password_store_mac.cc revision cedac228d2dd51db4b79ea1e72c7f249408ee061
1// Copyright (c) 2012 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#include "chrome/browser/password_manager/password_store_mac.h" 6#include "chrome/browser/password_manager/password_store_mac_internal.h" 7 8#include <CoreServices/CoreServices.h> 9#include <set> 10#include <string> 11#include <utility> 12#include <vector> 13 14#include "base/callback.h" 15#include "base/logging.h" 16#include "base/mac/mac_logging.h" 17#include "base/mac/mac_util.h" 18#include "base/message_loop/message_loop.h" 19#include "base/stl_util.h" 20#include "base/strings/string_util.h" 21#include "base/strings/utf_string_conversions.h" 22#include "chrome/browser/mac/security_wrappers.h" 23#include "components/password_manager/core/browser/login_database.h" 24#include "components/password_manager/core/browser/password_store_change.h" 25#include "content/public/browser/browser_thread.h" 26#include "crypto/apple_keychain.h" 27 28using autofill::PasswordForm; 29using crypto::AppleKeychain; 30using password_manager::PasswordStoreChange; 31using password_manager::PasswordStoreChangeList; 32 33// Utility class to handle the details of constructing and running a keychain 34// search from a set of attributes. 35class KeychainSearch { 36 public: 37 explicit KeychainSearch(const AppleKeychain& keychain); 38 ~KeychainSearch(); 39 40 // Sets up a keycahin search based on an non "null" (NULL for char*, 41 // The appropriate "Any" entry for other types) arguments. 42 // 43 // IMPORTANT: Any paramaters passed in *must* remain valid for as long as the 44 // KeychainSearch object, since the search uses them by reference. 45 void Init(const char* server, const UInt32& port, 46 const SecProtocolType& protocol, 47 const SecAuthenticationType& auth_type, const char* security_domain, 48 const char* path, const char* username, OSType creator); 49 50 // Fills |items| with all Keychain items that match the Init'd search. 51 // If the search fails for any reason, |items| will be unchanged. 52 void FindMatchingItems(std::vector<SecKeychainItemRef>* matches); 53 54 private: 55 const AppleKeychain* keychain_; 56 SecKeychainAttributeList search_attributes_; 57 SecKeychainSearchRef search_ref_; 58}; 59 60KeychainSearch::KeychainSearch(const AppleKeychain& keychain) 61 : keychain_(&keychain), search_ref_(NULL) { 62 search_attributes_.count = 0; 63 search_attributes_.attr = NULL; 64} 65 66KeychainSearch::~KeychainSearch() { 67 if (search_attributes_.attr) { 68 free(search_attributes_.attr); 69 } 70} 71 72void KeychainSearch::Init(const char* server, const UInt32& port, 73 const SecProtocolType& protocol, 74 const SecAuthenticationType& auth_type, 75 const char* security_domain, const char* path, 76 const char* username, OSType creator) { 77 // Allocate enough to hold everything we might use. 78 const unsigned int kMaxEntryCount = 8; 79 search_attributes_.attr = 80 static_cast<SecKeychainAttribute*>(calloc(kMaxEntryCount, 81 sizeof(SecKeychainAttribute))); 82 unsigned int entries = 0; 83 // We only use search_attributes_ with SearchCreateFromAttributes, which takes 84 // a "const SecKeychainAttributeList *", so we trust that they won't try 85 // to modify the list, and that casting away const-ness is thus safe. 86 if (server != NULL) { 87 DCHECK_LT(entries, kMaxEntryCount); 88 search_attributes_.attr[entries].tag = kSecServerItemAttr; 89 search_attributes_.attr[entries].length = strlen(server); 90 search_attributes_.attr[entries].data = 91 const_cast<void*>(reinterpret_cast<const void*>(server)); 92 ++entries; 93 } 94 if (port != kAnyPort) { 95 DCHECK_LE(entries, kMaxEntryCount); 96 search_attributes_.attr[entries].tag = kSecPortItemAttr; 97 search_attributes_.attr[entries].length = sizeof(port); 98 search_attributes_.attr[entries].data = 99 const_cast<void*>(reinterpret_cast<const void*>(&port)); 100 ++entries; 101 } 102 if (protocol != kSecProtocolTypeAny) { 103 DCHECK_LE(entries, kMaxEntryCount); 104 search_attributes_.attr[entries].tag = kSecProtocolItemAttr; 105 search_attributes_.attr[entries].length = sizeof(protocol); 106 search_attributes_.attr[entries].data = 107 const_cast<void*>(reinterpret_cast<const void*>(&protocol)); 108 ++entries; 109 } 110 if (auth_type != kSecAuthenticationTypeAny) { 111 DCHECK_LE(entries, kMaxEntryCount); 112 search_attributes_.attr[entries].tag = kSecAuthenticationTypeItemAttr; 113 search_attributes_.attr[entries].length = sizeof(auth_type); 114 search_attributes_.attr[entries].data = 115 const_cast<void*>(reinterpret_cast<const void*>(&auth_type)); 116 ++entries; 117 } 118 if (security_domain != NULL && strlen(security_domain) > 0) { 119 DCHECK_LE(entries, kMaxEntryCount); 120 search_attributes_.attr[entries].tag = kSecSecurityDomainItemAttr; 121 search_attributes_.attr[entries].length = strlen(security_domain); 122 search_attributes_.attr[entries].data = 123 const_cast<void*>(reinterpret_cast<const void*>(security_domain)); 124 ++entries; 125 } 126 if (path != NULL && strlen(path) > 0 && strcmp(path, "/") != 0) { 127 DCHECK_LE(entries, kMaxEntryCount); 128 search_attributes_.attr[entries].tag = kSecPathItemAttr; 129 search_attributes_.attr[entries].length = strlen(path); 130 search_attributes_.attr[entries].data = 131 const_cast<void*>(reinterpret_cast<const void*>(path)); 132 ++entries; 133 } 134 if (username != NULL) { 135 DCHECK_LE(entries, kMaxEntryCount); 136 search_attributes_.attr[entries].tag = kSecAccountItemAttr; 137 search_attributes_.attr[entries].length = strlen(username); 138 search_attributes_.attr[entries].data = 139 const_cast<void*>(reinterpret_cast<const void*>(username)); 140 ++entries; 141 } 142 if (creator != 0) { 143 DCHECK_LE(entries, kMaxEntryCount); 144 search_attributes_.attr[entries].tag = kSecCreatorItemAttr; 145 search_attributes_.attr[entries].length = sizeof(creator); 146 search_attributes_.attr[entries].data = 147 const_cast<void*>(reinterpret_cast<const void*>(&creator)); 148 ++entries; 149 } 150 search_attributes_.count = entries; 151} 152 153void KeychainSearch::FindMatchingItems(std::vector<SecKeychainItemRef>* items) { 154 OSStatus result = keychain_->SearchCreateFromAttributes( 155 NULL, kSecInternetPasswordItemClass, &search_attributes_, &search_ref_); 156 157 if (result != noErr) { 158 OSSTATUS_LOG(ERROR, result) << "Keychain lookup failed"; 159 return; 160 } 161 162 SecKeychainItemRef keychain_item; 163 while (keychain_->SearchCopyNext(search_ref_, &keychain_item) == noErr) { 164 // Consumer is responsible for freeing the items. 165 items->push_back(keychain_item); 166 } 167 168 keychain_->Free(search_ref_); 169 search_ref_ = NULL; 170} 171 172#pragma mark - 173 174// TODO(stuartmorgan): Convert most of this to private helpers in 175// MacKeychainPasswordFormAdapter once it has sufficient higher-level public 176// methods to provide test coverage. 177namespace internal_keychain_helpers { 178 179// Returns a URL built from the given components. To create a URL without a 180// port, pass kAnyPort for the |port| parameter. 181GURL URLFromComponents(bool is_secure, const std::string& host, int port, 182 const std::string& path) { 183 GURL::Replacements url_components; 184 std::string scheme(is_secure ? "https" : "http"); 185 url_components.SetSchemeStr(scheme); 186 url_components.SetHostStr(host); 187 std::string port_string; // Must remain in scope until after we do replacing. 188 if (port != kAnyPort) { 189 std::ostringstream port_stringstream; 190 port_stringstream << port; 191 port_string = port_stringstream.str(); 192 url_components.SetPortStr(port_string); 193 } 194 url_components.SetPathStr(path); 195 196 GURL url("http://dummy.com"); // ReplaceComponents needs a valid URL. 197 return url.ReplaceComponents(url_components); 198} 199 200// Converts a Keychain time string to a Time object, returning true if 201// time_string_bytes was parsable. If the return value is false, the value of 202// |time| is unchanged. 203bool TimeFromKeychainTimeString(const char* time_string_bytes, 204 unsigned int byte_length, 205 base::Time* time) { 206 DCHECK(time); 207 208 char* time_string = static_cast<char*>(malloc(byte_length + 1)); 209 memcpy(time_string, time_string_bytes, byte_length); 210 time_string[byte_length] = '\0'; 211 base::Time::Exploded exploded_time; 212 bzero(&exploded_time, sizeof(exploded_time)); 213 // The time string is of the form "yyyyMMddHHmmss'Z", in UTC time. 214 int assignments = sscanf(time_string, "%4d%2d%2d%2d%2d%2dZ", 215 &exploded_time.year, &exploded_time.month, 216 &exploded_time.day_of_month, &exploded_time.hour, 217 &exploded_time.minute, &exploded_time.second); 218 free(time_string); 219 220 if (assignments == 6) { 221 *time = base::Time::FromUTCExploded(exploded_time); 222 return true; 223 } 224 return false; 225} 226 227// Returns the PasswordForm Scheme corresponding to |auth_type|. 228PasswordForm::Scheme SchemeForAuthType(SecAuthenticationType auth_type) { 229 switch (auth_type) { 230 case kSecAuthenticationTypeHTMLForm: return PasswordForm::SCHEME_HTML; 231 case kSecAuthenticationTypeHTTPBasic: return PasswordForm::SCHEME_BASIC; 232 case kSecAuthenticationTypeHTTPDigest: return PasswordForm::SCHEME_DIGEST; 233 default: return PasswordForm::SCHEME_OTHER; 234 } 235} 236 237bool FillPasswordFormFromKeychainItem(const AppleKeychain& keychain, 238 const SecKeychainItemRef& keychain_item, 239 PasswordForm* form, 240 bool extract_password_data) { 241 DCHECK(form); 242 243 SecKeychainAttributeInfo attrInfo; 244 UInt32 tags[] = { kSecAccountItemAttr, 245 kSecServerItemAttr, 246 kSecPortItemAttr, 247 kSecPathItemAttr, 248 kSecProtocolItemAttr, 249 kSecAuthenticationTypeItemAttr, 250 kSecSecurityDomainItemAttr, 251 kSecCreationDateItemAttr, 252 kSecNegativeItemAttr }; 253 attrInfo.count = arraysize(tags); 254 attrInfo.tag = tags; 255 attrInfo.format = NULL; 256 257 SecKeychainAttributeList *attrList; 258 UInt32 password_length; 259 260 // If |extract_password_data| is false, do not pass in a reference to 261 // |password_data|. ItemCopyAttributesAndData will then extract only the 262 // attributes of |keychain_item| (doesn't require OS authorization), and not 263 // attempt to extract its password data (requires OS authorization). 