434 lines
15 KiB
Mathematica
434 lines
15 KiB
Mathematica
|
//
|
||
|
|
// SFHFKeychainUtils.m
|
||
|
|
//
|
||
|
|
// Created by Buzz Andersen on 10/20/08.
|
||
|
|
// Based partly on code by Jonathan Wight, Jon Crosby, and Mike Malone.
|
||
|
|
// Copyright 2008 Sci-Fi Hi-Fi. All rights reserved.
|
||
|
|
//
|
||
|
|
// Permission is hereby granted, free of charge, to any person
|
||
|
|
// obtaining a copy of this software and associated documentation
|
||
|
|
// files (the "Software"), to deal in the Software without
|
||
|
|
// restriction, including without limitation the rights to use,
|
||
|
|
// copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||
|
|
// copies of the Software, and to permit persons to whom the
|
||
|
|
// Software is furnished to do so, subject to the following
|
||
|
|
// conditions:
|
||
|
|
//
|
||
|
|
// The above copyright notice and this permission notice shall be
|
||
|
|
// included in all copies or substantial portions of the Software.
|
||
|
|
//
|
||
|
|
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||
|
|
// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
|
||
|
|
// OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
||
|
|
// NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
|
||
|
|
// HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
|
||
|
|
// WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
|
||
|
|
// FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
|
||
|
|
// OTHER DEALINGS IN THE SOFTWARE.
|
||
|
|
//
|
||
|
|
|
||
|
|
#import "SFHFKeychainUtils.h"
|
||
|
|
#import <Security/Security.h>
|
||
|
|
|
||
|
|
static NSString *SFHFKeychainUtilsErrorDomain = @"SFHFKeychainUtilsErrorDomain";
|
||
|
|
|
||
|
|
#if __IPHONE_OS_VERSION_MIN_REQUIRED < 30000 && TARGET_IPHONE_SIMULATOR
|
||
|
|
@interface SFHFKeychainUtils (PrivateMethods)
|
||
|
|
+ (SecKeychainItemRef) getKeychainItemReferenceForUsername: (NSString *) username andServerName: (NSString *) serverName error: (NSError **) error;
|
||
|
|
@end
|
||
|
|
#endif
|
||
|
|
|
||
|
|
@implementation SFHFKeychainUtils
|
||
|
|
|
||
|
|
#if __IPHONE_OS_VERSION_MIN_REQUIRED < 30000 && TARGET_IPHONE_SIMULATOR
|
||
|
|
|
||
|
|
+ (NSString *) getPasswordForUsername: (NSString *) username andServerName: (NSString *) serverName error: (NSError **) error {
|
||
|
|
if (!username || !serviceName) {
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: -2000 userInfo: nil];
|
||
|
|
return nil;
|
||
|
|
}
|
||
|
|
|
||
|
|
SecKeychainItemRef item = [SFHFKeychainUtils getKeychainItemReferenceForUsername: username andServerName: serverName error: error];
|
||
|
|
|
||
|
|
if (*error || !item) {
|
||
|
|
return nil;
|
||
|
|
}
|
||
|
|
|
||
|
|
// from Advanced Mac OS X Programming, ch. 16
|
||
|
|
UInt32 length;
|
||
|
|
char *password;
|
||
|
|
SecKeychainAttribute attributes[8];
|
||
|
|
SecKeychainAttributeList list;
|
||
|
|
|
||
|
|
attributes[0].tag = kSecAccountItemAttr;
|
||
|
|
attributes[1].tag = kSecDescriptionItemAttr;
|
||
|
|
attributes[2].tag = kSecLabelItemAttr;
|
||
|
|
attributes[3].tag = kSecModDateItemAttr;
|
||
|
|
|
||
|
|
list.count = 4;
|
||
|
|
list.attr = attributes;
|
||
|
|
|
||
|
|
OSStatus status = SecKeychainItemCopyContent(item, NULL, &list, &length, (void **)&password);
|
||
|
|
|
||
|
|
if (status != noErr) {
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: status userInfo: nil];
|
||
|
|
return nil;
|
||
|
|
}
|
||
|
|
|
||
|
|
