SFHFKeychainUtils.m

//
//  SFHFKeychainUtils.m
//
//  Created by Buzz Andersen on 10/20/08.
//  Based partly on code by Jonathan Wight, Jon Crosby, and Mike Malone.
//  Copyright 2008 Sci-Fi Hi-Fi. All rights reserved.
//
//  Permission is hereby granted, free of charge, to any person
//  obtaining a copy of this software and associated documentation
//  files (the "Software"), to deal in the Software without
//  restriction, including without limitation the rights to use,
//  copy, modify, merge, publish, distribute, sublicense, and/or sell
//  copies of the Software, and to permit persons to whom the
//  Software is furnished to do so, subject to the following
//  conditions:
//
//  The above copyright notice and this permission notice shall be
//  included in all copies or substantial portions of the Software.
//
//  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
//  EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
//  OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
//  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
//  HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
//  WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
//  FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
//  OTHER DEALINGS IN THE SOFTWARE.
//
 
#import "SFHFKeychainUtils.h"
#import <Security/Security.h>
 
static NSString *SFHFKeychainUtilsErrorDomain = @"SFHFKeychainUtilsErrorDomain";
 
#if __IPHONE_OS_VERSION_MIN_REQUIRED < 30000 && TARGET_IPHONE_SIMULATOR
@interface SFHFKeychainUtils (PrivateMethods)
+ (SecKeychainItemRef)getKeychainItemReferenceForUsername:(NSString *)username
                                            andServerName:(NSString *)serverName
                                                    error:(NSError **)error;
@end
#endif
 
@implementation SFHFKeychainUtils
 
#if __IPHONE_OS_VERSION_MIN_REQUIRED < 30000 && TARGET_IPHONE_SIMULATOR
 
+ (NSString *)getPasswordForUsername:(NSString *)username
                       andServerName:(NSString *)serverName
                               error:(NSError **)error
{
  if (!username || !serviceName)
  {
    *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-2000 userInfo:nil];
    return nil;
  }
 
  SecKeychainItemRef item = [SFHFKeychainUtils getKeychainItemReferenceForUsername:username
                                                                     andServerName:serverName
                                                                             error:error];
 
  if (*error || !item)
  {
    return nil;
  }
 
  // from Advanced Mac OS X Programming, ch. 16
  UInt32 length;
  char *password;
  SecKeychainAttribute attributes[8];
  SecKeychainAttributeList list;
 
  attributes[0].tag = kSecAccountItemAttr;
  attributes[1].tag = kSecDescriptionItemAttr;
  attributes[2].tag = kSecLabelItemAttr;
  attributes[3].tag = kSecModDateItemAttr;
 
  list.count = 4;
  list.attr = attributes;
 
  OSStatus status = SecKeychainItemCopyContent(item, NULL, &list, &length, (void **)&password);
 
  if (status != noErr)
  {
    *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:status userInfo:nil];
    return nil;
  }
 
  NSString *passwordString = nil;
 
  if (password != NULL)
  {
    char passwordBuffer[1024];
 
    if (length > 1023)
    {
      length = 1023;
    }
    strncpy(passwordBuffer, password, length);
 
    passwordBuffer[length] = '\0';
    passwordString = [NSString stringWithCString:passwordBuffer encoding:NSUTF8StringEncoding];
  }
 
  SecKeychainItemFreeContent(&list, password);
 
  CFRelease(item);
 
  return passwordString;
}
 
+ (void)storeUsername:(NSString *)username
          andPassword:(NSString *)password
        forServerName:(NSString *)serverName
       updateExisting:(BOOL)updateExisting
                error:(NSError **)error
{
  if (!username || !password || !serverName)
  {
    *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-2000 userInfo:nil];
    return;
  }
 
  OSStatus status = noErr;
 
  SecKeychainItemRef item = [SFHFKeychainUtils getKeychainItemReferenceForUsername:username
                                                                     andServerName:serverName
                                                                             error:error];
 
  if (*error && [*error code] != noErr)
  {
    return;
  }
 
  *error = nil;
 
  if (item)
  {
    status = SecKeychainItemModifyAttributesAndData(item, NULL, strlen([password UTF8String]),
                                                    [password UTF8String]);
 
    CFRelease(item);
  }
  else
  {
    status = SecKeychainAddGenericPassword(
        NULL, strlen([serverName UTF8String]), [serverName UTF8String],
        strlen([username UTF8String]), [username UTF8String], strlen([password UTF8String]),
        [password UTF8String], NULL);
  }
 
  if (status != noErr)
  {
    *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:status userInfo:nil];
  }
}
 
+ (void)deleteItemForUsername:(NSString *)username
                andServerName:(NSString *)serverName
                        error:(NSError **)error
{
  if (!username || !serverName)
  {
    *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:2000 userInfo:nil];
    return;
  }
 
