1 /* $NetBSD: ks_keychain.c,v 1.1.1.1 2011/04/13 18:15:11 elric Exp $ */ 2 3 /* 4 * Copyright (c) 2007 Kungliga Tekniska Högskolan 5 * (Royal Institute of Technology, Stockholm, Sweden). 6 * All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 19 * 3. Neither the name of the Institute nor the names of its contributors 20 * may be used to endorse or promote products derived from this software 21 * without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 24 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26 * ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 27 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33 * SUCH DAMAGE. 34 */ 35 36 #include "hx_locl.h" 37 38 #ifdef HAVE_FRAMEWORK_SECURITY 39 40 #include <Security/Security.h> 41 42 /* Missing function decls in pre Leopard */ 43 #ifdef NEED_SECKEYGETCSPHANDLE_PROTO 44 OSStatus SecKeyGetCSPHandle(SecKeyRef, CSSM_CSP_HANDLE *); 45 OSStatus SecKeyGetCredentials(SecKeyRef, CSSM_ACL_AUTHORIZATION_TAG, 46 int, const CSSM_ACCESS_CREDENTIALS **); 47 #define kSecCredentialTypeDefault 0 48 #define CSSM_SIZE uint32_t 49 #endif 50 51 52 static int 53 getAttribute(SecKeychainItemRef itemRef, SecItemAttr item, 54 SecKeychainAttributeList **attrs) 55 { 56 SecKeychainAttributeInfo attrInfo; 57 UInt32 attrFormat = 0; 58 OSStatus ret; 59 60 *attrs = NULL; 61 62 attrInfo.count = 1; 63 attrInfo.tag = &item; 64 attrInfo.format = &attrFormat; 65 66 ret = SecKeychainItemCopyAttributesAndData(itemRef, &attrInfo, NULL, 67 attrs, NULL, NULL); 68 if (ret) 69 return EINVAL; 70 return 0; 71 } 72 73 74 /* 75 * 76 */ 77 78 struct kc_rsa { 79 SecKeychainItemRef item; 80 size_t keysize; 81 }; 82 83 84 static int 85 kc_rsa_public_encrypt(int flen, 86 const unsigned char *from, 87 unsigned char *to, 88 RSA *rsa, 89 int padding) 90 { 91 return -1; 92 } 93 94 static int 95 kc_rsa_public_decrypt(int flen, 96 const unsigned char *from, 97 unsigned char *to, 98 RSA *rsa, 99 int padding) 100 { 101 return -1; 102 } 103 104 105 static int 106 kc_rsa_private_encrypt(int flen, 107 const unsigned char *from, 108 unsigned char *to, 109 RSA *rsa, 110 int padding) 111 { 112 struct kc_rsa *kc = RSA_get_app_data(rsa); 113 114 CSSM_RETURN cret; 115 OSStatus ret; 116 const CSSM_ACCESS_CREDENTIALS *creds; 117 SecKeyRef privKeyRef = (SecKeyRef)kc->item; 118 CSSM_CSP_HANDLE cspHandle; 119 const CSSM_KEY *cssmKey; 120 CSSM_CC_HANDLE sigHandle = 0; 121 CSSM_DATA sig, in; 122 int fret = 0; 123 124 if (padding != RSA_PKCS1_PADDING) 125 return -1; 126 127 cret = SecKeyGetCSSMKey(privKeyRef, &cssmKey); 128 if(cret) abort(); 129 130 cret = SecKeyGetCSPHandle(privKeyRef, &cspHandle); 131 if(cret) abort(); 132 133 ret = SecKeyGetCredentials(privKeyRef, CSSM_ACL_AUTHORIZATION_SIGN, 134 kSecCredentialTypeDefault, &creds); 135 if(ret) abort(); 136 137 ret = CSSM_CSP_CreateSignatureContext(cspHandle, CSSM_ALGID_RSA, 138 creds, cssmKey, &sigHandle); 139 if(ret) abort(); 140 141 in.Data = (uint8 *)from; 142 in.Length = flen; 143 144 sig.Data = (uint8 *)to; 145 sig.Length = kc->keysize; 146 147 cret = CSSM_SignData(sigHandle, &in, 1, CSSM_ALGID_NONE, &sig); 148 if(cret) { 149 /* cssmErrorString(cret); */ 150 fret = -1; 151 } else 152 fret = sig.Length; 153 154 if(sigHandle) 155 CSSM_DeleteContext(sigHandle); 156 157 return fret; 158 } 159 160 static int 161 kc_rsa_private_decrypt(int flen, const unsigned char *from, unsigned char *to, 162 RSA * rsa, int padding) 163 { 164 struct kc_rsa *kc = RSA_get_app_data(rsa); 165 166 CSSM_RETURN cret; 167 OSStatus ret; 168 const CSSM_ACCESS_CREDENTIALS *creds; 169 SecKeyRef privKeyRef = (SecKeyRef)kc->item; 170 CSSM_CSP_HANDLE cspHandle; 171 const CSSM_KEY *cssmKey; 172 CSSM_CC_HANDLE handle = 0; 173 CSSM_DATA out, in, rem; 174 int fret = 0; 175 CSSM_SIZE outlen = 0; 176 char remdata[1024]; 177 178 if (padding != RSA_PKCS1_PADDING) 179 return -1; 180 181 cret = SecKeyGetCSSMKey(privKeyRef, &cssmKey); 182 if(cret) abort(); 183 184 cret = SecKeyGetCSPHandle(privKeyRef, &cspHandle); 185 if(cret) abort(); 186 187 ret = SecKeyGetCredentials(privKeyRef, CSSM_ACL_AUTHORIZATION_DECRYPT, 188 kSecCredentialTypeDefault, &creds); 189 if(ret) abort(); 190 191 192 ret = CSSM_CSP_CreateAsymmetricContext (cspHandle, 193 CSSM_ALGID_RSA, 194 creds, 195 cssmKey, 196 CSSM_PADDING_PKCS1, 197 &handle); 198 if(ret) abort(); 199 200 in.Data = (uint8 *)from; 201 in.Length = flen; 202 203 out.Data = (uint8 *)to; 204 out.Length = kc->keysize; 205 206 rem.Data = (uint8 *)remdata; 207 rem.Length = sizeof(remdata); 208 209 cret = CSSM_DecryptData(handle, &in, 1, &out, 1, &outlen, &rem); 210 if(cret) { 211 /* cssmErrorString(cret); */ 212 fret = -1; 213 } else 214 fret = out.Length; 215 216 if(handle) 217 CSSM_DeleteContext(handle); 218 219 return fret; 220 } 221 222 static int 223 kc_rsa_init(RSA *rsa) 224 { 225 return 1; 226 } 227 228 static int 229 kc_rsa_finish(RSA *rsa) 230 { 231 struct kc_rsa *kc_rsa = RSA_get_app_data(rsa); 232 CFRelease(kc_rsa->item); 233 memset(kc_rsa, 0, sizeof(*kc_rsa)); 234 free(kc_rsa); 235 return 1; 236 } 237 238 static const RSA_METHOD kc_rsa_pkcs1_method = { 239 "hx509 Keychain PKCS#1 RSA", 240 kc_rsa_public_encrypt, 241 kc_rsa_public_decrypt, 242 kc_rsa_private_encrypt, 243 kc_rsa_private_decrypt, 244 NULL, 245 NULL, 246 kc_rsa_init, 247 kc_rsa_finish, 248 0, 249 NULL, 250 NULL, 251 NULL 252 }; 253 254 static int 255 set_private_key(hx509_context context, 256 SecKeychainItemRef itemRef, 257 hx509_cert cert) 258 { 259 struct kc_rsa *kc; 260 hx509_private_key key; 261 RSA *rsa; 262 int ret; 263 264 ret = hx509_private_key_init(&key, NULL, NULL); 265 if (ret) 266 return ret; 267 268 kc = calloc(1, sizeof(*kc)); 269 if (kc == NULL) 270 _hx509_abort("out of memory"); 271 272 kc->item = itemRef; 273 274 rsa = RSA_new(); 275 if (rsa == NULL) 276 _hx509_abort("out of memory"); 277 278 /* Argh, fake modulus since OpenSSL API is on crack */ 279 { 280 SecKeychainAttributeList *attrs = NULL; 281 uint32_t size; 282 void *data; 283 284 rsa->n = BN_new(); 285 if (rsa->n == NULL) abort(); 286 287 ret = getAttribute(itemRef, kSecKeyKeySizeInBits, &attrs); 288 if (ret) abort(); 289 290 size = *(uint32_t *)attrs->attr[0].data; 291 SecKeychainItemFreeAttributesAndData(attrs, NULL); 292 293 kc->keysize = (size + 7) / 8; 294 295 data = malloc(kc->keysize); 296 memset(data, 0xe0, kc->keysize); 297 BN_bin2bn(data, kc->keysize, rsa->n); 298 free(data); 299 } 300 rsa->e = NULL; 301 302 RSA_set_method(rsa, &kc_rsa_pkcs1_method); 303 ret = RSA_set_app_data(rsa, kc); 304 if (ret != 1) 305 _hx509_abort("RSA_set_app_data"); 306 307 hx509_private_key_assign_rsa(key, rsa); 308 _hx509_cert_assign_key(cert, key); 309 310 return 0; 311 } 312 313 /* 314 * 315 */ 316 317 struct ks_keychain { 318 int anchors; 319 SecKeychainRef keychain; 320 }; 321 322 static int 323 keychain_init(hx509_context context, 324 hx509_certs certs, void **data, int flags, 325 const char *residue, hx509_lock lock) 326 { 327 struct ks_keychain *ctx; 328 329 ctx = calloc(1, sizeof(*ctx)); 330 if (ctx == NULL) { 331 hx509_clear_error_string(context); 332 return ENOMEM; 333 } 334 335 if (residue) { 336 if (strcasecmp(residue, "system-anchors") == 0) { 337 ctx->anchors = 1; 338 } else if (strncasecmp(residue, "FILE:", 5) == 0) { 339 OSStatus ret; 340 341 ret = SecKeychainOpen(residue + 5, &ctx->keychain); 342 if (ret != noErr) { 343 hx509_set_error_string(context, 0, ENOENT, 344 "Failed to open %s", residue); 345 return ENOENT; 346 } 347 } else { 348 hx509_set_error_string(context, 0, ENOENT, 349 "Unknown subtype %s", residue); 350 return ENOENT; 351 } 352 } 353 354 *data = ctx; 355 return 0; 356 } 357 358 /* 359 * 360 */ 361 362 static int 363 keychain_free(hx509_certs certs, void *data) 364 { 365 struct ks_keychain *ctx = data; 366 if (ctx->keychain) 367 CFRelease(ctx->keychain); 368 memset(ctx, 0, sizeof(*ctx)); 369 free(ctx); 370 return 0; 371 } 372 373 /* 374 * 375 */ 376 377 struct iter { 378 hx509_certs certs; 379 void *cursor; 380 SecKeychainSearchRef searchRef; 381 }; 382 383 static int 384 keychain_iter_start(hx509_context context, 385 hx509_certs certs, void *data, void **cursor) 386 { 387 struct ks_keychain *ctx = data; 388 struct iter *iter; 389 390 iter = calloc(1, sizeof(*iter)); 391 if (iter == NULL) { 392 hx509_set_error_string(context, 0, ENOMEM, "out of memory"); 393 return ENOMEM; 394 } 395 396 if (ctx->anchors) { 397 CFArrayRef anchors; 398 int ret; 399 int i; 400 401 ret = hx509_certs_init(context, "MEMORY:ks-file-create", 402 0, NULL, &iter->certs); 403 if (ret) { 404 free(iter); 405 return ret; 406 } 407 408 ret = SecTrustCopyAnchorCertificates(&anchors); 409 if (ret != 0) { 410 hx509_certs_free(&iter->certs); 411 free(iter); 412 hx509_set_error_string(context, 0, ENOMEM, 413 "Can't get trust anchors from Keychain"); 414 return ENOMEM; 415 } 416 for (i = 0; i < CFArrayGetCount(anchors); i++) { 417 SecCertificateRef cr; 418 hx509_cert cert; 419 CSSM_DATA cssm; 420 421 cr = (SecCertificateRef)CFArrayGetValueAtIndex(anchors, i); 422 423 SecCertificateGetData(cr, &cssm); 424 425 ret = hx509_cert_init_data(context, cssm.Data, cssm.Length, &cert); 426 if (ret) 427 continue; 428 429 ret = hx509_certs_add(context, iter->certs, cert); 430 hx509_cert_free(cert); 431 } 432 CFRelease(anchors); 433 } 434 435 if (iter->certs) { 436 int ret; 437 ret = hx509_certs_start_seq(context, iter->certs, &iter->cursor); 438 if (ret) { 439 hx509_certs_free(&iter->certs); 440 free(iter); 441 return ret; 442 } 443 } else { 444 OSStatus ret; 445 446 ret = SecKeychainSearchCreateFromAttributes(ctx->keychain, 447 kSecCertificateItemClass, 448 NULL, 449 &iter->searchRef); 450 if (ret) { 451 free(iter); 452 hx509_set_error_string(context, 0, ret, 453 "Failed to start search for attributes"); 454 return ENOMEM; 455 } 456 } 457 458 *cursor = iter; 459 return 0; 460 } 461 462 /* 463 * 464 */ 465 466 static int 467 keychain_iter(hx509_context context, 468 hx509_certs certs, void *data, void *cursor, hx509_cert *cert) 469 { 470 SecKeychainAttributeList *attrs = NULL; 471 SecKeychainAttributeInfo attrInfo; 472 UInt32 attrFormat[1] = { 0 }; 473 SecKeychainItemRef itemRef; 474 SecItemAttr item[1]; 475 struct iter *iter = cursor; 476 OSStatus ret; 477 UInt32 len; 478 void *ptr = NULL; 479 480 if (iter->certs) 481 return hx509_certs_next_cert(context, iter->certs, iter->cursor, cert); 482 483 *cert = NULL; 484 485 ret = SecKeychainSearchCopyNext(iter->searchRef, &itemRef); 486 if (ret == errSecItemNotFound) 487 return 0; 488 else if (ret != 0) 489 return EINVAL; 490 491 /* 492 * Pick out certificate and matching "keyid" 493 */ 494 495 item[0] = kSecPublicKeyHashItemAttr; 496 497 attrInfo.count = 1; 498 attrInfo.tag = item; 499 attrInfo.format = attrFormat; 500 501 ret = SecKeychainItemCopyAttributesAndData(itemRef, &attrInfo, NULL, 502 &attrs, &len, &ptr); 503 if (ret) 504 return EINVAL; 505 506 ret = hx509_cert_init_data(context, ptr, len, cert); 507 if (ret) 508 goto out; 509 510 /* 511 * Find related private key if there is one by looking at 512 * kSecPublicKeyHashItemAttr == kSecKeyLabel 513 */ 514 { 515 SecKeychainSearchRef search; 516 SecKeychainAttribute attrKeyid; 517 SecKeychainAttributeList attrList; 518 519 attrKeyid.tag = kSecKeyLabel; 520 attrKeyid.length = attrs->attr[0].length; 521 attrKeyid.data = attrs->attr[0].data; 522 523 attrList.count = 1; 524 attrList.attr = &attrKeyid; 525 526 ret = SecKeychainSearchCreateFromAttributes(NULL, 527 CSSM_DL_DB_RECORD_PRIVATE_KEY, 528 &attrList, 529 &search); 530 if (ret) { 531 ret = 0; 532 goto out; 533 } 534 535 ret = SecKeychainSearchCopyNext(search, &itemRef); 536 CFRelease(search); 537 if (ret == errSecItemNotFound) { 538 ret = 0; 539 goto out; 540 } else if (ret) { 541 ret = EINVAL; 542 goto out; 543 } 544 set_private_key(context, itemRef, *cert); 545 } 546 547 out: 548 SecKeychainItemFreeAttributesAndData(attrs, ptr); 549 550 return ret; 551 } 552 553 /* 554 * 555 */ 556 557 static int 558 keychain_iter_end(hx509_context context, 559 hx509_certs certs, 560 void *data, 561 void *cursor) 562 { 563 struct iter *iter = cursor; 564 565 if (iter->certs) { 566 hx509_certs_end_seq(context, iter->certs, iter->cursor); 567 hx509_certs_free(&iter->certs); 568 } else { 569 CFRelease(iter->searchRef); 570 } 571 572 memset(iter, 0, sizeof(*iter)); 573 free(iter); 574 return 0; 575 } 576 577 /* 578 * 579 */ 580 581 struct hx509_keyset_ops keyset_keychain = { 582 "KEYCHAIN", 583 0, 584 keychain_init, 585 NULL, 586 keychain_free, 587 NULL, 588 NULL, 589 keychain_iter_start, 590 keychain_iter, 591 keychain_iter_end 592 }; 593 594 #endif /* HAVE_FRAMEWORK_SECURITY */ 595 596 /* 597 * 598 */ 599 600 void 601 _hx509_ks_keychain_register(hx509_context context) 602 { 603 #ifdef HAVE_FRAMEWORK_SECURITY 604 _hx509_ks_register(context, &keyset_keychain); 605 #endif 606 } 607