#include "Keychains.h"
#include "defaultcreds.h"
#include "StorageManager.h"
#include "Globals.h"
#include "KCCursor.h"
#include <security_cdsa_utilities/Schema.h>
#include <algorithm>
namespace Security {
namespace KeychainCore {
using namespace CssmClient;
DefaultCredentials::DefaultCredentials(KeychainImpl* kcImpl, Allocator &alloc)
: TrackingAllocator(alloc), AutoCredentials(static_cast<TrackingAllocator&>(*this)),
mMade(false), mKeychainImpl (kcImpl)
{
}
void DefaultCredentials::clear()
{
TrackingAllocator::reset();
mNeededItems.clear();
mMade = false;
}
bool DefaultCredentials::operator () (Db database)
{
if (!mMade) {
try {
KeychainSchema keychainSchema = mKeychainImpl->keychainSchema();
if (keychainSchema->hasRecordType(UnlockReferralRecord::recordType))
{
clear();
Table<UnlockReferralRecord> referrals(database);
for (Table<UnlockReferralRecord>::iterator it = referrals.begin(); it != referrals.end(); it++) {
switch ((*it)->type()) {
case CSSM_APPLE_UNLOCK_TYPE_KEY_DIRECT:
case CSSM_APPLE_UNLOCK_TYPE_WRAPPED_PRIVATE:
keyReferral(**it);
break;
default:
secdebug("kcreferral", "referral type %lu (to %s) not supported",
(unsigned long)(*it)->type(), (*it)->dbName().c_str());
break;
}
}
}
secdebug("kcreferral", "%lu samples generated", (unsigned long)size());
} catch (...) {
secdebug("kcreferral", "exception setting default credentials for %s; using standard value", database->name());
}
mMade = true;
}
return size() > 0; }
void DefaultCredentials::keyReferral(const UnlockReferralRecord &ref)
{
secdebug("kcreferral", "processing type %ld referral to %s",
(long)ref.type(), ref.dbName().c_str());
DLDbIdentifier identifier(ref.dbName().c_str(), ref.dbGuid(), ref.dbSSID(), ref.dbSSType());
try {
KeychainList list;
list.push_back(globals().storageManager.keychain(identifier));
if (unlockKey(ref, list)) return; } catch (...) { }
try {
secdebug("kcreferral", "no joy with %s; trying the entire keychain list for guid %s",
ref.dbName().c_str(), ref.dbGuid().toString().c_str());
unlockKey(ref, fallbackSearchList(identifier));
return;
} catch (...) { }
secdebug("kcreferral", "no luck at all; we'll skip this record");
}
bool DefaultCredentials::unlockKey(const UnlockReferralRecord &ref, const KeychainList &list)
{
bool foundSome = false;
try {
SecKeychainAttribute attributes[1] = {
{ kSecKeyLabel, ref.keyLabel().length(), ref.keyLabel().data() }
};
SecKeychainAttributeList search = { 1, attributes };
CSSM_DB_RECORDTYPE recordType =
(ref.type() == CSSM_APPLE_UNLOCK_TYPE_KEY_DIRECT) ?
CSSM_DL_DB_RECORD_SYMMETRIC_KEY : CSSM_DL_DB_RECORD_PRIVATE_KEY;
KCCursor cursor(list, recordType, &search);
Item keyItem;
while (cursor->next(keyItem)) {
secdebug("kcreferral", "located source key in %s", keyItem->keychain()->name());
CssmClient::Key key = dynamic_cast<KeyItem &>(*keyItem).key();
const CssmKey &masterKey = key;
CSSM_CSP_HANDLE cspHandle = key->csp()->handle();
append(TypedList(allocator, CSSM_SAMPLE_TYPE_KEYCHAIN_LOCK,
new(allocator) ListElement((recordType==CSSM_DL_DB_RECORD_SYMMETRIC_KEY)?
CSSM_WORDID_SYMMETRIC_KEY:CSSM_WORDID_ASYMMETRIC_KEY),
new(allocator) ListElement(allocator, CssmData::wrap(cspHandle)),
new(allocator) ListElement(allocator, CssmData::wrap(masterKey)),
new(allocator) ListElement(allocator, ref.get())
));
mNeededItems.insert(keyItem);
foundSome = true;
}
} catch (...) {
}
return foundSome;
}
struct NotGuid {
NotGuid(const Guid &g) : guid(g) { }
const Guid &guid;
bool operator () (Keychain kc) { return kc->database()->dl()->guid() != guid; }
};
DefaultCredentials::KeychainList DefaultCredentials::fallbackSearchList(const DLDbIdentifier &ident)
{
KeychainList list;
globals().storageManager.getSearchList(list);
list.erase(remove_if(list.begin(), list.end(), NotGuid(ident.ssuid().guid())), list.end());
return list;
}
} }