#include <certstor_macos.h>

Inheritance diagram for Botan::Certificate_Store_MacOS:

Public Member Functions
std::vector< X509_DN >	all_subjects () const override

bool	certificate_known (const X509_Certificate &cert) const

	Certificate_Store_MacOS ()

	Certificate_Store_MacOS (Certificate_Store_MacOS &&)=default

	Certificate_Store_MacOS (const Certificate_Store_MacOS &)=default

std::vector< X509_Certificate >	find_all_certs (const X509_DN &subject_dn, const std::vector< uint8_t > &key_id) const override

std::optional< X509_Certificate >	find_cert (const X509_DN &subject_dn, const std::vector< uint8_t > &key_id) const override

std::optional< X509_Certificate >	find_cert_by_pubkey_sha1 (const std::vector< uint8_t > &key_hash) const override

std::optional< X509_Certificate >	find_cert_by_raw_subject_dn_sha256 (const std::vector< uint8_t > &subject_hash) const override

std::optional< X509_CRL >	find_crl_for (const X509_Certificate &subject) const override

Certificate_Store_MacOS &	operator= (Certificate_Store_MacOS &&)=default

Certificate_Store_MacOS &	operator= (const Certificate_Store_MacOS &)=default

Detailed Description

Certificate Store that is backed by the system trust store on macOS. This opens a handle to the macOS keychain and serves certificate queries directly from there.

Definition at line 25 of file certstor_macos.h.

Constructor & Destructor Documentation

◆ Certificate_Store_MacOS() [1/3]

Botan::Certificate_Store_MacOS::Certificate_Store_MacOS ( )

Definition at line 337 of file certstor_macos.cpp.

337: m_impl(std::make_shared<Certificate_Store_MacOS_Impl>()) {}

◆ Certificate_Store_MacOS() [2/3]

Botan::Certificate_Store_MacOS::Certificate_Store_MacOS ( const Certificate_Store_MacOS & )

default

◆ Certificate_Store_MacOS() [3/3]

Botan::Certificate_Store_MacOS::Certificate_Store_MacOS ( Certificate_Store_MacOS && )

default

Member Function Documentation

◆ all_subjects()

std::vector< X509_DN > Botan::Certificate_Store_MacOS::all_subjects ( ) const

overridevirtual

Returns: DNs for all certificates managed by the store

Implements Botan::Certificate_Store.

Definition at line 339 of file certstor_macos.cpp.

                                                               {
   // Note: This fetches and parses all certificates in the trust store.
   //       Apple's API provides SecCertificateCopyNormalizedSubjectSequence
   //       which facilitates reading the certificate DN without parsing the
   //       entire certificate via X509_Certificate. However, this
   //       function applies the same DN "normalization" as stated above.
   const auto certificates = m_impl->findAll({});
 
   std::vector<X509_DN> output;
   std::transform(certificates.cbegin(),
                  certificates.cend(),
                  std::back_inserter(output),
                  [](const std::optional<X509_Certificate> cert) { return cert->subject_dn(); });
 
   return output;
}

◆ certificate_known()

bool Botan::Certificate_Store::certificate_known ( const X509_Certificate & cert ) const

inlineinherited

Returns: whether the certificate is known

Parameters

cert	certififcate to be searched

Definition at line 70 of file certstor.h.

                                                                 {
         return find_cert(cert.subject_dn(), cert.subject_key_id()).has_value();
      }

References Botan::X509_Certificate::subject_dn(), and Botan::X509_Certificate::subject_key_id().

◆ find_all_certs()

std::vector< X509_Certificate > Botan::Certificate_Store_MacOS::find_all_certs	(	const X509_DN &	subject_dn,
		const std::vector< uint8_t > &	key_id ) const

overridevirtual

Find all certificates with a given Subject DN. Subject DN and even the key identifier might not be unique.

Implements Botan::Certificate_Store.

Definition at line 368 of file certstor_macos.cpp.

