keychain/ckks/CKKSIncomingQueueOperation.m

   1 /*
   2  * Copyright (c) 2016 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import "CKKSKeychainView.h"
  25 #import "CKKSIncomingQueueOperation.h"
  26 #import "CKKSIncomingQueueEntry.h"
  27 #import "CKKSItemEncrypter.h"
  28 #import "CKKSOutgoingQueueEntry.h"
  29 #import "CKKSKey.h"
  30 #import "CKKSManifest.h"
  31 #import "CKKSAnalytics.h"
  32 #import "CKKSPowerCollection.h"
  33 #import "keychain/ckks/CKKSCurrentItemPointer.h"
  34
  35 #include <securityd/SecItemServer.h>
  36 #include <securityd/SecItemDb.h>
  37 #include <Security/SecItemPriv.h>
  38
  39 #include <utilities/SecADWrapper.h>
  40
  41 #if OCTAGON
  42
  43 @interface CKKSIncomingQueueOperation ()
  44 @property bool newOutgoingEntries;
  45 @property bool pendingClassAEntries;
  46 @property bool missingKey;
  47 @end
  48
  49 @implementation CKKSIncomingQueueOperation
  50
  51 - (instancetype)init {
  52     return nil;
  53 }
  54 - (instancetype)initWithCKKSKeychainView:(CKKSKeychainView*)ckks errorOnClassAFailure:(bool)errorOnClassAFailure {
  55     if(self = [super init]) {
  56         _ckks = ckks;
  57
  58         // Can't process unless we have a reasonable key hierarchy.
  59         if(ckks.keyStateReadyDependency) {
  60             [self addDependency: ckks.keyStateReadyDependency];
  61         }
  62
  63         [self addNullableDependency: ckks.holdIncomingQueueOperation];
  64
  65         _errorOnClassAFailure = errorOnClassAFailure;
  66         _pendingClassAEntries = false;
  67
  68         [self linearDependencies:ckks.incomingQueueOperations];
  69
  70         if ([CKKSManifest shouldSyncManifests]) {
  71             __weak __typeof(self) weakSelf = self;
  72             __weak CKKSKeychainView* weakCKKS = ckks;
  73             CKKSResultOperation* updateManifestOperation = [CKKSResultOperation operationWithBlock:^{
  74                 __strong __typeof(self) strongSelf = weakSelf;
  75                 __strong CKKSKeychainView* strongCKKS = weakCKKS;
  76                 __block NSError* error = nil;
  77                 if (!strongCKKS || !strongSelf) {
  78                     ckkserror("ckksincoming", strongCKKS, "update manifest operation fired for released object");
  79                     return;
  80                 }
  81
  82                 [strongCKKS dispatchSyncWithAccountKeys:^bool{
  83                     strongCKKS.latestManifest = [CKKSManifest latestTrustedManifestForZone:strongCKKS.zoneName error:&error];
  84                     if (error) {
  85                         strongSelf.error = error;
  86                         ckkserror("ckksincoming", strongCKKS, "failed to get latest manifest: %@", error);
  87                         return false;
  88                     }
  89                     else {
  90                         return true;
  91                     }
  92                 }];
  93             }];
  94             updateManifestOperation.name = @"update-manifest-operation";
  95
  96             [ckks scheduleOperation:updateManifestOperation];
  97             [self addSuccessDependency:updateManifestOperation];
  98         }
  99     }
 100     return self;
 101 }
 102
 103 - (bool)processNewCurrentItemPointers:(NSArray<CKKSCurrentItemPointer*>*)queueEntries withManifest:(CKKSManifest*)manifest egoManifest:(CKKSEgoManifest*)egoManifest
