#include "hx_locl.h"
extern bool isCertECDSA(CFTypeRef *);
#if defined(HAVE_FRAMEWORK_SECURITY)
#include <Security/Security.h>
#include <Security/SecKeyPriv.h>
#define kSecECCurveSecp256r1 CFSTR("73")
struct kc_rsa {
SecKeyRef pkey;
size_t keysize;
CFTypeRef authContext;
};
static int
kc_rsa_public_encrypt(int flen,
const unsigned char *from,
unsigned char *to,
RSA *rsa,
int padding)
{
return -1;
}
static int
kc_rsa_public_decrypt(int flen,
const unsigned char *from,
unsigned char *to,
RSA *rsa,
int padding)
{
return -1;
}
static int
kc_ecdsa_public_encrypt(int flen,
const unsigned char *from,
unsigned char *to,
ECDSA *ecdsa,
int padding)
{
return -1;
}
static int
kc_ecdsa_public_decrypt(int flen,
const unsigned char *from,
unsigned char *to,
ECDSA *ecdsa,
int padding)
{
return -1;
}
static SecKeyRef
createKeyDuplicateWithAuthContext(SecKeyRef origKey, CFTypeRef authContext)
{
SecKeyRef key = SecKeyCreateDuplicate(origKey);
bool allowAuthenticationUI = false;
if (authContext) {
if (CFGetTypeID(authContext) == CFBooleanGetTypeID()) {
if (CFBooleanGetValue((CFBooleanRef)authContext)) {
allowAuthenticationUI = true;
}
} else { SecKeySetParameter(key, kSecUseAuthenticationContext, authContext, NULL);
allowAuthenticationUI = true;
}
}
if (!allowAuthenticationUI) {
SecKeySetParameter(key, kSecUseAuthenticationUI, kSecUseAuthenticationUIFail, NULL);
}
return key;
}
static int
kc_ecdsa_sign(int type, const unsigned char *from, unsigned int flen,
unsigned char *to, unsigned int *tlen, const ECDSA *ecdsa)
{
struct kc_rsa *kc = ECDSA_get_app_data(rk_UNCONST(ecdsa));
SecKeyRef privKeyRef = kc->pkey;
SecKeyRef key;
CFTypeRef authContext = kc->authContext;
size_t klen = kc->keysize;
CFDataRef sig, in;
CFErrorRef error = NULL;
int fret = 0;
SecKeyAlgorithm stype;
stype = kSecKeyAlgorithmECDSASignatureDigestX962SHA256;
key = createKeyDuplicateWithAuthContext(privKeyRef, authContext);
in = CFDataCreate(kCFAllocatorDefault, (const UInt8 *)from, flen);
sig = SecKeyCreateSignature(key, stype, in, &error);
size_t slen = sig ? CFDataGetLength(sig) : 0;
if (sig && slen <= klen) {
fret = 1;
*tlen = (unsigned int)slen;
memcpy(to, CFDataGetBytePtr(sig), slen);
} else {
fret = -1;
}
if (key) {
CFRelease(key);
}
if (in) {
CFRelease(in);
}
if (sig) {
CFRelease(sig);
}
if (error) {
CFRelease(error);
}
return fret;
}
static int
kc_rsa_sign(int type, const unsigned char *from, unsigned int flen,
unsigned char *to, unsigned int *tlen, const RSA *rsa)
{
struct kc_rsa *kc = RSA_get_app_data(rk_UNCONST(rsa));
SecKeyRef privKeyRef = kc->pkey;
SecKeyRef key;
CFTypeRef authContext = kc->authContext;
size_t klen = kc->keysize;
CFDataRef sig, in;
int fret = 0;
SecKeyAlgorithm stype;
if (type == NID_md5) {
stype = kSecKeyAlgorithmRSASignatureDigestPKCS1v15MD5;
} else if (type == NID_sha1) {