                                                                                                              {
   Certificate_Store_MacOS_Impl::Query query;
   query.addParameter(kSecAttrSubject, normalizeAndSerialize(subject_dn));
 
   if(!key_id.empty()) {
      query.addParameter(kSecAttrSubjectKeyID, key_id);
   }
 
   return m_impl->findAll(std::move(query));
}

◆ find_cert()

std::optional< X509_Certificate > Botan::Certificate_Store_MacOS::find_cert	(	const X509_DN &	subject_dn,
		const std::vector< uint8_t > &	key_id ) const

overridevirtual

Find a certificate by Subject DN and (optionally) key identifier

Returns: the first certificate that matches

Reimplemented from Botan::Certificate_Store.

Definition at line 356 of file certstor_macos.cpp.

                                                                                                           {
   Certificate_Store_MacOS_Impl::Query query;
   query.addParameter(kSecAttrSubject, normalizeAndSerialize(subject_dn));
 
   if(!key_id.empty()) {
      query.addParameter(kSecAttrSubjectKeyID, key_id);
   }
 
   return m_impl->findOne(std::move(query));
}

◆ find_cert_by_pubkey_sha1()

std::optional< X509_Certificate > Botan::Certificate_Store_MacOS::find_cert_by_pubkey_sha1 ( const std::vector< uint8_t > & key_hash ) const

overridevirtual

Find a certificate by searching for one with a matching SHA-1 hash of public key.

Returns: a matching certificate or nullptr otherwise

Implements Botan::Certificate_Store.

Definition at line 380 of file certstor_macos.cpp.

                                             {
   if(key_hash.size() != 20) {
      throw Invalid_Argument("Certificate_Store_MacOS::find_cert_by_pubkey_sha1 invalid hash");
   }
 
   Certificate_Store_MacOS_Impl::Query query;
   query.addParameter(kSecAttrPublicKeyHash, key_hash);
 
   return m_impl->findOne(std::move(query));
}

◆ find_cert_by_raw_subject_dn_sha256()

std::optional< X509_Certificate > Botan::Certificate_Store_MacOS::find_cert_by_raw_subject_dn_sha256 ( const std::vector< uint8_t > & subject_hash ) const

overridevirtual

Exceptions

Not_Implemented

Implements Botan::Certificate_Store.

Definition at line 392 of file certstor_macos.cpp.

                                                 {
   BOTAN_UNUSED(subject_hash);
   throw Not_Implemented("Certificate_Store_MacOS::find_cert_by_raw_subject_dn_sha256");
}

References BOTAN_UNUSED.

◆ find_crl_for()

std::optional< X509_CRL > Botan::Certificate_Store_MacOS::find_crl_for ( const X509_Certificate & subject ) const

overridevirtual

Fetching CRLs is not supported by the keychain on macOS. This will always return an empty list.

Reimplemented from Botan::Certificate_Store.

Definition at line 398 of file certstor_macos.cpp.

                                                                                                 {
   BOTAN_UNUSED(subject);
   return {};
}

References BOTAN_UNUSED.

◆ operator=() [1/2]

Certificate_Store_MacOS & Botan::Certificate_Store_MacOS::operator= ( Certificate_Store_MacOS && )

default

◆ operator=() [2/2]

Certificate_Store_MacOS & Botan::Certificate_Store_MacOS::operator= ( const Certificate_Store_MacOS & )

default

The documentation for this class was generated from the following files:

src/lib/x509/certstor_system_macos/certstor_macos.h
src/lib/x509/certstor_system_macos/certstor_macos.cpp

Public Member Functions

Detailed Description

Constructor & Destructor Documentation

◆ Certificate_Store_MacOS() [1/3]

◆ Certificate_Store_MacOS() [2/3]

◆ Certificate_Store_MacOS() [3/3]

Member Function Documentation

◆ all_subjects()

◆ certificate_known()

◆ find_all_certs()

◆ find_cert()

◆ find_cert_by_pubkey_sha1()

◆ find_cert_by_raw_subject_dn_sha256()

◆ find_crl_for()

◆ operator=() [1/2]

◆ operator=() [2/2]