keychain/ckks/CKKSLocalSynchronizeOperation.m

   1 /*
   2  * Copyright (c) 2016 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import "keychain/ckks/CKKSKeychainView.h"
  25 #import "keychain/ckks/CKKSGroupOperation.h"
  26 #import "keychain/ckks/CKKSLocalSynchronizeOperation.h"
  27 #import "keychain/ckks/CKKSFetchAllRecordZoneChangesOperation.h"
  28 #import "keychain/ckks/CKKSScanLocalItemsOperation.h"
  29 #import "keychain/ckks/CKKSMirrorEntry.h"
  30 #import "keychain/ckks/CKKSIncomingQueueEntry.h"
  31 #import "keychain/ckks/CloudKitCategories.h"
  32
  33 #if OCTAGON
  34
  35 @interface CKKSLocalSynchronizeOperation ()
  36 @property int32_t restartCount;
  37 @end
  38
  39 @implementation CKKSLocalSynchronizeOperation
  40
  41 - (instancetype)init {
  42     return nil;
  43 }
  44 - (instancetype)initWithCKKSKeychainView:(CKKSKeychainView*)ckks
  45 {
  46     if(self = [super init]) {
  47         _ckks = ckks;
  48         _restartCount = 0;
  49
  50         [self addNullableDependency:ckks.holdLocalSynchronizeOperation];
  51     }
  52     return self;
  53 }
  54
  55 - (void)groupStart {
  56     __weak __typeof(self) weakSelf = self;
  57
  58     /*
  59      * A local synchronize is very similar to a CloudKit synchronize, but it won't cause any (non-essential)
  60      * CloudKit operations to occur.
  61      *
  62      *  1. Finish processing the outgoing queue. You can't be in-sync with cloudkit if you have an update that hasn't propagated.
  63      *  2. Process anything in the incoming queue as normal.
  64      *          (Note that this might require the keybag to be unlocked.)
  65      *
  66      *  3. Take every item in the CKMirror, and check for its existence in the local keychain. If not present, add to the incoming queue.
  67      *  4. Process the incoming queue again.
  68      *  5. Scan the local keychain for items which exist locally but are not in CloudKit. Upload them.
  69      *  6. If there are any such items in 4, restart the sync.
  70      */
  71
  72     CKKSKeychainView* ckks = self.ckks;
  73
  74     // Synchronous, on some thread. Get back on the CKKS queue for SQL thread-safety.
  75     [ckks dispatchSync: ^bool{
  76         if(self.cancelled) {
  77             ckksnotice("ckksresync", ckks, "CKKSSynchronizeOperation cancelled, quitting");
  78             return false;
  79         }
  80
  81         //ckks.lastLocalSynchronizeOperation = self;
  82
  83         uint32_t steps = 5;
  84
  85         ckksinfo("ckksresync", ckks, "Beginning local resynchronize (attempt %u)", self.restartCount);
  86
  87         CKOperationGroup* operationGroup = [CKOperationGroup CKKSGroupWithName:@"ckks-resync-local"];
  88
  89         // Step 1
  90         CKKSOutgoingQueueOperation* outgoingOp = [ckks processOutgoingQueue: operationGroup];
  91         outgoingOp.name = [NSString stringWithFormat: @"resync-step%u-outgoing", self.restartCount * steps + 1];
  92         [self dependOnBeforeGroupFinished:outgoingOp];
  93
  94         // Step 2
  95         CKKSIncomingQueueOperation* incomingOp = [[CKKSIncomingQueueOperation alloc] initWithCKKSKeychainView:ckks errorOnClassAFailure:true];
  96         incomingOp.name = [NSString stringWithFormat: @"resync-step%u-incoming", self.restartCount * steps + 2];
  97         [incomingOp addSuccessDependency:outgoingOp];
  98         [self runBeforeGroupFinished:incomingOp];
  99
 100         // Step 3:
 101         CKKSResultOperation* reloadOp = [[CKKSReloadAllItemsOperation alloc] initWithCKKSKeychainView:ckks];
 102         reloadOp.name = [NSString stringWithFormat: @"resync-step%u-reload", self.restartCount * steps + 3];
 103         [self runBeforeGroupFinished:reloadOp];
 104
 105         // Step 4
 106         CKKSIncomingQueueOperation* incomingResyncOp = [[CKKSIncomingQueueOperation alloc] initWithCKKSKeychainView:ckks errorOnClassAFailure:true];
 107         incomingResyncOp.name = [NSString stringWithFormat: @"resync-step%u-incoming-again", self.restartCount * steps + 4];
