]> git.saurik.com Git - apple/security.git/blob - OSX/sec/SOSCircle/SecureObjectSync/SOSPeerInfo.c
Security-57336.1.9.tar.gz
[apple/security.git] / OSX / sec / SOSCircle / SecureObjectSync / SOSPeerInfo.c
1 /*
2 * Copyright (c) 2012-2014 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24
25 #include <AssertMacros.h>
26 #include <TargetConditionals.h>
27
28 #include <Security/SecureObjectSync/SOSPeerInfo.h>
29 #include <Security/SecureObjectSync/SOSPeerInfoInternal.h>
30 #include <Security/SecureObjectSync/SOSPeerInfoPriv.h>
31 #include <Security/SecureObjectSync/SOSPeerInfoV2.h>
32 #include <Security/SecureObjectSync/SOSCircle.h>
33 #include <Security/SecureObjectSync/SOSAccountPriv.h>
34 #include <Security/SecureObjectSync/SOSInternal.h>
35 #include <ipc/securityd_client.h>
36
37 #include <CoreFoundation/CFArray.h>
38 #include <dispatch/dispatch.h>
39
40 #include <stdlib.h>
41 #include <assert.h>
42
43 #include <utilities/SecCFWrappers.h>
44 #include <utilities/SecCFRelease.h>
45 #include <utilities/SecCFError.h>
46 #include <utilities/SecXPCError.h>
47
48 #include <utilities/der_plist.h>
49 #include <utilities/der_plist_internal.h>
50 #include <corecrypto/ccder.h>
51 #include <utilities/der_date.h>
52
53 #include <corecrypto/ccdigest.h>
54 #include <corecrypto/ccsha2.h>
55
56
57 #include <CoreFoundation/CoreFoundation.h>
58 #include <CoreFoundation/CFDate.h>
59
60 #include <xpc/xpc.h>
61
62 #if TARGET_OS_IPHONE || TARGET_OS_EMBEDDED
63 #include <MobileGestalt.h>
64 #endif
65
66 #include <Security/SecBase64.h>
67 #include <Security/SecKeyPriv.h>
68 #include <Security/SecOTR.h>
69 #include <Security/SecuritydXPC.h>
70
71 CFGiblisWithHashFor(SOSPeerInfo);
72
73
74 const CFStringRef kPIUserDefinedDeviceNameKey = CFSTR("ComputerName");
75 const CFStringRef kPIDeviceModelNameKey = CFSTR("ModelName");
76 const CFStringRef kPIMessageProtocolVersionKey = CFSTR("MessageProtocolVersion");
77 const CFStringRef kPIOSVersionKey = CFSTR("OSVersion");
78
79 // Description Dictionary Entries
80 static CFStringRef sPublicKeyKey = CFSTR("PublicSigningKey");
81 const CFStringRef sGestaltKey = CFSTR("DeviceGestalt");
82 const CFStringRef sVersionKey = CFSTR("ConflictVersion");
83 static CFStringRef sCloudIdentityKey = CFSTR("CloudIdentity");
84 static CFStringRef sApplicationDate = CFSTR("ApplicationDate");
85 static CFStringRef sApplicationUsig = CFSTR("ApplicationUsig");
86 static CFStringRef sRetirementDate = CFSTR("RetirementDate");
87
88 // Peerinfo Entries
89 CFStringRef kSOSPeerInfoDescriptionKey = CFSTR("SOSPeerInfoDescription");
90 CFStringRef kSOSPeerInfoSignatureKey = CFSTR("SOSPeerInfoSignature");
91 CFStringRef kSOSPeerInfoNameKey = CFSTR("SOSPeerInfoName");
92
93 //Peer Info V2 Dictionary IDS keys
94 CFStringRef sPreferIDS = CFSTR("PreferIDS");
95 CFStringRef sTransportType = CFSTR("TransportType");
96 CFStringRef sDeviceID = CFSTR("DeviceID");
97
98 const CFStringRef peerIDLengthKey = CFSTR("idLength");
99
100 SOSPeerInfoRef SOSPeerInfoAllocate(CFAllocatorRef allocator) {
101 return CFTypeAllocate(SOSPeerInfo, struct __OpaqueSOSPeerInfo, allocator);
102 }
103
104 SecKeyRef SOSPeerInfoCopyPubKey(SOSPeerInfoRef peer) {
105 CFDataRef pubKeyBytes = CFDictionaryGetValue(peer->description, sPublicKeyKey);
106 if (pubKeyBytes == NULL)
107 return NULL;
108 CFAllocatorRef allocator = CFGetAllocator(peer);
109 SecKeyRef pubKey = SecKeyCreateFromPublicData(allocator, kSecECDSAAlgorithmID, pubKeyBytes);
110 return pubKey;
111 }
112
113 CFDataRef SOSPeerInfoGetAutoAcceptInfo(SOSPeerInfoRef peer) {
114 CFDataRef pubKeyBytes = NULL;
115
116 pubKeyBytes = CFDictionaryGetValue(peer->description, sPublicKeyKey);
117 if (!pubKeyBytes || CFGetTypeID(pubKeyBytes) != CFDataGetTypeID()) {
118 pubKeyBytes = NULL;
119 }
120
121 return pubKeyBytes;
122 }
123
124 static bool SOSDescriptionHash(SOSPeerInfoRef peer, const struct ccdigest_info *di, void *hashresult, CFErrorRef *error) {
125 ccdigest_di_decl(di, ctx);
126 ccdigest_init(di, ctx);
127 void *ctx_p = ctx;
128 if(!SOSPeerInfoUpdateDigestWithDescription(peer, di, ctx_p, error)) return false;
129 ccdigest_final(di, ctx, hashresult);
130 return true;
131 }
132
133
134 #define SIGLEN 128
135 static CFDataRef sosSignHash(SecKeyRef privkey, const struct ccdigest_info *di, uint8_t *hbuf) {
136 OSStatus stat;