stype = kSecKeyAlgorithmRSASignatureDigestPKCS1v15SHA1;
} else if (type == NID_sha256) {
stype = kSecKeyAlgorithmRSASignatureDigestPKCS1v15SHA256;
} else if (type == NID_sha384) {
stype = kSecKeyAlgorithmRSASignatureDigestPKCS1v15SHA384;
} else if (type == NID_sha512) {
stype = kSecKeyAlgorithmRSASignatureDigestPKCS1v15SHA512;
} else
return -1;
key = createKeyDuplicateWithAuthContext(privKeyRef, authContext);
in = CFDataCreate(kCFAllocatorDefault, (const UInt8 *)from, flen);
sig = SecKeyCreateSignature(key, stype, in, NULL);
size_t slen = sig ? CFDataGetLength(sig) : 0;
if (sig && slen <= klen) {
fret = 1;
*tlen = (unsigned int)slen;
memcpy(to, CFDataGetBytePtr(sig), slen);
} else {
fret = -1;
}
if (key) {
CFRelease(key);
}
if (in) {
CFRelease(in);
}
if (sig) {
CFRelease(sig);
}
return fret;
}
static int
kc_ecdsa_private_encrypt(int flen,
const unsigned char *from,
unsigned char *to,
ECDSA *ecdsa,
int padding)
{
return 1;
}
static int
kc_rsa_private_encrypt(int flen,
const unsigned char *from,
unsigned char *to,
RSA *rsa,
int padding)
{
struct kc_rsa *kc = RSA_get_app_data(rsa);
SecKeyRef privKeyRef = kc->pkey;
SecKeyRef key;
CFTypeRef authContext = kc->authContext;
size_t klen = kc->keysize;
CFDataRef sig, in;
int fret = 0;
if (padding != RSA_PKCS1_PADDING)
return -1;
key = createKeyDuplicateWithAuthContext(privKeyRef, authContext);
in = CFDataCreate(kCFAllocatorDefault, (const UInt8 *)from, flen);
sig = SecKeyCreateSignature(key, kSecKeyAlgorithmRSASignatureRaw, in, NULL);
size_t slen = sig ? CFDataGetLength(sig) : 0;
if (sig && slen <= klen) {
fret = (int)slen;
memcpy(to, CFDataGetBytePtr(sig), slen);
} else {
fret = -1;
}
if (key) {
CFRelease(key);
}
if (in) {
CFRelease(in);
}
if (sig) {
CFRelease(sig);
}
return fret;
}
int
kc_ecdsa_private_decrypt(int flen, const unsigned char *from, unsigned char *to,
ECDSA * ecdsa, int padding)
{
return 1;
}
int
kc_rsa_private_decrypt(int flen, const unsigned char *from, unsigned char *to,
RSA * rsa, int padding)
{
struct kc_rsa *kc = RSA_get_app_data(rsa);
SecKeyRef privKeyRef = kc->pkey;
SecKeyRef key;
CFTypeRef authContext = kc->authContext;
size_t klen = kc->keysize;
CFDataRef out, in;
int fret = 0;
if (padding != RSA_PKCS1_PADDING)
return -1;
key = createKeyDuplicateWithAuthContext(privKeyRef, authContext);
in = CFDataCreate(kCFAllocatorDefault, (const UInt8 *)from, flen);
out = SecKeyCreateDecryptedData(key, kSecKeyAlgorithmRSAEncryptionPKCS1, in, NULL);
size_t olen = out ? CFDataGetLength(out) : 0;
if (out && olen <= klen) {
fret = (int)olen;
memcpy(to, CFDataGetBytePtr(out), olen);
} else {
fret = -1;
}
if (key) {
CFRelease(key);
}
if (in) {
CFRelease(in);
}
if (out) {
CFRelease(out);
}
return fret;
}
static int
kc_ecdsa_init(ECDSA *ecdsa)
{
return 1;
}
static int
kc_rsa_init(RSA *rsa)
{
return 1;
}
static int
kc_ecdsa_finish(ECDSA *ecdsa)
{
