1 line
23 KiB
C++
1 line
23 KiB
C++
|
/* Copyright (c) 2017, Computer History Museum
All rights reserved.
Redistribution and use in source and binary forms, with or without modification, are permitted (subject to
the limitations in the disclaimer below) provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following
disclaimer in the documentation and/or other materials provided with the distribution.
* Neither the name of Computer History Museum nor the names of its contributors may be used to endorse or promote products
derived from this software without specific prior written permission.
NO EXPRESS OR IMPLIED LICENSES TO ANY PARTY'S PATENT RIGHTS ARE GRANTED BY THIS LICENSE. THIS SOFTWARE IS PROVIDED BY THE
COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
DAMAGE. */
/*
File: sslCerts.cp
Purpose: Routines for getting certificates for SSL operations
*/
#define DEBUGASSERT 0
#define DEBUGERR 0
#define DEBUGMESSAGE 0
#define DEBUGDATA 0
#ifndef _SSLCERTS_H_
#include "sslCerts.h"
#endif
#include "EZCrypto.h"
#if TARGET_API_MAC_CARBON
#include <KeychainCore.h>
#include <KeychainHI.h>
#include "MachOWrapper.h"
#endif
#include "md5.h"
#pragma mark -- OS 9 routines ---
extern Boolean gKeychainChanged;
enum { kKCGetRootCertificateKeychain = 14 };
EXTERN_API( OSStatus )
KCDispatch (UInt16 commandID,
void * value);
static OSStatus OS9ReadCertsFromKC ( SSLContext *sslContext, AddCertProc addCerts, KCRef kc ) {
OSStatus err;
KCAttributeList attrList;
KCAttribute attr;
KCItemAttr itemClass;
KCSearchRef search;
KCItemRef item;
Handle certData;
long certBuffSize = 1;
SSLBuffer berCert;
// Allocate a buffer to hold the certs
// Why NuHTempBetter doesn't return a handle is beyond me!
if ( !( certData = (Handle) NuHTempBetter ( certBuffSize )))
return memFullErr;
itemClass = kCertificateKCItemClass;
attrList.count = 1;
attrList.attr = &attr;
attr.tag = kClassKCItemAttr;
attr.length = sizeof(itemClass);
attr.data = &itemClass;
/* Get the first item */
if (( err = KCFindFirstItem ( kc, &attrList, &search, &item )) == noErr ) {
Boolean lastItem = false;
/* The first time, it will be 1 */
berCert.length = certBuffSize;
do { // for each certificate
do { // until the buffer is big enough
/* Is the buffer too small? */
if ( certBuffSize < berCert.length ) {
/* Make it bigger */
certBuffSize = berCert.length;
SetHandleSize ( certData, certBuffSize );
if (( err = MemError ()) != noErr )
break;
}
/* Get the cert data */
HLock ( certData );
err = KCGetData ( item, certBuffSize, *certData, &berCert.length );
HUnlock ( certData );
} while(err == errKCBufferTooSmall);
/* Release the current cert item; we've still got the data in the handle */
KCReleaseItem ( &item );
// To get out of a doubly-nested loop, you have to break twice!
if ( err != noErr )
break;
/* Add the cert to the SSL context */
HLock ( certData );
berCert.data = (unsigned char *) *certData;
err = addCerts ( sslContext, berCert, 1 );
HUnlock ( certData );
} while (err >= noErr && ( err = KCFindNextItem ( search, &item )) == noErr );
KCReleaseSearch(&search
|