OSX/sec/securityd/spi.c

   1 /*
   2  * Copyright (c) 2009-2010,2012-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 #include <securityd/spi.h>
  26 #include <ipc/SecdWatchdog.h>
  27 #include <ipc/server_security_helpers.h>
  28 #include <ipc/securityd_client.h>
  29 #include <securityd/SecPolicyServer.h>
  30 #include <securityd/SecItemBackupServer.h>
  31 #include <securityd/SecItemServer.h>
  32 #include <securityd/SecTrustStoreServer.h>
  33 #include <Security/SecureObjectSync/SOSPeerInfo.h>
  34 #include <CoreFoundation/CFString.h>
  35 #include <CoreFoundation/CFError.h>
  36 #include <securityd/SOSCloudCircleServer.h>
  37 #include <securityd/SecOCSPCache.h>
  38 #include <securityd/SecOTRRemote.h>
  39 #include <securityd/SecLogSettingsServer.h>
  40 #include <securityd/personalization.h>
  41 #include <securityd/SecTrustLoggingServer.h>
  42
  43 #include <CoreFoundation/CFXPCBridge.h>
  44 #include "utilities/iOSforOSX.h"
  45 #include "utilities/SecFileLocations.h"
  46 #include "OTATrustUtilities.h"
  47
  48 static struct securityd securityd_spi = {
  49     .sec_item_add                           = _SecItemAdd,
  50     .sec_item_copy_matching                 = _SecItemCopyMatching,
  51     .sec_item_update                        = _SecItemUpdate,
  52     .sec_item_delete                        = _SecItemDelete,
  53 #if TARGET_OS_IOS && !TARGET_OS_BRIDGE
  54     .sec_add_shared_web_credential          = _SecAddSharedWebCredential,
  55     .sec_copy_shared_web_credential         = _SecCopySharedWebCredential,
  56 #endif
  57     .sec_item_delete_all                    = _SecItemDeleteAll,
  58     .sec_keychain_backup                    = _SecServerKeychainCreateBackup,
  59     .sec_keychain_restore                   = _SecServerKeychainRestore,
  60     .sec_keychain_backup_syncable           = _SecServerBackupSyncable,
  61     .sec_keychain_restore_syncable          = _SecServerRestoreSyncable,
  62     .sec_item_backup_copy_names             = SecServerItemBackupCopyNames,
  63     .sec_item_backup_handoff_fd             = SecServerItemBackupHandoffFD,
  64     .sec_item_backup_set_confirmed_manifest = SecServerItemBackupSetConfirmedManifest,
  65     .sec_item_backup_restore                = SecServerItemBackupRestore,
  66     .sec_otr_session_create_remote          = _SecOTRSessionCreateRemote,
  67     .sec_otr_session_process_packet_remote  = _SecOTRSessionProcessPacketRemote,
  68     .soscc_TryUserCredentials               = SOSCCTryUserCredentials_Server,
  69     .soscc_SetUserCredentials               = SOSCCSetUserCredentials_Server,
  70     .soscc_SetUserCredentialsAndDSID        = SOSCCSetUserCredentialsAndDSID_Server,
  71     .soscc_SetUserCredentialsAndDSIDWithAnalytics  = SOSCCSetUserCredentialsAndDSIDWithAnalytics_Server,
  72     .soscc_CanAuthenticate                  = SOSCCCanAuthenticate_Server,
  73     .soscc_PurgeUserCredentials             = SOSCCPurgeUserCredentials_Server,
  74     .soscc_ThisDeviceIsInCircle             = SOSCCThisDeviceIsInCircle_Server,
  75     .soscc_RequestToJoinCircle              = SOSCCRequestToJoinCircle_Server,
  76     .soscc_RequestToJoinCircleAfterRestore  = SOSCCRequestToJoinCircleAfterRestore_Server,
  77     .soscc_RequestToJoinCircleAfterRestoreWithAnalytics  = SOSCCRequestToJoinCircleAfterRestoreWithAnalytics_Server,
  78     .soscc_RequestEnsureFreshParameters     = SOSCCRequestEnsureFreshParameters_Server,
  79     .soscc_GetAllTheRings                   = SOSCCGetAllTheRings_Server,
  80     .soscc_ApplyToARing                     = SOSCCApplyToARing_Server,
  81     .soscc_WithdrawlFromARing               = SOSCCWithdrawlFromARing_Server,
  82     .soscc_EnableRing                       = SOSCCEnableRing_Server,
  83     .soscc_RingStatus                       = SOSCCRingStatus_Server,
  84     .soscc_SetToNew                         = SOSCCAccountSetToNew_Server,
  85     .soscc_ResetToOffering                  = SOSCCResetToOffering_Server,
  86     .soscc_ResetToEmpty                     = SOSCCResetToEmpty_Server,
