OSX/sec/SOSCircle/SecureObjectSync/SOSControlServer.m

   1 #import <Foundation/Foundation.h>
   2 #import <Foundation/NSXPCConnection_Private.h>
   3 #import <Security/SecEntitlements.h>
   4 #import <ipc/securityd_client.h>
   5 #import "SOSAccount.h"
   6 #import "SOSControlHelper.h"
   7 #import "SOSControlServer.h"
   8
   9 @interface SOSControlServer : NSObject <NSXPCListenerDelegate>
  10 @end
  11
  12 @interface SOSClient : NSObject <SOSControlProtocol>
  13 @property (weak) NSXPCConnection * connection;
  14 @property (strong) SOSAccount * account;
  15
  16 - (instancetype)initWithConnection:(NSXPCConnection *)connection account:(SOSAccount *)account;
  17 @end
  18
  19 @implementation SOSControlServer
  20
  21 - (BOOL)listener:(__unused NSXPCListener *)listener shouldAcceptNewConnection:(NSXPCConnection *)newConnection
  22 {
  23     NSNumber *num = [newConnection valueForEntitlement:(__bridge NSString *)kSecEntitlementKeychainCloudCircle];
  24     if (![num isKindOfClass:[NSNumber class]] || ![num boolValue]) {
  25         secerror("sos: Client pid: %d doesn't have entitlement: %@",
  26                 [newConnection processIdentifier], kSecEntitlementKeychainCloudCircle);
  27         return NO;
  28     }
  29
  30
  31     SOSClient *sosClient = [[SOSClient alloc] initWithConnection:newConnection account:(__bridge SOSAccount *)SOSKeychainAccountGetSharedAccount()];
  32
  33     newConnection.exportedInterface = [NSXPCInterface interfaceWithProtocol:@protocol(SOSControlProtocol)];
  34     _SOSControlSetupInterface(newConnection.exportedInterface);
  35     newConnection.exportedObject = sosClient;
  36
  37     [newConnection resume];
  38
  39     return YES;
  40 }
  41
  42 @end
  43
  44 @implementation SOSClient
  45
  46 @synthesize account = _account;
  47 @synthesize connection = _connection;
  48
  49 - (instancetype)initWithConnection:(NSXPCConnection *)connection account:(SOSAccount *)account
  50 {
  51     if ((self = [super init])) {
  52         _connection = connection;
  53         _account = account;
  54     }
  55     return self;
  56 }
  57
  58 - (bool)checkEntitlement:(NSString *)entitlement
  59 {
  60     NSXPCConnection *strongConnection = _connection;
  61
  62     NSNumber *num = [strongConnection valueForEntitlement:entitlement];
  63     if (![num isKindOfClass:[NSNumber class]] || ![num boolValue]) {
  64         secerror("sos: Client pid: %d doesn't have entitlement: %@",
  65                 [strongConnection processIdentifier], entitlement);
  66         return false;
  67     }
  68     return true;
  69 }
  70
  71 - (void)userPublicKey:(void ((^))(BOOL trusted, NSData *spki, NSError *error))reply
  72 {
  73     [self.account userPublicKey:reply];
  74 }
  75
  76 - (void)kvsPerformanceCounters:(void(^)(NSDictionary <NSString *, NSNumber *> *))reply
  77 {
  78     [self.account kvsPerformanceCounters:reply];
  79 }
  80
  81 - (void)rateLimitingPerformanceCounters:(void(^)(NSDictionary <NSString *, NSString *> *))reply
  82 {
  83     [self.account rateLimitingPerformanceCounters:reply];
  84 }
  85
  86 - (void)stashedCredentialPublicKey:(void(^)(NSData *, NSError *error))reply
  87 {
  88     [self.account stashedCredentialPublicKey:reply];
  89 }
  90
  91 - (void)assertStashedAccountCredential:(void(^)(BOOL result, NSError *error))reply
  92 {
  93     [self.account assertStashedAccountCredential:reply];
  94 }
  95
  96 - (void)validatedStashedAccountCredential:(void(^)(NSData *credential, NSError *error))complete
  97 {
  98     [self.account validatedStashedAccountCredential:complete];
  99 }
 100
 101 - (void)stashAccountCredential:(NSData *)credential complete:(void(^)(bool success, NSError *error))complete
 102 {
 103     [self.account stashAccountCredential:credential complete:complete];
 104 }
 105
 106 - (void)myPeerInfo:(void (^)(NSData *, NSError *))complete
 107 {
 108     [self.account myPeerInfo:complete];
 109 }
 110
 111 - (void)circleJoiningBlob:(NSData *)applicant complete:(void (^)(NSData *blob, NSError *))complete
 112 {
 113     [self.account circleJoiningBlob:applicant complete:complete];
 114 }
 115
 116 - (void)joinCircleWithBlob:(NSData *)blob version:(PiggyBackProtocolVersion)version complete:(void (^)(bool success, NSError *))complete
 117 {
 118     [self.account joinCircleWithBlob:blob version:version complete:complete];
 119 }
 120
 121 - (void)initialSyncCredentials:(uint32_t)flags complete:(void (^)(NSArray *, NSError *))complete
 122 {
 123     if (![self checkEntitlement:(__bridge NSString *)kSecEntitlementKeychainInitialSync]) {
 124         complete(@[], [NSError errorWithDomain:(__bridge NSString *)kSOSErrorDomain code:kSOSEntitlementMissing userInfo:NULL]);
 125         return;
 126     }
 127
 128     [self.account initialSyncCredentials:flags complete:complete];
 129 }
 130
 131 - (void)importInitialSyncCredentials:(NSArray *)items complete:(void (^)(bool success, NSError *))complete
 132 {
 133     if (![self checkEntitlement:(__bridge NSString *)kSecEntitlementKeychainInitialSync]) {
 134         complete(false, [NSError errorWithDomain:(__bridge NSString *)kSOSErrorDomain code:kSOSEntitlementMissing userInfo:NULL]);
 135         return;
 136     }
 137
 138     [self.account importInitialSyncCredentials:items complete:complete];
 139 }
 140
 141 - (void)triggerSync:(NSArray <NSString *> *)peers complete:(void(^)(bool success, NSError *))complete
 142 {
 143     if (![self checkEntitlement:(__bridge NSString *)kSecEntitlementKeychainCloudCircle]) {
 144         complete(false, [NSError errorWithDomain:(__bridge NSString *)kSOSErrorDomain code:kSOSEntitlementMissing userInfo:NULL]);
 145         return;
 146     }
 147
 148     [self.account triggerSync:peers complete:complete];
 149 }
 150
 151 - (void)getWatchdogParameters:(void (^)(NSDictionary* parameters, NSError* error))complete
 152 {
 153     [self.account getWatchdogParameters:complete];
 154 }
 155
 156 - (void)setWatchdogParmeters:(NSDictionary*)parameters complete:(void (^)(NSError* error))complete
 157 {
 158     [self.account setWatchdogParmeters:parameters complete:complete];
 159 }
 160
 161 @end
 162
 163 void
 164 SOSControlServerInitialize(void)
 165 {
 166     static dispatch_once_t once;
 167     static SOSControlServer *server;
 168     static NSXPCListener *listener;
 169
 170     dispatch_once(&once, ^{
 171         @autoreleasepool {
 172             server = [SOSControlServer new];
 173
 174             listener = [[NSXPCListener alloc] initWithMachServiceName:@(kSecuritydSOSServiceName)];
 175             listener.delegate = server;
 176             [listener resume];
 177         }
 178     });
 179 }