rama-crypto 0.4.0

All crypto logic used by rama
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

use ahash::HashMap;
use security_framework::trust_settings::{Domain, TrustSettings, TrustSettingsForCertificate};

use super::CertificateResult;
use crate::pki_types::CertificateDer;

pub(super) fn load_native_certs() -> CertificateResult {
    // The various domains are designed to interact like this:
    //
    // "Per-user Trust Settings override locally administered Trust Settings,
    //  which in turn override the System Trust Settings."
    //
    // So we collect the certificates in this order; as a map of their DER
    // encoding to what we'll do with them. We don't overwrite existing
    // elements, which means User settings trump Admin trump System, as desired.

    let mut result = CertificateResult::default();
    let mut all_certs = HashMap::default();
    for domain in &[Domain::User, Domain::Admin, Domain::System] {
        let ts = TrustSettings::new(*domain);
        let iter = match ts.iter() {
            Ok(iter) => iter,
            Err(err) => {
                result.os_error(
                    err.into(),
                    match domain {
                        Domain::User => "failed to load user trust settings",
                        Domain::Admin => "failed to load admin trust settings",
                        Domain::System => "failed to load system trust settings",
                    },
                );
                continue;
            }
        };

        for cert in iter {
            let der = cert.to_der();

            // If there are no specific trust settings, the default is to trust
            // the certificate as a root cert. The docs say:
            //
            // "Note that an empty Trust Settings array means 'always trust this
            //  cert, with a resulting kSecTrustSettingsResult of
            //  kSecTrustSettingsResultTrustRoot'."
            let trusted = match ts.tls_trust_settings_for_certificate(&cert) {
                Ok(trusted) => trusted.unwrap_or(TrustSettingsForCertificate::TrustRoot),
                Err(err) => {
                    result.os_error(err.into(), "certificate not trusted");
                    continue;
                }
            };

            all_certs.entry(der).or_insert(trusted);
        }
    }

    // Now we have all the certificates and an idea of whether to use them.
    for (der, trusted) in all_certs.drain() {
        if let TrustSettingsForCertificate::TrustRoot | TrustSettingsForCertificate::TrustAsRoot =
            trusted
        {
            result.certs.push(CertificateDer::from(der));
        }
    }

    result
}