Merge pull request #14350 from FnControlOption/bundle

std.crypto.Certificate.Bundle: clear bundle before macOS rescan

lib/std/crypto/Certificate/Bundle.zig

@@ -120,21 +120,14 @@ pub fn rescanWindows(cb: *Bundle, gpa: Allocator) !void {
     };
     defer _ = w.crypt32.CertCloseStore(store, 0);
 
+    const now_sec = std.time.timestamp();
+
     var ctx = w.crypt32.CertEnumCertificatesInStore(store, null);
     while (ctx) |context| : (ctx = w.crypt32.CertEnumCertificatesInStore(store, ctx)) {
         const decoded_start = @intCast(u32, cb.bytes.items.len);
         const encoded_cert = context.pbCertEncoded[0..context.cbCertEncoded];
         try cb.bytes.appendSlice(gpa, encoded_cert);
-        const parsed_cert = try Certificate.parse(.{
-            .buffer = cb.bytes.items,
-            .index = decoded_start,
-        });
-        const gop = try cb.map.getOrPutContext(gpa, parsed_cert.subject_slice, .{ .cb = cb });
-        if (gop.found_existing) {
-            cb.bytes.items.len = decoded_start;
-        } else {
-            gop.value_ptr.* = decoded_start;
-        }
+        try cb.parseCert(gpa, decoded_start, now_sec);
     }
     cb.bytes.shrinkAndFree(gpa, cb.bytes.items.len);
 }

lib/std/crypto/Certificate/Bundle/macos.zig

@@ -1,11 +1,14 @@
 const std = @import("std");
 const assert = std.debug.assert;
-const mem = std.mem;
 const fs = std.fs;
+const mem = std.mem;
 const Allocator = std.mem.Allocator;
 const Bundle = @import("../Bundle.zig");
 
 pub fn rescanMac(cb: *Bundle, gpa: Allocator) !void {
+    cb.bytes.clearRetainingCapacity();
+    cb.map.clearRetainingCapacity();
+
     const file = try fs.openFileAbsolute("/System/Library/Keychains/SystemRootCertificates.keychain", .{});
     defer file.close();
 
@@ -37,7 +40,7 @@ pub fn rescanMac(cb: *Bundle, gpa: Allocator) !void {
 
         const table_header = try reader.readStructBig(TableHeader);
 
-        if (@intToEnum(TableId, table_header.table_id) != TableId.CSSM_DL_DB_RECORD_X509_CERTIFICATE) {
+        if (@intToEnum(std.os.darwin.cssm.DB_RECORDTYPE, table_header.table_id) != .X509_CERTIFICATE) {
             continue;
         }
 
@@ -63,6 +66,8 @@ pub fn rescanMac(cb: *Bundle, gpa: Allocator) !void {
             try cb.parseCert(gpa, cert_start, now_sec);
         }
     }
+
+    cb.bytes.shrinkAndFree(gpa, cb.bytes.items.len);
 }
 
 const ApplDbHeader = extern struct {
@@ -88,35 +93,6 @@ const TableHeader = extern struct {
     record_numbers_count: u32,
 };
 
-const TableId = enum(u32) {
-    CSSM_DL_DB_SCHEMA_INFO = 0x00000000,
-    CSSM_DL_DB_SCHEMA_INDEXES = 0x00000001,
-    CSSM_DL_DB_SCHEMA_ATTRIBUTES = 0x00000002,
-    CSSM_DL_DB_SCHEMA_PARSING_MODULE = 0x00000003,
-
-    CSSM_DL_DB_RECORD_ANY = 0x0000000a,
-    CSSM_DL_DB_RECORD_CERT = 0x0000000b,
-    CSSM_DL_DB_RECORD_CRL = 0x0000000c,
-    CSSM_DL_DB_RECORD_POLICY = 0x0000000d,
-    CSSM_DL_DB_RECORD_GENERIC = 0x0000000e,
-    CSSM_DL_DB_RECORD_PUBLIC_KEY = 0x0000000f,
-    CSSM_DL_DB_RECORD_PRIVATE_KEY = 0x00000010,
-    CSSM_DL_DB_RECORD_SYMMETRIC_KEY = 0x00000011,
-    CSSM_DL_DB_RECORD_ALL_KEYS = 0x00000012,
-
-    CSSM_DL_DB_RECORD_GENERIC_PASSWORD = 0x80000000,
-    CSSM_DL_DB_RECORD_INTERNET_PASSWORD = 0x80000001,
-    CSSM_DL_DB_RECORD_APPLESHARE_PASSWORD = 0x80000002,
-    CSSM_DL_DB_RECORD_USER_TRUST = 0x80000003,
-    CSSM_DL_DB_RECORD_X509_CRL = 0x80000004,
-    CSSM_DL_DB_RECORD_UNLOCK_REFERRAL = 0x80000005,
-    CSSM_DL_DB_RECORD_EXTENDED_ATTRIBUTE = 0x80000006,
-    CSSM_DL_DB_RECORD_X509_CERTIFICATE = 0x80001000,
-    CSSM_DL_DB_RECORD_METADATA = 0x80008000,
-
-    _,
-};
-
 const X509CertHeader = extern struct {
     record_size: u32,
     record_number: u32,

