6 #ifndef SOSAccountPriv_h
7 #define SOSAccountPriv_h
9 #import <Foundation/Foundation.h>
11 #include <CoreFoundation/CoreFoundation.h>
12 #include <CoreFoundation/CFRuntime.h>
13 #include <utilities/SecCFWrappers.h>
14 #include <utilities/SecCFError.h>
15 #include <utilities/SecAKSWrappers.h>
17 #include <Security/SecKeyPriv.h>
19 #include <Security/der_plist.h>
20 #include <utilities/der_plist_internal.h>
21 #include <corecrypto/ccder.h>
23 #include <AssertMacros.h>
28 #include <Security/SecureObjectSync/SOSInternal.h>
30 #include <Security/SecureObjectSync/SOSCircle.h>
31 #include <Security/SecureObjectSync/SOSCircleV2.h>
32 #include <Security/SecureObjectSync/SOSRing.h>
33 #include <Security/SecureObjectSync/SOSRingUtils.h>
34 #include <Security/SecureObjectSync/SOSCloudCircle.h>
35 #include <securityd/SOSCloudCircleServer.h>
36 #include <Security/SecureObjectSync/SOSEngine.h>
37 #include <Security/SecureObjectSync/SOSPeer.h>
38 #include <Security/SecureObjectSync/SOSFullPeerInfo.h>
39 #include <Security/SecureObjectSync/SOSPeerInfo.h>
40 #include <Security/SecureObjectSync/SOSPeerInfoInternal.h>
41 #include <Security/SecureObjectSync/SOSUserKeygen.h>
42 #include <Security/SecureObjectSync/SOSTransportCircle.h>
44 #include <utilities/iCloudKeychainTrace.h>
46 #include <Security/SecItemPriv.h>
49 extern const CFStringRef kSOSUnsyncedViewsKey
;
50 extern const CFStringRef kSOSPendingEnableViewsToBeSetKey
;
51 extern const CFStringRef kSOSPendingDisableViewsToBeSetKey
;
52 extern const CFStringRef kSOSRecoveryKey
;
53 extern const CFStringRef kSOSAccountUUID
;
54 extern const CFStringRef kSOSAccountPeerNegotiationTimeouts
;
55 extern const CFStringRef kSOSRecoveryRing
;
56 extern const CFStringRef kSOSEscrowRecord
;
57 extern const CFStringRef kSOSTestV2Settings
;
58 extern const CFStringRef kSOSRateLimitingCounters
;
59 extern const CFStringRef kSOSAccountPeerLastSentTimestamp
;
60 extern const CFStringRef kSOSAccountRenegotiationRetryCount
;
61 extern const CFStringRef kSOSInitialSyncTimeoutV0
;
63 #define kSecServerPeerInfoAvailable "com.apple.security.fpiAvailable"
65 typedef void (^SOSAccountSaveBlock
)(CFDataRef flattenedAccount
, CFErrorRef flattenFailError
);
69 @
class CKKeyParameter
;
70 @
class SOSAccountTrustClassic
;
71 @
class SOSKVSCircleStorageTransport
;
72 @
class SOSCircleStorageTransport
;
73 @
class SOSCKCircleStorage
;
75 @interface SOSAccount
: NSObject
<SOSControlProtocol
>
77 @
property (nonatomic
, retain
) NSDictionary
*gestalt
;
78 @
property (nonatomic
, retain
) NSData
*backup_key
;
79 @
property (nonatomic
, retain
) NSString
*deviceID
;
81 @
property (nonatomic
, retain
) SOSAccountTrustClassic
*trust
;
83 @
property (nonatomic
, retain
) dispatch_queue_t queue
;
84 @
property (nonatomic
, retain
) dispatch_source_t user_private_timer