struct kc_rsa *kc_ecdsa = ECDSA_get_app_data(ecdsa);
if (kc_ecdsa) {
CFRelease(kc_ecdsa->pkey);
if (kc_ecdsa->authContext) {
CFRelease(kc_ecdsa->authContext);
}
free(kc_ecdsa);
}
return 1;
}
static int
kc_rsa_finish(RSA *rsa)
{
struct kc_rsa *kc_rsa = RSA_get_app_data(rsa);
if (kc_rsa) {
CFRelease(kc_rsa->pkey);
if (kc_rsa->authContext) {
CFRelease(kc_rsa->authContext);
}
free(kc_rsa);
}
return 1;
}
static const RSA_METHOD kc_rsa_pkcs1_method = {
"hx509 Keychain PKCS#1 RSA",
kc_rsa_public_encrypt,
kc_rsa_public_decrypt,
kc_rsa_private_encrypt,
kc_rsa_private_decrypt,
NULL,
NULL,
kc_rsa_init,
kc_rsa_finish,
0,
NULL,
kc_rsa_sign,
NULL
};
const ECDSA_METHOD kc_ecdsa_pkcs1_method = {
"hx509 Keychain PKCS#1 ECDSA",
kc_ecdsa_public_encrypt,
kc_ecdsa_public_decrypt,
kc_ecdsa_private_encrypt,
kc_ecdsa_private_decrypt,
kc_ecdsa_init,
kc_ecdsa_finish,
0,
kc_ecdsa_sign,
NULL
};
static int
set_private_key(hx509_context context, hx509_cert cert, SecKeyRef pkey, void *authContext)
{
const SubjectPublicKeyInfo *spi;
const Certificate *c;
struct kc_rsa *kc;
RSAPublicKey pk;
hx509_private_key key;
size_t size;
RSA *rsa;
int ret;
ret = hx509_private_key_init(&key, NULL, NULL);
if (ret)
return ret;
kc = calloc(1, sizeof(*kc));
if (kc == NULL)
_hx509_abort("out of memory");
CFRetain(pkey);
kc->pkey = pkey;
if (authContext) {
CFRetain(authContext);
kc->authContext = authContext;
}
rsa = RSA_new();
if (rsa == NULL)
_hx509_abort("out of memory");
RSA_set_method(rsa, &kc_rsa_pkcs1_method);
ret = RSA_set_app_data(rsa, kc);
if (ret != 1)
_hx509_abort("RSA_set_app_data");
c = _hx509_get_cert(cert);
spi = &c->tbsCertificate.subjectPublicKeyInfo;
ret = decode_RSAPublicKey(spi->subjectPublicKey.data,
spi->subjectPublicKey.length / 8,
&pk, &size);
if (ret) {
RSA_free(rsa);
return 0;
}
rsa->n = _hx509_int2BN(&pk.modulus);
rsa->e = _hx509_int2BN(&pk.publicExponent);
free_RSAPublicKey(&pk);
kc->keysize = BN_num_bytes(rsa->n);
hx509_private_key_assign_rsa(key, rsa);
_hx509_cert_set_key(cert, key);
hx509_private_key_free(&key);
return 0;
}
static int
set_private_key_ecdsa(hx509_context context, hx509_cert cert, SecKeyRef pkey, void *authContext)
{
const Certificate *c;
struct kc_rsa *kc;
hx509_private_key key;
ECDSA *ecdsa;
int ret;
hx509_set_error_string(context, 0, ENOMEM, "kc4");
struct hx509_private_key_ops *ops;
ops = hx509_find_private_alg(ASN1_OID_ID_ECPUBLICKEY);
if (ops == NULL) {
hx509_clear_error_string(context);
return HX509_SIG_ALG_NO_SUPPORTED;
}
ret = hx509_private_key_init(&key, ops, NULL);
if (ret) {
return ret;
}
kc = calloc(1, sizeof(*kc));
if (kc == NULL)
_hx509_abort("out of memory");
CFRetain(pkey);
kc->pkey = pkey;
kc->keysize = ECDSA_KEY_SIZE;
if (authContext) {
CFRetain(authContext);
kc->authContext = authContext;
}
ecdsa = ECDSA_new();
if (ecdsa == NULL)
_hx509_abort("out of memory");
