]> git.saurik.com Git - apple/security.git/blob - OSX/sec/securityd/spi.c
Security-58286.230.21.tar.gz
[apple/security.git] / OSX / sec / securityd / spi.c
1 /*
2 * Copyright (c) 2009-2010,2012-2014 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24
25 #include <securityd/spi.h>
26 #include <ipc/SecdWatchdog.h>
27 #include <ipc/server_security_helpers.h>
28 #include <ipc/securityd_client.h>
29 #include <securityd/SecPolicyServer.h>
30 #include <securityd/SecItemBackupServer.h>
31 #include <securityd/SecItemServer.h>
32 #include <securityd/SecTrustStoreServer.h>
33 #include <Security/SecureObjectSync/SOSPeerInfo.h>
34 #include <CoreFoundation/CFString.h>
35 #include <CoreFoundation/CFError.h>
36 #include <securityd/SOSCloudCircleServer.h>
37 #include <securityd/SecOCSPCache.h>
38 #include <securityd/SecOTRRemote.h>
39 #include <securityd/SecLogSettingsServer.h>
40 #include <securityd/personalization.h>
41 #include <securityd/SecTrustLoggingServer.h>
42
43 #include <CoreFoundation/CFXPCBridge.h>
44 #include "utilities/iOSforOSX.h"
45 #include "utilities/SecFileLocations.h"
46 #include "OTATrustUtilities.h"
47
48 static struct securityd securityd_spi = {
49 .sec_item_add = _SecItemAdd,
50 .sec_item_copy_matching = _SecItemCopyMatching,
51 .sec_item_update = _SecItemUpdate,
52 .sec_item_delete = _SecItemDelete,
53 #if TARGET_OS_IOS && !TARGET_OS_BRIDGE
54 .sec_add_shared_web_credential = _SecAddSharedWebCredential,
55 .sec_copy_shared_web_credential = _SecCopySharedWebCredential,
56 #endif
57 .sec_item_delete_all = _SecItemDeleteAll,
58 .sec_keychain_backup = _SecServerKeychainCreateBackup,
59 .sec_keychain_restore = _SecServerKeychainRestore,
60 .sec_keychain_backup_syncable = _SecServerBackupSyncable,
61 .sec_keychain_restore_syncable = _SecServerRestoreSyncable,
62 .sec_item_backup_copy_names = SecServerItemBackupCopyNames,
63 .sec_item_backup_handoff_fd = SecServerItemBackupHandoffFD,
64 .sec_item_backup_set_confirmed_manifest = SecServerItemBackupSetConfirmedManifest,
65 .sec_item_backup_restore = SecServerItemBackupRestore,
66 .sec_otr_session_create_remote = _SecOTRSessionCreateRemote,
67 .sec_otr_session_process_packet_remote = _SecOTRSessionProcessPacketRemote,
68 .soscc_TryUserCredentials = SOSCCTryUserCredentials_Server,
69 .soscc_SetUserCredentials = SOSCCSetUserCredentials_Server,
70 .soscc_SetUserCredentialsAndDSID = SOSCCSetUserCredentialsAndDSID_Server,
71 .soscc_SetUserCredentialsAndDSIDWithAnalytics = SOSCCSetUserCredentialsAndDSIDWithAnalytics_Server,
72 .soscc_CanAuthenticate = SOSCCCanAuthenticate_Server,
73 .soscc_PurgeUserCredentials = SOSCCPurgeUserCredentials_Server,
74 .soscc_ThisDeviceIsInCircle = SOSCCThisDeviceIsInCircle_Server,
75 .soscc_RequestToJoinCircle = SOSCCRequestToJoinCircle_Server,
76 .soscc_RequestToJoinCircleAfterRestore = SOSCCRequestToJoinCircleAfterRestore_Server,
77 .soscc_RequestToJoinCircleAfterRestoreWithAnalytics = SOSCCRequestToJoinCircleAfterRestoreWithAnalytics_Server,
78 .soscc_RequestEnsureFreshParameters = SOSCCRequestEnsureFreshParameters_Server,
79 .soscc_GetAllTheRings = SOSCCGetAllTheRings_Server,
80 .soscc_ApplyToARing = SOSCCApplyToARing_Server,
81 .soscc_WithdrawlFromARing = SOSCCWithdrawlFromARing_Server,
82 .soscc_EnableRing = SOSCCEnableRing_Server,
83 .soscc_RingStatus = SOSCCRingStatus_Server,
84 .soscc_SetToNew = SOSCCAccountSetToNew_Server,
85 .soscc_ResetToOffering = SOSCCResetToOffering_Server,