264 void* password_data = NULL; 265 void** password_data_ref = extract_password_data ? &password_data : NULL; 266 267 OSStatus result = keychain.ItemCopyAttributesAndData(keychain_item, &attrInfo, 268 NULL, &attrList, 269 &password_length, 270 password_data_ref); 271 272 if (result != noErr) { 273 // We don't log errSecAuthFailed because that just means that the user 274 // chose not to allow us access to the item. 275 if (result != errSecAuthFailed) { 276 OSSTATUS_LOG(ERROR, result) << "Keychain data load failed"; 277 } 278 return false; 279 } 280 281 if (extract_password_data) { 282 base::UTF8ToUTF16(static_cast<const char *>(password_data), password_length, 283 &(form->password_value)); 284 } 285 286 int port = kAnyPort; 287 std::string server; 288 std::string security_domain; 289 std::string path; 290 for (unsigned int i = 0; i < attrList->count; i++) { 291 SecKeychainAttribute attr = attrList->attr[i]; 292 if (!attr.data) { 293 continue; 294 } 295 switch (attr.tag) { 296 case kSecAccountItemAttr: 297 base::UTF8ToUTF16(static_cast<const char *>(attr.data), attr.length, 298 &(form->username_value)); 299 break; 300 case kSecServerItemAttr: 301 server.assign(static_cast<const char *>(attr.data), attr.length); 302 break; 303 case kSecPortItemAttr: 304 port = *(static_cast<UInt32*>(attr.data)); 305 break; 306 case kSecPathItemAttr: 307 path.assign(static_cast<const char *>(attr.data), attr.length); 308 break; 309 case kSecProtocolItemAttr: 310 { 311 SecProtocolType protocol = *(static_cast<SecProtocolType*>(attr.data)); 312 // TODO(stuartmorgan): Handle proxy types 313 form->ssl_valid = (protocol == kSecProtocolTypeHTTPS); 314 break; 315 } 316 case kSecAuthenticationTypeItemAttr: 317 { 318 SecAuthenticationType auth_type = 319 *(static_cast<SecAuthenticationType*>(attr.data)); 320 form->scheme = SchemeForAuthType(auth_type); 321 break; 322 } 323 case kSecSecurityDomainItemAttr: 324 security_domain.assign(static_cast<const char *>(attr.data), 325 attr.length); 326 break; 327 case kSecCreationDateItemAttr: 328 // The only way to get a date out of Keychain is as a string. Really. 329 // (The docs claim it's an int, but the header is correct.) 330 TimeFromKeychainTimeString(static_cast<char*>(attr.data), attr.length, 331 &form->date_created); 332 break; 333 case kSecNegativeItemAttr: 334 Boolean negative_item = *(static_cast<Boolean*>(attr.data)); 335 if (negative_item) { 336 form->blacklisted_by_user = true; 337 } 338 break; 339 } 340 } 341 keychain.ItemFreeAttributesAndData(attrList, password_data); 342 343 // kSecNegativeItemAttr doesn't seem to actually be in widespread use. In 344 // practice, other browsers seem to use a "" or " " password (and a special 345 // user name) to indicated blacklist entries. 346 if (extract_password_data && (form->password_value.empty() || 347 EqualsASCII(form->password_value, " "))) { 348 form->blacklisted_by_user = true; 349 } 350 351 form->origin = URLFromComponents(form->ssl_valid, server, port, path); 352 // TODO(stuartmorgan): Handle proxies, which need a different signon_realm 353 // format. 354 form->signon_realm = form->origin.GetOrigin().spec(); 355 if (form->scheme != PasswordForm::SCHEME_HTML) { 356 form->signon_realm.append(security_domain); 357 } 358 return true; 359} 360 361bool FormsMatchForMerge(const PasswordForm& form_a, 362 const PasswordForm& form_b, 363 FormMatchStrictness strictness) { 364 // We never merge blacklist entries between our store and the keychain. 365 if (form_a.blacklisted_by_user || form_b.blacklisted_by_user) { 366 return false; 367 } 368 bool equal_realm = form_a.signon_realm == form_b.signon_realm; 369 if (strictness == FUZZY_FORM_MATCH) { 370 equal_realm |= (!form_a.original_signon_realm.empty()) && 371 form_a.original_signon_realm == form_b.signon_realm; 372 } 373 return form_a.scheme == form_b.scheme && equal_realm && 374 form_a.username_value == form_b.username_value; 375} 376 377// Returns an the best match for |base_form| from |keychain_forms|, or NULL if 378// there is no suitable match. 379PasswordForm* BestKeychainFormForForm( 380 const PasswordForm& base_form, 381 const std::vector<PasswordForm*>* keychain_forms) { 382 PasswordForm* partial_match = NULL; 383 for (std::vector<PasswordForm*>::const_iterator i = keychain_forms->begin(); 384 i != keychain_forms->end(); ++i) { 385 // TODO(stuartmorgan): We should really be scoring path matches and picking 386 // the best, rather than just checking exact-or-not (although in practice 387 // keychain items with paths probably came from us). 388 if (FormsMatchForMerge(base_form, *(*i), FUZZY_FORM_MATCH)) { 389 if (base_form.origin == (*i)->origin) { 390 return *i; 391 } else if (!partial_match) { 392 partial_match = *i; 393 } 394 } 395 } 396 return partial_match; 397} 398 399// Returns entries from |forms| that are blacklist entries, after removing 400// them from |forms|. 401std::vector<PasswordForm*> ExtractBlacklistForms( 402 std::vector<PasswordForm*>* forms) { 403 std::vector<PasswordForm*> blacklist_forms; 404 for (std::vector<PasswordForm*>::iterator i = forms->begin(); 405 i != forms->end();) { 406 PasswordForm* form = *i; 407 if (form->blacklisted_by_user) { 408 blacklist_forms.push_back(form); 409 i = forms->erase(i); 410 } else { 411 ++i; 412 } 413 } 414 return blacklist_forms; 415} 416 417// Deletes and removes from v any element that exists in s. 418template <class T> 419void DeleteVectorElementsInSet(std::vector<T*>* v, const std::set<T*>& s) { 420 for (typename std::vector<T*>::iterator i = v->begin(); i != v->end();) { 421 T* element = *i; 422 if (s.find(element) != s.end()) { 423 delete element; 424 i = v->erase(i); 425 } else { 426 ++i; 427 } 428 } 429} 430 431void MergePasswordForms(std::vector<PasswordForm*>* keychain_forms, 432 std::vector<PasswordForm*>* database_forms, 433 std::vector<PasswordForm*>* merged_forms) { 434 // Pull out the database blacklist items, since they are used as-is rather 435 // than being merged with keychain forms. 