ECDSA_set_method(ecdsa, &kc_ecdsa_pkcs1_method);
ret = ECDSA_set_app_data(ecdsa, kc);
if (ret != 1)
_hx509_abort("ECDSA_set_app_data");
c = _hx509_get_cert(cert);
hx509_private_key_assign_ecdsa(key, ecdsa);
_hx509_cert_set_key(cert, key);
hx509_private_key_free(&key);
return 0;
}
struct ks_keychain {
int anchors;
#ifndef __APPLE_TARGET_EMBEDDED__
SecKeychainRef keychain;
#endif
};
static int
keychain_init(hx509_context context,
hx509_certs certs, void **data, int flags,
const char *residue, hx509_lock lock)
{
struct ks_keychain *ctx;
ctx = calloc(1, sizeof(*ctx));
if (ctx == NULL) {
hx509_clear_error_string(context);
return ENOMEM;
}
if (residue && residue[0]) {
#ifndef __APPLE_TARGET_EMBEDDED__
if (strcasecmp(residue, "system-anchors") == 0) {
ctx->anchors = 1;
} else if (strncasecmp(residue, "FILE:", 5) == 0) {
OSStatus ret;
ret = SecKeychainOpen(residue + 5, &ctx->keychain);
if (ret != noErr) {
free(ctx);
hx509_set_error_string(context, 0, ENOENT,
"Failed to open %s", residue);
return ENOENT;
}
} else
#endif
{
free(ctx);
hx509_set_error_string(context, 0, ENOENT,
"Unknown subtype %s", residue);
return ENOENT;
}
}
*data = ctx;
return 0;
}
static int
keychain_free(hx509_certs certs, void *data)
{
struct ks_keychain *ctx = data;
if (ctx) {
#ifndef __APPLE_TARGET_EMBEDDED__
if (ctx->keychain)
CFRelease(ctx->keychain);
#endif
memset(ctx, 0, sizeof(*ctx));
free(ctx);
}
return 0;
}
static int
keychain_query(hx509_context context,
hx509_certs certs,
void *data,
const hx509_query *query,
hx509_cert *retcert)
{
CFArrayRef identities = NULL;
hx509_cert cert = NULL;
CFIndex n, count;
int ret;
int kdcLookupHack = 0;
#define FASTER_FLAGS (HX509_QUERY_MATCH_PERSISTENT|HX509_QUERY_PRIVATE_KEY)
if ((query->match & FASTER_FLAGS) == 0)
return HX509_UNIMPLEMENTED_OPERATION;
CFMutableDictionaryRef secQuery = CFDictionaryCreateMutable(NULL, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
if ((query->match & HX509_QUERY_MATCH_FRIENDLY_NAME) &&
(query->match & HX509_QUERY_PRIVATE_KEY) &&
strcmp(query->friendlyname, "O=System Identity,CN=com.apple.kerberos.kdc") == 0)
{
((hx509_query *)query)->match &= ~HX509_QUERY_PRIVATE_KEY;
kdcLookupHack = 1;
}
if (kdcLookupHack || (query->match & HX509_QUERY_MATCH_PERSISTENT)) {
CFDictionaryAddValue(secQuery, kSecClass, kSecClassCertificate);
} else
CFDictionaryAddValue(secQuery, kSecClass, kSecClassIdentity);
CFDictionaryAddValue(secQuery, kSecReturnRef, kCFBooleanTrue);
CFDictionaryAddValue(secQuery, kSecMatchLimit, kSecMatchLimitAll);
if (query->match & HX509_QUERY_MATCH_PERSISTENT) {
CFDataRef refdata = CFDataCreateWithBytesNoCopy(NULL, query->persistent->data, query->persistent->length, kCFAllocatorNull);
CFDictionaryAddValue(secQuery, kSecValuePersistentRef, refdata);
CFRelease(refdata);
}
OSStatus status = SecItemCopyMatching(secQuery, (CFTypeRef *)&identities);