137 size_t siglen = SIGLEN;
138 uint8_t sig[siglen];
139 if((stat = SecKeyRawSign(privkey, kSecPaddingNone, hbuf, di->output_size, sig, &siglen)) != 0) {
140 return NULL;
141 }
142 return CFDataCreate(NULL, sig, (CFIndex)siglen);
143 }
144
145 static bool sosVerifyHash(SecKeyRef pubkey, const struct ccdigest_info *di, uint8_t *hbuf, CFDataRef signature) {
146 return SecKeyRawVerify(pubkey, kSecPaddingNone, hbuf, di->output_size,
147 CFDataGetBytePtr(signature), CFDataGetLength(signature)) == errSecSuccess;
148 }
149
150 bool SOSPeerInfoSign(SecKeyRef privKey, SOSPeerInfoRef peer, CFErrorRef *error) {
151 bool status = false;
152 const struct ccdigest_info *di = ccsha256_di();
153 uint8_t hbuf[di->output_size];
154 CFDataRef newSignature = NULL;
155
156 require_action_quiet(SOSDescriptionHash(peer, di, hbuf, error), fail,
157 SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Failed to hash description for peer"), NULL, error));
158
159 newSignature = sosSignHash(privKey, di, hbuf);
160 require_action_quiet(newSignature, fail, SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Failed to sign peerinfo for peer"), NULL, error));
161
162 CFReleaseNull(peer->signature);
163 peer->signature = newSignature;
164 newSignature = NULL;
165 status = true;
166
167 fail:
168 CFReleaseNull(newSignature);
169 return status;
170 }
171
172 // Return true (1) if the signature verifies.
173 bool SOSPeerInfoVerify(SOSPeerInfoRef peer, CFErrorRef *error) {
174 bool result = false;
175 const struct ccdigest_info *di = ccsha256_di();
176 uint8_t hbuf[di->output_size];
177
178 SecKeyRef pubKey = SOSPeerInfoCopyPubKey(peer);
179 require_action_quiet(pubKey, error_out,
180 SOSErrorCreate(kSOSErrorNoKey, error, NULL,
181 CFSTR("Couldn't find pub key for %@"), peer));
182
183 require_quiet(SOSDescriptionHash(peer, di, hbuf, error), error_out);
184
185 require_action_quiet(sosVerifyHash(pubKey, di, hbuf, peer->signature), error_out,
186 SOSErrorCreate(kSOSErrorBadSignature, error, NULL,
187 CFSTR("Signature didn't verify for %@"), peer));
188 result = true;
189
190 error_out:
191 CFReleaseNull(pubKey);
192 return result;
193 }
194
195 void SOSPeerInfoSetVersionNumber(SOSPeerInfoRef pi, int version) {
196 pi->version = version;
197 CFNumberRef versionNumber = CFNumberCreateWithCFIndex(NULL, pi->version);
198 CFDictionarySetValue(pi->description, sVersionKey, versionNumber);
199 CFReleaseNull(versionNumber);
200 }
201
202 static SOSPeerInfoRef SOSPeerInfoCreate_Internal(CFAllocatorRef allocator,
203 CFDictionaryRef gestalt, CFDataRef backup_key,
204 CFStringRef IDSID, CFStringRef transportType, CFBooleanRef preferIDS,
205 CFSetRef enabledViews,
206 SecKeyRef signingKey, CFErrorRef* error,
207 void (^ description_modifier)(CFMutableDictionaryRef description)) {
208 SOSPeerInfoRef pi = CFTypeAllocate(SOSPeerInfo, struct __OpaqueSOSPeerInfo, allocator);
209 pi->gestalt = gestalt;
210 CFRetain(pi->gestalt);
211
212 pi->version = SOSPeerInfoGetPeerProtocolVersion(pi);
213 CFDataRef publicBytes = NULL;
214 CFNumberRef versionNumber = NULL;
215
216 SecKeyRef publicKey = SecKeyCreatePublicFromPrivate(signingKey);
217 if (publicKey == NULL) {
218 SOSCreateError(kSOSErrorBadKey, CFSTR("Unable to get public"), NULL, error);
219 CFReleaseNull(pi);
220 goto exit;
221 }
222
223 OSStatus result = SecKeyCopyPublicBytes(publicKey, &publicBytes);
224
225 if (result != errSecSuccess) {
226 SOSCreateError(kSOSErrorBadKey, CFSTR("Failed to export public bytes"), NULL, error);
227 CFReleaseNull(pi);
228 goto exit;
229 }
230
231 pi->signature = CFDataCreateMutable(allocator, 0);
232
233 versionNumber = CFNumberCreateWithCFIndex(NULL, pi->version);
234
235 pi->description = CFDictionaryCreateMutableForCFTypesWith(allocator,
236 sVersionKey, versionNumber,
237 sPublicKeyKey, publicBytes,
238 sGestaltKey, pi->gestalt,
239 NULL);
240
241 if (backup_key != NULL)
242 SOSPeerInfoV2DictionarySetValue(pi, sBackupKeyKey, backup_key);
243
244 description_modifier(pi->description);
245
246
247 pi->id = SOSCopyIDOfKey(publicKey, error);
248 CFReleaseNull(publicKey);
249
250 require_quiet(pi->id, exit);
251
252 // ================ V2 Additions Start
253
254 if(!SOSPeerInfoUpdateToV2(pi, error)) {
255 CFReleaseNull(pi);
256 goto exit;
257 }
258
259 // V2DictionarySetValue handles NULL as remove
