keychain/SecureObjectSync/SOSAccountUpdate.m

   1 //
   2 //  SOSAccountUpdate.c
   3 //  sec
   4 //
   5
   6 #include "SOSAccountPriv.h"
   7 #include "SOSAccountLog.h"
   8
   9 #include "keychain/SecureObjectSync/SOSTransportCircleKVS.h"
  10 #include "keychain/SecureObjectSync/SOSTransport.h"
  11 #include <Security/SecureObjectSync/SOSViews.h>
  12 #include "keychain/SecureObjectSync/SOSPeerInfoCollections.h"
  13 #include "keychain/SecureObjectSync/SOSPeerInfoPriv.h"
  14 #include "keychain/SecureObjectSync/SOSPeerInfoV2.h"
  15 #include "keychain/SecureObjectSync/SOSPeerInfoDER.h"
  16 #include <Security/SecureObjectSync/SOSBackupSliceKeyBag.h>
  17 #import "keychain/SecureObjectSync/SOSAccountGhost.h"
  18
  19 #import "keychain/SecureObjectSync/SOSAccountTrust.h"
  20 #import "keychain/SecureObjectSync/SOSAccountTrustClassic+Circle.h"
  21 #import "keychain/SecureObjectSync/SOSAccountTrustClassic+Expansion.h"
  22
  23 static void DifferenceAndCall(CFSetRef old_members, CFSetRef new_members, void (^updatedCircle)(CFSetRef additions, CFSetRef removals))
  24 {
  25     CFMutableSetRef additions = CFSetCreateMutableCopy(kCFAllocatorDefault, 0, new_members);
  26     CFMutableSetRef removals = CFSetCreateMutableCopy(kCFAllocatorDefault, 0, old_members);
  27
  28
  29     CFSetForEach(old_members, ^(const void * value) {
  30         CFSetRemoveValue(additions, value);
  31     });
  32
  33     CFSetForEach(new_members, ^(const void * value) {
  34         CFSetRemoveValue(removals, value);
  35     });
  36
  37     updatedCircle(additions, removals);
  38
  39     CFReleaseSafe(additions);
  40     CFReleaseSafe(removals);
  41 }
  42 static CFMutableSetRef SOSAccountCopyIntersectedViews(CFSetRef peerViews, CFSetRef myViews) {
  43     __block CFMutableSetRef views = CFSetCreateMutable(NULL, 0, &kCFTypeSetCallBacks);
  44     if (peerViews && myViews) CFSetForEach(peerViews, ^(const void *view) {
  45         if (CFSetContainsValue(myViews, view)) {
  46             CFSetAddValue(views, view);
  47         }
  48     });
  49     return views;
  50 }
  51
  52 static inline bool isSyncing(SOSPeerInfoRef peer, SecKeyRef upub) {
  53     if(!SOSPeerInfoApplicationVerify(peer, upub, NULL)) return false;
  54     if(SOSPeerInfoIsRetirementTicket(peer)) return false;
  55     return true;
  56 }
  57
  58 static bool isBackupSOSRing(SOSRingRef ring)
  59 {
  60     return isSOSRing(ring) && (kSOSRingBackup == SOSRingGetType(ring));
  61 }
  62
  63 static void SOSAccountAppendPeerMetasForViewBackups(SOSAccount* account, CFSetRef views, CFMutableArrayRef appendTo)
  64 {
  65     CFMutableDictionaryRef ringToViewTable = NULL;
  66
  67     if([account getCircleStatus:NULL] != kSOSCCInCircle)
  68         return;
  69
  70     if(!(SOSAccountHasCompletedInitialSync(account))){
  71         secnotice("backup", "Haven't finished initial backup syncing, not registering backup metas with engine");
  72         return;
  73     }
  74     if(!SOSPeerInfoV2DictionaryHasData(account.peerInfo, sBackupKeyKey)){
  75         secnotice("backup", "No key to backup to, we don't enable individual view backups");
  76         return;
  77     }
  78     ringToViewTable = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
  79
  80     CFSetForEach(views, ^(const void *value) {
  81         CFStringRef viewName = value;
  82         if (isString(viewName) && !CFEqualSafe(viewName, kSOSViewKeychainV0)) {
  83             CFStringRef ringName = SOSBackupCopyRingNameForView(viewName);
  84             viewName = ringName;
  85             SOSRingRef ring = [account.trust copyRing:ringName err:NULL];
  86             if (ring && isBackupSOSRing(ring)) {
  87                 CFTypeRef currentValue = (CFTypeRef) CFDictionaryGetValue(ringToViewTable, ring);
  88
  89                 if (isSet(currentValue)) {
  90                     CFSetAddValue((CFMutableSetRef)currentValue, viewName);
  91                 } else {
  92                     CFMutableSetRef viewNameSet = CFSetCreateMutableForCFTypes(kCFAllocatorDefault);
  93                     CFSetAddValue(viewNameSet, viewName);