436 std::vector<PasswordForm*> database_blacklist_forms = 437 ExtractBlacklistForms(database_forms); 438 439 // Merge the normal entries. 440 std::set<PasswordForm*> used_keychain_forms; 441 for (std::vector<PasswordForm*>::iterator i = database_forms->begin(); 442 i != database_forms->end();) { 443 PasswordForm* db_form = *i; 444 PasswordForm* best_match = BestKeychainFormForForm(*db_form, 445 keychain_forms); 446 if (best_match) { 447 used_keychain_forms.insert(best_match); 448 db_form->password_value = best_match->password_value; 449 merged_forms->push_back(db_form); 450 i = database_forms->erase(i); 451 } else { 452 ++i; 453 } 454 } 455 456 // Add in the blacklist entries from the database. 457 merged_forms->insert(merged_forms->end(), 458 database_blacklist_forms.begin(), 459 database_blacklist_forms.end()); 460 461 // Clear out all the Keychain entries we used. 462 DeleteVectorElementsInSet(keychain_forms, used_keychain_forms); 463} 464 465std::vector<ItemFormPair> ExtractAllKeychainItemAttributesIntoPasswordForms( 466 std::vector<SecKeychainItemRef>* keychain_items, 467 const AppleKeychain& keychain) { 468 DCHECK(keychain_items); 469 MacKeychainPasswordFormAdapter keychain_adapter(&keychain); 470 *keychain_items = keychain_adapter.GetAllPasswordFormKeychainItems(); 471 std::vector<ItemFormPair> item_form_pairs; 472 for (std::vector<SecKeychainItemRef>::iterator i = keychain_items->begin(); 473 i != keychain_items->end(); ++i) { 474 PasswordForm* form_without_password = new PasswordForm(); 475 internal_keychain_helpers::FillPasswordFormFromKeychainItem( 476 keychain, 477 *i, 478 form_without_password, 479 false); // Load password attributes, but not password data. 480 item_form_pairs.push_back(std::make_pair(&(*i), form_without_password)); 481 } 482 return item_form_pairs; 483} 484 485std::vector<PasswordForm*> GetPasswordsForForms( 486 const AppleKeychain& keychain, 487 std::vector<PasswordForm*>* database_forms) { 488 // First load the attributes of all items in the keychain without loading 489 // their password data, and then match items in |database_forms| against them. 490 // This avoids individually searching through the keychain for passwords 491 // matching each form in |database_forms|, and results in a significant 492 // performance gain, replacing O(N) keychain search operations with a single 493 // operation that loads all keychain items, and then selective reads of only 494 // the relevant passwords. See crbug.com/263685. 495 std::vector<SecKeychainItemRef> keychain_items; 496 std::vector<ItemFormPair> item_form_pairs = 497 ExtractAllKeychainItemAttributesIntoPasswordForms(&keychain_items, 498 keychain); 499 500 // Next, compare the attributes of the PasswordForms in |database_forms| 501 // against those in |item_form_pairs|, and extract password data for each 502 // matching PasswordForm using its corresponding SecKeychainItemRef. 503 std::vector<PasswordForm*> merged_forms; 504 for (std::vector<PasswordForm*>::iterator i = database_forms->begin(); 505 i != database_forms->end();) { 506 std::vector<PasswordForm*> db_form_container(1, *i); 507 std::vector<PasswordForm*> keychain_matches = 508 ExtractPasswordsMergeableWithForm(keychain, item_form_pairs, **i); 509 MergePasswordForms(&keychain_matches, &db_form_container, &merged_forms); 510 if (db_form_container.empty()) { 511 i = database_forms->erase(i); 512 } else { 513 ++i; 514 } 515 STLDeleteElements(&keychain_matches); 516 } 517 518 // Clean up temporary PasswordForms and SecKeychainItemRefs. 519 STLDeleteContainerPairSecondPointers(item_form_pairs.begin(), 520 item_form_pairs.end()); 521 for (std::vector<SecKeychainItemRef>::iterator i = keychain_items.begin(); 522 i != keychain_items.end(); ++i) { 523 keychain.Free(*i); 524 } 525 return merged_forms; 526} 527 528// TODO(stuartmorgan): signon_realm for proxies is not yet supported. 529bool ExtractSignonRealmComponents( 530 const std::string& signon_realm, std::string* server, int* port, 531 bool* is_secure, std::string* security_domain) { 532 // The signon_realm will be the Origin portion of a URL for an HTML form, 533 // and the same but with the security domain as a path for HTTP auth. 534 GURL realm_as_url(signon_realm); 535 if (!realm_as_url.is_valid()) { 536 return false; 537 } 538 539 if (server) 540 *server = realm_as_url.host(); 541 if (is_secure) 542 *is_secure = realm_as_url.SchemeIsSecure(); 543 if (port) 544 *port = realm_as_url.has_port() ? atoi(realm_as_url.port().c_str()) : 0; 545 if (security_domain) { 546 // Strip the leading '/' off of the path to get the security domain. 547 if (realm_as_url.path().length() > 0) 548 *security_domain = realm_as_url.path().substr(1); 549 else 550 security_domain->clear(); 551 } 552 return true; 553} 554 555bool FormIsValidAndMatchesOtherForm(const PasswordForm& query_form, 556 const PasswordForm& other_form) { 557 std::string server; 558 std::string security_domain; 559 int port; 560 bool is_secure; 561 if (!ExtractSignonRealmComponents(query_form.signon_realm, &server, &port, 562 &is_secure, &security_domain)) { 563 return false; 564 } 565 return internal_keychain_helpers::FormsMatchForMerge( 566 query_form, other_form, STRICT_FORM_MATCH); 567} 568 569std::vector<PasswordForm*> ExtractPasswordsMergeableWithForm( 570 const AppleKeychain& keychain, 571 const std::vector<ItemFormPair>& item_form_pairs, 572 const PasswordForm& query_form) { 573 std::vector<PasswordForm*> matches; 574 for (std::vector<ItemFormPair>::const_iterator i = item_form_pairs.begin(); 575 i != item_form_pairs.end(); ++i) { 576 if (FormIsValidAndMatchesOtherForm(query_form, *(i->second))) { 577 // Create a new object, since the caller is responsible for deleting the 578 // returned forms. 