1/*
2 * Copyright (c) 2006-2007,2011-2013 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24//
25// csdb - system-supported Code Signing related database interfaces
26//
27#include "csdatabase.h"
28#include "detachedrep.h"
29
30namespace Security {
31namespace CodeSigning {
32
33using namespace SQLite;
34
35
36//
37// The one and only SignatureDatabase object.
38// It auto-adapts to readonly vs. writable use.
39//
40ModuleNexus<SignatureDatabase> signatureDatabase;
41ModuleNexus<SignatureDatabaseWriter> signatureDatabaseWriter;
42
43
44//
45// Default path to the signature database.
46//
47const char SignatureDatabase::defaultPath[] = "/var/db/DetachedSignatures";
48
49
50//
51// Creation commands to initialize the system database.
52//
53const char schema[] = "\
54	create table if not exists code ( \n\
55		id integer primary key on conflict replace autoincrement not null, \n\
56		global integer null references global (id), \n\
57		identifier text not null, \n\
58		architecture integer, \n\
59		identification blob not null unique on conflict replace, \n\
60		signature blob not null, \n\
61		created text default current_timestamp \n\
62	); \n\
63	create index if not exists identifier_index on code (identifier); \n\
64	create index if not exists architecture_index on code (architecture); \n\
65	create index if not exists id_index on code (identification); \n\
66	\n\
67	create table if not exists global ( \n\
68		id integer primary key on conflict replace autoincrement not null, \n\
69		sign_location text not null, \n\
70		signature blob null \n\
71	); \n\
72	create index if not exists location_index on global (sign_location); \n\
73";
74
75
76
77//
78// Open the database (creating it if necessary and possible).
79// Note that this isn't creating the schema; we do that on first write.
80//
81SignatureDatabase::SignatureDatabase(const char *path, int flags)
82	: SQLite::Database(path, flags, true)	// lenient open
83{
84}
85
86SignatureDatabase::~SignatureDatabase()
87{ /* virtual */ }
88
89
90//
91// Consult the database to find code by identification blob.
92// Return the signature and (optional) global data blobs.
93//
94FilterRep *SignatureDatabase::findCode(DiskRep *rep)
95{
96	if (CFRef<CFDataRef> identification = rep->identification())
97		if (!this->empty()) {
98			SQLite::Statement query(*this,
99				"select code.signature, global.signature from code, global \
100				 where code.identification = ?1 and code.global = global.id;");
101			query.bind(1) = identification.get();
102			if (query.nextRow()) {
103				CFRef<CFDataRef> sig = query[0].data();
104				CFRef<CFDataRef> gsig = query[1].data();
105				return new DetachedRep(sig, gsig, rep, "system");
106			}
107		}
108
109	// no joy
110	return NULL;
111}
112
113
114//
115// Given a unified detached signature blob, store its data in the database.
116// This writes exactly one Global record, plus one Code record per architecture
117// (where non-architectural code is treated as single-architecture).
118//
119void SignatureDatabaseWriter::storeCode(const BlobCore *sig, const char *location)
120{
121	if (!this->isOpen())	// failed database open or creation
122		MacOSError::throwMe(errSecCSDBAccess);
123	Transaction xa(*this, Transaction::exclusive);	// lock out everyone
124	if (this->empty())
125		this->execute(schema);					// initialize schema
126	if (const EmbeddedSignatureBlob *esig = EmbeddedSignatureBlob::specific(sig)) {	// architecture-less
127		int64 globid = insertGlobal(location, NULL);
128		insertCode(globid, 0, esig);
129		xa.commit();
130		return;
131	} else if (const DetachedSignatureBlob *dsblob = DetachedSignatureBlob::specific(sig)) {
132		int64 globid = insertGlobal(location, dsblob->find(0));
133		unsigned count = dsblob->count();
134		for (unsigned n = 0; n < count; n++)
135			if (uint32_t arch = dsblob->type(n))
136				insertCode(globid, arch, EmbeddedSignatureBlob::specific(dsblob->blob(n)));
137		xa.commit();
138		return;
139	}
140
141	MacOSError::throwMe(errSecCSSignatureInvalid);
142
143}
144
145int64 SignatureDatabaseWriter::insertGlobal(const char *location, const BlobCore *blob)
146{
147	Statement insert(*this, "insert into global (sign_location, signature) values (?1, ?2);");
148	insert.bind(1) = location;
149	if (blob)
150		insert.bind(2).blob(blob, blob->length(), true);
151	insert();
152	return lastInsert();
153}
154
155void SignatureDatabaseWriter::insertCode(int64 globid, int arch, const EmbeddedSignatureBlob *sig)
156{
157	// retrieve binary identifier (was added by signer)
158	const BlobWrapper *ident = BlobWrapper::specific(sig->find(cdIdentificationSlot));
159	assert(ident);
160
161	// extract CodeDirectory to get some information from it
162	const CodeDirectory *cd = CodeDirectory::specific(sig->find(cdCodeDirectorySlot));
163	assert(cd);
164
165	// write the record
166	Statement insert(*this,
167		"insert into code (global, identifier, architecture, identification, signature) values (?1, ?2, ?3, ?4, ?5);");
168	insert.bind(1) = globid;
169	insert.bind(2) = cd->identifier();
170	if (arch)
171		insert.bind(3) = arch;
172	insert.bind(4).blob(ident->data(), ident->length(), true);
173	insert.bind(5).blob(sig, sig->length(), true);
174	insert();
175}
176
177
178
179} // end namespace CodeSigning
180} // end namespace Security
181