260 SOSPeerInfoV2DictionarySetValue(pi, sBackupKeyKey, backup_key);
261 SOSPeerInfoV2DictionarySetValue(pi, sDeviceID, IDSID);
262 SOSPeerInfoV2DictionarySetValue(pi, sTransportType, transportType);
263 SOSPeerInfoV2DictionarySetValue(pi, sPreferIDS, preferIDS);
264
265 SOSPeerInfoV2DictionarySetValue(pi, sViewsKey, enabledViews);
266
267 // ================ V2 Additions End
268
269 if (!SOSPeerInfoSign(signingKey, pi, error)) {
270 CFReleaseNull(pi);
271 goto exit;
272 }
273
274 exit:
275 CFReleaseNull(versionNumber);
276 CFReleaseNull(publicBytes);
277 return pi;
278 }
279
280 SOSPeerInfoRef SOSPeerInfoCreate(CFAllocatorRef allocator, CFDictionaryRef gestalt, CFDataRef backup_key, SecKeyRef signingKey, CFErrorRef* error) {
281 return SOSPeerInfoCreate_Internal(allocator, gestalt, backup_key, NULL, NULL, NULL, NULL, signingKey, error, ^(CFMutableDictionaryRef description) {});
282 }
283
284 SOSPeerInfoRef SOSPeerInfoCreateWithTransportAndViews(CFAllocatorRef allocator, CFDictionaryRef gestalt, CFDataRef backup_key,
285 CFStringRef IDSID, CFStringRef transportType, CFBooleanRef preferIDS,
286 CFSetRef enabledViews,
287 SecKeyRef signingKey, CFErrorRef* error)
288 {
289 return SOSPeerInfoCreate_Internal(allocator, gestalt, backup_key, IDSID, transportType, preferIDS, enabledViews, signingKey, error, ^(CFMutableDictionaryRef description) {});
290 }
291
292
293 SOSPeerInfoRef SOSPeerInfoCreateCloudIdentity(CFAllocatorRef allocator, CFDictionaryRef gestalt, SecKeyRef signingKey, CFErrorRef* error) {
294 return SOSPeerInfoCreate_Internal(allocator, gestalt, NULL, NULL, NULL, NULL, NULL, signingKey, error, ^(CFMutableDictionaryRef description) {
295 CFDictionarySetValue(description, sCloudIdentityKey, kCFBooleanTrue);
296 });
297
298 }
299
300
301 SOSPeerInfoRef SOSPeerInfoCreateCopy(CFAllocatorRef allocator, SOSPeerInfoRef toCopy, CFErrorRef* error) {
302 if(!toCopy) return NULL;
303 SOSPeerInfoRef pi = CFTypeAllocate(SOSPeerInfo, struct __OpaqueSOSPeerInfo, allocator);
304
305 pi->description = CFDictionaryCreateMutableCopy(allocator, 0, toCopy->description);
306 pi->signature = CFDataCreateCopy(allocator, toCopy->signature);
307
308 pi->gestalt = CFDictionaryCreateCopy(allocator, toCopy->gestalt);
309 pi->id = CFStringCreateCopy(allocator, toCopy->id);
310
311 pi->version = toCopy->version;
312 if(!SOSPeerInfoVersionHasV2Data(pi)) SOSPeerInfoExpandV2Data(pi, error);
313
314 return pi;
315 }
316
317 bool SOSPeerInfoVersionIsCurrent(SOSPeerInfoRef pi) {
318 return pi->version >= PEERINFO_CURRENT_VERSION;
319 }
320
321 bool SOSPeerInfoVersionHasV2Data(SOSPeerInfoRef pi) {
322 return pi->version >= kSOSPeerV2BaseVersion;
323 }
324
325 SOSPeerInfoRef SOSPeerInfoCreateCurrentCopy(CFAllocatorRef allocator, SOSPeerInfoRef toCopy,
326 CFStringRef IDSID, CFStringRef transportType, CFBooleanRef preferIDS, CFSetRef enabledViews,
327 SecKeyRef signingKey, CFErrorRef* error) {
328
329 SOSPeerInfoRef pi = SOSPeerInfoCreateCopy(allocator, toCopy, error);
330 if(!SOSPeerInfoVersionHasV2Data(pi)) SOSPeerInfoUpdateToV2(pi, error);
331
332 SOSPeerInfoSetSerialNumber(pi);
333
334 if (IDSID) {
335 SOSPeerInfoV2DictionarySetValue(pi, sDeviceID, IDSID);
336 }
337 if (transportType) {
338 SOSPeerInfoV2DictionarySetValue(pi, sTransportType, transportType);
339 }
340 if (preferIDS) {
341 SOSPeerInfoV2DictionarySetValue(pi, sPreferIDS, preferIDS);
342 }
343 if (enabledViews) {
344 SOSPeerInfoV2DictionarySetValue(pi, sViewsKey, enabledViews);
345 }
346
347 if(!SOSPeerInfoSign(signingKey, pi, error)) {
348 CFReleaseNull(pi);
349 }
350
351 return pi;
352 }
353
354
355 static SOSPeerInfoRef SOSPeerInfoCopyWithModification(CFAllocatorRef allocator, SOSPeerInfoRef original,
356 SecKeyRef signingKey, CFErrorRef *error,
357 bool (^modification)(SOSPeerInfoRef peerToModify, CFErrorRef *error)) {
358
359 SOSPeerInfoRef result = NULL;
360 SOSPeerInfoRef copy = SOSPeerInfoCreateCopy(allocator, original, error);
361
362 require_quiet(modification(copy, error), fail);
363
364 require_quiet(SOSPeerInfoSign(signingKey, copy, error), fail);
365
366 CFTransferRetained(result, copy);
367
368 fail:
369 CFReleaseNull(copy);
370 return result;
371
372 }
373
374 SOSPeerInfoRef SOSPeerInfoCopyWithGestaltUpdate(CFAllocatorRef allocator, SOSPeerInfoRef toCopy, CFDictionaryRef gestalt, SecKeyRef signingKey, CFErrorRef* error) {
