authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2023-01-17 19:04:55-05:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2023-01-17 19:04:55-05:00
logbbab4bedac44f1177638421c311fc016432a13ee
tree84bea95ab2450636da72960bdbed5f1ba402d350
parent06e9b2c4e360e738c3be3d3e5d5a36006fd5b224
parent2623e1c4d623812913cccc8d7a6e7dab41dfd305
signaturebadge-question-mark Signed by PGP key 4AEE18F83AFDEB23

Merge pull request #14350 from FnControlOption/bundle

std.crypto.Certificate.Bundle: clear bundle before macOS rescan

4 files changed, 59 insertions(+), 41 deletions(-)

lib/std/crypto/Certificate/Bundle.zig+3-10
......@@ -120,21 +120,14 @@ pub fn rescanWindows(cb: *Bundle, gpa: Allocator) !void {
120120 };
121121 defer _ = w.crypt32.CertCloseStore(store, 0);
122122
123 const now_sec = std.time.timestamp();
124
123125 var ctx = w.crypt32.CertEnumCertificatesInStore(store, null);
124126 while (ctx) |context| : (ctx = w.crypt32.CertEnumCertificatesInStore(store, ctx)) {
125127 const decoded_start = @intCast(u32, cb.bytes.items.len);
126128 const encoded_cert = context.pbCertEncoded[0..context.cbCertEncoded];
127129 try cb.bytes.appendSlice(gpa, encoded_cert);
128 const parsed_cert = try Certificate.parse(.{
129 .buffer = cb.bytes.items,
130 .index = decoded_start,
131 });
132 const gop = try cb.map.getOrPutContext(gpa, parsed_cert.subject_slice, .{ .cb = cb });
133 if (gop.found_existing) {
134 cb.bytes.items.len = decoded_start;
135 } else {
136 gop.value_ptr.* = decoded_start;
137 }
130 try cb.parseCert(gpa, decoded_start, now_sec);
138131 }
139132 cb.bytes.shrinkAndFree(gpa, cb.bytes.items.len);
140133}
lib/std/crypto/Certificate/Bundle/macos.zig+7-31
......@@ -1,11 +1,14 @@
11const std = @import("std");
22const assert = std.debug.assert;
3const mem = std.mem;
43const fs = std.fs;
4const mem = std.mem;
55const Allocator = std.mem.Allocator;
66const Bundle = @import("../Bundle.zig");
77
88pub fn rescanMac(cb: *Bundle, gpa: Allocator) !void {
9 cb.bytes.clearRetainingCapacity();
10 cb.map.clearRetainingCapacity();
11
912 const file = try fs.openFileAbsolute("/System/Library/Keychains/SystemRootCertificates.keychain", .{});
1013 defer file.close();
1114
......@@ -37,7 +40,7 @@ pub fn rescanMac(cb: *Bundle, gpa: Allocator) !void {
3740
3841 const table_header = try reader.readStructBig(TableHeader);
3942
40 if (@intToEnum(TableId, table_header.table_id) != TableId.CSSM_DL_DB_RECORD_X509_CERTIFICATE) {
43 if (@intToEnum(std.os.darwin.cssm.DB_RECORDTYPE, table_header.table_id) != .X509_CERTIFICATE) {
4144 continue;
4245 }
4346
......@@ -63,6 +66,8 @@ pub fn rescanMac(cb: *Bundle, gpa: Allocator) !void {
6366 try cb.parseCert(gpa, cert_start, now_sec);
6467 }
6568 }
69
70 cb.bytes.shrinkAndFree(gpa, cb.bytes.items.len);
6671}
6772
6873const ApplDbHeader = extern struct {
......@@ -88,35 +93,6 @@ const TableHeader = extern struct {
8893 record_numbers_count: u32,
8994};
9095
91const TableId = enum(u32) {
92 CSSM_DL_DB_SCHEMA_INFO = 0x00000000,
93 CSSM_DL_DB_SCHEMA_INDEXES = 0x00000001,
94 CSSM_DL_DB_SCHEMA_ATTRIBUTES = 0x00000002,
95 CSSM_DL_DB_SCHEMA_PARSING_MODULE = 0x00000003,
96