lib/std/os/darwin.zig

@@ -3,6 +3,8 @@ const builtin = @import("builtin");
 const log = std.log;
 const mem = std.mem;
 
+pub const cssm = @import("darwin/cssm.zig");
+
 pub usingnamespace std.c;
 pub usingnamespace mach_task;
 

lib/std/os/darwin/cssm.zig

@@ -0,0 +1,47 @@
+// Common Security Services Manager
+// Security.framework/Headers/cssm*.h
+
+// Schema Management Name Space Range Definition
+pub const DB_RECORDTYPE_SCHEMA_START = 0x00000000;
+pub const DB_RECORDTYPE_SCHEMA_END = DB_RECORDTYPE_SCHEMA_START + 4;
+
+// Open Group Application Name Space Range Definition
+pub const DB_RECORDTYPE_OPEN_GROUP_START = 0x0000000A;
+pub const DB_RECORDTYPE_OPEN_GROUP_END = DB_RECORDTYPE_OPEN_GROUP_START + 8;
+
+// Industry At Large Application Name Space Range Definition
+pub const DB_RECORDTYPE_APP_DEFINED_START = 0x80000000;
+pub const DB_RECORDTYPE_APP_DEFINED_END = 0xffffffff;
+
+pub const DB_RECORDTYPE = enum(u32) {
+    // Record Types defined in the Schema Management Name Space
+    SCHEMA_INFO = DB_RECORDTYPE_SCHEMA_START + 0,
+    SCHEMA_INDEXES = DB_RECORDTYPE_SCHEMA_START + 1,
+    SCHEMA_ATTRIBUTES = DB_RECORDTYPE_SCHEMA_START + 2,
+    SCHEMA_PARSING_MODULE = DB_RECORDTYPE_SCHEMA_START + 3,
+
+    // Record Types defined in the Open Group Application Name Space
+    ANY = DB_RECORDTYPE_OPEN_GROUP_START + 0,
+    CERT = DB_RECORDTYPE_OPEN_GROUP_START + 1,
+    CRL = DB_RECORDTYPE_OPEN_GROUP_START + 2,
+    POLICY = DB_RECORDTYPE_OPEN_GROUP_START + 3,
+    GENERIC = DB_RECORDTYPE_OPEN_GROUP_START + 4,
+    PUBLIC_KEY = DB_RECORDTYPE_OPEN_GROUP_START + 5,
+    PRIVATE_KEY = DB_RECORDTYPE_OPEN_GROUP_START + 6,
+    SYMMETRIC_KEY = DB_RECORDTYPE_OPEN_GROUP_START + 7,
+    ALL_KEYS = DB_RECORDTYPE_OPEN_GROUP_START + 8,
+
+    // AppleFileDL record types
+    GENERIC_PASSWORD = DB_RECORDTYPE_APP_DEFINED_START + 0,
+    INTERNET_PASSWORD = DB_RECORDTYPE_APP_DEFINED_START + 1,
+    APPLESHARE_PASSWORD = DB_RECORDTYPE_APP_DEFINED_START + 2,
+
+    X509_CERTIFICATE = DB_RECORDTYPE_APP_DEFINED_START + 0x1000,
+    USER_TRUST,
+    X509_CRL,
+    UNLOCK_REFERRAL,
+    EXTENDED_ATTRIBUTE,
+    METADATA = DB_RECORDTYPE_APP_DEFINED_START + 0x8000,
+
+    _,
+};