 104 {
 105     CKKSKeychainView* ckks = self.ckks;
 106
 107     NSError* error = nil;
 108     for(CKKSCurrentItemPointer* p in queueEntries) {
 109         @autoreleasepool {
 110             if ([CKKSManifest shouldSyncManifests]) {
 111                 if (![manifest validateCurrentItem:p withError:&error]) {
 112                     ckkserror("ckksincoming", ckks, "Unable to validate current item pointer (%@) against manifest (%@)", p, manifest);
 113                     if ([CKKSManifest shouldEnforceManifests]) {
 114                         return false;
 115                     }
 116                 }
 117             }
 118
 119             p.state = SecCKKSProcessedStateLocal;
 120
 121             [p saveToDatabase:&error];
 122             ckksnotice("ckkspointer", ckks, "Saving new current item pointer: %@", p);
 123             if(error) {
 124                 ckkserror("ckksincoming", ckks, "Error saving new current item pointer: %@ %@", error, p);
 125             }
 126
 127             // Schedule a view change notification
 128             [ckks.notifyViewChangedScheduler trigger];
 129         }
 130     }
 131
 132     if(queueEntries.count > 0) {
 133         // Schedule a view change notification
 134         [ckks.notifyViewChangedScheduler trigger];
 135     }
 136
 137     return (error == nil);
 138 }
 139
 140 - (bool)processQueueEntries:(NSArray<CKKSIncomingQueueEntry*>*)queueEntries withManifest:(CKKSManifest*)manifest egoManifest:(CKKSEgoManifest*)egoManifest
 141 {
 142     CKKSKeychainView* ckks = self.ckks;
 143
 144     NSMutableArray* newOrChangedRecords = [[NSMutableArray alloc] init];
 145     NSMutableArray* deletedRecordIDs = [[NSMutableArray alloc] init];
 146
 147     for(id entry in queueEntries) {
 148         @autoreleasepool {
 149             if(self.cancelled) {
 150                 ckksnotice("ckksincoming", ckks, "CKKSIncomingQueueOperation cancelled, quitting");
 151                 return false;
 152             }
 153
 154             NSError* error = nil;
 155
 156             CKKSIncomingQueueEntry* iqe = (CKKSIncomingQueueEntry*) entry;
 157             ckksnotice("ckksincoming", ckks, "ready to process an incoming queue entry: %@ %@ %@", iqe, iqe.uuid, iqe.action);
 158
 159             // Note that we currently unencrypt the item before deleting it, instead of just deleting it
 160             // This finds the class, which is necessary for the deletion process. We could just try to delete
 161             // across all classes, though...
 162             NSMutableDictionary* attributes = [[CKKSItemEncrypter decryptItemToDictionary: iqe.item error:&error] mutableCopy];
 163             if(!attributes || error) {
 164                 if([ckks.lockStateTracker isLockedError:error]) {
 165                     NSError* localerror = nil;
 166                     ckkserror("ckksincoming", ckks, "Keychain is locked; can't decrypt IQE %@", iqe);
 167                     CKKSKey* key = [CKKSKey tryFromDatabase:iqe.item.parentKeyUUID zoneID:ckks.zoneID error:&localerror];
 168                     if(localerror || ([key.keyclass isEqualToString:SecCKKSKeyClassA] && self.errorOnClassAFailure)) {
 169                         self.error = error;
 170                     }
 171
 172                     // If this isn't an error, make sure it gets processed later.