375 return SOSPeerInfoCopyWithModification(allocator, toCopy, signingKey, error,
376 ^bool(SOSPeerInfoRef peerToModify, CFErrorRef *error) {
377 CFRetainAssign(peerToModify->gestalt, gestalt);
378 CFDictionarySetValue(peerToModify->description, sGestaltKey, peerToModify->gestalt);
379 return true;
380
381 });
382 }
383
384
385 SOSPeerInfoRef SOSPeerInfoCopyWithBackupKeyUpdate(CFAllocatorRef allocator, SOSPeerInfoRef toCopy, CFDataRef backupKey, SecKeyRef signingKey, CFErrorRef *error) {
386 return SOSPeerInfoCopyWithModification(allocator, toCopy, signingKey, error,
387 ^bool(SOSPeerInfoRef peerToModify, CFErrorRef *error) {
388 if (backupKey != NULL)
389 SOSPeerInfoV2DictionarySetValue(peerToModify, sBackupKeyKey, backupKey);
390 else
391 SOSPeerInfoV2DictionaryRemoveValue(peerToModify, sBackupKeyKey);
392 return true;
393 });
394 }
395
396 CFDataRef SOSPeerInfoCopyBackupKey(SOSPeerInfoRef peer) {
397 return SOSPeerInfoV2DictionaryCopyData(peer, sBackupKeyKey);
398 }
399
400 bool SOSPeerInfoHasBackupKey(SOSPeerInfoRef peer) {
401 CFDataRef bk = SOSPeerInfoCopyBackupKey(peer);
402 bool success = bk != NULL;
403 CFReleaseNull(bk);
404 return success;
405 }
406
407 SOSPeerInfoRef SOSPeerInfoCopyWithViewsChange(CFAllocatorRef allocator, SOSPeerInfoRef toCopy,
408 SOSViewActionCode action, CFStringRef viewname, SOSViewResultCode *retval,
409 SecKeyRef signingKey, CFErrorRef* error) {
410 SOSPeerInfoRef pi = SOSPeerInfoCreateCopy(allocator, toCopy, error);
411 if(action == kSOSCCViewEnable) {
412 *retval = SOSViewsEnable(pi, viewname, error);
413 require((kSOSCCViewMember == *retval), exit);
414 } else if(action == kSOSCCViewDisable) {
415 *retval = SOSViewsDisable(pi, viewname, error);
416 require((kSOSCCViewNotMember == *retval), exit);
417 }
418
419 require_action_quiet(SOSPeerInfoSign(signingKey, pi, error), exit, *retval = kSOSCCGeneralViewError);
420 return pi;
421
422 exit:
423 CFReleaseNull(pi);
424 return NULL;
425 }
426
427
428 CFStringRef sPingKey = CFSTR("Ping");
429
430 SOSPeerInfoRef SOSPeerInfoCopyWithPing(CFAllocatorRef allocator, SOSPeerInfoRef toCopy, SecKeyRef signingKey, CFErrorRef* error) {
431 SOSPeerInfoRef pi = SOSPeerInfoCreateCopy(allocator, toCopy, error);
432 CFDataRef ping = CFDataCreateWithRandomBytes(8);
433 SOSPeerInfoV2DictionarySetValue(pi, sPingKey, ping);
434 SecKeyRef pub_key = SOSPeerInfoCopyPubKey(pi);
435 pi->id = SOSCopyIDOfKey(pub_key, error);
436 require_quiet(pi->id, exit);
437 require_action_quiet(SOSPeerInfoSign(signingKey, pi, error), exit, CFReleaseNull(pi));
438
439 exit:
440 CFReleaseNull(pub_key);
441 return pi;
442 }
443
444
445 SOSViewResultCode SOSPeerInfoViewStatus(SOSPeerInfoRef pi, CFStringRef view, CFErrorRef *error) {
446 return SOSViewsQuery(pi, view, error);
447 }
448
449
450 SOSPeerInfoRef SOSPeerInfoCopyWithSecurityPropertyChange(CFAllocatorRef allocator, SOSPeerInfoRef toCopy,
451 SOSSecurityPropertyActionCode action, CFStringRef property, SOSSecurityPropertyResultCode *retval,
452 SecKeyRef signingKey, CFErrorRef* error) {
453 SOSPeerInfoRef pi = SOSPeerInfoCreateCopy(allocator, toCopy, error);
454 if(action == kSOSCCSecurityPropertyEnable) {
455 *retval = SOSSecurityPropertyEnable(pi, property, error);
456 require((kSOSCCSecurityPropertyValid == *retval), exit);
457 } else if(action == kSOSCCSecurityPropertyDisable) {
458 *retval = SOSSecurityPropertyDisable(pi, property, error);
459 require((kSOSCCSecurityPropertyNotValid == *retval), exit);
460 }
461
462 require_action_quiet(SOSPeerInfoSign(signingKey, pi, error), exit, *retval = kSOSCCGeneralViewError);
463 return pi;
464
465 exit:
466 CFReleaseNull(pi);
467 return NULL;
468 }
469
470 SOSViewResultCode SOSPeerInfoSecurityPropertyStatus(SOSPeerInfoRef pi, CFStringRef property, CFErrorRef *error) {
471 return SOSSecurityPropertyQuery(pi, property, error);
472 }
473
474
475
476 static void SOSPeerInfoDestroy(CFTypeRef aObj) {
477 SOSPeerInfoRef pi = (SOSPeerInfoRef) aObj;
478
479 if(!pi) return;
480 CFReleaseNull(pi->description);
481 CFReleaseNull(pi->signature);
482 CFReleaseNull(pi->gestalt);
483 CFReleaseNull(pi->id);
484 CFReleaseNull(pi->v2Dictionary);
485 CFReleaseNull(pi->secproperties);
486 }
487
488 static Boolean SOSPeerInfoCompare(CFTypeRef lhs, CFTypeRef rhs) {
489 SOSPeerInfoRef lpeer = (SOSPeerInfoRef) lhs;