  *error = nil;
 
  SecKeychainItemRef item = [SFHFKeychainUtils getKeychainItemReferenceForUsername:username
                                                                     andServerName:serverName
                                                                             error:error];
 
  if (*error && [*error code] != noErr)
  {
    return;
  }
 
  OSStatus status;
 
  if (item)
  {
    status = SecKeychainItemDelete(item);
 
    CFRelease(item);
  }
 
  if (status != noErr)
  {
    *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:status userInfo:nil];
  }
}
 
+ (SecKeychainItemRef)getKeychainItemReferenceForUsername:(NSString *)username
                                            andServerName:(NSString *)serverName
                                                    error:(NSError **)error
{
  if (!username || !serverName)
  {
    *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-2000 userInfo:nil];
    return nil;
  }
 
  *error = nil;
 
  SecKeychainItemRef item;
 
  OSStatus status = SecKeychainFindGenericPassword(
      NULL, strlen([serverName UTF8String]), [serverName UTF8String],
      strlen([username UTF8String]), [username UTF8String], NULL, NULL, &item);
 
  if (status != noErr)
  {
    if (status != errSecItemNotFound)
    {
      *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain
                                   code:status
                               userInfo:nil];
    }
 
    return nil;
  }
 
  return item;
}
 
#else
 
+ (NSString *)getPasswordForUsername:(NSString *)username
                       andServerName:(NSString *)serverName
                               error:(NSError **)error
{
  if (!username || !serverName)
  {
    if (error != nil)
    {
      *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-2000 userInfo:nil];
    }
    return nil;
  }
 
  if (error != nil)
  {
    *error = nil;
  }
 
  // Set up a query dictionary with the base query attributes: item type (generic), username, and
  // service
 
  NSArray *keys = [[[NSArray alloc]
      initWithObjects:(NSString *)kSecClass, kSecAttrAccount, kSecAttrService, nil] autorelease];
  NSArray *objects = [[[NSArray alloc] initWithObjects:(NSString *)kSecClassGenericPassword,
                                                       username, serverName, nil] autorelease];
 
  NSMutableDictionary *query = [[[NSMutableDictionary alloc] initWithObjects:objects
                                                                     forKeys:keys] autorelease];
 
  // First do a query for attributes, in case we already have a Keychain item with no password
  // data set. One likely way such an incorrect item could have come about is due to the previous
  // (incorrect) version of this code (which set the password as a generic attribute instead of
  // password data).
 
  NSDictionary *attributeResult = NULL;
  NSMutableDictionary *attributeQuery = [query mutableCopy];
  [attributeQuery setObject:(id)kCFBooleanTrue forKey:(id)kSecReturnAttributes];
  OSStatus status =
      SecItemCopyMatching((CFDictionaryRef)attributeQuery, (CFTypeRef *)&attributeResult);
 
  [attributeResult release];
  [attributeQuery release];
 
  if (status != noErr)
  {
    // No existing item found--simply return nil for the password
    if (error != nil && status != errSecItemNotFound)
    {
      // Only return an error if a real exception happened--not simply for "not found."
      *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain
                                   code:status
                               userInfo:nil];
    }
 
    return nil;
  }
 
  // We have an existing item, now query for the password data associated with it.
 
  NSData *resultData = nil;
  NSMutableDictionary *passwordQuery = [query mutableCopy];
  [passwordQuery setObject:(id)kCFBooleanTrue forKey:(id)kSecReturnData];
 
  status = SecItemCopyMatching((CFDictionaryRef)passwordQuery, (CFTypeRef *)&resultData);
 
  [resultData autorelease];
  [passwordQuery release];
 
  if (status != noErr)
  {
    if (status == errSecItemNotFound)
    {
      // We found attributes for the item previously, but no password now, so return a special
      // error. Users of this API will probably want to detect this error and prompt the user
      // to re-enter their credentials.  When you attempt to store the re-entered credentials
      // using storeUsername:andPassword:forServiceName:updateExisting:error
      // the old, incorrect entry will be deleted and a new one with a properly encrypted
      // password will be added.
      if (error != nil)
      {
        *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain
                                     code:-1999
                                 userInfo:nil];
      }
    }
    else
    {
      // Something else went wrong. Simply return the normal Keychain API error code.
      if (error != nil)
      {
        *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain
                                     code:status
                                 userInfo:nil];
      }
    }
 
    return nil;
  }
 
  NSString *password = nil;
 
  if (resultData)
  {
    password = [[NSString alloc] initWithData:resultData encoding:NSUTF8StringEncoding];
  }
  else
  {
    // There is an existing item, but we weren't able to get password data for it for some
    // reason, Possibly as a result of an item being incorrectly entered by the previous code.
    // Set the -1999 error so the code above us can prompt the user again.
    if (error != nil)
    {
      *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-1999 userInfo:nil];
    }
  }
 
  return [password autorelease];
}
 
+ (BOOL)storeUsername:(NSString *)username
          andPassword:(NSString *)password
        forServerName:(NSString *)serverName
       updateExisting:(BOOL)updateExisting
                error:(NSError **)error
{
  if (!username || !password || !serverName)
  {
    if (error != nil)
    {
      *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-2000 userInfo:nil];
    }
    return NO;
  }
 