 173                     if([key.keyclass isEqualToString:SecCKKSKeyClassA] && !self.errorOnClassAFailure) {
 174                         self.pendingClassAEntries = true;
 175                     }
 176
 177                 } else if ([error.domain isEqualToString:@"securityd"] && error.code == errSecItemNotFound) {
 178                     ckkserror("ckksincoming", ckks, "Coudn't find key in keychain; will attempt to poke key hierarchy: %@", error)
 179                     self.missingKey = true;
 180
 181                 } else {
 182                     ckkserror("ckksincoming", ckks, "Couldn't decrypt IQE %@ for some reason: %@", iqe, error);
 183                     self.error = error;
 184                 }
 185                 self.errorItemsProcessed += 1;
 186                 continue;
 187             }
 188
 189             // Add the UUID (which isn't stored encrypted)
 190             [attributes setValue: iqe.item.uuid forKey: (__bridge NSString*) kSecAttrUUID];
 191
 192             // Add the PCS plaintext fields, if they exist
 193             if(iqe.item.plaintextPCSServiceIdentifier) {
 194                 [attributes setValue: iqe.item.plaintextPCSServiceIdentifier forKey: (__bridge NSString*) kSecAttrPCSPlaintextServiceIdentifier];
 195             }
 196             if(iqe.item.plaintextPCSPublicKey) {
 197                 [attributes setValue: iqe.item.plaintextPCSPublicKey forKey: (__bridge NSString*) kSecAttrPCSPlaintextPublicKey];
 198             }
 199             if(iqe.item.plaintextPCSPublicIdentity) {
 200                 [attributes setValue: iqe.item.plaintextPCSPublicIdentity forKey: (__bridge NSString*) kSecAttrPCSPlaintextPublicIdentity];
 201             }
 202
 203             // This item is also synchronizable (by definition)
 204             [attributes setValue: @(YES) forKey: (__bridge NSString*) kSecAttrSynchronizable];
 205
 206             NSString* classStr = [attributes objectForKey: (__bridge NSString*) kSecClass];
 207             if(![classStr isKindOfClass: [NSString class]]) {
 208                 self.error = [NSError errorWithDomain:@"securityd"
 209                                                  code:errSecInternalError
 210                                              userInfo:@{NSLocalizedDescriptionKey : [NSString stringWithFormat:@"Item did not have a reasonable class: %@", classStr]}];
 211                 ckkserror("ckksincoming", ckks, "Synced item seems wrong: %@", self.error);
 212                 self.errorItemsProcessed += 1;
 213                 continue;
 214             }
 215
 216             const SecDbClass * classP = !classStr ? NULL : kc_class_with_name((__bridge CFStringRef) classStr);
 217
 218             if(!classP) {
 219                 ckkserror("ckksincoming", ckks, "unknown class in object: %@ %@", classStr, iqe);
 220                 iqe.state = SecCKKSStateError;
 221                 [iqe saveToDatabase:&error];
 222                 if(error) {
 223                     ckkserror("ckksincoming", ckks, "Couldn't save errored IQE to database: %@", error);
 224                     self.error = error;
 225                 }
 226                 self.errorItemsProcessed += 1;
 227                 continue;
 228             }
 229
 230             if([iqe.action isEqualToString: SecCKKSActionAdd] || [iqe.action isEqualToString: SecCKKSActionModify]) {
 231                 BOOL requireManifestValidation = [CKKSManifest shouldEnforceManifests];
 232                 BOOL manifestValidatesItem = [manifest validateItem:iqe.item withError:&error];
 233
 234                 if (!requireManifestValidation || manifestValidatesItem) {
 235                     [self _onqueueHandleIQEChange: iqe attributes:attributes class:classP];
 236                     [newOrChangedRecords addObject:[iqe.item CKRecordWithZoneID:ckks.zoneID]];
 237                 }
 238                 else {
 239                     ckkserror("ckksincoming", ckks, "could not validate incoming item against manifest with error: %@", error);
 240                     if (![self _onqueueUpdateIQE:iqe withState:SecCKKSStateUnauthenticated error:&error]) {
 241                         ckkserror("ckksincoming", ckks, "failed to save incoming item back to database in unauthenticated state with error: %@", error);
 242                         return false;
 243                     }
 244                     self.errorItemsProcessed += 1;
 245                     continue;
 246                 }
 247             } else if ([iqe.action isEqualToString: SecCKKSActionDelete]) {
 248                 BOOL requireManifestValidation = [CKKSManifest shouldEnforceManifests];