  94
  95                     CFDictionarySetValue(ringToViewTable, ring, viewNameSet);
  96                     CFReleaseNull(viewNameSet);
  97                 }
  98             } else {
  99                 secwarning("View '%@' not being backed up – ring %@:%@ not backup ring.", viewName, ringName, ring);
 100             }
 101             CFReleaseNull(ringName);
 102             CFReleaseNull(ring);
 103         }
 104     });
 105
 106     CFDictionaryForEach(ringToViewTable, ^(const void *key, const void *value) {
 107         SOSRingRef ring = (SOSRingRef) key;
 108         CFSetRef viewNames = asSet(value, NULL);
 109         if (isSOSRing(ring) && viewNames) {
 110             if (SOSAccountIntersectsWithOutstanding(account, viewNames)) {
 111                 CFStringSetPerformWithDescription(viewNames, ^(CFStringRef ringViews) {
 112                     secnotice("engine-notify", "Not ready, no peer meta: R: %@ Vs: %@", SOSRingGetName(ring), ringViews);
 113                 });
 114             } else {
 115                 bool meta_added = false;
 116                 CFErrorRef create_error = NULL;
 117                 SOSBackupSliceKeyBagRef key_bag = NULL;
 118                 SOSPeerMetaRef newMeta = NULL;
 119
 120                 CFDataRef ring_payload = SOSRingGetPayload(ring, NULL);
 121                 require_quiet(isData(ring_payload), skip);
 122
 123                 key_bag = SOSBackupSliceKeyBagCreateFromData(kCFAllocatorDefault, ring_payload, &create_error);
 124                 require_quiet(key_bag, skip);
 125
 126                 newMeta = SOSPeerMetaCreateWithComponents(SOSRingGetName(ring), viewNames, ring_payload);
 127                 require_quiet(SecAllocationError(newMeta, &create_error, CFSTR("Didn't make peer meta for: %@"), ring), skip);
 128                 CFArrayAppendValue(appendTo, newMeta);
 129
 130                 CFStringSetPerformWithDescription(viewNames, ^(CFStringRef ringViews) {
 131                     secnotice("engine-notify", "Backup peer meta: R: %@ Vs: %@ VD: %@", SOSRingGetName(ring), ringViews, ring_payload);
 132                 });
 133
 134                 meta_added = true;
 135
 136             skip:
 137                 if (!meta_added) {
 138                     CFStringSetPerformWithDescription(viewNames, ^(CFStringRef ringViews) {
 139                         secerror("Failed to register backup meta from %@ for views %@. Error (%@)", ring, ringViews, create_error);
 140                     });
 141                 }
 142                 CFReleaseNull(newMeta);
 143                 CFReleaseNull(key_bag);
 144                 CFReleaseNull(create_error);
 145             }
 146         }
 147     });
 148
 149     CFReleaseNull(ringToViewTable);
 150 }
 151
 152 bool SOSAccountSyncingV0(SOSAccount* account) {
 153     __block bool syncingV0 = false;
 154     SOSAccountForEachCirclePeerExceptMe(account, ^(SOSPeerInfoRef peer) {
 155         if (SOSPeerInfoIsEnabledView(peer, kSOSViewKeychainV0)) {
 156             syncingV0 = true;
 157         }
 158     });
 159
 160     return syncingV0;
 161 }
 162
 163 void SOSAccountNotifyEngines(SOSAccount* account)
 164 {
 165     dispatch_assert_queue(account.queue);
 166
 167     SOSAccountTrustClassic *trust = account.trust;
 168     SOSFullPeerInfoRef identity = trust.fullPeerInfo;
 169     SOSCircleRef circle = trust.trustedCircle;
 170
 171     SOSPeerInfoRef myPi = SOSFullPeerInfoGetPeerInfo(identity);
 172     CFStringRef myPi_id = SOSPeerInfoGetPeerID(myPi);
 173     CFMutableArrayRef syncing_peer_metas = NULL;
 174     CFMutableArrayRef zombie_peer_metas = NULL;
 175     CFErrorRef localError = NULL;
 176     SOSPeerMetaRef myMeta = NULL;
 177
 178     if (myPi_id && isSyncing(myPi, account.accountKey) && SOSCircleHasPeer(circle, myPi, NULL)) {
 179         CFMutableSetRef myViews = SOSPeerInfoCopyEnabledViews(myPi);
 180
 181         // We add V0 views to everyone if we see a V0 peer, or a peer with the view explicity enabled
 182         // V2 peers shouldn't be explicity enabling the uber V0 view, though the seeds did.