NSString *passwordString = nil;
|
||
|
|
|
||
|
|
if (password != NULL) {
|
||
|
|
char passwordBuffer[1024];
|
||
|
|
|
||
|
|
if (length > 1023) {
|
||
|
|
length = 1023;
|
||
|
|
}
|
||
|
|
strncpy(passwordBuffer, password, length);
|
||
|
|
|
||
|
|
passwordBuffer[length] = '\0';
|
||
|
|
passwordString = [NSString stringWithCString:passwordBuffer];
|
||
|
|
}
|
||
|
|
|
||
|
|
SecKeychainItemFreeContent(&list, password);
|
||
|
|
|
||
|
|
CFRelease(item);
|
||
|
|
|
||
|
|
return passwordString;
|
||
|
|
}
|
||
|
|
|
||
|
|
+ (void) storeUsername: (NSString *) username andPassword: (NSString *) password forServerName: (NSString *) serverName updateExisting: (BOOL) updateExisting error: (NSError **) error {
|
||
|
|
if (!username || !password || !serverName) {
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: -2000 userInfo: nil];
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
OSStatus status = noErr;
|
||
|
|
|
||
|
|
SecKeychainItemRef item = [SFHFKeychainUtils getKeychainItemReferenceForUsername: username andServerName: serverName error: error];
|
||
|
|
|
||
|
|
if (*error && [*error code] != noErr) {
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
*error = nil;
|
||
|
|
|
||
|
|
if (item) {
|
||
|
|
status = SecKeychainItemModifyAttributesAndData(item,
|
||
|
|
NULL,
|
||
|
|
strlen([password UTF8String]),
|
||
|
|
[password UTF8String]);
|
||
|
|
|
||
|
|
CFRelease(item);
|
||
|
|
}
|
||
|
|
else {
|
||
|
|
status = SecKeychainAddGenericPassword(NULL,
|
||
|
|
strlen([serverName UTF8String]),
|
||
|
|
[serverName UTF8String],
|
||
|
|
strlen([username UTF8String]),
|
||
|
|
[username UTF8String],
|
||
|
|
strlen([password UTF8String]),
|
||
|
|
[password UTF8String],
|
||
|
|
NULL);
|
||
|
|
}
|
||
|
|
|
||
|
|
if (status != noErr) {
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: status userInfo: nil];
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
+ (void) deleteItemForUsername: (NSString *) username andServerName: (NSString *) serverName error: (NSError **) error {
|
||
|
|
if (!username || !serverName) {
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: 2000 userInfo: nil];
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
*error = nil;
|
||
|
|
|
||
|
|
SecKeychainItemRef item = [SFHFKeychainUtils getKeychainItemReferenceForUsername: username andServerName: serverName error: error];
|
||
|
|
|
||
|
|
if (*error && [*error code] != noErr) {
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
|
||
|
|
OSStatus status;
|
||
|
|
|
||
|
|
if (item) {
|
||
|
|
status = SecKeychainItemDelete(item);
|
||
|
|
|
||
|
|
CFRelease(item);
|
||
|
|
}
|
||
|
|
|
||
|
|
if (status != noErr) {
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: status userInfo: nil];
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
+ (SecKeychainItemRef) getKeychainItemReferenceForUsername: (NSString *) username andServerName: (NSString *) serverName error: (NSError **) error {
|
||
|
|
if (!username || !serverName) {
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: -2000 userInfo: nil];
|
||
|
|
return nil;
|
||
|
|
}
|
||
|
|
|
||
|
|
*error = nil;
|
||
|
|
|
||
|
|
SecKeychainItemRef item;
|
||
|
|
|
||
|
|
OSStatus status = SecKeychainFindGenericPassword(NULL,
|
||
|
|
strlen([serverName UTF8String]),
|
||
|
|
[serverName UTF8String],
|
||
|
|
strlen([username UTF8String]),
|
||
|
|
[username UTF8String],
|
||
|
|
NULL,
|
||
|
|
NULL,
|
||
|
|
&item);