490 SOSPeerInfoRef rpeer = (SOSPeerInfoRef) rhs;
491 if(!lpeer || !rpeer) return false;
492 return CFEqualSafe(lpeer->description, rpeer->description) && CFEqualSafe(lpeer->signature, rpeer->signature);
493 }
494
495
496 CFComparisonResult SOSPeerInfoCompareByID(const void *val1, const void *val2, void *context) {
497 // The code below is necessary but not sufficient; not returning a CFComparisonResult
498 // It probably is OK to say that a NULL is < <non-NULL>
499 if (val1 == NULL || val2 == NULL) {
500 ptrdiff_t dv = val1 - val2;
501 return dv < 0 ? kCFCompareLessThan : dv == 0 ? kCFCompareEqualTo : kCFCompareGreaterThan;
502 }
503
504 CFStringRef v1 = SOSPeerInfoGetPeerID((SOSPeerInfoRef) val1);
505 CFStringRef v2 = SOSPeerInfoGetPeerID((SOSPeerInfoRef) val2);
506 if (v1 == NULL || v2 == NULL) {
507 ptrdiff_t dv = (const void *)v1 - (const void *)v2;
508 return dv < 0 ? kCFCompareLessThan : dv == 0 ? kCFCompareEqualTo : kCFCompareGreaterThan;
509 }
510
511 return CFStringCompare(v1, v2, 0);
512 }
513
514 static CFHashCode SOSPeerInfoHash(CFTypeRef cf) {
515 SOSPeerInfoRef peer = (SOSPeerInfoRef) cf;
516
517 return CFHash(peer->description) ^ CFHash(peer->signature);
518 }
519
520 static CFStringRef copyDescriptionWithFormatOptions(CFTypeRef aObj, CFDictionaryRef formatOptions){
521
522 SOSPeerInfoRef pi = (SOSPeerInfoRef) aObj;
523 CFStringRef description = NULL;
524
525
526 // Get the format options we care about:
527 CFNumberRef peerIDLengthNumber = formatOptions ? CFDictionaryGetValue(formatOptions, peerIDLengthKey) : NULL;
528 bool useSyncDFormat = formatOptions && CFDictionaryContainsKey(formatOptions, CFSTR("SyncD"));
529
530 // Calculate the truncated length
531 CFIndex truncatedLength = CFStringGetLength(pi->id);
532 if (isNumber(peerIDLengthNumber)) {
533 CFIndex peerIDMaximumLength = truncatedLength;
534 CFNumberGetValue(peerIDLengthNumber, kCFNumberCFIndexType, &peerIDMaximumLength);
535 truncatedLength = MIN(truncatedLength, peerIDMaximumLength);
536 }
537 CFStringRef displayPeerID = CFStringCreateWithSubstring(kCFAllocatorDefault, pi->id, CFRangeMake(0, truncatedLength));
538
539 CFStringRef objectPrefix = useSyncDFormat ? CFSTR("PI") :
540 CFStringCreateWithFormat(kCFAllocatorDefault, formatOptions, CFSTR("PeerInfo@%p"), pi);
541
542 CFStringRef osVersion = CFDictionaryGetValue(pi->gestalt, kPIOSVersionKey);
543
544 CFStringRef transportType = SOSPeerInfoV2DictionaryCopyString(pi, sTransportType);
545 CFStringRef deviceID = SOSPeerInfoV2DictionaryCopyString(pi, sDeviceID);
546
547 description = CFStringCreateWithFormat(NULL, NULL, CFSTR("<%@: %s%s '%@' %@ %@ %@ %@ %@ %ld>"),
548 objectPrefix,
549 SOSPeerInfoIsRetirementTicket(pi) ? "R" : "-",
550 SOSPeerInfoHasBackupKey(pi) ? "B" : "-",
551 CFDictionaryGetValue(pi->gestalt, kPIUserDefinedDeviceNameKey),
552 CFDictionaryGetValue(pi->gestalt, kPIDeviceModelNameKey),
553 osVersion ? osVersion : CFSTR("????"),
554 transportType ? transportType : CFSTR("KVS"),
555 deviceID ? deviceID : CFSTR(""),
556 displayPeerID,
557 pi->version);
558
559 CFReleaseNull(transportType);
560 CFReleaseNull(deviceID);
561
562 CFReleaseNull(objectPrefix);
563 CFReleaseNull(displayPeerID);
564
565 return description;
566 }
567
568 static CFStringRef SOSPeerInfoCopyFormatDescription(CFTypeRef aObj, CFDictionaryRef formatOptions) {
569
570 CFStringRef description = NULL;
571
572 description = copyDescriptionWithFormatOptions(aObj, formatOptions);
573
574 return description;
575 }
576
577 CFDictionaryRef SOSPeerInfoCopyPeerGestalt(SOSPeerInfoRef pi) {
578 CFRetain(pi->gestalt);
579 return pi->gestalt;
580 }
581
582 CFDictionaryRef SOSPeerGetGestalt(SOSPeerInfoRef pi){
583 return pi->gestalt;
584 }
585
586 CFStringRef SOSPeerInfoGetPeerName(SOSPeerInfoRef peer) {
587 return SOSPeerInfoLookupGestaltValue(peer, kPIUserDefinedDeviceNameKey);
588 }
589
590 CFStringRef SOSPeerInfoGetPeerDeviceType(SOSPeerInfoRef peer) {
591 return SOSPeerInfoLookupGestaltValue(peer, kPIDeviceModelNameKey);
592 }
593
594 CFIndex SOSPeerInfoGetPeerProtocolVersion(SOSPeerInfoRef peer) {
595 CFIndex version = PEERINFO_CURRENT_VERSION;
596 CFTypeRef val = SOSPeerInfoLookupGestaltValue(peer, kPIMessageProtocolVersionKey);
597 if (val && CFGetTypeID(val) == CFNumberGetTypeID())
598 CFNumberGetValue(val, kCFNumberCFIndexType, &version);