 249                 BOOL manifestValidatesDelete = ![manifest itemUUIDExistsInManifest:iqe.uuid];
 250
 251                 if (!requireManifestValidation || manifestValidatesDelete) {
 252                     // if the item does not exist in the latest manifest, we're good to delete it
 253                     [self _onqueueHandleIQEDelete: iqe class:classP];
 254                     [deletedRecordIDs addObject:[[CKRecordID alloc] initWithRecordName:iqe.uuid zoneID:ckks.zoneID]];
 255                 }
 256                 else {
 257                     // if the item DOES exist in the manifest, we can't trust the deletion
 258                     ckkserror("ckksincoming", ckks, "could not validate incoming item deletion against manifest");
 259                     if (![self _onqueueUpdateIQE:iqe withState:SecCKKSStateUnauthenticated error:&error]) {
 260                         ckkserror("ckksincoming", ckks, "failed to save incoming item deletion back to database in unauthenticated state with error: %@", error);
 261
 262                         self.errorItemsProcessed += 1;
 263                         return false;
 264                     }
 265                 }
 266             }
 267         }
 268     }
 269
 270     if(newOrChangedRecords.count > 0 || deletedRecordIDs > 0) {
 271         // Schedule a view change notification
 272         [ckks.notifyViewChangedScheduler trigger];
 273     }
 274
 275     if(self.missingKey) {
 276         [ckks.pokeKeyStateMachineScheduler trigger];
 277     }
 278
 279     if ([CKKSManifest shouldSyncManifests]) {
 280         [egoManifest updateWithNewOrChangedRecords:newOrChangedRecords deletedRecordIDs:deletedRecordIDs];
 281     }
 282     return true;
 283 }
 284
 285 - (bool)_onqueueUpdateIQE:(CKKSIncomingQueueEntry*)iqe withState:(NSString*)newState error:(NSError**)error
 286 {
 287     if (![iqe.state isEqualToString:newState]) {
 288         NSMutableDictionary* oldWhereClause = iqe.whereClauseToFindSelf.mutableCopy;
 289         oldWhereClause[@"state"] = iqe.state;
 290         iqe.state = newState;
 291         if ([iqe saveToDatabase:error]) {
 292             if (![CKKSSQLDatabaseObject deleteFromTable:[iqe.class sqlTable] where:oldWhereClause connection:NULL error:error]) {
 293                 return false;
 294             }
 295         }
 296         else {
 297             return false;
 298         }
 299     }
 300
 301     return true;
 302 }
 303
 304 - (void) main {
 305     // Synchronous, on some thread. Get back on the CKKS queue for thread-safety.
 306     CKKSKeychainView* ckks = self.ckks;
 307     if(!ckks) {
 308         ckkserror("ckksincoming", ckks, "no CKKS object");
 309         return;
 310     }
 311
 312     __weak __typeof(self) weakSelf = self;
 313     self.completionBlock = ^(void) {
 314         __strong __typeof(self) strongSelf = weakSelf;
 315         if (!strongSelf) {
 316             ckkserror("ckksincoming", ckks, "received callback for released object");
 317             return;
 318         }
 319
 320         CKKSAnalytics* logger = [CKKSAnalytics logger];
 321
 322         if (!strongSelf.error) {
 323             [logger logSuccessForEvent:CKKSEventProcessIncomingQueueClassC inView:ckks];
 324             if (!strongSelf.pendingClassAEntries) {
 325                 [logger logSuccessForEvent:CKKSEventProcessIncomingQueueClassA inView:ckks];
 326             }
 327         } else {
 328             [logger logRecoverableError:strongSelf.error
 329                                forEvent:strongSelf.errorOnClassAFailure ? CKKSEventProcessIncomingQueueClassA : CKKSEventProcessIncomingQueueClassC
 330                                  inView:ckks
 331                          withAttributes:NULL];
 332         }
 333     };
 334
 335     __block bool errored = false;
 336     [ckks dispatchSync: ^bool{
 337         if(self.cancelled) {
 338             ckksnotice("ckksincoming", ckks, "CKKSIncomingQueueOperation cancelled, quitting");
 339             return false;
 340         }
 341         ckks.lastIncomingQueueOperation = self;
 342
 343         ckksnotice("ckksincoming", ckks, "Processing incoming queue");
 344
 345         if ([CKKSManifest shouldSyncManifests]) {
 346             if (!ckks.latestManifest) {
 347                 // Until we can make manifests in our unit tests, we can't abort here
 348                 ckkserror("ckksincoming", ckks, "no manifest in ckks");
 349             }
 350             if (!ckks.egoManifest) {
 351                 ckkserror("ckksincoming", ckks, "no ego manifest in ckks");
 352             }
 353         }
 354
 355         bool ok = true; // Should commit transaction?