97 CSSM_DL_DB_RECORD_ANY = 0x0000000a,
98 CSSM_DL_DB_RECORD_CERT = 0x0000000b,
99 CSSM_DL_DB_RECORD_CRL = 0x0000000c,
100 CSSM_DL_DB_RECORD_POLICY = 0x0000000d,
101 CSSM_DL_DB_RECORD_GENERIC = 0x0000000e,
102 CSSM_DL_DB_RECORD_PUBLIC_KEY = 0x0000000f,
103 CSSM_DL_DB_RECORD_PRIVATE_KEY = 0x00000010,
104 CSSM_DL_DB_RECORD_SYMMETRIC_KEY = 0x00000011,
105 CSSM_DL_DB_RECORD_ALL_KEYS = 0x00000012,
106
107 CSSM_DL_DB_RECORD_GENERIC_PASSWORD = 0x80000000,
108 CSSM_DL_DB_RECORD_INTERNET_PASSWORD = 0x80000001,
109 CSSM_DL_DB_RECORD_APPLESHARE_PASSWORD = 0x80000002,
110 CSSM_DL_DB_RECORD_USER_TRUST = 0x80000003,
111 CSSM_DL_DB_RECORD_X509_CRL = 0x80000004,
112 CSSM_DL_DB_RECORD_UNLOCK_REFERRAL = 0x80000005,
113 CSSM_DL_DB_RECORD_EXTENDED_ATTRIBUTE = 0x80000006,
114 CSSM_DL_DB_RECORD_X509_CERTIFICATE = 0x80001000,
115 CSSM_DL_DB_RECORD_METADATA = 0x80008000,
116
117 _,
118};
119
12096const X509CertHeader = extern struct {
12197 record_size: u32,
12298 record_number: u32,
lib/std/os/darwin.zig+2
......@@ -3,6 +3,8 @@ const builtin = @import("builtin");
33const log = std.log;
44const mem = std.mem;
55
6pub const cssm = @import("darwin/cssm.zig");
7
68pub usingnamespace std.c;
79pub usingnamespace mach_task;
810
lib/std/os/darwin/cssm.zig created+47
......@@ -0,0 +1,47 @@
1// Common Security Services Manager
2// Security.framework/Headers/cssm*.h
3
4// Schema Management Name Space Range Definition
5pub const DB_RECORDTYPE_SCHEMA_START = 0x00000000;
6pub const DB_RECORDTYPE_SCHEMA_END = DB_RECORDTYPE_SCHEMA_START + 4;
7
8// Open Group Application Name Space Range Definition
9pub const DB_RECORDTYPE_OPEN_GROUP_START = 0x0000000A;
10pub const DB_RECORDTYPE_OPEN_GROUP_END = DB_RECORDTYPE_OPEN_GROUP_START + 8;
11
12// Industry At Large Application Name Space Range Definition
13pub const DB_RECORDTYPE_APP_DEFINED_START = 0x80000000;
14pub const DB_RECORDTYPE_APP_DEFINED_END = 0xffffffff;
15
16pub const DB_RECORDTYPE = enum(u32) {
17 // Record Types defined in the Schema Management Name Space
18 SCHEMA_INFO = DB_RECORDTYPE_SCHEMA_START + 0,
19 SCHEMA_INDEXES = DB_RECORDTYPE_SCHEMA_START + 1,
20 SCHEMA_ATTRIBUTES = DB_RECORDTYPE_SCHEMA_START + 2,
21 SCHEMA_PARSING_MODULE = DB_RECORDTYPE_SCHEMA_START + 3,
22
23 // Record Types defined in the Open Group Application Name Space
24 ANY = DB_RECORDTYPE_OPEN_GROUP_START + 0,
25 CERT = DB_RECORDTYPE_OPEN_GROUP_START + 1,
26 CRL = DB_RECORDTYPE_OPEN_GROUP_START + 2,
27 POLICY = DB_RECORDTYPE_OPEN_GROUP_START + 3,
28 GENERIC = DB_RECORDTYPE_OPEN_GROUP_START + 4,
29 PUBLIC_KEY = DB_RECORDTYPE_OPEN_GROUP_START + 5,
30 PRIVATE_KEY = DB_RECORDTYPE_OPEN_GROUP_START + 6,
31 SYMMETRIC_KEY = DB_RECORDTYPE_OPEN_GROUP_START + 7,
32 ALL_KEYS = DB_RECORDTYPE_OPEN_GROUP_START + 8,
33
34 // AppleFileDL record types
35 GENERIC_PASSWORD = DB_RECORDTYPE_APP_DEFINED_START + 0,
36 INTERNET_PASSWORD = DB_RECORDTYPE_APP_DEFINED_START + 1,
37 APPLESHARE_PASSWORD = DB_RECORDTYPE_APP_DEFINED_START + 2,
38
39 X509_CERTIFICATE = DB_RECORDTYPE_APP_DEFINED_START + 0x1000,
40 USER_TRUST,
41 X509_CRL,
42 UNLOCK_REFERRAL,
43 EXTENDED_ATTRIBUTE,
44 METADATA = DB_RECORDTYPE_APP_DEFINED_START + 0x8000,
45
46 _,
47};