599 return version;
600 }
601
602 CFTypeRef SOSPeerInfoLookupGestaltValue(SOSPeerInfoRef pi, CFStringRef key) {
603 return CFDictionaryGetValue(pi->gestalt, key);
604 }
605
606 CFStringRef SOSPeerInfoGetPeerID(SOSPeerInfoRef pi) {
607 return pi ? pi->id : NULL;
608 }
609
610 bool SOSPeerInfoPeerIDEqual(SOSPeerInfoRef pi, CFStringRef myPeerID) {
611 return CFEqualSafe(myPeerID, SOSPeerInfoGetPeerID(pi));
612 }
613
614 CFIndex SOSPeerInfoGetVersion(SOSPeerInfoRef pi) {
615 return pi->version;
616 }
617
618 bool SOSPeerInfoUpdateDigestWithPublicKeyBytes(SOSPeerInfoRef peer, const struct ccdigest_info *di,
619 ccdigest_ctx_t ctx, CFErrorRef *error) {
620 CFDataRef pubKeyBytes = CFDictionaryGetValue(peer->description, sPublicKeyKey);
621
622 if(!pubKeyBytes) {
623 SOSCreateErrorWithFormat(kSOSErrorEncodeFailure, NULL, error, NULL, CFSTR("Digest failed – no public key"));
624 return false;
625 }
626
627 ccdigest_update(di, ctx, CFDataGetLength(pubKeyBytes), CFDataGetBytePtr(pubKeyBytes));
628
629 return true;
630 }
631
632 bool SOSPeerInfoUpdateDigestWithDescription(SOSPeerInfoRef peer, const struct ccdigest_info *di,
633 ccdigest_ctx_t ctx, CFErrorRef *error) {
634 if(SOSPeerInfoVersionHasV2Data(peer)) SOSPeerInfoPackV2Data(peer);
635 size_t description_size = der_sizeof_plist(peer->description, error);
636 uint8_t data_begin[description_size];
637 uint8_t *data_end = data_begin + description_size;
638 uint8_t *encoded = der_encode_plist(peer->description, error, data_begin, data_end);
639
640 if(!encoded) {
641 SOSCreateErrorWithFormat(kSOSErrorEncodeFailure, NULL, error, NULL, CFSTR("Description encode failed"));
642 return false;
643 }
644
645 ccdigest_update(di, ctx, description_size, data_begin);
646
647 return true;
648 }
649
650
651 static CFDataRef sosCreateDate() {
652 CFDateRef now = CFDateCreate(NULL, CFAbsoluteTimeGetCurrent());
653 size_t bufsiz = der_sizeof_date(now, NULL);
654 uint8_t buf[bufsiz];
655 der_encode_date(now, NULL, buf, buf+bufsiz);
656 CFReleaseNull(now);
657 return CFDataCreate(NULL, buf, bufsiz);
658 }
659
660 static CFDateRef sosCreateCFDate(CFDataRef sosdate) {
661 CFDateRef date;
662 der_decode_date(NULL, 0, &date, NULL, CFDataGetBytePtr(sosdate),
663 CFDataGetBytePtr(sosdate) + CFDataGetLength(sosdate));
664 return date;
665 }
666
667 static bool sospeer_application_hash(SOSPeerInfoRef pi, const struct ccdigest_info *di, uint8_t *hbuf) {
668 CFDataRef appdate = CFDictionaryGetValue(pi->description, sApplicationDate);
669 if(!appdate) return false;
670 ccdigest_di_decl(di, ctx);
671 ccdigest_init(di, ctx);
672 ccdigest_update(di, ctx, CFDataGetLength(appdate), CFDataGetBytePtr(appdate));
673 if (!SOSPeerInfoUpdateDigestWithPublicKeyBytes(pi, di, ctx, NULL)) return false;
674 ccdigest_final(di, ctx, hbuf);
675 return true;
676 }
677
678 SOSPeerInfoRef SOSPeerInfoCopyAsApplication(SOSPeerInfoRef original, SecKeyRef userkey, SecKeyRef peerkey, CFErrorRef *error) {
679 SOSPeerInfoRef result = NULL;
680 SOSPeerInfoRef pi = SOSPeerInfoCreateCopy(kCFAllocatorDefault, original, error);
681 const struct ccdigest_info *di = ccsha256_di();
682 uint8_t hbuf[di->output_size];
683 CFDataRef usersig = NULL;
684
685 CFDataRef creationDate = sosCreateDate();
686 CFDictionarySetValue(pi->description, sApplicationDate, creationDate);
687 CFReleaseNull(creationDate);
688
689 // Create User Application Signature
690 require_action_quiet(sospeer_application_hash(pi, di, hbuf), fail,
691 SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Failed to create hash for peer applicant"), NULL, error));
692
693 usersig = sosSignHash(userkey, di, hbuf);
694 require_action_quiet(usersig, fail,
695 SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Failed to sign public key hash for peer"), NULL, error));
696
697 CFDictionarySetValue(pi->description, sApplicationUsig, usersig);
698
699 require_quiet(SOSPeerInfoSign(peerkey, pi, error), fail);
700
701 result = pi;
702 pi = NULL;
703
704 fail:
705 CFReleaseNull(usersig);
706 CFReleaseNull(pi);
707 return result;
708 }
709
710 bool SOSPeerInfoApplicationVerify(SOSPeerInfoRef pi, SecKeyRef userkey, CFErrorRef *error) {
711 const struct ccdigest_info *di = ccsha256_di();
712 uint8_t hbuf[di->output_size];
713 bool result = false;
714
715 CFDataRef usig = CFDictionaryGetValue(pi->description, sApplicationUsig);