;
85 @
property (nonatomic
) SecKeyRef accountPrivateKey
;
87 @
property (nonatomic
) SOSDataSourceFactoryRef factory
;
89 @
property (nonatomic
, retain
) NSData
*_password_tmp
;
90 @
property (nonatomic
, assign
) BOOL isListeningForSync
;
91 @
property (nonatomic
, assign
) int lock_notification_token
;
92 @
property (nonatomic
, retain
) CKKeyParameter
* key_transport
;
93 @
property (nonatomic
) SOSKVSCircleStorageTransport
* circle_transport
;
94 @
property (nonatomic
, retain
) SOSMessageKVS
* kvs_message_transport
;
95 @
property (nonatomic
, retain
) SOSMessageIDS
* ids_message_transport
;
96 @
property (nonatomic
, retain
) SOSCKCircleStorage
* ck_storage
;
99 @
property (nonatomic
, assign
) BOOL circle_rings_retirements_need_attention
;
100 @
property (nonatomic
, assign
) BOOL engine_peer_state_needs_repair
;
101 @
property (nonatomic
, assign
) BOOL key_interests_need_updating
;
103 @
property (nonatomic
, retain
) NSMutableArray
*change_blocks
;
105 @
property (nonatomic
, retain
) NSMutableDictionary
*waitForInitialSync_blocks
;
106 @
property (nonatomic
, assign
) BOOL isInitialSyncing
;
108 @
property (nonatomic
) NSData
* accountKeyDerivationParamters
;
110 @
property (nonatomic
, assign
) BOOL accountKeyIsTrusted
;
111 @
property (nonatomic
) SecKeyRef accountKey
;
112 @
property (nonatomic
) SecKeyRef previousAccountKey
;
114 @
property (copy
) SOSAccountSaveBlock saveBlock
;
117 // Identity access properties, all delegated to the trust object
118 @
property (readonly
, nonatomic
) BOOL hasPeerInfo
;
119 @
property (readonly
, nonatomic
) SOSPeerInfoRef peerInfo
;
120 @
property (readonly
, nonatomic
) SOSFullPeerInfoRef fullPeerInfo
;
121 @
property (readonly
, nonatomic
) NSString
* peerID
;
125 -(id
) initWithGestalt
:(CFDictionaryRef
)gestalt factory
:(SOSDataSourceFactoryRef
)factory
;
127 void SOSAccountAddSyncablePeerBlock(SOSAccount
* a
,
129 SOSAccountSyncablePeersBlock changeBlock
);
131 -(bool) ensureFactoryCircles
;
132 -(void) ensureOctagonPeerKeys
;
134 -(void) flattenToSaveBlock
;
136 void SOSAccountSetToNew(SOSAccount
* a
);
138 bool SOSAccountIsMyPeerActive(SOSAccount
* account
, CFErrorRef
* error
);
140 // MARK: In Sync checking
141 typedef bool (^SOSAccountWaitForInitialSyncBlock
)(SOSAccount
* account
);
143 CF_RETURNS_RETAINED CFStringRef
SOSAccountCallWhenInSync(SOSAccount
* account
, SOSAccountWaitForInitialSyncBlock syncBlock
);
144 bool SOSAccountUnregisterCallWhenInSync(SOSAccount
* account
, CFStringRef id
);
146 bool SOSAccountHandleOutOfSyncUpdate(SOSAccount
* account
, CFSetRef oldOOSViews
, CFSetRef newOOSViews
);
148 void SOSAccountEnsureSyncChecking(SOSAccount
* account
);
149 void SOSAccountCancelSyncChecking(SOSAccount
* account
);
151 CFMutableSetRef
SOSAccountCopyOutstandingViews(SOSAccount