CFRelease(secQuery);
if (status || identities == NULL) {
hx509_clear_error_string(context);
return HX509_CERT_NOT_FOUND;
}
heim_assert(CFArrayGetTypeID() == CFGetTypeID(identities), "return value not an array");
count = CFArrayGetCount(identities);
for (n = 0; n < count; n++) {
CFTypeRef secitem = (CFTypeRef)CFArrayGetValueAtIndex(identities, n);
#ifndef __APPLE_TARGET_EMBEDDED__
if (query->match & HX509_QUERY_MATCH_PERSISTENT) {
SecIdentityRef other = NULL;
OSStatus osret;
osret = SecIdentityCreateWithCertificate(NULL, (SecCertificateRef)secitem, &other);
if (osret == noErr) {
ret = hx509_cert_init_SecFramework(context, (void *)other, &cert);
CFRelease(other);
if (ret)
continue;
} else {
ret = hx509_cert_init_SecFramework(context, (void *)secitem, &cert);
if (ret)
continue;
}
} else
#endif
{
ret = hx509_cert_init_SecFramework(context, (void *)secitem, &cert);
if (ret)
continue;
}
if (_hx509_query_match_cert(context, query, cert)) {
#ifndef __APPLE_TARGET_EMBEDDED__
if (kdcLookupHack) {
SecIdentityRef other = NULL;
OSStatus osret;
osret = SecIdentityCreateWithCertificate(NULL, (SecCertificateRef)secitem, &other);
if (osret == noErr) {
hx509_cert_free(cert);
ret = hx509_cert_init_SecFramework(context, other, &cert);
CFRelease(other);
if (ret)
continue;
}
}
#endif
*retcert = cert;
break;
}
hx509_cert_free(cert);
}
if (kdcLookupHack)
((hx509_query *)query)->match |= HX509_QUERY_PRIVATE_KEY;
CFRelease(identities);
if (*retcert == NULL) {
hx509_clear_error_string(context);
return HX509_CERT_NOT_FOUND;
}
return 0;
}
struct iter {
hx509_certs certs;
void *cursor;
CFArrayRef search;
CFIndex index;
};
static int
keychain_iter_start(hx509_context context,
hx509_certs certs, void *data, void **cursor)
{
#ifndef __APPLE_TARGET_EMBEDDED__
struct ks_keychain *ctx = data;
#endif
struct iter *iter;
iter = calloc(1, sizeof(*iter));
if (iter == NULL) {
hx509_set_error_string(context, 0, ENOMEM, "out of memory");
return ENOMEM;
}
#ifndef __APPLE_TARGET_EMBEDDED__
if (ctx->anchors) {
CFArrayRef anchors;
int ret;
int i;
ret = hx509_certs_init(context, "MEMORY:ks-file-create",
0, NULL, &iter->certs);
if (ret) {
free(iter);
return ret;
}
ret = SecTrustCopyAnchorCertificates(&anchors);
if (ret != 0) {
hx509_certs_free(&iter->certs);
free(iter);
hx509_set_error_string(context, 0, ENOMEM,
"Can't get trust anchors from Keychain");
return ENOMEM;
}
for (i = 0; i < CFArrayGetCount(anchors); i++) {
SecCertificateRef cr;
hx509_cert cert;
CFDataRef dataref;
cr = (SecCertificateRef)CFArrayGetValueAtIndex(anchors, i);
dataref = SecCertificateCopyData(cr);
if (dataref == NULL)
continue;
ret = hx509_cert_init_data(context, CFDataGetBytePtr(dataref), CFDataGetLength(dataref), &cert);
CFRelease(dataref);
if (ret)
continue;
ret = hx509_certs_add(context, iter->certs, cert);