716 require_action_quiet(usig, exit,
717 SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Peer is not an applicant"), NULL, error));
718 // Verify User Application Signature
719 require_action_quiet(sospeer_application_hash(pi, di, hbuf), exit,
720 SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Failed to create hash for peer applicant"), NULL, error));
721 require_action_quiet(sosVerifyHash(userkey, di, hbuf, usig), exit,
722 SOSCreateError(kSOSErrorUnexpectedType, CFSTR("user signature of public key hash fails to verify"), NULL, error));
723
724 result = SOSPeerInfoVerify(pi, error);
725
726 exit:
727 return result;
728 }
729
730
731 static CF_RETURNS_RETAINED CFDateRef sosPeerInfoGetDate(SOSPeerInfoRef pi, CFStringRef entry) {
732 if(!pi) return NULL;
733 CFDataRef sosdate = CFDictionaryGetValue(pi->description, entry);
734 if(!sosdate) return NULL;
735 CFDateRef date = sosCreateCFDate(sosdate);
736
737 return date;
738 }
739
740 CF_RETURNS_RETAINED CFDateRef SOSPeerInfoGetApplicationDate(SOSPeerInfoRef pi) {
741 return sosPeerInfoGetDate(pi, sApplicationDate);
742 }
743
744 CF_RETURNS_RETAINED CFDateRef SOSPeerInfoGetRetirementDate(SOSPeerInfoRef pi) {
745 return sosPeerInfoGetDate(pi, sRetirementDate);
746 }
747
748
749
750 //
751 // Gestalt helpers
752 //
753
754 CFStringRef SOSPeerGestaltGetName(CFDictionaryRef gestalt) {
755 CFStringRef name = SOSPeerGestaltGetAnswer(gestalt, kPIUserDefinedDeviceNameKey);
756 return isString(name) ? name : NULL;
757 }
758
759 CFTypeRef SOSPeerGestaltGetAnswer(CFDictionaryRef gestalt, CFStringRef question) {
760 return gestalt ? CFDictionaryGetValue(gestalt, question) : NULL;
761 }
762
763 //
764 // Peer Retirement
765 //
766
767
768 SOSPeerInfoRef SOSPeerInfoCreateRetirementTicket(CFAllocatorRef allocator, SecKeyRef privKey, SOSPeerInfoRef peer, CFErrorRef *error) {
769 // Copy PeerInfo
770 SOSPeerInfoRef pi = SOSPeerInfoCreateCopy(allocator, peer, error);
771
772 require(pi, fail);
773
774 // Fill out Resignation Date
775 CFDataRef resignationDate = sosCreateDate();
776 CFDictionaryAddValue(pi->description, sRetirementDate, resignationDate);
777 CFReleaseNull(resignationDate);
778
779 require(SOSPeerInfoSign(privKey, pi, error), fail);
780
781 return pi;
782
783 fail:
784 CFReleaseNull(pi);
785 return NULL;
786 }
787
788 CFStringRef SOSPeerInfoInspectRetirementTicket(SOSPeerInfoRef pi, CFErrorRef *error) {
789 CFStringRef retval = NULL;
790 CFDateRef now = CFDateCreate(NULL, CFAbsoluteTimeGetCurrent());
791 CFDateRef retirement = NULL;
792
793 require_quiet(SOSPeerInfoVerify(pi, error), err);
794
795 retirement = sosCreateCFDate(CFDictionaryGetValue(pi->description, sRetirementDate));
796
797 require_action_quiet(retirement, err,
798 SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Peer is not retired"), NULL, error));
799
800 require_action_quiet(CFDateCompare(now, retirement, NULL) == kCFCompareGreaterThan, err,
801 SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Retirement date is after current date"), NULL, error));
802
803 retval = SOSPeerInfoGetPeerID(pi);
804
805 err:
806 CFReleaseNull(now);
807 CFReleaseNull(retirement);
808 return retval;
809 }
810
811 bool SOSPeerInfoRetireRetirementTicket(size_t max_seconds, SOSPeerInfoRef pi) {
812 CFDateRef now = CFDateCreate(NULL, CFAbsoluteTimeGetCurrent());
813 CFDateRef retirement = sosCreateCFDate(CFDictionaryGetValue(pi->description, sRetirementDate));
814 CFTimeInterval timediff = CFDateGetTimeIntervalSinceDate(now, retirement); // diff in seconds
815 CFReleaseNull(now);
816 CFReleaseNull(retirement);
817 if(timediff > (max_seconds)) return true;
818 return false;
819 }
820
821 bool SOSPeerInfoIsRetirementTicket(SOSPeerInfoRef pi) {
822 CFDataRef flag = CFDictionaryGetValue(pi->description, sRetirementDate);
823 return flag != NULL;
824 }
825
826 bool SOSPeerInfoIsCloudIdentity(SOSPeerInfoRef pi) {
827 CFTypeRef value = CFDictionaryGetValue(pi->description, sCloudIdentityKey);
828 return CFEqualSafe(value, kCFBooleanTrue);
829 }
830
831 SOSPeerInfoRef SOSPeerInfoUpgradeSignatures(CFAllocatorRef allocator, SecKeyRef privKey, SecKeyRef peerKey, SOSPeerInfoRef peer, CFErrorRef *error) {
832 SecKeyRef pubKey = SecKeyCreatePublicFromPrivate(privKey);
833 SOSPeerInfoRef retval = NULL;
834