|
||
|
|
|
||
|
|
if (status != noErr) {
|
||
|
|
if (status != errSecItemNotFound) {
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: status userInfo: nil];
|
||
|
|
}
|
||
|
|
|
||
|
|
return nil;
|
||
|
|
}
|
||
|
|
|
||
|
|
return item;
|
||
|
|
}
|
||
|
|
|
||
|
|
#else
|
||
|
|
|
||
|
|
+ (NSString *) getPasswordForUsername: (NSString *) username andServerName: (NSString *) serverName error: (NSError **) error {
|
||
|
|
if (!username || !serverName) {
|
||
|
|
if (error != nil) {
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: -2000 userInfo: nil];
|
||
|
|
}
|
||
|
|
return nil;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (error != nil) {
|
||
|
|
*error = nil;
|
||
|
|
}
|
||
|
|
|
||
|
|
// Set up a query dictionary with the base query attributes: item type (generic), username, and service
|
||
|
|
|
||
|
|
NSArray *keys = [[[NSArray alloc] initWithObjects: (NSString *) kSecClass, kSecAttrAccount, kSecAttrService, nil] autorelease];
|
||
|
|
NSArray *objects = [[[NSArray alloc] initWithObjects: (NSString *) kSecClassGenericPassword, username, serverName, nil] autorelease];
|
||
|
|
|
||
|
|
NSMutableDictionary *query = [[[NSMutableDictionary alloc] initWithObjects: objects forKeys: keys] autorelease];
|
||
|
|
|
||
|
|
// First do a query for attributes, in case we already have a Keychain item with no password data set.
|
||
|
|
// One likely way such an incorrect item could have come about is due to the previous (incorrect)
|
||
|
|
// version of this code (which set the password as a generic attribute instead of password data).
|
||
|
|
|
||
|
|
NSDictionary *attributeResult = NULL;
|
||
|
|
NSMutableDictionary *attributeQuery = [query mutableCopy];
|
||
|
|
[attributeQuery setObject: (id) kCFBooleanTrue forKey:(id) kSecReturnAttributes];
|
||
|
|
OSStatus status = SecItemCopyMatching((CFDictionaryRef) attributeQuery, (CFTypeRef *) &attributeResult);
|
||
|
|
|
||
|
|
[attributeResult release];
|
||
|
|
[attributeQuery release];
|
||
|
|
|
||
|
|
if (status != noErr) {
|
||
|
|
// No existing item found--simply return nil for the password
|
||
|
|
if (error != nil && status != errSecItemNotFound) {
|
||
|
|
//Only return an error if a real exception happened--not simply for "not found."
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: status userInfo: nil];
|
||
|
|
}
|
||
|
|
|
||
|
|
return nil;
|
||
|
|
}
|
||
|
|
|
||
|
|
// We have an existing item, now query for the password data associated with it.
|
||
|
|
|
||
|
|
NSData *resultData = nil;
|
||
|
|
NSMutableDictionary *passwordQuery = [query mutableCopy];
|
||
|
|
[passwordQuery setObject: (id) kCFBooleanTrue forKey: (id) kSecReturnData];
|
||
|
|
|
||
|
|
status = SecItemCopyMatching((CFDictionaryRef) passwordQuery, (CFTypeRef *) &resultData);
|
||
|
|
|
||
|
|
[resultData autorelease];
|
||
|
|
[passwordQuery release];
|
||
|
|
|
||
|
|
if (status != noErr) {
|
||
|
|
if (status == errSecItemNotFound) {
|
||
|
|
// We found attributes for the item previously, but no password now, so return a special error.
|
||
|
|
// Users of this API will probably want to detect this error and prompt the user to
|
||
|
|
// re-enter their credentials. When you attempt to store the re-entered credentials
|
||
|
|
// using storeUsername:andPassword:forServiceName:updateExisting:error
|
||
|
|
// the old, incorrect entry will be deleted and a new one with a properly encrypted
|
||
|
|
// password will be added.