  87     .soscc_ResetToEmptyWithAnalytics        = SOSCCResetToEmptyWithAnalytics_Server,
  88     .soscc_View                             = SOSCCView_Server,
  89     .soscc_ViewSet                          = SOSCCViewSet_Server,
  90     .soscc_ViewSetWithAnalytics             = SOSCCViewSetWithAnalytics_Server,
  91     .soscc_RemoveThisDeviceFromCircle       = SOSCCRemoveThisDeviceFromCircle_Server,
  92     .soscc_RemoveThisDeviceFromCircleWithAnalytics = SOSCCRemoveThisDeviceFromCircleWithAnalytics_Server,
  93     .soscc_RemovePeersFromCircle            = SOSCCRemovePeersFromCircle_Server,
  94     .soscc_RemovePeersFromCircleWithAnalytics = SOSCCRemovePeersFromCircleWithAnalytics_Server,
  95     .soscc_LoggedOutOfAccount               = SOSCCLoggedOutOfAccount_Server,
  96     .soscc_BailFromCircle                   = SOSCCBailFromCircle_Server,
  97     .soscc_AcceptApplicants                 = SOSCCAcceptApplicants_Server,
  98     .soscc_RejectApplicants                 = SOSCCRejectApplicants_Server,
  99     .soscc_CopyApplicantPeerInfo            = SOSCCCopyApplicantPeerInfo_Server,
 100     .soscc_CopyGenerationPeerInfo           = SOSCCCopyGenerationPeerInfo_Server,
 101     .soscc_CopyValidPeerPeerInfo            = SOSCCCopyValidPeerPeerInfo_Server,
 102     .soscc_ValidateUserPublic               = SOSCCValidateUserPublic_Server,
 103     .soscc_CopyNotValidPeerPeerInfo         = SOSCCCopyNotValidPeerPeerInfo_Server,
 104     .soscc_CopyRetirementPeerInfo           = SOSCCCopyRetirementPeerInfo_Server,
 105     .soscc_CopyViewUnawarePeerInfo          = SOSCCCopyViewUnawarePeerInfo_Server,
 106     .soscc_CopyEngineState                  = SOSCCCopyEngineState_Server,
 107     .soscc_CopyPeerInfo                     = SOSCCCopyPeerPeerInfo_Server,
 108     .soscc_CopyConcurringPeerInfo           = SOSCCCopyConcurringPeerPeerInfo_Server,
 109     .soscc_ProcessSyncWithPeers             = SOSCCProcessSyncWithPeers_Server,
 110     .soscc_ProcessSyncWithAllPeers          = SOSCCProcessSyncWithAllPeers_Server,
 111     .soscc_EnsurePeerRegistration           = SOSCCProcessEnsurePeerRegistration_Server,
 112     .sec_roll_keys                          = _SecServerRollKeysGlue,
 113     .sec_keychain_sync_update_message       = _SecServerKeychainSyncUpdateMessage,
 114     .sec_get_log_settings                   = SecCopyLogSettings_Server,
 115     .sec_set_xpc_log_settings               = SecSetXPCLogSettings_Server,
 116     .sec_set_circle_log_settings            = SecSetCircleLogSettings_Server,
 117     .soscc_CopyMyPeerInfo                   = SOSCCCopyMyPeerInfo_Server,
 118         .soscc_SetLastDepartureReason           = SOSCCSetLastDepartureReason_Server,
 119     .soscc_SetNewPublicBackupKey            = SOSCCSetNewPublicBackupKey_Server,
 120     .soscc_RegisterSingleRecoverySecret     = SOSCCRegisterSingleRecoverySecret_Server,
 121     .soscc_WaitForInitialSync               = SOSCCWaitForInitialSync_Server,
 122     .soscc_WaitForInitialSyncWithAnalytics  = SOSCCWaitForInitialSyncWithAnalytics_Server,
 123     .soscc_CopyYetToSyncViewsList           = SOSCCCopyYetToSyncViewsList_Server,
 124     .soscc_SetEscrowRecords                 = SOSCCSetEscrowRecord_Server,
 125     .soscc_CopyEscrowRecords                = SOSCCCopyEscrowRecord_Server,
 126     .sosbskb_WrapToBackupSliceKeyBagForView = SOSWrapToBackupSliceKeyBagForView_Server,
 127     .soscc_CopyAccountState                 = SOSCCCopyAccountState_Server,
 128     .soscc_DeleteAccountState               = SOSCCDeleteAccountState_Server,
 129     .soscc_CopyEngineData                   = SOSCCCopyEngineData_Server,
 130     .soscc_DeleteEngineState                = SOSCCDeleteEngineState_Server,
 131     .soscc_AccountHasPublicKey              = SOSCCAccountHasPublicKey_Server,
 132     .soscc_AccountIsNew                     = SOSCCAccountIsNew_Server,
 133     .sec_item_update_token_items            = _SecItemUpdateTokenItems,
 134     .sec_delete_items_with_access_groups    = _SecItemServerDeleteAllWithAccessGroups,
