#include "sstransit.h"
#include <servers/netname.h>
#include <security_utilities/debugging.h>
using MachPlusPlus::check;
using MachPlusPlus::Bootstrap;
namespace Security {
namespace SecurityServer {
UnixPlusPlus::StaticForkMonitor ClientSession::mHasForked;
ModuleNexus<ClientSession::Global> ClientSession::mGlobal;
const char *ClientSession::mContactName;
SecGuestRef ClientSession::mDedicatedGuest = kSecNoGuest;
ClientSession::ClientSession(Allocator &std, Allocator &rtn)
: ClientCommon(std, rtn), mCallback(NULL), mCallbackContext(NULL)
{ }
ClientSession::~ClientSession()
{ }
void
ClientSession::registerForAclEdits(DidChangeKeyAclCallback *callback, void *context)
{
mCallback = callback;
mCallbackContext = context;
}
void ClientSession::activate()
{
if (mHasForked()) {
secdebug("SSclnt", "process has forked (now pid=%d) - resetting connection object", getpid());
mGlobal.reset();
}
Global &global = mGlobal();
Thread &thread = global.thread();
if (!thread) {
IPCN(ucsp_client_setupThread(UCSP_ARGS, mach_task_self()));
thread.registered = true;
secdebug("SSclnt", "Thread registered with %s", mContactName);
}
if (thread.currentGuest != thread.lastGuest) {
IPCN(ucsp_client_setGuest(UCSP_ARGS, thread.currentGuest, kSecCSDefaultFlags));
thread.lastGuest = thread.currentGuest;
secdebug("SSclnt", "switched guest state to 0x%x", thread.currentGuest);
}
}
void ClientSession::contactName(const char *name)
{
mContactName = name;
}
const char *ClientSession::contactName() const
{
return mContactName;
}
ClientSession::Global::Global()
{
serverPort = findSecurityd();
mach_port_t originPort = MACH_PORT_NULL;
IPCN(ucsp_client_verifyPrivileged2(serverPort.port(), mig_get_reply_port(), &securitydCreds, &rcode, &originPort));
if (originPort != serverPort.port())
CssmError::throwMe(CSSM_ERRCODE_VERIFICATION_FAILURE);
mach_port_mod_refs(mach_task_self(), originPort, MACH_PORT_RIGHT_SEND, -1);
static const char extForm[] = "?:obsolete";
ClientSetupInfo info = { 0x1234, SSPROTOVERSION };
Thread &thread = this->thread();
IPCN(ucsp_client_setup(serverPort, thread.replyPort, &securitydCreds, &rcode,
mach_task_self(), info, extForm));
thread.registered = true; IFDEBUG(serverPort.requestNotify(thread.replyPort));
secdebug("SSclnt", "contact with %s established", mContactName);
}
void ClientSession::reset()
{
secdebug("SSclnt", "resetting client state (OUCH)");
mGlobal.reset();
}
Port ClientSession::findSecurityd()
{
if (!mContactName)
{
mContactName = getenv(SECURITYSERVER_BOOTSTRAP_ENV);
if (!mContactName)
mContactName = SECURITYSERVER_BOOTSTRAP_NAME;
}
secdebug("SSclnt", "Locating %s", mContactName);
Port serverPort = Bootstrap().lookup2(mContactName);
secdebug("SSclnt", "contacting %s at port %d (version %d)",
mContactName, serverPort.port(), SSPROTOVERSION);
return serverPort;
}
void ClientSession::childCheckIn(Port serverPort, Port taskPort)
{
Port securitydPort = findSecurityd();
mach_port_t originPort = MACH_PORT_NULL;
IPCN(ucsp_client_verifyPrivileged2(securitydPort.port(), mig_get_reply_port(), &securitydCreds, &rcode, &originPort));
if (originPort != securitydPort.port())
CssmError::throwMe(CSSM_ERRCODE_VERIFICATION_FAILURE);
mach_port_mod_refs(mach_task_self(), originPort, MACH_PORT_RIGHT_SEND, -1);
check(ucsp_client_childCheckIn(securitydPort, serverPort, taskPort));
}
void ClientSession::notifyAclChange(KeyHandle key, CSSM_ACL_AUTHORIZATION_TAG tag)
{
if (mCallback) {
secdebug("keyacl", "ACL change key %u operation %u", key, tag);
mCallback(mCallbackContext, *this, key, tag);
} else
secdebug("keyacl", "dropped ACL change notice for key %u operation %u",
key, tag);
}
} }