 356         __block NSError* error = nil;
 357
 358         if ([CKKSManifest shouldSyncManifests]) {
 359             NSInteger unauthenticatedItemCount = [CKKSIncomingQueueEntry countByState:SecCKKSStateUnauthenticated zone:ckks.zoneID error:&error];
 360             if (error || unauthenticatedItemCount < 0) {
 361                 ckkserror("ckksincoming", ckks, "Error fetching incoming queue state counts: %@", error);
 362                 self.error = error;
 363                 return false;
 364             }
 365
 366             // take any existing unauthenticated entries and put them back in the new state
 367             NSArray<CKKSIncomingQueueEntry*>* unauthenticatedEntries = nil;
 368             NSString* lastMaxUUID = nil;
 369             NSInteger numEntriesProcessed = 0;
 370             while (numEntriesProcessed < unauthenticatedItemCount &&  (unauthenticatedEntries == nil || unauthenticatedEntries.count == SecCKKSIncomingQueueItemsAtOnce)) {
 371                 if(self.cancelled) {
 372                     ckksnotice("ckksincoming", ckks, "CKKSIncomingQueueOperation cancelled, quitting");
 373                     return false;
 374                 }
 375
 376                 unauthenticatedEntries = [CKKSIncomingQueueEntry fetch:SecCKKSIncomingQueueItemsAtOnce
 377                                                         startingAtUUID:lastMaxUUID
 378                                                                  state:SecCKKSStateUnauthenticated
 379                                                                 zoneID:ckks.zoneID
 380                                                                  error:&error];
 381                 if (error) {
 382                     ckkserror("ckksincoming", ckks, "Error fetching unauthenticated queue records: %@", error);
 383                     self.error = error;
 384                     return false;
 385                 }
 386
 387                 if (unauthenticatedEntries.count == 0) {
 388                     ckksinfo("ckksincoming", ckks, "No unauthenticated entries in incoming queue to process");
 389                     break;
 390                 }
 391
 392                 for (CKKSIncomingQueueEntry* unauthenticatedEntry in unauthenticatedEntries) {
 393                     if (![self _onqueueUpdateIQE:unauthenticatedEntry withState:SecCKKSStateNew error:&error]) {
 394                         ckkserror("ckksincoming", ckks, "Error saving unauthenticated entry back to new state: %@", error);
 395                         self.error = error;
 396                         return false;
 397                     }
 398
 399                     lastMaxUUID = ([lastMaxUUID compare:unauthenticatedEntry.uuid] == NSOrderedDescending) ? lastMaxUUID : unauthenticatedEntry.uuid;
 400                 }
 401             }
 402         }
 403         errored = !ok;
 404         return ok;
 405     }];
 406
 407     if(errored) {
 408         ckksnotice("ckksincoming", ckks, "Early-exiting from IncomingQueueOperation");
 409         return;
 410     }
 411
 412     // Now for the tricky bit: take and drop the account queue for each batch of queue entries
 413     // This is for peak memory concerns, but also to allow keychain API clients to make changes while we're processing many items
 414     // Note that IncomingQueueOperations are no longer transactional: they can partially succeed. This might make them harder to reason about.
 415     __block NSUInteger lastCount = SecCKKSIncomingQueueItemsAtOnce;
 416     __block NSString* lastMaxUUID = nil;
 417
 418     while(lastCount == SecCKKSIncomingQueueItemsAtOnce) {
 419         [ckks dispatchSync: ^bool{
 420             NSArray<CKKSIncomingQueueEntry*> * queueEntries = nil;
 421             if(self.cancelled) {
 422                 ckksnotice("ckksincoming", ckks, "CKKSIncomingQueueOperation cancelled, quitting");
 423                 errored = true;
 424                 return false;
 425             }
 426
 427             NSError* error = nil;
 428
 429             queueEntries = [CKKSIncomingQueueEntry fetch: SecCKKSIncomingQueueItemsAtOnce
 430                                           startingAtUUID:lastMaxUUID
 431                                                    state:SecCKKSStateNew
 432                                                   zoneID:ckks.zoneID
 433                                                    error: &error];
 434
 435             if(error != nil) {
 436                 ckkserror("ckksincoming", ckks, "Error fetching incoming queue records: %@", error);
 437                 self.error = error;
 438                 errored = true;
 439                 return false;
 440             }
 441
 442             lastCount = queueEntries.count;
 443
 444             if([queueEntries count] == 0) {
 445                 // Nothing to do! exit.