86 .soscc_ResetToEmpty = SOSCCResetToEmpty_Server,
87 .soscc_ResetToEmptyWithAnalytics = SOSCCResetToEmptyWithAnalytics_Server,
88 .soscc_View = SOSCCView_Server,
89 .soscc_ViewSet = SOSCCViewSet_Server,
90 .soscc_ViewSetWithAnalytics = SOSCCViewSetWithAnalytics_Server,
91 .soscc_RemoveThisDeviceFromCircle = SOSCCRemoveThisDeviceFromCircle_Server,
92 .soscc_RemoveThisDeviceFromCircleWithAnalytics = SOSCCRemoveThisDeviceFromCircleWithAnalytics_Server,
93 .soscc_RemovePeersFromCircle = SOSCCRemovePeersFromCircle_Server,
94 .soscc_RemovePeersFromCircleWithAnalytics = SOSCCRemovePeersFromCircleWithAnalytics_Server,
95 .soscc_LoggedOutOfAccount = SOSCCLoggedOutOfAccount_Server,
96 .soscc_BailFromCircle = SOSCCBailFromCircle_Server,
97 .soscc_AcceptApplicants = SOSCCAcceptApplicants_Server,
98 .soscc_RejectApplicants = SOSCCRejectApplicants_Server,
99 .soscc_CopyApplicantPeerInfo = SOSCCCopyApplicantPeerInfo_Server,
100 .soscc_CopyGenerationPeerInfo = SOSCCCopyGenerationPeerInfo_Server,
101 .soscc_CopyValidPeerPeerInfo = SOSCCCopyValidPeerPeerInfo_Server,
102 .soscc_ValidateUserPublic = SOSCCValidateUserPublic_Server,
103 .soscc_CopyNotValidPeerPeerInfo = SOSCCCopyNotValidPeerPeerInfo_Server,
104 .soscc_CopyRetirementPeerInfo = SOSCCCopyRetirementPeerInfo_Server,
105 .soscc_CopyViewUnawarePeerInfo = SOSCCCopyViewUnawarePeerInfo_Server,
106 .soscc_CopyEngineState = SOSCCCopyEngineState_Server,
107 .soscc_CopyPeerInfo = SOSCCCopyPeerPeerInfo_Server,
108 .soscc_CopyConcurringPeerInfo = SOSCCCopyConcurringPeerPeerInfo_Server,
109 .soscc_ProcessSyncWithPeers = SOSCCProcessSyncWithPeers_Server,
110 .soscc_ProcessSyncWithAllPeers = SOSCCProcessSyncWithAllPeers_Server,
111 .soscc_EnsurePeerRegistration = SOSCCProcessEnsurePeerRegistration_Server,
112 .sec_roll_keys = _SecServerRollKeysGlue,
113 .sec_keychain_sync_update_message = _SecServerKeychainSyncUpdateMessage,
114 .sec_get_log_settings = SecCopyLogSettings_Server,
115 .sec_set_xpc_log_settings = SecSetXPCLogSettings_Server,
116 .sec_set_circle_log_settings = SecSetCircleLogSettings_Server,
117 .soscc_CopyMyPeerInfo = SOSCCCopyMyPeerInfo_Server,
118 .soscc_SetLastDepartureReason = SOSCCSetLastDepartureReason_Server,
119 .soscc_SetNewPublicBackupKey = SOSCCSetNewPublicBackupKey_Server,
120 .soscc_RegisterSingleRecoverySecret = SOSCCRegisterSingleRecoverySecret_Server,
121 .soscc_WaitForInitialSync = SOSCCWaitForInitialSync_Server,
122 .soscc_WaitForInitialSyncWithAnalytics = SOSCCWaitForInitialSyncWithAnalytics_Server,
123 .soscc_CopyYetToSyncViewsList = SOSCCCopyYetToSyncViewsList_Server,
124 .soscc_SetEscrowRecords = SOSCCSetEscrowRecord_Server,
125 .soscc_CopyEscrowRecords = SOSCCCopyEscrowRecord_Server,
126 .sosbskb_WrapToBackupSliceKeyBagForView = SOSWrapToBackupSliceKeyBagForView_Server,
127 .soscc_CopyAccountState = SOSCCCopyAccountState_Server,
128 .soscc_DeleteAccountState = SOSCCDeleteAccountState_Server,
129 .soscc_CopyEngineData = SOSCCCopyEngineData_Server,
130 .soscc_DeleteEngineState = SOSCCDeleteEngineState_Server,
131 .soscc_AccountHasPublicKey = SOSCCAccountHasPublicKey_Server,
132 .soscc_AccountIsNew = SOSCCAccountIsNew_Server,
133 .sec_item_update_token_items = _SecItemUpdateTokenItems,
134 .sec_delete_items_with_access_groups = _SecItemServerDeleteAllWithAccessGroups,
135 .soscc_IsThisDeviceLastBackup = SOSCCkSecXPCOpIsThisDeviceLastBackup_Server,
