decrypt_block;
158      dispatch_queue_t operation_queue;
159  });
160  
161  @implementation SEC_CONCRETE_CLASS_NAME(sec_identity)
162  
163  - (instancetype)initWithIdentity:(SecIdentityRef)_identity
164  {
165      if (_identity == NULL) {
166          return SEC_NIL_BAD_INPUT;
167      }
168  
169      if ((self = [super init])) {
170          self->identity = __DECONST(SecIdentityRef, CFRetainSafe(_identity));
171      } else {
172          return SEC_NIL_OUT_OF_MEMORY;
173      }
174      return self;
175  }
176  
177  - (instancetype)initWithIdentityAndCertificates:(SecIdentityRef)_identity certificates:(CFArrayRef)certificates
178  {
179      if (_identity == NULL) {
180          return SEC_NIL_BAD_INPUT;
181      }
182      
183      if ((self = [super init])) {
184          self->identity = __DECONST(SecIdentityRef, CFRetainSafe(_identity));
185          self->certs = __DECONST(CFArrayRef, CFRetainSafe(certificates));
186      } else {
187          return SEC_NIL_OUT_OF_MEMORY;
188      }
189      
190      return self;
191  }
192  
193  - (instancetype)initWithCertificates:(CFArrayRef)certificates signBlock:(sec_protocol_private_key_sign_t)sign decryptBlock:(sec_protocol_private_key_decrypt_t)decrypt queue:(dispatch_queue_t)queue
194  {
195      if (certificates == NULL) {
196          return SEC_NIL_BAD_INPUT;
197      }
198      if (sign == NULL) {
199          return SEC_NIL_BAD_INPUT;
200      }
201      if (decrypt == NULL) {
202          return SEC_NIL_BAD_INPUT;
203      }
204  
205      if ((self = [super init])) {
206          self->certs = __DECONST(CFArrayRef, CFRetainSafe(certificates));
207          self->sign_block = sign;
208          self->decrypt_block = decrypt;
209          self->operation_queue = queue;
210      } else {
211          return SEC_NIL_OUT_OF_MEMORY;
212      }
213      return self;
214  }
215  
216  - (void)dealloc
217  {
218      if (self->identity != NULL) {
219          CFRelease(self->identity);
220          self->identity = NULL;
221          
222          if (self->certs) {
223              CFRelease(self->certs);
224          }
225          self->certs = NULL;
226      }
227  }
228  
229  sec_identity_t
230  sec_identity_create(SecIdentityRef identity)
231  {
232      return [[SEC_CONCRETE_CLASS_NAME(sec_identity) alloc] initWithIdentity:identity];
233  }
234  
235  sec_identity_t
236  sec_identity_create_with_certificates(SecIdentityRef identity, CFArrayRef certificates)
237  {
238      return [[SEC_CONCRETE_CLASS_NAME(sec_identity) alloc] initWithIdentityAndCertificates:identity certificates:certificates];
239  }
240  
241  sec_identity_t
242  sec_identity_create_with_certificates_and_external_private_key(CFArrayRef __nonnull certificates,
243                                                        sec_protocol_private_key_sign_t sign_block,
244                                                        sec_protocol_private_key_decrypt_t decrypt_block,
245                                                        dispatch_queue_t queue)
246  {
247      return [[SEC_CONCRETE_CLASS_NAME(sec_identity) alloc] initWithCertificates:certificates signBlock:sign_block decryptBlock:decrypt_block queue:queue];
248  }
249  
250  SecIdentityRef
251  sec_identity_copy_ref(sec_identity_t object)
252  {
253      if (object == NULL) {
254          return SEC_NULL_BAD_INPUT;
255      }
256      if (object->identity != NULL) {
257          return __DECONST(SecIdentityRef, CFRetain(object->identity));
258      }
259      return SEC_NULL_BAD_INPUT;
260  }
261  
262  CFArrayRef
263  sec_identity_copy_certificates_ref(sec_identity_t object)
264  {
265      if (object == NULL) {
266          return SEC_NULL_BAD_INPUT;
267      }
268      if (object->certs != NULL) {
269          return __DECONST(CFArrayRef, CFRetain(object->certs));
270      }
271      return SEC_NULL_BAD_INPUT;
272  }
273  
274  bool
275  sec_identity_access_certificates(sec_identity_t identity,
276                                   void (^handler)(sec_certificate_t certificate))
277  {
278      if (identity == NULL) {
279          return false;
280      }
281      if (identity->certs != NULL) {
282          CFArrayForEach(identity->certs, ^(const void *value) {
283              SecCertificateRef certificate_ref = (SecCertificateRef)value;