 446                 ckksnotice("ckksincoming", ckks, "Nothing in incoming queue to process");
 447                 return true;
 448             }
 449
 450             [CKKSPowerCollection CKKSPowerEvent:kCKKSPowerEventOutgoingQueue zone:ckks.zoneName count:[queueEntries count]];
 451
 452             if (![self processQueueEntries:queueEntries withManifest:ckks.latestManifest egoManifest:ckks.egoManifest]) {
 453                 ckksnotice("ckksincoming", ckks, "processQueueEntries didn't complete successfully");
 454                 errored = true;
 455                 return false;
 456             }
 457
 458             // Find the highest UUID for the next fetch.
 459             for(CKKSIncomingQueueEntry* iqe in queueEntries) {
 460                 lastMaxUUID = ([lastMaxUUID compare:iqe.uuid] == NSOrderedDescending) ? lastMaxUUID : iqe.uuid;
 461             };
 462             return true;
 463         }];
 464
 465         if(errored) {
 466             ckksnotice("ckksincoming", ckks, "Early-exiting from IncomingQueueOperation");
 467             return;
 468         }
 469     }
 470
 471     ckksnotice("ckksincoming", ckks, "Processed %lu items in incoming queue (%lu errors)", (unsigned long)self.successfulItemsProcessed, (unsigned long)self.errorItemsProcessed);
 472
 473     [ckks dispatchSync: ^bool{
 474         NSError* error = nil;
 475
 476         NSArray<CKKSCurrentItemPointer*>* newCIPs = [CKKSCurrentItemPointer remoteItemPointers:ckks.zoneID error:&error];
 477         if(error || !newCIPs) {
 478             ckkserror("ckksincoming", ckks, "Could not load remote item pointers: %@", error);
 479         } else {
 480             if (![self processNewCurrentItemPointers:newCIPs withManifest:ckks.latestManifest egoManifest:ckks.egoManifest]) {
 481                 return false;
 482             }
 483             ckksnotice("ckksincoming", ckks, "Processed %lu items in CIP queue", (unsigned long)newCIPs.count);
 484         }
 485
 486         if(self.newOutgoingEntries) {
 487             // No operation group
 488             [ckks processOutgoingQueue:nil];
 489         }
 490
 491         if(self.pendingClassAEntries) {
 492             [self.ckks processIncomingQueueAfterNextUnlock];
 493         }
 494
 495         return true;
 496     }];
 497 }
 498
 499 - (void)_onqueueHandleIQEChange: (CKKSIncomingQueueEntry*) iqe attributes:(NSDictionary*)attributes class:(const SecDbClass *)classP {
 500     CKKSKeychainView* ckks = self.ckks;
 501     if(!ckks) {
 502         ckkserror("ckksincoming", ckks, "no CKKS object");
 503         return;
 504     }
 505
 506     dispatch_assert_queue(ckks.queue);
 507
 508     bool ok = false;
 509     __block CFErrorRef cferror = NULL;
 510     __block NSError* error = NULL;
 511
 512     SecDbItemRef item = SecDbItemCreateWithAttributes(NULL, classP, (__bridge CFDictionaryRef) attributes, KEYBAG_DEVICE, &cferror);
 513
 514     __block NSDate* moddate = (__bridge NSDate*) CFDictionaryGetValue(item->attributes, kSecAttrModificationDate);
 515
 516     ok = kc_with_dbt(true, &cferror, ^(SecDbConnectionRef dbt){
 517         bool replaceok = SecDbItemInsertOrReplace(item, dbt, &cferror, ^(SecDbItemRef olditem, SecDbItemRef *replace) {
 518             // If the UUIDs do not match, then select the item with the 'lower' UUID, and tell CKKS to
 519             //   delete the item with the 'higher' UUID.
 520             // Otherwise, the cloud wins.
 521
 522             SecADAddValueForScalarKey((__bridge CFStringRef) SecCKKSAggdPrimaryKeyConflict,1);
 523
 524             // Note that SecDbItemInsertOrReplace CFReleases any replace pointer it's given, so, be careful
 525
 526             if(!CFDictionaryContainsKey(olditem->attributes, kSecAttrUUID)) {
 527                 // No UUID -> no good.