|
||
|
|
if (error != nil) {
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: -1999 userInfo: nil];
|
||
|
|
}
|
||
|
|
}
|
||
|
|
else {
|
||
|
|
// Something else went wrong. Simply return the normal Keychain API error code.
|
||
|
|
if (error != nil) {
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: status userInfo: nil];
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
return nil;
|
||
|
|
}
|
||
|
|
|
||
|
|
NSString *password = nil;
|
||
|
|
|
||
|
|
if (resultData) {
|
||
|
|
password = [[NSString alloc] initWithData: resultData encoding: NSUTF8StringEncoding];
|
||
|
|
}
|
||
|
|
else {
|
||
|
|
// There is an existing item, but we weren't able to get password data for it for some reason,
|
||
|
|
// Possibly as a result of an item being incorrectly entered by the previous code.
|
||
|
|
// Set the -1999 error so the code above us can prompt the user again.
|
||
|
|
if (error != nil) {
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: -1999 userInfo: nil];
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
return [password autorelease];
|
||
|
|
}
|
||
|
|
|
||
|
|
+ (BOOL) storeUsername: (NSString *) username andPassword: (NSString *) password forServerName: (NSString *) serverName updateExisting: (BOOL) updateExisting error: (NSError **) error
|
||
|
|
{
|
||
|
|
if (!username || !password || !serverName)
|
||
|
|
{
|
||
|
|
if (error != nil)
|
||
|
|
{
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: -2000 userInfo: nil];
|
||
|
|
}
|
||
|
|
return NO;
|
||
|
|
}
|
||
|
|
|
||
|
|
// See if we already have a password entered for these credentials.
|
||
|
|
NSError *getError = nil;
|
||
|
|
NSString *existingPassword = [SFHFKeychainUtils getPasswordForUsername: username andServerName: serverName error:&getError];
|
||
|
|
|
||
|
|
if ([getError code] == -1999)
|
||
|
|
{
|
||
|
|
// There is an existing entry without a password properly stored (possibly as a result of the previous incorrect version of this code.
|
||
|
|
// Delete the existing item before moving on entering a correct one.
|
||
|
|
|
||
|
|
getError = nil;
|
||
|
|
|
||
|
|
[self deleteItemForUsername: username andServerName: serverName error: &getError];
|
||
|
|
|
||
|
|
if ([getError code] != noErr)
|
||
|
|
{
|
||
|
|
if (error != nil)
|
||
|
|
{
|
||
|
|
*error = getError;
|
||
|
|
}
|
||
|
|
return NO;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
else if ([getError code] != noErr)
|
||
|
|
{
|
||
|
|
if (error != nil)
|
||
|
|
{
|
||
|
|
*error = getError;
|
||
|
|
}
|
||
|
|
return NO;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (error != nil)
|
||
|
|
{
|
||
|
|
*error = nil;
|
||
|
|
}
|
||
|
|
|
||
|
|
OSStatus status = noErr;
|
||
|
|
|
||
|
|
if (existingPassword)
|
||
|
|
{
|
||
|
|
// We have an existing, properly entered item with a password.
|
||
|
|
// Update the existing item.
|
||
|
|
|
||
|
|
if (![existingPassword isEqualToString:password] && updateExisting)
|
||
|
|
{
|
||
|
|
//Only update if we're allowed to update existing. If not, simply do nothing.