284              if (certificate_ref != NULL) {
285                  sec_certificate_t certificate = sec_certificate_create(certificate_ref);
286                  handler(certificate);
287              }
288          });
289          return true;
290      }
291      return false;
292  }
293  
294  bool
295  sec_identity_has_certificates(sec_identity_t identity)
296  {
297      if (identity == NULL) {
298          return false;
299      }
300      return identity->certs != NULL;
301  }
302  
303  sec_protocol_private_key_sign_t
304  sec_identity_copy_private_key_sign_block(sec_identity_t object)
305  {
306      if (object == NULL) {
307          return SEC_NULL_BAD_INPUT;
308      }
309      if (object->sign_block != NULL) {
310          return object->sign_block;
311      }
312      return SEC_NIL_BAD_INPUT;
313  }
314  
315  sec_protocol_private_key_decrypt_t
316  sec_identity_copy_private_key_decrypt_block(sec_identity_t object)
317  {
318      if (object == NULL) {
319          return SEC_NULL_BAD_INPUT;
320      }
321      if (object->decrypt_block != NULL) {
322          return object->decrypt_block;
323      }
324      return SEC_NIL_BAD_INPUT;
325  }
326  
327  dispatch_queue_t
328  sec_identity_copy_private_key_queue(sec_identity_t object)
329  {
330      if (object == NULL) {
331          return SEC_NULL_BAD_INPUT;
332      }
333      if (object->operation_queue != nil) {
334          return object->operation_queue;
335      }
336      return SEC_NIL_BAD_INPUT;
337  }
338  
339  
340  @end
341  
342  SEC_OBJECT_IMPL_INTERNAL_OBJC(sec_certificate,
343  {
344      SecCertificateRef certificate;
345  });
346  
347  @implementation SEC_CONCRETE_CLASS_NAME(sec_certificate)
348  
349  - (instancetype)initWithCertificate:(SecCertificateRef)_certificate
350  {
351      if (_certificate == NULL) {
352          return SEC_NIL_BAD_INPUT;
353      }
354  
355      if ((self = [super init])) {
356          self->certificate = __DECONST(SecCertificateRef, CFRetainSafe(_certificate));
357      } else {
358          return SEC_NIL_OUT_OF_MEMORY;
359      }
360      return self;
361  }
362  
363  - (void)dealloc
364  {
365      if (self->certificate != NULL) {
366          CFRelease(self->certificate);
367          self->certificate = NULL;
368      }
369  }
370  
371  sec_certificate_t
372  sec_certificate_create(SecCertificateRef certificate)
373  {
374      return [[SEC_CONCRETE_CLASS_NAME(sec_certificate) alloc] initWithCertificate:certificate];
375  }
376  
377  SecCertificateRef
378  sec_certificate_copy_ref(sec_certificate_t object)
379  {
380      if (object == NULL) {
381          return SEC_NULL_BAD_INPUT;
382      }
383      if (object->certificate != NULL) {
384          return __DECONST(SecCertificateRef, CFRetain(object->certificate));
385      }
386      return SEC_NULL_BAD_INPUT;
387  }
388  
389  @end
390  
391  SEC_OBJECT_IMPL_INTERNAL_OBJC(sec_trust,
392  {
393      SecTrustRef trust;
394  });
395  
396  @implementation SEC_CONCRETE_CLASS_NAME(sec_trust)
397  
398  - (instancetype)initWithTrust:(SecTrustRef)_trust
399  {
400      if (_trust == NULL) {
401          return SEC_NIL_BAD_INPUT;
402      }
403  
404      if ((self = [super init])) {
405          self->trust = __DECONST(SecTrustRef, CFRetainSafe(_trust));
406      } else {
407          return SEC_NIL_OUT_OF_MEMORY;
408      }
409      return self;
410  }
411  
412  - (void)dealloc
413  {
414      if (self->trust != NULL) {
415          CFRelease(self->trust);
416          self->trust = NULL;
417      }
418  }
419  
420  sec_trust_t
421  sec_trust_create(SecTrustRef trust)
422  {
423      return [[SEC_CONCRETE_CLASS_NAME(sec_trust) alloc] initWithTrust:trust];
424  }
425  
426  SecTrustRef
427  sec_trust_copy_ref(sec_trust_t object)
428  {
429      if (object == NULL) {
430          return SEC_NULL_BAD_INPUT;
431      }
432      if (object->trust != NULL) {
433          return __DECONST(SecTrustRef, CFRetain(object->trust));
434      }
435      return SEC_NULL_BAD_INPUT;
436  }
437  
438  @end
439  
440  static bool
441  _is_apple_bundle(void)
442  {
443      static dispatch_once_t onceToken;
444      static bool result = false;
445      dispatch_once(&onceToken, ^{