* account
);
152 void SOSAccountNotifyEngines(SOSAccount
* account
);
153 CFMutableSetRef
SOSAccountCopyOutstandingViews(SOSAccount
* account
);
154 bool SOSAccountIsViewOutstanding(SOSAccount
* account
, CFStringRef view
);
155 CFMutableSetRef
SOSAccountCopyIntersectionWithOustanding(SOSAccount
* account
, CFSetRef inSet
);
156 bool SOSAccountIntersectsWithOutstanding(SOSAccount
* account
, CFSetRef views
);
157 bool SOSAccountHasOustandingViews(SOSAccount
* account
);
158 bool SOSAccountHasCompletedInitialSync(SOSAccount
* account
);
159 bool SOSAccountHasCompletedRequiredBackupSync(SOSAccount
* account
);
160 CFMutableSetRef
SOSAccountCopyOutstandingViews(SOSAccount
* account
);
161 bool SOSAccountSyncingV0(SOSAccount
* account
);
166 size_t der_sizeof_fullpeer_or_null(SOSFullPeerInfoRef data
, CFErrorRef
* error
);
168 uint8_t* der_encode_fullpeer_or_null(SOSFullPeerInfoRef data
, CFErrorRef
* error
, const uint8_t* der
, uint8_t* der_end
);
170 const uint8_t* der_decode_fullpeer_or_null(CFAllocatorRef allocator
, SOSFullPeerInfoRef
* data
,
172 const uint8_t* der
, const uint8_t* der_end
);
175 size_t der_sizeof_public_bytes(SecKeyRef publicKey
, CFErrorRef
* error
);
177 uint8_t* der_encode_public_bytes(SecKeyRef publicKey
, CFErrorRef
* error
, const uint8_t* der
, uint8_t* der_end
);
179 const uint8_t* der_decode_public_bytes(CFAllocatorRef allocator
, CFIndex algorithmID
, SecKeyRef
* publicKey
, CFErrorRef
* error
, const uint8_t* der
, const uint8_t* der_end
);
183 -(SOSCCStatus
) getCircleStatus
:(CFErrorRef
*) error
;
185 bool SOSAccountHandleCircleMessage(SOSAccount
* account
,
186 CFStringRef circleName
, CFDataRef encodedCircleMessage
, CFErrorRef
*error
);
189 CFDictionaryRef
SOSAccountHandleRetirementMessages(SOSAccount
* account
, CFDictionaryRef circle_retirement_messages
, CFErrorRef
*error
);
191 void SOSAccountRecordRetiredPeersInCircle(SOSAccount
* account
);
193 bool SOSAccountHandleUpdateCircle(SOSAccount
* account
,
194 SOSCircleRef prospective_circle
,
200 bool SOSAccountHasFullPeerInfo(SOSAccount
* account
, CFErrorRef
* error
);
202 bool SOSAccountIsMyPeerInBackupAndCurrentInView(SOSAccount
* account
, CFStringRef viewname
);
203 bool SOSAccountUpdateOurPeerInBackup(SOSAccount
* account
, SOSRingRef oldRing
, CFErrorRef
*error
);
204 bool SOSAccountIsPeerInBackupAndCurrentInView(SOSAccount
* account
, SOSPeerInfoRef testPeer
, CFStringRef viewname
);
205 bool SOSDeleteV0Keybag(CFErrorRef
*error
);
206 void SOSAccountForEachBackupView(SOSAccount
* account
, void (^operation
)(const void *value
));
207 bool SOSAccountUpdatePeerInfo(SOSAccount
* account
, CFStringRef updateDescription
, CFErrorRef
*error
, bool (^update
)(SOSFullPeerInfoRef fpi
, CFErrorRef
*error
));
209 // Currently permitted backup rings.
