contrib: Remove keychain-mcd code

After the security audits performed by Cryptography Engineering the spring of 2017 [1], there were several concerns about the contrib code for the macOS keychain support. After more careful review of this code base, it was considered to be in such a bad shape that it will need a massive overhaul. There were more issues than what the security audit revealed.

It was attempted several times to get in touch with the contributor of this code; with no response at all [2]. There has however been some discussions with the Tunnelblick project [3]. There is one person there willing to go through this and improve the situation. The main Tunnelblick maintainer is also willing to include the improved code to their project instead of having this as a contrib code in the upstream OpenVPN project.

So this patch just removes the code which we will no longer ship as part of OpenVPN - and the Tunnelblick project will take over the responsibility for this code base on their own. And since this code base is purely macOS specific, this seems to be a far better place for this code to reside.

[1] <http://community.openvpn.net/openvpn/wiki/QuarkslabAndCryptographyEngineerAudits#OVPN-04-1:PossibleNULLpointerderefenceincontribkeychain-mcdcert_data.c>
[2] <https://www.mail-archive.com/[email protected]/msg14559.html>
[3] <https://github.com/Tunnelblick/Tunnelblick/pull/369>

---
 contrib/keychain-mcd/Makefile       |  13 -
 contrib/keychain-mcd/cert_data.c    | 866 ------------------------------------
 contrib/keychain-mcd/cert_data.h    |  50 ---
 contrib/keychain-mcd/common_osx.c   | 100 -----
 contrib/keychain-mcd/common_osx.h   |  38 --
 contrib/keychain-mcd/crypto_osx.c   |  79 ----
 contrib/keychain-mcd/crypto_osx.h   |  44 --
 contrib/keychain-mcd/keychain-mcd.8 | 161 -------
 contrib/keychain-mcd/main.c         | 310 -------------
 9 files changed, 1661 deletions(-)
 delete mode 100644 contrib/keychain-mcd/Makefile
 delete mode 100644 contrib/keychain-mcd/cert_data.c
 delete mode 100644 contrib/keychain-mcd/cert_data.h
 delete mode 100644 contrib/keychain-mcd/common_osx.c
 delete mode 100644 contrib/keychain-mcd/common_osx.h
 delete mode 100644 contrib/keychain-mcd/crypto_osx.c
 delete mode 100644 contrib/keychain-mcd/crypto_osx.h
 delete mode 100644 contrib/keychain-mcd/keychain-mcd.8
 delete mode 100644 contrib/keychain-mcd/main.c

deleted file mode 100644
index c6431df1..00000000
@@ -1,13 +0,0 @@
-CFILES = cert_data.c common_osx.c crypto_osx.c main.c
-OFILES = $(CFILES:.c=.o) ../../src/openvpn/base64.o
-prog = keychain-mcd
-
-CC = gcc
-CFLAGS = -Wall
-LDFLAGS =  -framework CoreFoundation -framework Security -framework CoreServices
-
-$(prog): $(OFILES)
-	$(CC) $(LDFLAGS) $(OFILES) -o $(prog)
-
-%.o: %.c
-	$(CC) $(CFLAGS) -c $< -o $@

deleted file mode 100644
index d37e059e..00000000
@@ -1,38 +0,0 @@
-/*
- *  OpenVPN -- An application to securely tunnel IP networks
- *             over a single UDP port, with support for SSL/TLS-based
- *             session authentication and key exchange,
- *             packet encryption, packet authentication, and
- *             packet compression.
- *
- *  Copyright (C) 2010 Brian Raderman <[email protected]...>
- *  Copyright (C) 2013-2015 Vasily Kulikov <[email protected]...>
- *
- *  This program is free software; you can redistribute it and/or modify
- *  it under the terms of the GNU General Public License version 2
- *  as published by the Free Software Foundation.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License along
- *  with this program; if not, write to the Free Software Foundation, Inc.,
- *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
- */
-
-#ifndef __common_osx_h__
-#define __common_osx_h__
-
-#include <CoreFoundation/CoreFoundation.h>
-
-void printCFString(CFStringRef str);
-
-char *cfstringToCstr(CFStringRef str);
-
-CFStringRef createHexString(unsigned char *pData, int length);
-
-void printHex(unsigned char *pData, int length);
-
-#endif /*__Common_osx_h__ */

2.11.0

ACK to removing this code.

I will add the code to the Tunnelblick project if/when it is fixed.

It should be noted, however, that what is added to Tunnelblick will have many modifications and will be integrated into Tunnelblick's existing code for the OpenVPN management interface. It will not have the separate "keychain-mcd" daemon which is in the keychain-mcd code that is being removed from OpenVPN.

And: thanks, David, for your work on this.

Best regards,

Jon Bullard

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Your patch has been applied to the following branches

commit 59e7e9fce8de6ea90d13baeaede83adc0b594e22 (master) commit b597ded895e372831bb19538e5591d5c52270a44 (release/2.4)

Author: David Sommerseth
Date:   Tue Jul 25 15:03:14 2017 +0200

     contrib: Remove keychain-mcd code

     Signed-off-by: David Sommerseth <[email protected]...>
     Acked-by: Jonathan K. Bullard <[email protected]...>
     Message-Id: <[email protected]...>
     URL: https://www.mail-archive.com/[email protected]/msg15130.html
     Signed-off-by: David Sommerseth <[email protected]...>

- --
kind regards,

David Sommerseth

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)

iQIcBAEBCgAGBQJZjg+LAAoJEIbPlEyWcf3yOy4P/2nZicxE8HlV+T3jLDc93gN7 F0+O6wzKufYZq5+Jis2eA/iBenvO5maDZJufRLq4+QiLA1xg0+2BB13yqVi7Qwrp zbD5N0P4F5zQcOfGNS9/YfaRdCk7+lk9K/YR221FWxzrV/CLn53GcZ96cBbOcxFn /aojz7BgXzV4rQs344jKb0LNQonTXPLuCFtHxXvyWN9b/bHHerAuUdt0DgQDh6RJ b5pzDMJVEUiOHDtbu8nMQPPzxU+hdOSXZWaVnDfEp3P94kpbCjQtqryaYcmaUyV7 PduZ0n1e+TGSzFlTH9cUdF4HlXIcTWtUnwx30q2fFUEc+OSB9hWAA25+kbinUR69 zWnAChIEJviokvPlP6s2TUBy+QCI0qelGhVUYR6O36lTNBvCseF3j2Zy7XJMZk0j n+D8ZtRXm/498sLmYmvDm4pnUaSWnLIT5oxY3U80TJTIo1uY2ZtP396ndJNrHxPu KMV0htZhtlnqcbKnj+ejz6qwCG5t9Qlu4uGE5NYIaUDBH4LbIoW2mClG7+JBMH7L VUKlnod2rpSnbOkqPs9DNVHgTbz03+ujNeUQ8gptm4uIBLuOlD4qTwiqkVLPjj44 x02upwTZSubTWu441ijXwz9q0Dzy5HqiTtS7mj8sfkveUrNSM1gLmRRIE4mlZ0sp mon5H4n/VG1eYDhwWj/j
=OShB
-----END PGP SIGNATURE-----