579 scoped_ptr<PasswordForm> form_with_password(new PasswordForm()); 580 internal_keychain_helpers::FillPasswordFormFromKeychainItem( 581 keychain, 582 *(i->first), 583 form_with_password.get(), 584 true); // Load password attributes and data. 585 // Do not include blacklisted items found in the keychain. 586 if (!form_with_password->blacklisted_by_user) 587 matches.push_back(form_with_password.release()); 588 } 589 } 590 return matches; 591} 592 593} // namespace internal_keychain_helpers 594 595#pragma mark - 596 597MacKeychainPasswordFormAdapter::MacKeychainPasswordFormAdapter( 598 const AppleKeychain* keychain) 599 : keychain_(keychain), finds_only_owned_(false) { 600} 601 602std::vector<PasswordForm*> MacKeychainPasswordFormAdapter::PasswordsFillingForm( 603 const std::string& signon_realm, 604 PasswordForm::Scheme scheme) { 605 std::vector<SecKeychainItemRef> keychain_items = 606 MatchingKeychainItems(signon_realm, scheme, NULL, NULL); 607 608 return ConvertKeychainItemsToForms(&keychain_items); 609} 610 611PasswordForm* MacKeychainPasswordFormAdapter::PasswordExactlyMatchingForm( 612 const PasswordForm& query_form) { 613 SecKeychainItemRef keychain_item = KeychainItemForForm(query_form); 614 if (keychain_item) { 615 PasswordForm* form = new PasswordForm(); 616 internal_keychain_helpers::FillPasswordFormFromKeychainItem(*keychain_, 617 keychain_item, 618 form, 619 true); 620 keychain_->Free(keychain_item); 621 return form; 622 } 623 return NULL; 624} 625 626bool MacKeychainPasswordFormAdapter::HasPasswordsMergeableWithForm( 627 const PasswordForm& query_form) { 628 std::string username = base::UTF16ToUTF8(query_form.username_value); 629 std::vector<SecKeychainItemRef> matches = 630 MatchingKeychainItems(query_form.signon_realm, query_form.scheme, 631 NULL, username.c_str()); 632 for (std::vector<SecKeychainItemRef>::iterator i = matches.begin(); 633 i != matches.end(); ++i) { 634 keychain_->Free(*i); 635 } 636 637 return !matches.empty(); 638} 639 640std::vector<SecKeychainItemRef> 641 MacKeychainPasswordFormAdapter::GetAllPasswordFormKeychainItems() { 642 SecAuthenticationType supported_auth_types[] = { 643 kSecAuthenticationTypeHTMLForm, 644 kSecAuthenticationTypeHTTPBasic, 645 kSecAuthenticationTypeHTTPDigest, 646 }; 647 648 std::vector<SecKeychainItemRef> matches; 649 for (unsigned int i = 0; i < arraysize(supported_auth_types); ++i) { 650 KeychainSearch keychain_search(*keychain_); 651 keychain_search.Init(NULL, 0, kSecProtocolTypeAny, supported_auth_types[i], 652 NULL, NULL, NULL, CreatorCodeForSearch()); 653 keychain_search.FindMatchingItems(&matches); 654 } 655 return matches; 656} 657 658std::vector<PasswordForm*> 659 MacKeychainPasswordFormAdapter::GetAllPasswordFormPasswords() { 660 std::vector<SecKeychainItemRef> items = GetAllPasswordFormKeychainItems(); 661 return ConvertKeychainItemsToForms(&items); 662} 663 664bool MacKeychainPasswordFormAdapter::AddPassword(const PasswordForm& form) { 665 // We should never be trying to store a blacklist in the keychain. 666 DCHECK(!form.blacklisted_by_user); 667 668 std::string server; 669 std::string security_domain; 670 int port; 671 bool is_secure; 672 if (!internal_keychain_helpers::ExtractSignonRealmComponents( 673 form.signon_realm, &server, &port, &is_secure, &security_domain)) { 674 return false; 675 } 676 std::string username = base::UTF16ToUTF8(form.username_value); 677 std::string password = base::UTF16ToUTF8(form.password_value); 678 std::string path = form.origin.path(); 679 SecProtocolType protocol = is_secure ? kSecProtocolTypeHTTPS 680 : kSecProtocolTypeHTTP; 681 SecKeychainItemRef new_item = NULL; 682 OSStatus result = keychain_->AddInternetPassword( 683 NULL, server.size(), server.c_str(), 684 security_domain.size(), security_domain.c_str(), 685 username.size(), username.c_str(), 686 path.size(), path.c_str(), 687 port, protocol, AuthTypeForScheme(form.scheme), 688 password.size(), password.c_str(), &new_item); 689 690 if (result == noErr) { 691 SetKeychainItemCreatorCode(new_item, 692 base::mac::CreatorCodeForApplication()); 693 keychain_->Free(new_item); 694 } else if (result == errSecDuplicateItem) { 695 // If we collide with an existing item, find and update it instead. 