210 void SOSAccountForEachBackupRingName(SOSAccount
* account
, void (^operation
)(CFStringRef value
));
211 void SOSAccountForEachRingName(SOSAccount
* account
, void (^operation
)(CFStringRef value
));
214 bool SOSAccountHasCircle(SOSAccount
* account
, CFErrorRef
* error
);
215 SOSCircleRef CF_RETURNS_RETAINED
SOSAccountEnsureCircle(SOSAccount
* a
, CFStringRef name
, CFErrorRef
*error
);
217 void AppendCircleKeyName(CFMutableArrayRef array
, CFStringRef name
);
219 CFStringRef
SOSInterestListCopyDescription(CFArrayRef interests
);
222 // FullPeerInfos - including Cloud Identity
223 SOSFullPeerInfoRef
CopyCloudKeychainIdentity(SOSPeerInfoRef cloudPeer
, CFErrorRef
*error
);
225 bool SOSAccountIsAccountIdentity(SOSAccount
* account
, SOSPeerInfoRef peer_info
, CFErrorRef
*error
);
226 bool SOSAccountFullPeerInfoVerify(SOSAccount
* account
, SecKeyRef privKey
, CFErrorRef
*error
);
227 CF_RETURNS_RETAINED SOSPeerInfoRef
GenerateNewCloudIdentityPeerInfo(CFErrorRef
*error
);
230 bool SOSAccountHasPublicKey(SOSAccount
* account
, CFErrorRef
* error
);
231 bool SOSAccountPublishCloudParameters(SOSAccount
* account
, CFErrorRef
* error
);
232 bool SOSAccountRetrieveCloudParameters(SOSAccount
* account
, SecKeyRef
*newKey
,
234 CFDataRef
*newParameters
, CFErrorRef
* error
);
237 void SOSAccountAssertDSID(SOSAccount
* account
, CFStringRef dsid
);
243 SecKeyRef
SOSAccountCopyDeviceKey(SOSAccount
* account
, CFErrorRef
*error
);
244 SecKeyRef CF_RETURNS_RETAINED
GeneratePermanentFullECKey(int keySize
, CFStringRef name
, CFErrorRef
* error
);
247 void SOSAccountSetLastDepartureReason(SOSAccount
* account
, enum DepartureReason reason
);
248 void SOSAccountSetUserPublicTrustedForTesting(SOSAccount
* account
);
250 void SOSAccountPurgeIdentity(SOSAccount
*);
251 bool sosAccountLeaveCircle(SOSAccount
* account
, SOSCircleRef circle
, CFErrorRef
* error
);
252 bool sosAccountLeaveRing(SOSAccount
* account
, SOSRingRef ring
, CFErrorRef
* error
);
253 bool SOSAccountForEachRing(SOSAccount
* account
, SOSRingRef (^action
)(CFStringRef name
, SOSRingRef ring
));
254 bool SOSAccountUpdateBackUp(SOSAccount
* account
, CFStringRef viewname
, CFErrorRef
*error
);
255 void SOSAccountEnsureRecoveryRing(SOSAccount
* account
);
256 bool SOSAccountEnsureInBackupRings(SOSAccount
* account
);
258 bool SOSAccountEnsurePeerRegistration(SOSAccount
* account
, CFErrorRef
*error
);
260 extern const CFStringRef kSOSUnsyncedViewsKey
;
261 extern const CFStringRef kSOSPendingEnableViewsToBeSetKey
;
262 extern const CFStringRef kSOSPendingDisableViewsToBeSetKey
;
263 extern const CFStringRef kSOSRecoveryKey
;
266 kSOSTransportNone
= 0,
267 kSOSTransportIDS
= 1,
268 kSOSTransportKVS
= 2,
269 kSOSTransportFuture
= 3,
270 kSOSTransportPresent
= 4
273 SOSPeerInfoRef
SOSAccountCopyPeerWithID(SOSAccount
* account
, CFStringRef peerid
, CFErrorRef
*error
);
275 bool SOSAccountSetValue(SOSAccount
* account
, CFStringRef key
, CFTypeRef value
, CFErrorRef
*error
);
276 bool SOSAccountClearValue(SOSAccount
* account
, CFStringRef key
, CFErrorRef
*error
);
277 CFTypeRef
SOSAccountGetValue(SOSAccount
* account
, CFStringRef key
, CFErrorRef
*error
);
279 bool SOSAccountAddEscrowToPeerInfo(SOSAccount
* account
, SOSFullPeerInfoRef myPeer
