1/* 2 * Copyright (c) 2000-2006,2011,2014 Apple Inc. All Rights Reserved. 3 * 4 * @APPLE_LICENSE_HEADER_START@ 5 * 6 * This file contains Original Code and/or Modifications of Original Code 7 * as defined in and that are subject to the Apple Public Source License 8 * Version 2.0 (the 'License'). You may not use this file except in 9 * compliance with the License. Please obtain a copy of the License at 10 * http://www.opensource.apple.com/apsl/ and read it before using this 11 * file. 12 * 13 * The Original Code and all software distributed under the License are 14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER 15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, 16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, 17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. 18 * Please see the License for the specific language governing rights and 19 * limitations under the License. 20 * 21 * @APPLE_LICENSE_HEADER_END@ 22 */ 23 24 25// 26// acl_protectedpw - protected-path password-based ACL subject types. 27// 28#include <security_cdsa_utilities/acl_protectedpw.h> 29#include <security_utilities/debugging.h> 30#include <algorithm> 31 32 33// 34// Construct a password ACL subject 35// 36ProtectedPasswordAclSubject::ProtectedPasswordAclSubject(Allocator &alloc, const CssmData &password) 37 : SimpleAclSubject(CSSM_ACL_SUBJECT_TYPE_PROTECTED_PASSWORD), 38 allocator(alloc), mPassword(alloc, password) 39{ } 40 41ProtectedPasswordAclSubject::ProtectedPasswordAclSubject(Allocator &alloc, CssmManagedData &password) 42 : SimpleAclSubject(CSSM_ACL_SUBJECT_TYPE_PROTECTED_PASSWORD), 43 allocator(alloc), mPassword(alloc, password) 44{ } 45 46 47// 48// Validate a credential set against this subject 49// 50bool ProtectedPasswordAclSubject::validate(const AclValidationContext &context, 51 const TypedList &sample) const 52{ 53 if (sample.length() == 1) { 54 return true; //@@@ validate against PP 55 } else if (sample.length() == 2 && sample[1].type() == CSSM_LIST_ELEMENT_DATUM) { 56 const CssmData &password = sample[1]; 57 return password == mPassword; 58 } else 59 CssmError::throwMe(CSSM_ERRCODE_INVALID_SAMPLE_VALUE); 60} 61 62 63// 64// Make a copy of this subject in CSSM_LIST form 65// 66CssmList ProtectedPasswordAclSubject::toList(Allocator &alloc) const 67{ 68 // the password itself is private and not exported to CSSM 69 return TypedList(alloc, CSSM_ACL_SUBJECT_TYPE_PROTECTED_PASSWORD); 70} 71 72 73// 74// Create a ProtectedPasswordAclSubject 75// 76ProtectedPasswordAclSubject *ProtectedPasswordAclSubject::Maker::make(const TypedList &list) const 77{ 78 CssmAutoData password(Allocator::standard(Allocator::sensitive)); 79 if (list.length() == 1) { 80 char pass[] = "secret"; 81 CssmData password = CssmData::wrap(pass, 6); //@@@ get password from PP 82 return new ProtectedPasswordAclSubject(Allocator::standard(Allocator::sensitive), password); 83 } else { 84 ListElement *password; 85 crack(list, 1, &password, CSSM_LIST_ELEMENT_DATUM); 86 return new ProtectedPasswordAclSubject(Allocator::standard(Allocator::sensitive), *password); 87 } 88} 89 90ProtectedPasswordAclSubject *ProtectedPasswordAclSubject::Maker::make(Version, 91 Reader &pub, Reader &priv) const 92{ 93 Allocator &alloc = Allocator::standard(Allocator::sensitive); 94 const void *data; size_t length; priv.countedData(data, length); 95 return new ProtectedPasswordAclSubject(alloc, CssmAutoData(alloc, data, length)); 96} 97 98 99// 100// Export the subject to a memory blob 101// 102void ProtectedPasswordAclSubject::exportBlob(Writer::Counter &pub, Writer::Counter &priv) 103{ 104 priv.countedData(mPassword); 105} 106 107void ProtectedPasswordAclSubject::exportBlob(Writer &pub, Writer &priv) 108{ 109 priv.countedData(mPassword); 110} 111 112 113#ifdef DEBUGDUMP 114 115void ProtectedPasswordAclSubject::debugDump() const 116{ 117 Debug::dump("Protected Password "); 118 Debug::dumpData(mPassword.data(), mPassword.length()); 119} 120 121#endif //DEBUGDUMP 122