 528                 ckksnotice("ckksincoming", ckks, "Replacing item (it doesn't have a UUID) for %@", iqe.uuid);
 529                 if(replace) {
 530                     *replace = CFRetainSafe(item);
 531                 }
 532                 return;
 533             }
 534
 535             CFStringRef itemUUID    = CFDictionaryGetValue(item->attributes,    kSecAttrUUID);
 536             CFStringRef olditemUUID = CFDictionaryGetValue(olditem->attributes, kSecAttrUUID);
 537
 538             CFComparisonResult compare = CFStringCompare(itemUUID, olditemUUID, 0);
 539             CKKSOutgoingQueueEntry* oqe = nil;
 540             switch(compare) {
 541                 case kCFCompareLessThan:
 542                     // item wins; delete olditem
 543                     ckksnotice("ckksincoming", ckks, "Primary key conflict; replacing %@ with CK item %@", olditem, item);
 544                     if(replace) {
 545                         *replace = CFRetainSafe(item);
 546                         moddate = (__bridge NSDate*) CFDictionaryGetValue(item->attributes, kSecAttrModificationDate);
 547                     }
 548
 549                     oqe = [CKKSOutgoingQueueEntry withItem:olditem action:SecCKKSActionDelete ckks:ckks error:&error];
 550                     [oqe saveToDatabase: &error];
 551                     self.newOutgoingEntries = true;
 552                     break;
 553                 case kCFCompareGreaterThan:
 554                     // olditem wins; don't change olditem; delete item
 555                     ckksnotice("ckksincoming", ckks, "Primary key conflict; dropping CK item %@", item);
 556
 557                     oqe = [CKKSOutgoingQueueEntry withItem:item action:SecCKKSActionDelete ckks:ckks error:&error];
 558                     [oqe saveToDatabase: &error];
 559                     self.newOutgoingEntries = true;
 560                     moddate = nil;
 561                     break;
 562
 563                 case kCFCompareEqualTo:
 564                     // remote item wins; this is the normal update case
 565                     ckksnotice("ckksincoming", ckks, "Primary key conflict; replacing %@ with CK item %@", olditem, item);
 566                     if(replace) {
 567                         *replace = CFRetainSafe(item);
 568                         moddate = (__bridge NSDate*) CFDictionaryGetValue(item->attributes, kSecAttrModificationDate);
 569                     }
 570                     break;
 571             }
 572         });
 573
 574         // SecDbItemInsertOrReplace returns an error even when it succeeds.
 575         if(!replaceok && SecErrorIsSqliteDuplicateItemError(cferror)) {
 576             CFReleaseNull(cferror);
 577             replaceok = true;
 578         }
 579         return replaceok;
 580     });
 581
 582     CFReleaseNull(item);
 583
 584     if(cferror) {
 585         ckkserror("ckksincoming", ckks, "couldn't process item from IncomingQueue: %@", cferror);
 586         SecTranslateError(&error, cferror);
 587         self.error = error;
 588
 589         iqe.state = SecCKKSStateError;
 590         [iqe saveToDatabase:&error];
 591         if(error) {
 592             ckkserror("ckksincoming", ckks, "Couldn't save errored IQE to database: %@", error);
 593             self.error = error;
 594         }
 595         return;
 596     }
 597
 598     if(error) {
 599         ckkserror("ckksincoming", ckks, "Couldn't handle IQE, but why?: %@", error);
 600         self.error = error;
 601         return;
 602     }
 603
 604     if(ok) {
 605         ckksinfo("ckksincoming", ckks, "Correctly processed an IQE; deleting");
 606         [iqe deleteFromDatabase: &error];
 607
 608         if(error) {
 609             ckkserror("ckksincoming", ckks, "couldn't delete CKKSIncomingQueueEntry: %@", error);
 610             self.error = error;
 611             self.errorItemsProcessed += 1;
 612         } else {
