#ifndef _H_CSUTILITIES
#define _H_CSUTILITIES
#include <Security/Security.h>
#include <security_utilities/dispatch.h>
#include <security_utilities/hashing.h>
#include <security_utilities/unix++.h>
#if TARGET_OS_OSX
#include <security_cdsa_utilities/cssmdata.h>
#endif
#include <copyfile.h>
#include <asl.h>
#include <cstdarg>
namespace Security {
namespace CodeSigning {
bool isAppleCA(SecCertificateRef cert);
void hashOfCertificate(const void *certData, size_t certLength, SHA1::Digest digest);
void hashOfCertificate(SecCertificateRef cert, SHA1::Digest digest);
bool verifyHash(SecCertificateRef cert, const Hashing::Byte *digest);
inline size_t scanFileData(UnixPlusPlus::FileDesc fd, size_t limit, void (^handle)(const void *buffer, size_t size))
{
UnixPlusPlus::FileDesc::UnixStat st;
size_t total = 0;
unsigned char *buffer = NULL;
try {
fd.fstat(st);
size_t bufSize = MAX(64 * 1024, st.st_blksize);
buffer = (unsigned char *)valloc(bufSize);
if (!buffer)
return 0;
for (;;) {
size_t size = bufSize;
if (limit && limit < size)
size = limit;
size_t got = fd.read(buffer, size);
total += got;
if (fd.atEnd())
break;
handle(buffer, got);
if (limit && (limit -= got) == 0)
break;
}
}
catch(...) {
if (buffer)
free(buffer);
throw;
}
free(buffer);
return total;
}
template <class _Hash>
size_t hashFileData(UnixPlusPlus::FileDesc fd, _Hash *hasher, size_t limit = 0)
{
return scanFileData(fd, limit, ^(const void *buffer, size_t size) {
hasher->update(buffer, size);
});
}
template <class _Hash>
size_t hashFileData(const char *path, _Hash *hasher)
{
UnixPlusPlus::AutoFileDesc fd(path);
return hashFileData(fd, hasher);
}
#if TARGET_OS_OSX
bool certificateHasField(SecCertificateRef cert, const CSSM_OID &oid);
bool certificateHasPolicy(SecCertificateRef cert, const CSSM_OID &policyOid);
#endif
class Copyfile {
public:
Copyfile();
~Copyfile() { copyfile_state_free(mState); }
operator copyfile_state_t () const { return mState; }
void set(uint32_t flag, const void *value);
void get(uint32_t flag, void *value);
void operator () (const char *src, const char *dst, copyfile_flags_t flags);
private:
void check(int rc);
private:
copyfile_state_t mState;
};
class MessageTrace {
public:
MessageTrace(const char *domain, const char *signature);
~MessageTrace() { ::asl_free(mAsl); }
void add(const char *key, const char *format, ...) __attribute__((format(printf,3,4)));
void send(const char *format, ...) __attribute__((format(printf,2,3)));
private:
aslmsg mAsl;
};
class UidGuard {
public:
UidGuard() : mPrevious(-1) { }
UidGuard(uid_t uid) : mPrevious(-1) { (void)seteuid(uid); }
~UidGuard()
{
if (active())
UnixError::check(::seteuid(mPrevious));
}
bool seteuid(uid_t uid)
{
if (uid == geteuid())
return true; if (!active())
mPrevious = ::geteuid();
return ::seteuid(uid) == 0;
}
bool active() const { return mPrevious != uid_t(-1); }
operator bool () const { return active(); }
uid_t saved() const { assert(active()); return mPrevious; }
private:
uid_t mPrevious;
};
class LimitedAsync {
NOCOPY(LimitedAsync)
public:
LimitedAsync(bool async);
LimitedAsync(LimitedAsync& limitedAsync);
virtual ~LimitedAsync();
bool perform(Dispatch::Group &groupRef, void (^block)());
private:
Dispatch::Semaphore *mResourceSemaphore;
};
} }
#endif // !_H_CSUTILITIES