1/* 2 * Copyright (c) 2000-2006,2011-2012,2014 Apple Inc. All Rights Reserved. 3 * 4 * @APPLE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. Please obtain a copy of the License at 10 * http://www.opensource.apple.com/apsl/ and read it before using this 11 * file. 12 * 13 * The Original Code and all software distributed under the License are 14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 18 * Please see the License for the specific language governing rights and 19 * limitations under the License. 20 * 21 * @APPLE_LICENSE_HEADER_END@ 22 */ 23 24 25// 26// acl_comment - "ignore" ACL subject type. 27// 28// CommentAclSubjects were a bad idea, badly implemented. The code below 29// exists solely to keep existing (external) ACL forms from blowing up the 30// ACL reader machinery and crashing the evaluation host. 31// The original serialization code was not architecture independent - for either 32// pointer sizes(!) or byte ordering. Yes, that was a stupid mistake. 33// The following code is intentionally, wilfully violating the layer separation 34// of the ACL reader/writer machine to deduce enough information about the 35// originating architecture to cleanly consume (just) the bytes making up this 36// ACL's external representation. We make no use of the bytes read; thankfully, 37// the semantics of a CommentAclSubject have always been "never matches." 38// We do not preserve them on write-out; a newly-written ACL will contain no data 39// (and will read cleanly). 40// If you use this code as a template for anything (other than a how-not-to-write-code 41// seminar), your backups shall rot right after your main harddrive crashes, and 42// you have only yourself to blame. 43// 44#include <security_cdsa_utilities/acl_comment.h> 45#include <security_cdsa_utilities/cssmwalkers.h> 46#include <security_cdsa_utilities/cssmlist.h> 47#include <algorithm> 48 49using namespace DataWalkers; 50 51 52// 53// The COMMENT subject matches nothing, no matter how pretty. 54// 55bool CommentAclSubject::validate(const AclValidationContext &) const 56{ 57 return false; 58} 59 60 61// 62// The list form has no values. 63// 64CssmList CommentAclSubject::toList(Allocator &alloc) const 65{ 66 return TypedList(Allocator::standard(), CSSM_ACL_SUBJECT_TYPE_COMMENT); 67} 68 69 70// 71// We completely disregard any data contained in CSSM form COMMENT ACLs. 72// 73CommentAclSubject *CommentAclSubject::Maker::make(const TypedList &list) const 74{ 75 return new CommentAclSubject(); 76} 77 78 79// 80// This is the nasty code. We don't really care what data was originally baked 81// into this ACL's external (stream) form, but since there's no external framing 82// to delimit it, we need to figure out how many bytes to consume to keep the 83// reader from going out of sync. And that's not pretty, since the external form 84// contains (stupidly!) a pointer, so we have all permutations of byte order and 85// pointer size to worry about. 86// 87CommentAclSubject *CommentAclSubject::Maker::make(Version, Reader &pub, Reader &) const 88{ 89 // 90 // At this point, the Reader is positioned at data that was once written using 91 // this code: 92 // pub(ptr); // yes, that's a pointer 93 // pub.countedData(ptr, size); 94 // We know ptr was a non-NULL pointer (4 or 8 bytes, alas). 95 // CountedData writes a 4-byte NBO length followed by that many bytes. 96 // The data written starts with a CSSM_LIST structure in native architecture. 97 // That in turn begins with a CSSM_LIST_TYPE (4 bytes, native, 0<=type<=2). 98 // So to summarize (h=host byte order, n=network byte order), we might be looking at: 99 // 32 bits: | P4h | L4n | T4h | (L-4 bytes) | 100 // 64 bits: | P8h | L4n | (L bytes) | 101 // It's the T4h-or-L4n bytes that save our day, since we know that 102 // 0 <= T <= 2 (definition of CSSM_LIST_TYPE) 103 // 16M > L >= sizeof(CSSM_LIST) >= 12 104 // Phew. I'd rather be lucky than good... 105 // 106 // So let's get started: 107#ifndef NDEBUG 108 static const size_t minCssmList = 12; // min(sizeof(CSSM_LIST)) of all architectures 109#endif 110 pub.get<void>(4); // skip first 4 bytes 111 uint32_t lop; pub(lop); // read L4n-or-(bottom of)P8h 112 uint32_t tol; pub(tol); // read T4h-or-L4n 113 if (tol <= 2 || flip(tol) <= 2) { // 32 bits 114 // the latter can't be a very big (flipped) L because we know 12 < L < 16M, 115 // and you'd have to be a multiple of 2^24 to pass that test 116 size_t length = n2h(lop); 117 assert(length >= minCssmList); 118 pub.get<void>(length - sizeof(tol)); // skip L-4 bytes 119 } else { // 64 bits 120 size_t length = n2h(tol); 121 assert(length >= minCssmList); 122 pub.get<void>(length); // skip L bytes 123 } 124 125 // we've successfully thrown out the garbage. What's left is a data-less subject 126 return new CommentAclSubject(); // no data 127} 128 129 130// 131// Export to blob form. 132// This simply writes the smallest form consistent with the heuristic above. 133// 134void CommentAclSubject::exportBlob(Writer::Counter &pub, Writer::Counter &) 135{ 136 uint32_t zero = 0; 137 Endian<uint32_t> length = 12; 138 pub(zero); pub(length); pub(zero); pub(zero); pub(zero); 139} 140 141void CommentAclSubject::exportBlob(Writer &pub, Writer &) 142{ 143 uint32_t zero = 0; 144 Endian<uint32_t> length = 12; 145 pub(zero); pub(length); pub(zero); pub(zero); pub(zero); 146} 147 148 149#ifdef DEBUGDUMP 150 151void CommentAclSubject::debugDump() const 152{ 153 Debug::dump("Comment[never]"); 154} 155 156#endif //DEBUGDUMP 157