 613             self.successfulItemsProcessed += 1;
 614         }
 615
 616         if(moddate) {
 617             // Log the number of seconds it took to propagate this change
 618             uint64_t secondsDelay = (uint64_t) ([[NSDate date] timeIntervalSinceDate:moddate]);
 619             SecADClientPushValueForDistributionKey((__bridge CFStringRef) SecCKKSAggdPropagationDelay, secondsDelay);
 620         }
 621
 622     } else {
 623         ckksnotice("ckksincoming", ckks, "IQE not correctly processed, but why? %@ %@", error, cferror);
 624         self.error = error;
 625
 626         iqe.state = SecCKKSStateError;
 627         [iqe saveToDatabase:&error];
 628         if(error) {
 629             ckkserror("ckksincoming", ckks, "Couldn't save errored IQE to database: %@", error);
 630             self.error = error;
 631         }
 632
 633         self.errorItemsProcessed += 1;
 634     }
 635 }
 636
 637 - (void)_onqueueHandleIQEDelete: (CKKSIncomingQueueEntry*) iqe class:(const SecDbClass *)classP {
 638     CKKSKeychainView* ckks = self.ckks;
 639     if(!ckks) {
 640         ckkserror("ckksincoming", ckks, "no CKKS object");
 641         return;
 642     }
 643
 644     dispatch_assert_queue(ckks.queue);
 645
 646     bool ok = false;
 647     __block CFErrorRef cferror = NULL;
 648     NSError* error = NULL;
 649     NSDictionary* queryAttributes = @{(__bridge NSString*) kSecClass: (__bridge NSString*) classP->name,
 650                                       (__bridge NSString*) kSecAttrUUID: iqe.uuid,
 651                                       (__bridge NSString*) kSecAttrSyncViewHint: ckks.zoneID.zoneName,
 652                                       (__bridge NSString*) kSecAttrSynchronizable: @(YES)};
 653     ckksnotice("ckksincoming", ckks, "trying to delete with query: %@", queryAttributes);
 654     Query *q = query_create_with_limit( (__bridge CFDictionaryRef) queryAttributes, NULL, kSecMatchUnlimited, &cferror);
 655
 656
 657     if(cferror) {
 658         ckkserror("ckksincoming", ckks, "couldn't create query: %@", cferror);
 659         SecTranslateError(&error, cferror);
 660         self.error = error;
 661         return;
 662     }
 663
 664     ok = kc_with_dbt(true, &cferror, ^(SecDbConnectionRef dbt) {
 665         return s3dl_query_delete(dbt, q, NULL, &cferror);
 666     });
 667
 668     if(cferror) {
 669         if(CFErrorGetCode(cferror) == errSecItemNotFound) {
 670             ckkserror("ckksincoming", ckks, "couldn't delete item (as it's already gone); this is okay: %@", cferror);
 671             ok = true;
 672             CFReleaseNull(cferror);
 673         } else {
 674             ckkserror("ckksincoming", ckks, "couldn't delete item: %@", cferror);
 675             SecTranslateError(&error, cferror);
 676             self.error = error;
 677             query_destroy(q, NULL);
 678             return;
 679         }
 680     }
 681
 682
 683     ok = query_notify_and_destroy(q, ok, &cferror);
 684
 685     if(cferror) {
 686         ckkserror("ckksincoming", ckks, "couldn't delete query: %@", cferror);
 687         SecTranslateError(&error, cferror);
 688         self.error = error;
 689         return;
 690     }
 691
 692     if(ok) {
 693         ckksnotice("ckksincoming", ckks, "Correctly processed an IQE; deleting");
 694         [iqe deleteFromDatabase: &error];
 695
 696         if(error) {
 697             ckkserror("ckksincoming", ckks, "couldn't delete CKKSIncomingQueueEntry: %@", error);
 698             self.error = error;
 699             self.errorItemsProcessed += 1;
 700         } else {
 701             self.successfulItemsProcessed += 1;
 702         }
 703     } else {
 704         ckkserror("ckksincoming", ckks, "IQE not correctly processed, but why? %@ %@", error, cferror);
 705         self.error = error;
 706         self.errorItemsProcessed += 1;
 707     }
 708 }
 709
 710 @end;
 711
 712 #endif