hx509_cert_free(cert);
}
CFRelease(anchors);
if (ret != 0) {
hx509_certs_free(&iter->certs);
free(iter);
hx509_set_error_string(context, 0, ret,
"Failed to add cert");
return ret;
}
}
if (iter->certs) {
int ret;
ret = hx509_certs_start_seq(context, iter->certs, &iter->cursor);
if (ret) {
hx509_certs_free(&iter->certs);
free(iter);
return ret;
}
} else
#endif
{
OSStatus ret;
const void *keys[] = {
kSecClass,
kSecReturnRef,
kSecMatchLimit
};
const void *values[] = {
kSecClassCertificate,
kCFBooleanTrue,
kSecMatchLimitAll
};
CFDictionaryRef secQuery;
secQuery = CFDictionaryCreate(NULL, keys, values,
sizeof(keys) / sizeof(*keys),
&kCFTypeDictionaryKeyCallBacks,
&kCFTypeDictionaryValueCallBacks);
ret = SecItemCopyMatching(secQuery, (CFTypeRef *)&iter->search);
CFRelease(secQuery);
if (ret) {
free(iter);
return ENOMEM;
}
}
*cursor = iter;
return 0;
}
static int
keychain_iter(hx509_context context,
hx509_certs certs, void *data, void *cursor, hx509_cert *cert)
{
struct iter *iter = cursor;
OSStatus ret = 0;
if (iter->certs)
return hx509_certs_next_cert(context, iter->certs, iter->cursor, cert);
*cert = NULL;
next:
if (iter->index < CFArrayGetCount(iter->search)) {
CFTypeRef secCert = CFArrayGetValueAtIndex(iter->search, iter->index);
ret = hx509_cert_init_SecFramework(context, (void *)secCert, cert);
iter->index++;
if (ret)
goto next;
}
if (iter->index == CFArrayGetCount(iter->search))
return 0;
return ret;
}
static int
keychain_iter_end(hx509_context context,
hx509_certs certs,
void *data,
void *cursor)
{
struct iter *iter = cursor;
if (iter->certs) {
hx509_certs_end_seq(context, iter->certs, iter->cursor);
hx509_certs_free(&iter->certs);
} else {
CFRelease(iter->search);
}
memset(iter, 0, sizeof(*iter));
free(iter);
return 0;
}
struct hx509_keyset_ops keyset_keychain = {
"KEYCHAIN",
0,
keychain_init,
NULL,
keychain_free,
NULL,
keychain_query,
keychain_iter_start,
keychain_iter,
keychain_iter_end
};
#endif
void
_hx509_ks_keychain_register(hx509_context context)
{
#if defined(HAVE_FRAMEWORK_SECURITY)
_hx509_ks_register(context, &keyset_keychain);
#endif
}
static void
kc_cert_release(hx509_cert cert, void *ctx)
{
SecCertificateRef seccert = ctx;
CFRelease(seccert);
}
static void
setPersistentRef(hx509_cert cert, SecCertificateRef itemRef)
{
#if !__APPLE_TARGET_EMBEDDED__
CFDataRef persistent;
OSStatus ret;
ret = SecKeychainItemCreatePersistentReference((SecKeychainItemRef)itemRef, &persistent);
if (ret == noErr) {
heim_octet_string os;
os.data = rk_UNCONST(CFDataGetBytePtr(persistent));
os.length = CFDataGetLength(persistent);
hx509_cert_set_persistent(cert, &os);
CFRelease(persistent);
}
#endif
}
int
hx509_cert_init_SecFrameworkAuth(hx509_context context, void * identity, hx509_cert *cert, void *authContext)
{
CFTypeID typeid = CFGetTypeID(identity);
SecCertificateRef seccert;