, CFErrorRef
*error
);
280 bool SOSAccountAddEscrowRecords(SOSAccount
* account
, CFStringRef dsid
, CFDictionaryRef record
, CFErrorRef
*error
);
281 void SOSAccountRemoveRing(SOSAccount
* a
, CFStringRef ringName
);
282 SOSRingRef
SOSAccountCopyRingNamed(SOSAccount
* a
, CFStringRef ringName
, CFErrorRef
*error
);
283 SOSRingRef
SOSAccountRingCreateForName(SOSAccount
* a
, CFStringRef ringName
, CFErrorRef
*error
);
284 bool SOSAccountUpdateRingFromRemote(SOSAccount
* account
, SOSRingRef newRing
, CFErrorRef
*error
);
285 bool SOSAccountUpdateRing(SOSAccount
* account
, SOSRingRef newRing
, CFErrorRef
*error
);
286 bool SOSAccountRemoveBackupPeers(SOSAccount
* account
, CFArrayRef peerIDs
, CFErrorRef
*error
);
287 bool SOSAccountResetRing(SOSAccount
* account
, CFStringRef ringName
, CFErrorRef
*error
);
288 bool SOSAccountCheckPeerAvailability(SOSAccount
* account
, CFErrorRef
*error
);
289 bool SOSAccountUpdateNamedRing(SOSAccount
* account
, CFStringRef ringName
, CFErrorRef
*error
,
290 SOSRingRef (^create
)(CFStringRef ringName
, CFErrorRef
*error
),
291 SOSRingRef (^copyModified
)(SOSRingRef existing
, CFErrorRef
*error
));
294 // MARK: Backup translation functions
297 CFStringRef
SOSBackupCopyRingNameForView(CFStringRef viewName
);
300 // Security tool test/debug functions
302 bool SOSAccountPostDebugScope(SOSAccount
* account
, CFTypeRef scope
, CFErrorRef
*error
);
303 CFDataRef
SOSAccountCopyAccountStateFromKeychain(CFErrorRef
*error
);
304 bool SOSAccountDeleteAccountStateFromKeychain(CFErrorRef
*error
);
305 CFDataRef
SOSAccountCopyEngineStateFromKeychain(CFErrorRef
*error
);
306 bool SOSAccountDeleteEngineStateFromKeychain(CFErrorRef
*error
);
308 bool SOSAccountIsNew(SOSAccount
* account
, CFErrorRef
*error
);
309 bool SOSAccountCheckForAlwaysOnViews(SOSAccount
* account
);
310 // UUID, no setter just getter and ensuring value.
311 void SOSAccountEnsureUUID(SOSAccount
* account
);
312 CFStringRef CF_RETURNS_RETAINED
SOSAccountCopyUUID(SOSAccount
* account
);
313 const uint8_t* der_decode_cloud_parameters(CFAllocatorRef allocator
,
314 CFIndex algorithmID
, SecKeyRef
* publicKey
,
315 CFDataRef
*parameters
,
317 const uint8_t* der
, const uint8_t* der_end
);
323 CFDataRef
SOSPiggyBackBlobCopyEncodedData(SOSGenCountRef gencount
, SecKeyRef pubKey
, CFDataRef signature
, CFErrorRef
*error
);
326 NSData
*SOSPiggyCreateInitialSyncData(NSArray
<NSData
*> *identities
, NSArray
<NSDictionary
*>* tlks
);
327 NSDictionary
* SOSPiggyCopyInitialSyncData(const uint8_t** der
, const uint8_t *der_end
);
328 NSArray
<NSDictionary
*>* SOSAccountSortTLKS(NSArray
<NSDictionary
*>* tlks
);
331 bool SOSAccountCleanupAllKVSKeys(SOSAccount
* account
, CFErrorRef
* error
);
332 bool SOSAccountPopulateKVSWithBadKeys(SOSAccount
* account
, CFErrorRef
* error
);
336 @interface
SOSAccount (Persistence
)
338 +(instancetype
) accountFromData
: (NSData
*) data
339 factory
: (SOSDataSourceFactoryRef
) factory
340 error
: (NSError
**) error
;
341 +(instancetype
) accountFromDER
: (const uint8_t**) der
342 end
: (const uint8_t*) der_end
343 factory
: (SOSDataSourceFactoryRef
) factory
344 error
: (NSError
**) error
;
346 -(NSData
*) encodedData
: (NSError
**) error
;
349 #endif /* SOSAccount_h */