696 SecKeychainItemRef existing_item = KeychainItemForForm(form); 697 if (!existing_item) { 698 return false; 699 } 700 bool changed = SetKeychainItemPassword(existing_item, password); 701 keychain_->Free(existing_item); 702 return changed; 703 } 704 705 return result == noErr; 706} 707 708bool MacKeychainPasswordFormAdapter::RemovePassword(const PasswordForm& form) { 709 SecKeychainItemRef keychain_item = KeychainItemForForm(form); 710 if (keychain_item == NULL) 711 return false; 712 OSStatus result = keychain_->ItemDelete(keychain_item); 713 keychain_->Free(keychain_item); 714 return result == noErr; 715} 716 717void MacKeychainPasswordFormAdapter::SetFindsOnlyOwnedItems( 718 bool finds_only_owned) { 719 finds_only_owned_ = finds_only_owned; 720} 721 722std::vector<PasswordForm*> 723 MacKeychainPasswordFormAdapter::ConvertKeychainItemsToForms( 724 std::vector<SecKeychainItemRef>* items) { 725 std::vector<PasswordForm*> keychain_forms; 726 for (std::vector<SecKeychainItemRef>::const_iterator i = items->begin(); 727 i != items->end(); ++i) { 728 PasswordForm* form = new PasswordForm(); 729 if (internal_keychain_helpers::FillPasswordFormFromKeychainItem( 730 *keychain_, *i, form, true)) { 731 keychain_forms.push_back(form); 732 } 733 keychain_->Free(*i); 734 } 735 items->clear(); 736 return keychain_forms; 737} 738 739SecKeychainItemRef MacKeychainPasswordFormAdapter::KeychainItemForForm( 740 const PasswordForm& form) { 741 // We don't store blacklist entries in the keychain, so the answer to "what 742 // Keychain item goes with this form" is always "nothing" for blacklists. 743 if (form.blacklisted_by_user) { 744 return NULL; 745 } 746 747 std::string path = form.origin.path(); 748 std::string username = base::UTF16ToUTF8(form.username_value); 749 std::vector<SecKeychainItemRef> matches = MatchingKeychainItems( 750 form.signon_realm, form.scheme, path.c_str(), username.c_str()); 751 752 if (matches.empty()) { 753 return NULL; 754 } 755 // Free all items after the first, since we won't be returning them. 756 for (std::vector<SecKeychainItemRef>::iterator i = matches.begin() + 1; 757 i != matches.end(); ++i) { 758 keychain_->Free(*i); 759 } 760 return matches[0]; 761} 762 763std::vector<SecKeychainItemRef> 764 MacKeychainPasswordFormAdapter::MatchingKeychainItems( 765 const std::string& signon_realm, 766 autofill::PasswordForm::Scheme scheme, 767 const char* path, const char* username) { 768 std::vector<SecKeychainItemRef> matches; 769 770 std::string server; 771 std::string security_domain; 772 int port; 773 bool is_secure; 774 if (!internal_keychain_helpers::ExtractSignonRealmComponents( 775 signon_realm, &server, &port, &is_secure, &security_domain)) { 776 // TODO(stuartmorgan): Proxies will currently fail here, since their 777 // signon_realm is not a URL. We need to detect the proxy case and handle 778 // it specially. 779 return matches; 780 } 781 SecProtocolType protocol = is_secure ? kSecProtocolTypeHTTPS 782 : kSecProtocolTypeHTTP; 783 SecAuthenticationType auth_type = AuthTypeForScheme(scheme); 784 const char* auth_domain = (scheme == PasswordForm::SCHEME_HTML) ? 785 NULL : security_domain.c_str(); 786 KeychainSearch keychain_search(*keychain_); 787 keychain_search.Init(server.c_str(), port, protocol, auth_type, 788 auth_domain, path, username, CreatorCodeForSearch()); 789 keychain_search.FindMatchingItems(&matches); 790 return matches; 791} 792 793// Returns the Keychain SecAuthenticationType type corresponding to |scheme|. 794SecAuthenticationType MacKeychainPasswordFormAdapter::AuthTypeForScheme( 795 PasswordForm::Scheme scheme) { 796 switch (scheme) { 797 case PasswordForm::SCHEME_HTML: return kSecAuthenticationTypeHTMLForm; 798 case PasswordForm::SCHEME_BASIC: return kSecAuthenticationTypeHTTPBasic; 799 case PasswordForm::SCHEME_DIGEST: return kSecAuthenticationTypeHTTPDigest; 800 case PasswordForm::SCHEME_OTHER: return kSecAuthenticationTypeDefault; 801 } 802 NOTREACHED(); 803 return kSecAuthenticationTypeDefault; 804} 805 806bool MacKeychainPasswordFormAdapter::SetKeychainItemPassword( 807 const SecKeychainItemRef& keychain_item, const std::string& password) { 808 OSStatus result = keychain_->ItemModifyAttributesAndData(keychain_item, NULL, 809 password.size(), 810 password.c_str()); 811 return result == noErr; 812} 813 814bool MacKeychainPasswordFormAdapter::SetKeychainItemCreatorCode( 815 const SecKeychainItemRef& keychain_item, OSType creator_code) { 816 SecKeychainAttribute attr = { kSecCreatorItemAttr, sizeof(creator_code), 817 &creator_code }; 818 SecKeychainAttributeList attrList = { 1, &attr }; 819 OSStatus result = keychain_->ItemModifyAttributesAndData(keychain_item, 820 &attrList, 0, NULL); 821 return result == noErr; 822} 823 824OSType MacKeychainPasswordFormAdapter::CreatorCodeForSearch() { 825 return finds_only_owned_ ? base::mac::CreatorCodeForApplication() : 0; 826} 827 828#pragma mark - 829 830PasswordStoreMac::PasswordStoreMac( 831 scoped_refptr<base::SingleThreadTaskRunner> main_thread_runner, 832 scoped_refptr<base::SingleThreadTaskRunner> db_thread_runner, 833 AppleKeychain* keychain, 834 password_manager::LoginDatabase* login_db) 835 : password_manager::PasswordStore(main_thread_runner, db_thread_runner), 836 keychain_(keychain), 837 login_metadata_db_(login_db) { 838 DCHECK(keychain_.get()); 839 DCHECK(login_metadata_db_.get()); 840} 841 842PasswordStoreMac::~PasswordStoreMac() {} 843 844bool PasswordStoreMac::Init( 845 const syncer::SyncableService::StartSyncFlare& flare) { 846 DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI)); 847 thread_.reset(new base::Thread("Chrome_PasswordStore_Thread")); 848 849 if (!thread_->Start()) { 850 thread_.reset(NULL); 851 return false; 852 } 853 return password_manager::PasswordStore::Init(flare); 854} 855 856void PasswordStoreMac::Shutdown() { 857 DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI)); 858 password_manager::PasswordStore::Shutdown(); 859 thread_->Stop(); 860} 861 862// Mac stores passwords in the system keychain, which can block for an 863// arbitrarily long time (most notably, it can block on user confirmation 864// from a dialog). Run tasks on a dedicated thread to avoid blocking the DB 865// thread. 