1const std = @import("std");
2const Io = std.Io;
3const assert = std.debug.assert;
4const fs = std.fs;
5const mem = std.mem;
6const Allocator = std.mem.Allocator;
7const Bundle = @import("../Bundle.zig");
8
9pub const RescanMacError = Allocator.Error || Io.File.OpenError || Io.File.Reader.Error || Io.File.SeekError || Bundle.ParseCertError || error{EndOfStream};
10
11pub fn rescanMac(cb: *Bundle, gpa: Allocator, io: Io, now: Io.Timestamp) RescanMacError!void {
12 cb.bytes.clearRetainingCapacity();
13 cb.map.clearRetainingCapacity();
14
15 const keychain_paths = [2][]const u8{
16 "/System/Library/Keychains/SystemRootCertificates.keychain",
17 "/Library/Keychains/System.keychain",
18 };
19
20 for (keychain_paths) |keychain_path| {
21 const bytes = Io.Dir.cwd().readFileAlloc(io, keychain_path, gpa, .limited(std.math.maxInt(u32))) catch |err| switch (err) {
22 error.StreamTooLong => return error.FileTooBig,
23 else => |e| return e,
24 };
25 defer gpa.free(bytes);
26
27 var reader: Io.Reader = .fixed(bytes);
28 scanReader(cb, gpa, &reader, now.toSeconds()) catch |err| switch (err) {
29 error.ReadFailed => unreachable, // prebuffered
30 else => |e| return e,
31 };
32 }
33
34 cb.bytes.shrinkAndFree(gpa, cb.bytes.items.len);
35}
36
37fn scanReader(cb: *Bundle, gpa: Allocator, reader: *Io.Reader, now_sec: i64) !void {
38 const db_header = try reader.takeStruct(ApplDbHeader, .big);
39 assert(mem.eql(u8, &db_header.signature, "kych"));
40
41 reader.seek = db_header.schema_offset;
42
43 const db_schema = try reader.takeStruct(ApplDbSchema, .big);
44
45 var table_list = try gpa.alloc(u32, db_schema.table_count);
46 defer gpa.free(table_list);
47
48 var table_idx: u32 = 0;
49 while (table_idx < table_list.len) : (table_idx += 1) {
50 table_list[table_idx] = try reader.takeInt(u32, .big);
51 }
52
53 for (table_list) |table_offset| {
54 reader.seek = db_header.schema_offset + table_offset;
55
56 const table_header = try reader.takeStruct(TableHeader, .big);
57
58 if (@as(std.c.DB_RECORDTYPE, @fromBackingInt(@intCast(table_header.table_id))) != .X509_CERTIFICATE) {
59 continue;
60 }
61
62 var record_list = try gpa.alloc(u32, table_header.record_count);
63 defer gpa.free(record_list);
64
65 var record_idx: u32 = 0;
66 while (record_idx < record_list.len) : (record_idx += 1) {
67 record_list[record_idx] = try reader.takeInt(u32, .big);
68 }
69
70 for (record_list) |record_offset| {
71 // An offset of zero means that the record is not present.
72 // An offset that is not 4-byte-aligned is invalid.
73 if (record_offset == 0 or record_offset % 4 != 0) continue;
74
75 reader.seek = db_header.schema_offset + table_offset + record_offset;
76
77 const cert_header = try reader.takeStruct(X509CertHeader, .big);
78
79 if (cert_header.cert_size == 0) continue;
80
81 const cert_start: u32 = @intCast(cb.bytes.items.len);
82 const dest_buf = try cb.bytes.addManyAsSlice(gpa, cert_header.cert_size);
83 try reader.readSliceAll(dest_buf);
84
85 try cb.parseCert(gpa, cert_start, now_sec);
86 }
87 }
88}
89
90const ApplDbHeader = extern struct {
91 signature: [4]u8,
92 version: u32,
93 header_size: u32,
94 schema_offset: u32,
95 auth_offset: u32,
96};
97
98const ApplDbSchema = extern struct {
99 schema_size: u32,
100 table_count: u32,
101};
102
103const TableHeader = extern struct {
104 table_size: u32,
105 table_id: u32,
106 record_count: u32,
107 records: u32,
108 indexes_offset: u32,
109 free_list_head: u32,
110 record_numbers_count: u32,
111};
112
113const X509CertHeader = extern struct {
114 record_size: u32,
115 record_number: u32,
116 unknown1: u32,
117 unknown2: u32,
118 cert_size: u32,
119 unknown3: u32,
120 cert_type: u32,
121 cert_encoding: u32,
122 print_name: u32,
123 alias: u32,
124 subject: u32,
125 issuer: u32,
126 serial_number: u32,
127 subject_key_identifier: u32,
128 public_key_hash: u32,
129};