  // See if we already have a password entered for these credentials.
  NSError *getError = nil;
  NSString *existingPassword = [SFHFKeychainUtils getPasswordForUsername:username
                                                           andServerName:serverName
                                                                   error:&getError];
 
  if ([getError code] == -1999)
  {
    // There is an existing entry without a password properly stored (possibly as a result of
    // the previous incorrect version of this code. Delete the existing item before moving on
    // entering a correct one.
 
    getError = nil;
 
    [self deleteItemForUsername:username andServerName:serverName error:&getError];
 
    if ([getError code] != noErr)
    {
      if (error != nil)
      {
        *error = getError;
      }
      return NO;
    }
  }
  else if ([getError code] != noErr)
  {
    if (error != nil)
    {
      *error = getError;
    }
    return NO;
  }
 
  if (error != nil)
  {
    *error = nil;
  }
 
  OSStatus status = noErr;
 
  if (existingPassword)
  {
    // We have an existing, properly entered item with a password.
    // Update the existing item.
 
    if (![existingPassword isEqualToString:password] && updateExisting)
    {
      // Only update if we're allowed to update existing.  If not, simply do nothing.
 
      NSArray *keys =
          [[[NSArray alloc] initWithObjects:(NSString *)kSecClass, kSecAttrService,
                                            kSecAttrLabel, kSecAttrAccount, nil] autorelease];
 
      NSArray *objects =
          [[[NSArray alloc] initWithObjects:(NSString *)kSecClassGenericPassword, serverName,
                                            serverName, username, nil] autorelease];
 
      NSDictionary *query = [[[NSDictionary alloc] initWithObjects:objects
                                                           forKeys:keys] autorelease];
 
      status = SecItemUpdate(
          (CFDictionaryRef)query,
          (CFDictionaryRef)[NSDictionary
              dictionaryWithObject:[password dataUsingEncoding:NSUTF8StringEncoding]
                            forKey:(NSString *)kSecValueData]);
    }
  }
  else
  {
    // No existing entry (or an existing, improperly entered, and therefore now
    // deleted, entry).  Create a new entry.
 
    NSArray *keys =
        [[[NSArray alloc] initWithObjects:(NSString *)kSecClass, kSecAttrService, kSecAttrLabel,
                                          kSecAttrAccount, kSecValueData, nil] autorelease];
 
    NSArray *objects = [[[NSArray alloc]
        initWithObjects:(NSString *)kSecClassGenericPassword, serverName, serverName, username,
                        [password dataUsingEncoding:NSUTF8StringEncoding], nil] autorelease];
 
    NSDictionary *query = [[[NSDictionary alloc] initWithObjects:objects
                                                         forKeys:keys] autorelease];
 
    status = SecItemAdd((CFDictionaryRef)query, NULL);
  }
 
  if (error != nil && status != noErr)
  {
    // Something went wrong with adding the new item. Return the Keychain error code.
    *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:status userInfo:nil];
 
    return NO;
  }
 
  return YES;
}
 
+ (BOOL)deleteItemForUsername:(NSString *)username
                andServerName:(NSString *)serverName
                        error:(NSError **)error
{
  if (!username || !serverName)
  {
    if (error != nil)
    {
      *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:-2000 userInfo:nil];
    }
    return NO;
  }
 
  if (error != nil)
  {
    *error = nil;
  }
 
  NSArray *keys =
      [[[NSArray alloc] initWithObjects:(NSString *)kSecClass, kSecAttrAccount, kSecAttrService,
                                        kSecReturnAttributes, nil] autorelease];
  NSArray *objects =
      [[[NSArray alloc] initWithObjects:(NSString *)kSecClassGenericPassword, username,
                                        serverName, kCFBooleanTrue, nil] autorelease];
 
  NSDictionary *query = [[[NSDictionary alloc] initWithObjects:objects forKeys:keys] autorelease];
 
  OSStatus status = SecItemDelete((CFDictionaryRef)query);
 
  if (error != nil && status != noErr)
  {
    *error = [NSError errorWithDomain:SFHFKeychainUtilsErrorDomain code:status userInfo:nil];
 
    return NO;
  }
 
  return YES;
}
 
#endif
 
@end