866scoped_refptr<base::SingleThreadTaskRunner> 867PasswordStoreMac::GetBackgroundTaskRunner() { 868 return (thread_.get()) ? thread_->message_loop_proxy() : NULL; 869} 870 871void PasswordStoreMac::ReportMetricsImpl() { 872 login_metadata_db_->ReportMetrics(); 873} 874 875PasswordStoreChangeList PasswordStoreMac::AddLoginImpl( 876 const PasswordForm& form) { 877 DCHECK(thread_->message_loop() == base::MessageLoop::current()); 878 PasswordStoreChangeList changes; 879 if (AddToKeychainIfNecessary(form)) { 880 changes = login_metadata_db_->AddLogin(form); 881 } 882 return changes; 883} 884 885PasswordStoreChangeList PasswordStoreMac::UpdateLoginImpl( 886 const PasswordForm& form) { 887 DCHECK(thread_->message_loop() == base::MessageLoop::current()); 888 PasswordStoreChangeList changes = login_metadata_db_->UpdateLogin(form); 889 890 MacKeychainPasswordFormAdapter keychain_adapter(keychain_.get()); 891 if (changes.empty() && 892 !keychain_adapter.HasPasswordsMergeableWithForm(form)) { 893 // If the password isn't in either the DB or the keychain, then it must have 894 // been deleted after autofill happened, and should not be re-added. 895 return changes; 896 } 897 898 // The keychain add will update if there is a collision and add if there 899 // isn't, which is the behavior we want, so there's no separate update call. 900 if (AddToKeychainIfNecessary(form) && changes.empty()) { 901 changes = login_metadata_db_->AddLogin(form); 902 } 903 return changes; 904} 905 906PasswordStoreChangeList PasswordStoreMac::RemoveLoginImpl( 907 const PasswordForm& form) { 908 DCHECK(thread_->message_loop() == base::MessageLoop::current()); 909 PasswordStoreChangeList changes; 910 if (login_metadata_db_->RemoveLogin(form)) { 911 // See if we own a Keychain item associated with this item. We can do an 912 // exact search rather than messing around with trying to do fuzzy matching 913 // because passwords that we created will always have an exact-match 914 // database entry. 915 // (If a user does lose their profile but not their keychain we'll treat the 916 // entries we find like other imported entries anyway, so it's reasonable to 917 // handle deletes on them the way we would for an imported item.) 918 MacKeychainPasswordFormAdapter owned_keychain_adapter(keychain_.get()); 919 owned_keychain_adapter.SetFindsOnlyOwnedItems(true); 920 PasswordForm* owned_password_form = 921 owned_keychain_adapter.PasswordExactlyMatchingForm(form); 922 if (owned_password_form) { 923 // If we don't have other forms using it (i.e., a form differing only by 924 // the names of the form elements), delete the keychain entry. 925 if (!DatabaseHasFormMatchingKeychainForm(form)) { 926 owned_keychain_adapter.RemovePassword(form); 927 } 928 } 929 930 changes.push_back(PasswordStoreChange(PasswordStoreChange::REMOVE, form)); 931 } 932 return changes; 933} 934 935PasswordStoreChangeList PasswordStoreMac::RemoveLoginsCreatedBetweenImpl( 936 const base::Time& delete_begin, const base::Time& delete_end) { 937 PasswordStoreChangeList changes; 938 std::vector<PasswordForm*> forms; 939 if (login_metadata_db_->GetLoginsCreatedBetween(delete_begin, delete_end, 940 &forms)) { 941 if (login_metadata_db_->RemoveLoginsCreatedBetween(delete_begin, 942 delete_end)) { 943 // We can't delete from the Keychain by date because we may be sharing 944 // items with database entries that weren't in the delete range. Instead, 945 // we find all the Keychain items we own but aren't using any more and 946 // delete those. 947 std::vector<PasswordForm*> orphan_keychain_forms = 948 GetUnusedKeychainForms(); 949 // This is inefficient, since we have to re-look-up each keychain item 950 // one at a time to delete it even though the search step already had a 951 // list of Keychain item references. If this turns out to be noticeably 952 // slow we'll need to rearchitect to allow the search and deletion steps 953 // to share. 954 RemoveKeychainForms(orphan_keychain_forms); 955 STLDeleteElements(&orphan_keychain_forms); 956 957 for (std::vector<PasswordForm*>::const_iterator it = forms.begin(); 958 it != forms.end(); ++it) { 959 changes.push_back(PasswordStoreChange(PasswordStoreChange::REMOVE, 960 **it)); 961 } 962 LogStatsForBulkDeletion(changes.size()); 963 } 964 } 965 return changes; 966} 967 968void PasswordStoreMac::GetLoginsImpl( 969 const autofill::PasswordForm& form, 970 AuthorizationPromptPolicy prompt_policy, 971 const ConsumerCallbackRunner& callback_runner) { 972 chrome::ScopedSecKeychainSetUserInteractionAllowed user_interaction_allowed( 973 prompt_policy == ALLOW_PROMPT); 974 975 std::vector<PasswordForm*> database_forms; 976 login_metadata_db_->GetLogins(form, &database_forms); 977 978 // Let's gather all signon realms we want to match with keychain entries. 979 std::set<std::string> realm_set; 980 realm_set.insert(form.signon_realm); 981 for (std::vector<PasswordForm*>::const_iterator db_form = 982 database_forms.begin(); 983 db_form != database_forms.end(); 984 ++db_form) { 985 // TODO(vabr): We should not be getting different schemes here. 986 // http://crbug.com/340112 987 if (form.scheme != (*db_form)->scheme) 988 continue; // Forms with different schemes never match. 