136 .soscc_SOSCCPeersHaveViewsEnabled = SOSCCPeersHaveViewsEnabled_Server,
137 .soscc_RegisterRecoveryPublicKey = SOSCCRegisterRecoveryPublicKey_Server,
138 .soscc_CopyRecoveryPublicKey = SOSCCCopyRecoveryPublicKey_Server,
139 .soscc_CopyBackupInformation = SOSCCCopyBackupInformation_Server,
140 .soscc_SOSCCMessageFromPeerIsPending = SOSCCMessageFromPeerIsPending_Server,
141 .soscc_SOSCCSendToPeerIsPending = SOSCCSendToPeerIsPending_Server,
142 .sec_item_copy_parent_certificates = _SecItemCopyParentCertificates,
143 .sec_item_certificate_exists = _SecItemCertificateExists,
144 };
145
146 #ifdef LIBTRUSTD
147 static struct trustd trustd_spi = {
148 .sec_trust_store_for_domain = SecTrustStoreForDomainName,
149 .sec_trust_store_contains = SecTrustStoreContainsCertificateWithDigest,
150 .sec_trust_store_set_trust_settings = _SecTrustStoreSetTrustSettings,
151 .sec_trust_store_remove_certificate = SecTrustStoreRemoveCertificateWithDigest,
152 .sec_truststore_remove_all = _SecTrustStoreRemoveAll,
153 .sec_trust_evaluate = SecTrustServerEvaluate,
154 .sec_ota_pki_trust_store_version = SecOTAPKIGetCurrentTrustStoreVersion,
155 .sec_ota_pki_asset_version = SecOTAPKIGetCurrentAssetVersion,
156 .ota_CopyEscrowCertificates = SecOTAPKICopyCurrentEscrowCertificates,
157 .sec_ota_pki_get_new_asset = SecOTAPKISignalNewAsset,
158 .sec_trust_store_copy_all = _SecTrustStoreCopyAll,
159 .sec_trust_store_copy_usage_constraints = _SecTrustStoreCopyUsageConstraints,
160 .sec_ocsp_cache_flush = SecOCSPCacheFlush,
161 .sec_networking_analytics_report = SecNetworkingAnalyticsReport,
162 .sec_trust_store_set_ct_exceptions = _SecTrustStoreSetCTExceptions,
163 .sec_trust_store_copy_ct_exceptions = _SecTrustStoreCopyCTExceptions,
164 };
165 #endif
166
167 #if SECD_SERVER
168 static CFTypeRef
169 delayedSOSSharedObject(void)
170 {
171 static CFTypeRef soscc_status;
172 static dispatch_once_t onceToken;
173 dispatch_once(&onceToken, ^{
174 soscc_status = SOSKeychainAccountGetSharedAccount();
175 });
176 return soscc_status;
177 }
178 #endif
179
180 void securityd_init_local_spi(void) {
181 gSecurityd = &securityd_spi;
182 #if SECD_SERVER
183 // We're the server: we need to handle this locally. Bring them up and set them in the global object.
184 securityd_spi.soscc_status = delayedSOSSharedObject;
185 #endif
186 // You're trying to bring up a (non-trustd) 'securityd'. Create the local handler for securityd XPCs.
187 securityd_spi.secd_xpc_server = SecCreateLocalCFSecuritydXPCServer();
188 }
189
190 void securityd_init_server(void) {
191 securityd_init_local_spi();
192
193 // Lazy initialization is no good; bring up the keychain on start
194 // If you want to not do this, you'll need to check the APSConnection Mach mailbox for messages here instead (good luck)
195 CFErrorRef cferror = nil;
196 bool keychainAlive = kc_with_dbt(false, &cferror, ^bool(SecDbConnectionRef dbt) {
197 secnotice("keychain", "Keychain initialized!");
198 return true;
199 });
200 if(!keychainAlive || cferror) {
201 secerror("Couldn't bring up keychain: %@", cferror);
202 }
203 CFReleaseNull(cferror);
204
205 SecdLoadWatchDog();
206 }
207
208 static void trustd_init_server(void) {
209 #ifdef LIBTRUSTD
210 gTrustd = &trustd_spi;
211 SecPolicyServerInitialize();
212 #endif
213 }
214
215 void securityd_init(CFURLRef home_path) {
216 if (home_path)
217 SetCustomHomeURL(home_path);
218
219 securityd_init_server();
220 trustd_init_server();
221 }