446          CFBundleRef bundle = CFBundleGetMainBundle();
447          CFStringRef bundleID = CFBundleGetIdentifier(bundle);
448          result = !bundleID || CFStringHasPrefix(bundleID, CFSTR("com.apple."));
449      });
450      return result;
451  }
452  
453  SEC_OBJECT_IMPL_INTERNAL_OBJC(sec_protocol_configuration_builder,
454  {
455  @package
456      CFDictionaryRef dictionary;
457      bool is_apple;
458  });
459  
460  @implementation SEC_CONCRETE_CLASS_NAME(sec_protocol_configuration_builder)
461  
462  - (id)init
463  {
464      if (self = [super init]) {
465          CFBundleRef bundle = CFBundleGetMainBundle();
466          if (bundle != NULL) {
467              CFTypeRef rawATS = CFBundleGetValueForInfoDictionaryKey(bundle, CFSTR(kATSInfoKey));
468              self->dictionary = (CFDictionaryRef)rawATS;
469              CFRetainSafe(self->dictionary);
470              self->is_apple = _is_apple_bundle();
471          }
472      }
473      return self;
474  }
475  
476  - (id)initWithDictionary:(CFDictionaryRef)dict
477           andInternalFlag:(bool)flag
478  {
479      if ((self = [super init])) {
480          self->dictionary = dict;
481          CFRetainSafe(dict);
482          self->is_apple = flag;
483      }
484      return self;
485  }
486  
487  @end
488  
489  sec_protocol_configuration_builder_t
490  sec_protocol_configuration_builder_copy_default()
491  {
492      return [[SEC_CONCRETE_CLASS_NAME(sec_protocol_configuration_builder) alloc] init];
493  }
494  
495  sec_protocol_configuration_builder_t
496  sec_protocol_configuration_builder_create(CFDictionaryRef dictionary, bool is_apple)
497  {
498      return [[SEC_CONCRETE_CLASS_NAME(sec_protocol_configuration_builder) alloc] initWithDictionary:dictionary andInternalFlag:is_apple];
499  }
500  
501  CFDictionaryRef
502  sec_protocol_configuration_builder_get_ats_dictionary(sec_protocol_configuration_builder_t builder)
503  {
504      return builder->dictionary;
505  }
506  
507  bool
508  sec_protocol_configuration_builder_get_is_apple_bundle(sec_protocol_configuration_builder_t builder)
509  {
510      return builder->is_apple;
511  }
512  
513  SEC_OBJECT_IMPL_INTERNAL_OBJC(sec_protocol_configuration,
514  {
515      xpc_object_t dictionary;
516  });
517  
518  @implementation SEC_CONCRETE_CLASS_NAME(sec_protocol_configuration)
519  
520  - (id)init {
521      if ((self = [super init])) {
522          self->dictionary = xpc_dictionary_create(NULL, NULL, 0);
523      }
524      return self;
525  }
526  
527  static sec_protocol_configuration_t
528  sec_protocol_configuration_create(void)
529  {
530      return [[SEC_CONCRETE_CLASS_NAME(sec_protocol_configuration) alloc] init];
531  }
532  
533  sec_protocol_configuration_t
534  sec_protocol_configuration_create_with_builder(sec_protocol_configuration_builder_t builder)
535  {
536      sec_protocol_configuration_t configuration = sec_protocol_configuration_create();
537      if (configuration) {
538          if (builder->is_apple) {
539              os_log_debug(OS_LOG_DEFAULT, "Building default configuration for first-party bundle");
540              sec_protocol_configuration_populate_insecure_defaults(configuration);
541          } else {
542              os_log_debug(OS_LOG_DEFAULT, "Building default configuration for third-party bundle");
543              sec_protocol_configuration_populate_secure_defaults(configuration);
544          }
545  
546          sec_protocol_configuration_register_builtin_exceptions(configuration);
547          CFDictionaryRef dictionary = builder->dictionary;
548          if (dictionary) {
549              os_log_debug(OS_LOG_DEFAULT, "Setting configuration overrides based on AppTransportSecurity exceptions");
550              sec_protocol_configuration_set_ats_overrides(configuration, dictionary);
551          } else {
552              os_log_debug(OS_LOG_DEFAULT, "Using default configuration settings");
553          }
554      } else {
555          os_log_error(OS_LOG_DEFAULT, "sec_protocol_configuration_create failed");
556      }
557      return configuration;
558  }
559  
560  xpc_object_t
561  sec_protocol_configuration_get_map(sec_protocol_configuration_t configuration)
562  {
563      return configuration->dictionary;
564  }
565  
566  @end