989 const std::string& original_singon_realm((*db_form)->original_signon_realm); 990 if (!original_singon_realm.empty()) 991 realm_set.insert(original_singon_realm); 992 } 993 std::vector<PasswordForm*> keychain_forms; 994 for (std::set<std::string>::const_iterator realm = realm_set.begin(); 995 realm != realm_set.end(); 996 ++realm) { 997 MacKeychainPasswordFormAdapter keychain_adapter(keychain_.get()); 998 std::vector<PasswordForm*> temp_keychain_forms = 999 keychain_adapter.PasswordsFillingForm(*realm, form.scheme); 1000 keychain_forms.insert(keychain_forms.end(), 1001 temp_keychain_forms.begin(), 1002 temp_keychain_forms.end()); 1003 } 1004 1005 std::vector<PasswordForm*> matched_forms; 1006 internal_keychain_helpers::MergePasswordForms(&keychain_forms, 1007 &database_forms, 1008 &matched_forms); 1009 1010 // Strip any blacklist entries out of the unused Keychain array, then take 1011 // all the entries that are left (which we can use as imported passwords). 1012 std::vector<PasswordForm*> keychain_blacklist_forms = 1013 internal_keychain_helpers::ExtractBlacklistForms(&keychain_forms); 1014 matched_forms.insert(matched_forms.end(), 1015 keychain_forms.begin(), 1016 keychain_forms.end()); 1017 keychain_forms.clear(); 1018 STLDeleteElements(&keychain_blacklist_forms); 1019 1020 // Clean up any orphaned database entries. 1021 RemoveDatabaseForms(database_forms); 1022 STLDeleteElements(&database_forms); 1023 1024 callback_runner.Run(matched_forms); 1025} 1026 1027void PasswordStoreMac::GetBlacklistLoginsImpl(GetLoginsRequest* request) { 1028 FillBlacklistLogins(request->result()); 1029 ForwardLoginsResult(request); 1030} 1031 1032void PasswordStoreMac::GetAutofillableLoginsImpl(GetLoginsRequest* request) { 1033 FillAutofillableLogins(request->result()); 1034 ForwardLoginsResult(request); 1035} 1036 1037bool PasswordStoreMac::FillAutofillableLogins( 1038 std::vector<PasswordForm*>* forms) { 1039 DCHECK(thread_->message_loop() == base::MessageLoop::current()); 1040 1041 std::vector<PasswordForm*> database_forms; 1042 login_metadata_db_->GetAutofillableLogins(&database_forms); 1043 1044 std::vector<PasswordForm*> merged_forms = 1045 internal_keychain_helpers::GetPasswordsForForms(*keychain_, 1046 &database_forms); 1047 1048 // Clean up any orphaned database entries. 1049 RemoveDatabaseForms(database_forms); 1050 STLDeleteElements(&database_forms); 1051 1052 forms->insert(forms->end(), merged_forms.begin(), merged_forms.end()); 1053 return true; 1054} 1055 1056bool PasswordStoreMac::FillBlacklistLogins( 1057 std::vector<PasswordForm*>* forms) { 1058 DCHECK(thread_->message_loop() == base::MessageLoop::current()); 1059 return login_metadata_db_->GetBlacklistLogins(forms); 1060} 1061 1062bool PasswordStoreMac::AddToKeychainIfNecessary(const PasswordForm& form) { 1063 if (form.blacklisted_by_user) { 1064 return true; 1065 } 1066 MacKeychainPasswordFormAdapter keychainAdapter(keychain_.get()); 1067 return keychainAdapter.AddPassword(form); 1068} 1069 1070bool PasswordStoreMac::DatabaseHasFormMatchingKeychainForm( 1071 const autofill::PasswordForm& form) { 1072 bool has_match = false; 1073 std::vector<PasswordForm*> database_forms; 1074 login_metadata_db_->GetLogins(form, &database_forms); 1075 for (std::vector<PasswordForm*>::iterator i = database_forms.begin(); 1076 i != database_forms.end(); ++i) { 1077 // Below we filter out forms with non-empty original_signon_realm, because 1078 // those signal fuzzy matches, and we are only interested in exact ones. 1079 if ((*i)->original_signon_realm.empty() && 1080 internal_keychain_helpers::FormsMatchForMerge( 1081 form, **i, internal_keychain_helpers::STRICT_FORM_MATCH) && 1082 (*i)->origin == form.origin) { 1083 has_match = true; 1084 break; 1085 } 1086 } 1087 STLDeleteElements(&database_forms); 1088 return has_match; 1089} 1090 1091std::vector<PasswordForm*> PasswordStoreMac::GetUnusedKeychainForms() { 1092 std::vector<PasswordForm*> database_forms; 1093 login_metadata_db_->GetAutofillableLogins(&database_forms); 1094 1095 MacKeychainPasswordFormAdapter owned_keychain_adapter(keychain_.get()); 1096 owned_keychain_adapter.SetFindsOnlyOwnedItems(true); 1097 std::vector<PasswordForm*> owned_keychain_forms = 1098 owned_keychain_adapter.GetAllPasswordFormPasswords(); 1099 1100 // Run a merge; anything left in owned_keychain_forms when we are done no 1101 // longer has a matching database entry. 1102 std::vector<PasswordForm*> merged_forms; 1103 internal_keychain_helpers::MergePasswordForms(&owned_keychain_forms, 1104 &database_forms, 1105 &merged_forms); 1106 STLDeleteElements(&merged_forms); 1107 STLDeleteElements(&database_forms); 1108 1109 return owned_keychain_forms; 1110} 1111 1112void PasswordStoreMac::RemoveDatabaseForms( 1113 const std::vector<PasswordForm*>& forms) { 1114 for (std::vector<PasswordForm*>::const_iterator i = forms.begin(); 1115 i != forms.end(); ++i) { 1116 login_metadata_db_->RemoveLogin(**i); 1117 } 1118} 1119 1120void PasswordStoreMac::RemoveKeychainForms( 1121 const std::vector<PasswordForm*>& forms) { 1122 MacKeychainPasswordFormAdapter owned_keychain_adapter(keychain_.get()); 1123 owned_keychain_adapter.SetFindsOnlyOwnedItems(true); 1124 for (std::vector<PasswordForm*>::const_iterator i = forms.begin(); 1125 i != forms.end(); ++i) { 1126 owned_keychain_adapter.RemovePassword(**i); 1127 } 1128} 1129