 183         __block bool addV0Views = SOSAccountSyncingV0(account);
 184
 185         syncing_peer_metas = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
 186         zombie_peer_metas = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
 187         SOSAccountForEachCirclePeerExceptMe(account, ^(SOSPeerInfoRef peer) {
 188             CFMutableArrayRef arrayToAddTo = isSyncing(peer, account.accountKey) ? syncing_peer_metas : zombie_peer_metas;
 189
 190             // Compute views each peer is in that we are also in ourselves
 191             CFMutableSetRef peerEnabledViews = SOSPeerInfoCopyEnabledViews(peer);
 192             CFMutableSetRef views = SOSAccountCopyIntersectedViews(peerEnabledViews, myViews);
 193             CFReleaseNull(peerEnabledViews);
 194
 195             if(addV0Views) {
 196                 CFSetAddValue(views, kSOSViewKeychainV0);
 197             }
 198
 199             CFStringSetPerformWithDescription(views, ^(CFStringRef viewsDescription) {
 200                 secnotice("engine-notify", "Meta: %@: %@", SOSPeerInfoGetPeerID(peer), viewsDescription);
 201             });
 202
 203             SOSPeerMetaRef peerMeta = SOSPeerMetaCreateWithComponents(SOSPeerInfoGetPeerID(peer), views, NULL);
 204             CFReleaseNull(views);
 205
 206             CFArrayAppendValue(arrayToAddTo, peerMeta);
 207             CFReleaseNull(peerMeta);
 208         });
 209
 210         // We don't make a backup peer meta for the magic V0 peer
 211         // Set up all the rest before we munge the set
 212         SOSAccountAppendPeerMetasForViewBackups(account, myViews, syncing_peer_metas);
 213
 214         // If we saw someone else needing V0, we sync V0, too!
 215         if (addV0Views) {
 216             CFSetAddValue(myViews, kSOSViewKeychainV0);
 217         }
 218
 219         CFStringSetPerformWithDescription(myViews, ^(CFStringRef viewsDescription) {
 220             secnotice("engine-notify", "My Meta: %@: %@", myPi_id, viewsDescription);
 221         });
 222         myMeta = SOSPeerMetaCreateWithComponents(myPi_id, myViews, NULL);
 223         CFReleaseSafe(myViews);
 224     }
 225
 226     SOSEngineRef engine = SOSDataSourceFactoryGetEngineForDataSourceName(account.factory, SOSCircleGetName(circle), NULL);
 227     if (engine) {
 228         SOSEngineCircleChanged(engine, myMeta, syncing_peer_metas, zombie_peer_metas);
 229     }
 230
 231     CFReleaseNull(myMeta);
 232     CFReleaseSafe(localError);
 233
 234     CFReleaseNull(syncing_peer_metas);
 235     CFReleaseNull(zombie_peer_metas);
 236 }
 237
 238
 239 // Upcoming call to View Changes Here
 240 void SOSAccountNotifyOfChange(SOSAccount* account, SOSCircleRef oldCircle, SOSCircleRef newCircle)
 241 {
 242     account.circle_rings_retirements_need_attention = true;
 243
 244     CFMutableSetRef old_members = SOSCircleCopyPeers(oldCircle, kCFAllocatorDefault);
 245     CFMutableSetRef new_members = SOSCircleCopyPeers(newCircle, kCFAllocatorDefault);
 246
