1/*
2 * Copyright (c) 2000-2006,2011-2012,2014 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24
25//
26// acl_comment - "ignore" ACL subject type.
27//
28// CommentAclSubjects were a bad idea, badly implemented. The code below
29// exists solely to keep existing (external) ACL forms from blowing up the
30// ACL reader machinery and crashing the evaluation host.
31// The original serialization code was not architecture independent - for either
32// pointer sizes(!) or byte ordering. Yes, that was a stupid mistake.
33// The following code is intentionally, wilfully violating the layer separation
34// of the ACL reader/writer machine to deduce enough information about the
35// originating architecture to cleanly consume (just) the bytes making up this
36// ACL's external representation. We make no use of the bytes read; thankfully,
37// the semantics of a CommentAclSubject have always been "never matches."
38// We do not preserve them on write-out; a newly-written ACL will contain no data
39// (and will read cleanly).
40// If you use this code as a template for anything (other than a how-not-to-write-code
41// seminar), your backups shall rot right after your main harddrive crashes, and
42// you have only yourself to blame.
43//
44#include <security_cdsa_utilities/acl_comment.h>
45#include <security_cdsa_utilities/cssmwalkers.h>
46#include <security_cdsa_utilities/cssmlist.h>
47#include <algorithm>
48
49using namespace DataWalkers;
50
51
52//
53// The COMMENT subject matches nothing, no matter how pretty.
54//
55bool CommentAclSubject::validate(const AclValidationContext &) const
56{
57	return false;
58}
59
60
61//
62// The list form has no values.
63//
64CssmList CommentAclSubject::toList(Allocator &alloc) const
65{
66	return TypedList(Allocator::standard(), CSSM_ACL_SUBJECT_TYPE_COMMENT);
67}
68
69
70//
71// We completely disregard any data contained in CSSM form COMMENT ACLs.
72//
73CommentAclSubject *CommentAclSubject::Maker::make(const TypedList &list) const
74{
75	return new CommentAclSubject();
76}
77
78
79//
80// This is the nasty code. We don't really care what data was originally baked
81// into this ACL's external (stream) form, but since there's no external framing
82// to delimit it, we need to figure out how many bytes to consume to keep the
83// reader from going out of sync. And that's not pretty, since the external form
84// contains (stupidly!) a pointer, so we have all permutations of byte order and
85// pointer size to worry about.
86//
87CommentAclSubject *CommentAclSubject::Maker::make(Version, Reader &pub, Reader &) const
88{
89	//
90	// At this point, the Reader is positioned at data that was once written using
91	// this code:
92	//	pub(ptr);  // yes, that's a pointer
93    //	pub.countedData(ptr, size);
94	// We know ptr was a non-NULL pointer (4 or 8 bytes, alas).
95	// CountedData writes a 4-byte NBO length followed by that many bytes.
96	// The data written starts with a CSSM_LIST structure in native architecture.
97	// That in turn begins with a CSSM_LIST_TYPE (4 bytes, native, 0<=type<=2).
98	// So to summarize (h=host byte order, n=network byte order), we might be looking at:
99	//   32 bits:  | P4h | L4n | T4h | (L-4 bytes) |
100	//   64 bits:  |    P8h    | L4n |  (L bytes)  |
101	// It's the T4h-or-L4n bytes that save our day, since we know that
102	//	0 <= T <= 2 (definition of CSSM_LIST_TYPE)
103	//	16M > L >= sizeof(CSSM_LIST) >= 12
104	// Phew. I'd rather be lucky than good...
105	//
106	// So let's get started:
107#ifndef NDEBUG
108	static const size_t minCssmList = 12;	// min(sizeof(CSSM_LIST)) of all architectures
109#endif
110	pub.get<void>(4);			// skip first 4 bytes
111	uint32_t lop; pub(lop);		// read L4n-or-(bottom of)P8h
112	uint32_t tol; pub(tol);		// read T4h-or-L4n
113	if (tol <= 2 || flip(tol) <= 2) {	// 32 bits
114		// the latter can't be a very big (flipped) L because we know 12 < L < 16M,
115		// and you'd have to be a multiple of 2^24 to pass that test
116		size_t length = n2h(lop);
117		assert(length >= minCssmList);
118		pub.get<void>(length - sizeof(tol)); // skip L-4 bytes
119	} else {							// 64 bits
120		size_t length = n2h(tol);
121		assert(length >= minCssmList);
122		pub.get<void>(length); // skip L bytes
123	}
124
125	// we've successfully thrown out the garbage. What's left is a data-less subject
126	return new CommentAclSubject();		// no data
127}
128
129
130//
131// Export to blob form.
132// This simply writes the smallest form consistent with the heuristic above.
133//
134void CommentAclSubject::exportBlob(Writer::Counter &pub, Writer::Counter &)
135{
136	uint32_t zero = 0;
137	Endian<uint32_t> length = 12;
138	pub(zero); pub(length); pub(zero); pub(zero); pub(zero);
139}
140
141void CommentAclSubject::exportBlob(Writer &pub, Writer &)
142{
143	uint32_t zero = 0;
144	Endian<uint32_t> length = 12;
145	pub(zero); pub(length); pub(zero); pub(zero); pub(zero);
146}
147
148
149#ifdef DEBUGDUMP
150
151void CommentAclSubject::debugDump() const
152{
153	Debug::dump("Comment[never]");
154}
155
156#endif //DEBUGDUMP
157