|
||
|
|
|
||
|
|
NSArray *keys = [[[NSArray alloc] initWithObjects: (NSString *) kSecClass,
|
||
|
|
kSecAttrService,
|
||
|
|
kSecAttrLabel,
|
||
|
|
kSecAttrAccount,
|
||
|
|
nil] autorelease];
|
||
|
|
|
||
|
|
NSArray *objects = [[[NSArray alloc] initWithObjects: (NSString *) kSecClassGenericPassword,
|
||
|
|
serverName,
|
||
|
|
serverName,
|
||
|
|
username,
|
||
|
|
nil] autorelease];
|
||
|
|
|
||
|
|
NSDictionary *query = [[[NSDictionary alloc] initWithObjects: objects forKeys: keys] autorelease];
|
||
|
|
|
||
|
|
status = SecItemUpdate((CFDictionaryRef) query, (CFDictionaryRef) [NSDictionary dictionaryWithObject: [password dataUsingEncoding: NSUTF8StringEncoding] forKey: (NSString *) kSecValueData]);
|
||
|
|
}
|
||
|
|
}
|
||
|
|
else
|
||
|
|
{
|
||
|
|
// No existing entry (or an existing, improperly entered, and therefore now
|
||
|
|
// deleted, entry). Create a new entry.
|
||
|
|
|
||
|
|
NSArray *keys = [[[NSArray alloc] initWithObjects: (NSString *) kSecClass,
|
||
|
|
kSecAttrService,
|
||
|
|
kSecAttrLabel,
|
||
|
|
kSecAttrAccount,
|
||
|
|
kSecValueData,
|
||
|
|
nil] autorelease];
|
||
|
|
|
||
|
|
NSArray *objects = [[[NSArray alloc] initWithObjects: (NSString *) kSecClassGenericPassword,
|
||
|
|
serverName,
|
||
|
|
serverName,
|
||
|
|
username,
|
||
|
|
[password dataUsingEncoding: NSUTF8StringEncoding],
|
||
|
|
nil] autorelease];
|
||
|
|
|
||
|
|
NSDictionary *query = [[[NSDictionary alloc] initWithObjects: objects forKeys: keys] autorelease];
|
||
|
|
|
||
|
|
status = SecItemAdd((CFDictionaryRef) query, NULL);
|
||
|
|
}
|
||
|
|
|
||
|
|
if (error != nil && status != noErr)
|
||
|
|
{
|
||
|
|
// Something went wrong with adding the new item. Return the Keychain error code.
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: status userInfo: nil];
|
||
|
|
|
||
|
|
return NO;
|
||
|
|
}
|
||
|
|
|
||
|
|
return YES;
|
||
|
|
}
|
||
|
|
|
||
|
|
+ (BOOL) deleteItemForUsername: (NSString *) username andServerName: (NSString *) serverName error: (NSError **) error
|
||
|
|
{
|
||
|
|
if (!username || !serverName)
|
||
|
|
{
|
||
|
|
if (error != nil)
|
||
|
|
{
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: -2000 userInfo: nil];
|
||
|
|
}
|
||
|
|
return NO;
|
||
|
|
}
|
||
|
|
|
||
|
|
if (error != nil)
|
||
|
|
{
|
||
|
|
*error = nil;
|
||
|
|
}
|
||
|
|
|
||
|
|
NSArray *keys = [[[NSArray alloc] initWithObjects: (NSString *) kSecClass, kSecAttrAccount, kSecAttrService, kSecReturnAttributes, nil] autorelease];
|
||
|
|
NSArray *objects = [[[NSArray alloc] initWithObjects: (NSString *) kSecClassGenericPassword, username, serverName, kCFBooleanTrue, nil] autorelease];
|
||
|
|
|
||
|
|
NSDictionary *query = [[[NSDictionary alloc] initWithObjects: objects forKeys: keys] autorelease];
|
||
|
|
|
||
|
|
OSStatus status = SecItemDelete((CFDictionaryRef) query);
|
||
|
|
|
||
|
|
if (error != nil && status != noErr)
|
||
|
|
{
|
||
|
|
*error = [NSError errorWithDomain: SFHFKeychainUtilsErrorDomain code: status userInfo: nil];
|
||
|
|
|
||
|
|
return NO;
|
||
|
|
}
|
||
|
|
|
||
|
|
return YES;
|
||
|
|
}
|
||
|
|
|
||
|
|
#endif
|
||
|
|
|
||
|
|
@end
|