 135     .soscc_IsThisDeviceLastBackup           = SOSCCkSecXPCOpIsThisDeviceLastBackup_Server,
 136     .soscc_SOSCCPeersHaveViewsEnabled       = SOSCCPeersHaveViewsEnabled_Server,
 137     .soscc_RegisterRecoveryPublicKey        = SOSCCRegisterRecoveryPublicKey_Server,
 138     .soscc_CopyRecoveryPublicKey            = SOSCCCopyRecoveryPublicKey_Server,
 139     .soscc_CopyBackupInformation            = SOSCCCopyBackupInformation_Server,
 140     .soscc_SOSCCMessageFromPeerIsPending    = SOSCCMessageFromPeerIsPending_Server,
 141     .soscc_SOSCCSendToPeerIsPending         = SOSCCSendToPeerIsPending_Server,
 142     .sec_item_copy_parent_certificates      = _SecItemCopyParentCertificates,
 143     .sec_item_certificate_exists            = _SecItemCertificateExists,
 144 };
 145
 146 #ifdef LIBTRUSTD
 147 static struct trustd trustd_spi = {
 148     .sec_trust_store_for_domain             = SecTrustStoreForDomainName,
 149     .sec_trust_store_contains               = SecTrustStoreContainsCertificateWithDigest,
 150     .sec_trust_store_set_trust_settings     = _SecTrustStoreSetTrustSettings,
 151     .sec_trust_store_remove_certificate     = SecTrustStoreRemoveCertificateWithDigest,
 152     .sec_truststore_remove_all              = _SecTrustStoreRemoveAll,
 153     .sec_trust_evaluate                     = SecTrustServerEvaluate,
 154     .sec_ota_pki_trust_store_version        = SecOTAPKIGetCurrentTrustStoreVersion,
 155     .sec_ota_pki_asset_version              = SecOTAPKIGetCurrentAssetVersion,
 156     .ota_CopyEscrowCertificates             = SecOTAPKICopyCurrentEscrowCertificates,
 157     .sec_ota_pki_get_new_asset              = SecOTAPKISignalNewAsset,
 158     .sec_trust_store_copy_all               = _SecTrustStoreCopyAll,
 159     .sec_trust_store_copy_usage_constraints = _SecTrustStoreCopyUsageConstraints,
 160     .sec_ocsp_cache_flush                   = SecOCSPCacheFlush,
 161     .sec_networking_analytics_report        = SecNetworkingAnalyticsReport,
 162     .sec_trust_store_set_ct_exceptions      = _SecTrustStoreSetCTExceptions,
 163     .sec_trust_store_copy_ct_exceptions     = _SecTrustStoreCopyCTExceptions,
 164 };
 165 #endif
 166
 167 #if SECD_SERVER
 168 static CFTypeRef
 169 delayedSOSSharedObject(void)
 170 {
 171     static CFTypeRef soscc_status;
 172     static dispatch_once_t onceToken;
 173     dispatch_once(&onceToken, ^{
 174         soscc_status = SOSKeychainAccountGetSharedAccount();
 175     });
 176     return soscc_status;
 177 }
 178 #endif
 179
 180 void securityd_init_local_spi(void) {
 181     gSecurityd = &securityd_spi;
 182 #if SECD_SERVER
 183     // We're the server: we need to handle this locally. Bring them up and set them in the global object.
 184     securityd_spi.soscc_status = delayedSOSSharedObject;
 185 #endif
 186     // You're trying to bring up a (non-trustd) 'securityd'. Create the local handler for securityd XPCs.
 187     securityd_spi.secd_xpc_server = SecCreateLocalCFSecuritydXPCServer();
 188 }
 189
 190 void securityd_init_server(void) {
 191     securityd_init_local_spi();
 192
 193     // Lazy initialization is no good; bring up the keychain on start
 194     // If you want to not do this, you'll need to check the APSConnection Mach mailbox for messages here instead (good luck)
 195     CFErrorRef cferror = nil;
 196     bool keychainAlive = kc_with_dbt(false, &cferror, ^bool(SecDbConnectionRef dbt) {
 197         secnotice("keychain", "Keychain initialized!");
 198         return true;
 199     });
 200     if(!keychainAlive || cferror) {
 201         secerror("Couldn't bring up keychain: %@", cferror);
 202     }
 203     CFReleaseNull(cferror);
 204
 205     SecdLoadWatchDog();
 206 }
 207
 208 static void trustd_init_server(void) {
 209 #ifdef LIBTRUSTD
 210     gTrustd = &trustd_spi;
 211     SecPolicyServerInitialize();
 212 #endif
 213 }
 214
 215 void securityd_init(CFURLRef home_path) {
 216     if (home_path)
 217         SetCustomHomeURL(home_path);
 218
 219     securityd_init_server();
 220     trustd_init_server();
 221 }