835 retval = SOSPeerInfoCopyAsApplication(peer, privKey, peerKey, error);
836 CFReleaseNull(pubKey);
837 return retval;
838 }
839
840 CFBooleanRef SOSPeerInfoCopyIDSPreference(SOSPeerInfoRef peer){
841 CFBooleanRef preference = (CFBooleanRef)SOSPeerInfoV2DictionaryCopyBoolean(peer, sPreferIDS);
842 return (preference ? preference : CFRetain(kCFBooleanFalse));
843 }
844
845
846 SOSPeerInfoRef SOSPeerInfoSetIDSPreference(CFAllocatorRef allocator, SOSPeerInfoRef toCopy, CFBooleanRef preference, SecKeyRef signingKey, CFErrorRef *error){
847 return SOSPeerInfoCopyWithModification(allocator, toCopy, signingKey, error,
848 ^bool(SOSPeerInfoRef peerToModify, CFErrorRef *error) {
849 SOSPeerInfoV2DictionarySetValue(peerToModify, sPreferIDS, preference);
850 return true;
851 });
852 }
853
854 CFStringRef SOSPeerInfoCopyTransportType(SOSPeerInfoRef peer){
855 CFStringRef transportType = (CFStringRef)SOSPeerInfoV2DictionaryCopyString(peer, sTransportType);
856 return (transportType ? transportType : CFRetain(SOSTransportMessageTypeKVS));
857 }
858
859 SOSPeerInfoRef SOSPeerInfoSetTransportType(CFAllocatorRef allocator, SOSPeerInfoRef toCopy, CFStringRef transportType, SecKeyRef signingKey, CFErrorRef *error){
860
861 return SOSPeerInfoCopyWithModification(allocator, toCopy, signingKey, error,
862 ^bool(SOSPeerInfoRef peerToModify, CFErrorRef *error) {
863 SOSPeerInfoV2DictionarySetValue(peerToModify, sTransportType, transportType);
864 return true;
865 });
866 }
867
868 bool SOSPeerInfoHasDeviceID(SOSPeerInfoRef peer) {
869 return SOSPeerInfoV2DictionaryHasString(peer, sDeviceID);
870 }
871
872 CFStringRef SOSPeerInfoCopyDeviceID(SOSPeerInfoRef peer){
873 return (CFStringRef)SOSPeerInfoV2DictionaryCopyString(peer, sDeviceID);
874 }
875
876 SOSPeerInfoRef SOSPeerInfoSetDeviceID(CFAllocatorRef allocator, SOSPeerInfoRef toCopy, CFStringRef IDS, SecKeyRef signingKey, CFErrorRef *error){
877
878 return SOSPeerInfoCopyWithModification(allocator, toCopy, signingKey, error,
879 ^bool(SOSPeerInfoRef peerToModify, CFErrorRef *error) {
880 SOSPeerInfoV2DictionarySetValue(peerToModify, sDeviceID, IDS);
881 return true;
882 });
883 }
884
885 bool SOSPeerInfoShouldUseIDSTransport(SOSPeerInfoRef myPeer, SOSPeerInfoRef theirPeer){
886
887 CFBooleanRef myPreference = SOSPeerInfoCopyIDSPreference(myPeer);
888 CFStringRef myTransportType = SOSPeerInfoCopyTransportType(myPeer);
889
890 CFBooleanRef theirPreference = SOSPeerInfoCopyIDSPreference(theirPeer);
891 CFStringRef theirTransportType = SOSPeerInfoCopyTransportType(theirPeer);
892
893 bool success = false;
894 //If I'm a galarch KVS + peer is KVS and ids only is true for both == KVS
895 if((CFStringCompare(myTransportType, SOSTransportMessageTypeKVS, 0) == 0 && CFStringCompare(theirTransportType, SOSTransportMessageTypeKVS, 0) == 0)&& (myPreference == kCFBooleanTrue && theirPreference == kCFBooleanTrue))
896 success = false;
897
898 //If transport is IDS Galarch +1 (Pref is true) and peer is KVS (ids is true) == IDS
899 else if ((CFStringCompare(myTransportType, SOSTransportMessageTypeIDS, 0) == 0 && CFStringCompare(theirTransportType, SOSTransportMessageTypeKVS, 0) == 0) && (myPreference == kCFBooleanTrue && theirPreference == kCFBooleanTrue))
900 success = true;
901
902 else if ((CFStringCompare(theirTransportType, SOSTransportMessageTypeIDS, 0) == 0 && CFStringCompare(myTransportType, SOSTransportMessageTypeKVS, 0) == 0) && (theirPreference == kCFBooleanTrue && myPreference == kCFBooleanTrue))
903 success = true;
904
905 //If transport is IDS Galarch +1 and peer is IDS Galarch +1 (prefer IDS is true) == IDS
906 else if ((CFStringCompare(myTransportType, SOSTransportMessageTypeIDS, 0) == 0 && CFStringCompare(theirTransportType, SOSTransportMessageTypeIDS, 0) == 0))
907 success = true;
908
909 //If KVS and KVS prefer IDS is false (set to false or doesn't exist) == KVS
910 else if ((CFStringCompare(myTransportType, SOSTransportMessageTypeKVS, 0) == 0 && CFStringCompare(theirTransportType, SOSTransportMessageTypeKVS, 0) == 0) && (myPreference == kCFBooleanFalse && theirPreference == kCFBooleanFalse))
911 success = false;
912
913 else
914 success = false;
915
916 CFReleaseSafe(myPreference);
917 CFReleaseSafe(myTransportType);
918 CFReleaseSafe(theirPreference);
919 CFReleaseSafe(theirTransportType);
920 return success;
921 }