CFTypeRef secdata = NULL;
SecKeyRef pkey = NULL;
CFDataRef data;
OSStatus osret;
hx509_cert c;
int ret;
*cert = NULL;
if (CFDataGetTypeID() == typeid) {
void const * keys[4] = {
kSecClass,
kSecReturnRef,
kSecMatchLimit,
kSecValuePersistentRef
};
void const * values[4] = {
kSecClassIdentity,
kCFBooleanTrue,
kSecMatchLimitOne,
identity
};
CFDictionaryRef query;
assert(sizeof(keys) == sizeof(values));
query = CFDictionaryCreate(NULL, keys, values,
sizeof(keys) / sizeof(*keys),
&kCFTypeDictionaryKeyCallBacks,
&kCFTypeDictionaryValueCallBacks);
osret = SecItemCopyMatching(query, &secdata);
CFRelease(query);
if (osret || secdata == NULL) {
hx509_set_error_string(context, 0, HX509_CERTIFICATE_UNKNOWN_TYPE,
"Failed to turn persistent reference into a certifiate: %d", (int)osret);
return HX509_CERTIFICATE_UNKNOWN_TYPE;
}
typeid = CFGetTypeID(secdata);
identity = (void *)secdata;
}
if (SecIdentityGetTypeID() == typeid) {
osret = SecIdentityCopyCertificate(identity, &seccert);
if (osret) {
if (secdata)
CFRelease(secdata);
hx509_set_error_string(context, 0, HX509_CERTIFICATE_UNKNOWN_TYPE,
"Failed to convert the identity to a certificate: %d", (int)osret);
return HX509_CERTIFICATE_UNKNOWN_TYPE;
}
} else if (SecCertificateGetTypeID() == typeid) {
seccert = (SecCertificateRef)identity;
CFRetain(seccert);
} else {
if (secdata)
CFRelease(secdata);
hx509_set_error_string(context, 0, HX509_CERTIFICATE_UNKNOWN_TYPE,
"Data from persistent ref not a identity or certificate");
return HX509_CERTIFICATE_UNKNOWN_TYPE;
}
data = SecCertificateCopyData(seccert);
if (data == NULL) {
if (secdata)
CFRelease(secdata);
CFRelease(seccert);
return ENOMEM;
}
ret = hx509_cert_init_data(context, CFDataGetBytePtr(data),
CFDataGetLength(data), &c);
CFRelease(data);
if (ret) {
if (secdata)
CFRelease(secdata);
CFRelease(seccert);
return ret;
}
setPersistentRef(c, seccert);
if (SecIdentityGetTypeID() == typeid) {
osret = SecIdentityCopyPrivateKey(identity, &pkey);
}
if (pkey) {
SecKeyRef key;
CFDictionaryRef keyAttrs = NULL;
CFStringRef keyType = NULL;
bool certIsECDSA = false;
key = SecCertificateCopyKey(seccert);
if (key != NULL) {
keyAttrs = SecKeyCopyAttributes(key);
CFRelease(key);
}
if (keyAttrs != NULL ) {
keyType = CFDictionaryGetValue(keyAttrs, kSecAttrKeyType);
CFRelease(keyAttrs);
}
if (keyType != NULL) {
certIsECDSA = CFEqual(keyType, kSecAttrKeyTypeECSECPrimeRandom);
CFRelease(keyType);
}
if (certIsECDSA) {
set_private_key_ecdsa(context, c, pkey, authContext);
} else {
set_private_key(context, c, pkey, authContext);
}
CFRelease(pkey);
}
_hx509_cert_set_release(c, kc_cert_release, seccert);
if (secdata)
CFRelease(secdata);
*cert = c;
return 0;
}
int
hx509_cert_init_SecFramework(hx509_context context, void * identity, hx509_cert *cert)
{
return hx509_cert_init_SecFrameworkAuth(context, identity, cert, NULL);
}