 108         [incomingResyncOp addSuccessDependency: reloadOp];
 109         [self runBeforeGroupFinished:incomingResyncOp];
 110
 111         // Step 5
 112         CKKSScanLocalItemsOperation* scan = [[CKKSScanLocalItemsOperation alloc] initWithCKKSKeychainView:ckks ckoperationGroup:operationGroup];
 113         scan.name = [NSString stringWithFormat: @"resync-step%u-scan", self.restartCount * steps + 5];
 114         [scan addSuccessDependency: incomingResyncOp];
 115         [self runBeforeGroupFinished: scan];
 116
 117         // Step 6
 118         CKKSResultOperation* restart = [[CKKSResultOperation alloc] init];
 119         restart.name = [NSString stringWithFormat: @"resync-step%u-consider-restart", self.restartCount * steps + 6];
 120         [restart addExecutionBlock:^{
 121             __strong __typeof(weakSelf) strongSelf = weakSelf;
 122             if(!strongSelf) {
 123                 secerror("ckksresync: received callback for released object");
 124                 return;
 125             }
 126
 127             NSError* error = nil;
 128             NSArray<NSString*>* iqes = [CKKSIncomingQueueEntry allUUIDs:ckks.zoneID error:&error];
 129             if(error) {
 130                 ckkserror("ckksresync", ckks, "Couldn't fetch IQEs: %@", error);
 131             }
 132
 133             if(scan.recordsFound > 0 || iqes.count > 0) {
 134                 if(strongSelf.restartCount >= 3) {
 135                     // we've restarted too many times. Fail and stop.
 136                     ckkserror("ckksresync", ckks, "restarted synchronization too often; Failing");
 137                     strongSelf.error = [NSError errorWithDomain:@"securityd"
 138                                                            code:2
 139                                                        userInfo:@{NSLocalizedDescriptionKey: @"resynchronization restarted too many times; churn in database?"}];
 140                 } else {
 141                     // restart the sync operation.
 142                     strongSelf.restartCount += 1;
 143                     ckkserror("ckksresync", ckks, "restarting synchronization operation due to new local items");
 144                     [strongSelf groupStart];
 145                 }
 146             }
 147         }];
 148
 149         [restart addSuccessDependency: scan];
 150         [self runBeforeGroupFinished: restart];
 151
 152         return true;
 153     }];
 154 }
 155
 156 @end;
 157
 158 #pragma mark - CKKSReloadAllItemsOperation
 159
 160 @implementation CKKSReloadAllItemsOperation
 161
 162 - (instancetype)init {
 163     return nil;
 164 }
 165 - (instancetype)initWithCKKSKeychainView:(CKKSKeychainView*)ckks
 166 {
 167     if(self = [super init]) {
 168         _ckks = ckks;
 169     }
 170     return self;
 171 }
 172
 173 - (void)main {
 174     CKKSKeychainView* strongCKKS = self.ckks;
 175
 176     [strongCKKS dispatchSync: ^bool{
 177        NSError* error = nil;
 178        NSArray<CKKSMirrorEntry*>* mirrorItems = [CKKSMirrorEntry all:strongCKKS.zoneID error:&error];
 179
 180        if(error) {
 181            ckkserror("ckksresync", strongCKKS, "Couldn't fetch mirror items: %@", error);
 182            self.error = error;
 183            return false;
 184        }
 185
 186        // Reload all entries back into the local keychain
 187        // We _could_ scan for entries, but that'd be expensive
 188        // In 36044942, we used to store only the CKRecord system fields in the ckrecord. To work around this, make a whole new CKRecord from the item.
 189        for(CKKSMirrorEntry* ckme in mirrorItems) {
 190            CKRecord* ckmeRecord = [ckme.item CKRecordWithZoneID:strongCKKS.zoneID];
 191            if(!ckmeRecord) {
 192                ckkserror("ckksresync", strongCKKS, "Couldn't make CKRecord for item: %@", ckme);
 193                continue;
 194            }
 195
 196            [strongCKKS _onqueueCKRecordChanged:ckmeRecord resync:true];
 197        }
 198
 199        return true;
 200     }];
 201 }
 202 @end
 203 #endif
 204