 247     CFMutableSetRef old_applicants = SOSCircleCopyApplicants(oldCircle, kCFAllocatorDefault);
 248     CFMutableSetRef new_applicants = SOSCircleCopyApplicants(newCircle, kCFAllocatorDefault);
 249
 250     SOSPeerInfoRef me = account.peerInfo;
 251     if(me && CFSetContainsValue(new_members, me))
 252         SOSAccountSetValue(account, kSOSEscrowRecord, kCFNull, NULL); //removing the escrow records from the account object
 253
 254     DifferenceAndCall(old_members, new_members, ^(CFSetRef added_members, CFSetRef removed_members) {
 255         DifferenceAndCall(old_applicants, new_applicants, ^(CFSetRef added_applicants, CFSetRef removed_applicants) {
 256             CFArrayForEach((__bridge CFArrayRef)(account.change_blocks), ^(const void * notificationBlock) {
 257                 secnotice("updates", "calling change block");
 258                 ((__bridge SOSAccountCircleMembershipChangeBlock) notificationBlock)(account, newCircle, added_members, removed_members, added_applicants, removed_applicants);
 259             });
 260         });
 261     });
 262
 263     CFReleaseNull(old_applicants);
 264     CFReleaseNull(new_applicants);
 265
 266     CFReleaseNull(old_members);
 267     CFReleaseNull(new_members);
 268 }
 269
 270 CF_RETURNS_RETAINED
 271 CFDictionaryRef SOSAccountHandleRetirementMessages(SOSAccount* account, CFDictionaryRef circle_retirement_messages, CFErrorRef *error) {
 272     SOSAccountTrustClassic* trust = account.trust;
 273     CFStringRef circle_name = SOSCircleGetName(trust.trustedCircle);
 274     CFMutableArrayRef handledRetirementIDs = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
 275     // We only handle one circle, look it up:
 276
 277     if(!trust.trustedCircle) // We don't fail, we intentionally handle nothing.
 278         return CFDictionaryCreateForCFTypes(kCFAllocatorDefault, NULL);
 279
 280     CFDictionaryRef retirement_dictionary = asDictionary(CFDictionaryGetValue(circle_retirement_messages, circle_name), NULL);
 281     if(!retirement_dictionary)
 282         return CFDictionaryCreateForCFTypes(kCFAllocatorDefault, NULL);
 283
 284     CFDictionaryForEach(retirement_dictionary, ^(const void *key, const void *value) {
 285         if(isData(value)) {
 286             SOSPeerInfoRef pi = SOSPeerInfoCreateFromData(NULL, error, (CFDataRef) value);
 287             if(pi && CFEqual(key, SOSPeerInfoGetPeerID(pi)) && SOSPeerInfoInspectRetirementTicket(pi, error)) {
 288                 [trust.retirees addObject: (__bridge id _Nonnull)(pi)];
 289
 290                 account.circle_rings_retirements_need_attention = true; // Have to handle retirements.
 291
 292                 CFArrayAppendValue(handledRetirementIDs, key);
 293             }
 294             CFReleaseNull(pi);
 295         }
 296     });
 297
 298     // If we are in the retiree list, we somehow got resurrected
 299     // clearly we took care of proper departure before so leave
 300     // and delcare that we withdrew this time.
 301     SOSPeerInfoRef me = account.peerInfo;
 302
 303     if (me && [trust.retirees containsObject:(__bridge id _Nonnull)(me)]) {
 304         SOSAccountPurgeIdentity(account);
 305         trust.departureCode = kSOSDiscoveredRetirement;
 306     }
 307
 308     CFDictionaryRef result = (CFArrayGetCount(handledRetirementIDs) == 0) ? CFDictionaryCreateForCFTypes(kCFAllocatorDefault, NULL)
 309                                                                           : CFDictionaryCreateForCFTypes(kCFAllocatorDefault, circle_name, handledRetirementIDs, NULL);
 310
 311     CFReleaseNull(handledRetirementIDs);
 312     return result;
 313 }
 314
 315 static SOSCircleRef SOSAccountCreateCircleFrom(CFStringRef circleName, CFTypeRef value, CFErrorRef *error) {
 316     if (value && !isData(value) && !isNull(value)) {
 317         secnotice("circleOps", "Value provided not appropriate for a circle");
 318         CFStringRef description = CFCopyTypeIDDescription(CFGetTypeID(value));
 319         SOSCreateErrorWithFormat(kSOSErrorUnexpectedType, NULL, error, NULL,
 320                                  CFSTR("Expected data or NULL got %@"), description);
 321         CFReleaseSafe(description);
 322         return NULL;
 323     }
 324
 325     SOSCircleRef circle = NULL;
 326     if (!value || isNull(value)) {
 327         secnotice("circleOps", "No circle found in data: %@", value);
 328         circle = NULL;
 329     } else {
 330         circle = SOSCircleCreateFromData(NULL, (CFDataRef) value, error);
 331         if (circle) {
 332             CFStringRef name = SOSCircleGetName(circle);
 333             if (!CFEqualSafe(name, circleName)) {
 334                 secnotice("circleOps", "Expected circle named %@, got %@", circleName, name);
 335                 SOSCreateErrorWithFormat(kSOSErrorNameMismatch, NULL, error, NULL,
 336                                          CFSTR("Expected circle named %@, got %@"), circleName, name);
 337                 CFReleaseNull(circle);
 338             }
 339         } else {
 340             secnotice("circleOps", "SOSCircleCreateFromData returned NULL.");
 341         }
 342     }
 343     return circle;
 344 }
 345
 346 bool SOSAccountHandleCircleMessage(SOSAccount* account,
 347                                    CFStringRef circleName, CFDataRef encodedCircleMessage, CFErrorRef *error) {
 348     bool success = false;
 349     CFErrorRef localError = NULL;
 350     SOSCircleRef circle = SOSAccountCreateCircleFrom(circleName, encodedCircleMessage, &localError);
 351     if (circle) {
 352         success = [account.trust updateCircleFromRemote:account.circle_transport newCircle:circle err:&localError];
 353         CFReleaseSafe(circle);
 354     } else {
 355         secerror("NULL circle found, ignoring ...");
 356         success = true;  // don't pend this NULL thing.
 357     }
 358
 359     if (!success) {
 360         if (isSOSErrorCoded(localError, kSOSErrorIncompatibleCircle)) {
 361             secerror("Incompatible circle found, abandoning membership: %@", circleName);
 362         }
 363
 364         if (error) {
 365             *error = localError;
 366             localError = NULL;
 367         }
 368
 369     }
 370
 371     CFReleaseNull(localError);
 372
 373     return success;
 374 }
 375
 376 bool SOSAccountHandleParametersChange(SOSAccount* account, CFDataRef parameters, CFErrorRef *error){
 377
 378     SecKeyRef newKey = NULL;
 379     CFDataRef newParameters = NULL;
 380     bool success = false;
 381
 382     if(SOSAccountRetrieveCloudParameters(account, &newKey, parameters, &newParameters, error)) {
 383         debugDumpUserParameters(CFSTR("SOSAccountHandleParametersChange got new user key parameters:"), parameters);
 384         secnotice("circleOps", "SOSAccountHandleParametersChange got new public key: %@", newKey);
 385
 386         if (CFEqualSafe(account.accountKey, newKey)) {
 387             secnotice("circleOps", "Got same public key sent our way. Ignoring.");
 388             success = true;
 389         } else if (CFEqualSafe(account.previousAccountKey, newKey)) {
 390             secnotice("circleOps", "Got previous public key repeated. Ignoring.");
 391             success = true;
 392         } else {
 393             SOSAccountSetUnTrustedUserPublicKey(account, newKey);
 394             CFReleaseNull(newKey);
 395             SOSAccountSetParameters(account, newParameters);
 396
 397             if(SOSAccountRetryUserCredentials(account)) {
 398                 secnotice("circleOps", "Successfully used cached password with new parameters");
 399                 SOSAccountGenerationSignatureUpdate(account, error);
 400             } else {
 401                 secnotice("circleOps", "Got new parameters for public key - could not find or use cached password");
 402                 SOSAccountPurgePrivateCredential(account);
 403             }
 404             secnotice("circleop", "Setting account.key_interests_need_updating to true in SOSAccountHandleParametersChange");
 405             account.circle_rings_retirements_need_attention = true;
 406             account.key_interests_need_updating = true;
 407
 408             success = true;
 409         }
 410     }
 411
 412     CFReleaseNull(newKey);
 413     CFReleaseNull(newParameters);
 414
 415     return success;
 416 }
 417