6 #ifndef SOSAccountPriv_h
7 #define SOSAccountPriv_h
9 #import <Foundation/Foundation.h>
11 #include <CoreFoundation/CoreFoundation.h>
12 #include <CoreFoundation/CFRuntime.h>
13 #include <utilities/SecCFWrappers.h>
14 #include <utilities/SecCFError.h>
15 #include <utilities/SecAKSWrappers.h>
17 #include <Security/SecKeyPriv.h>
19 #include <Security/der_plist.h>
20 #include <utilities/der_plist_internal.h>
21 #include <corecrypto/ccder.h>
23 #include <AssertMacros.h>
28 #include <Security/SecureObjectSync/SOSInternal.h>
30 #include <Security/SecureObjectSync/SOSCircle.h>
31 #include <Security/SecureObjectSync/SOSCircleV2.h>
32 #include <Security/SecureObjectSync/SOSRing.h>
33 #include <Security/SecureObjectSync/SOSRingUtils.h>
34 #include <Security/SecureObjectSync/SOSCloudCircle.h>
35 #include <securityd/SOSCloudCircleServer.h>
36 #include <Security/SecureObjectSync/SOSEngine.h>
37 #include <Security/SecureObjectSync/SOSPeer.h>
38 #include <Security/SecureObjectSync/SOSFullPeerInfo.h>
39 #include <Security/SecureObjectSync/SOSPeerInfo.h>
40 #include <Security/SecureObjectSync/SOSPeerInfoInternal.h>
41 #include <Security/SecureObjectSync/SOSUserKeygen.h>
42 #include <Security/SecureObjectSync/SOSTransportCircle.h>
44 #include <utilities/iCloudKeychainTrace.h>
46 #include <Security/SecItemPriv.h>
49 extern const CFStringRef kSOSUnsyncedViewsKey
;
50 extern const CFStringRef kSOSPendingEnableViewsToBeSetKey
;
51 extern const CFStringRef kSOSPendingDisableViewsToBeSetKey
;
52 extern const CFStringRef kSOSRecoveryKey
;
53 extern const CFStringRef kSOSAccountUUID
;
54 extern const CFStringRef kSOSAccountPeerNegotiationTimeouts
;
55 extern const CFStringRef kSOSRecoveryRing
;
56 extern const CFStringRef kSOSEscrowRecord
;
57 extern const CFStringRef kSOSAccountName
;
58 extern const CFStringRef kSOSTestV2Settings
;
59 extern const CFStringRef kSOSRateLimitingCounters
;
60 extern const CFStringRef kSOSAccountPeerLastSentTimestamp
;
61 extern const CFStringRef kSOSAccountRenegotiationRetryCount
;
62 extern const CFStringRef kSOSInitialSyncTimeoutV0
;
64 typedef void (^SOSAccountSaveBlock
)(CFDataRef flattenedAccount
, CFErrorRef flattenFailError
);
67 @
class CKKeyParameter
;
68 @
class SOSAccountTrustClassic
;
69 @
class SOSKVSCircleStorageTransport
;
70 @
class SOSCircleStorageTransport
;
71 @
class SOSCKCircleStorage
;
73 @interface SOSAccount
: NSObject
<SOSControlProtocol
>
75 @
property (nonatomic
, retain
) NSDictionary
*gestalt
;
76 @
property (nonatomic
, retain
) NSData
*backup_key
;
77 @
property (nonatomic
, retain
) NSString
*deviceID
;
79 @
property (nonatomic
, retain
) SOSAccountTrustClassic
*trust
;
81 @
property (nonatomic
, retain
) dispatch_queue_t queue
;
82 @
property (nonatomic
, retain
) dispatch_source_t user_private_timer
;
83 @
property (nonatomic
) SecKeyRef accountPrivateKey
;
85 @
property (nonatomic
) SOSDataSourceFactoryRef factory
;
87 @
property (nonatomic
, retain
) NSData
*_password_tmp
;
88 @
property (nonatomic
, assign
) BOOL isListeningForSync
;
89 @
property (nonatomic
, assign
) int lock_notification_token
;
90 @
property (nonatomic
, retain
) CKKeyParameter
* key_transport
;
91 @
property (nonatomic
) SOSKVSCircleStorageTransport
* circle_transport
;
92 @
property (nonatomic
, retain
) SOSMessageKVS
* kvs_message_transport
;
93 @
property (nonatomic
, retain
) SOSCKCircleStorage
* ck_storage
;
96 @
property (nonatomic
, assign
) BOOL circle_rings_retirements_need_attention
;
97 @
property (nonatomic
, assign
) BOOL engine_peer_state_needs_repair
;
98 @
property (nonatomic
, assign
) BOOL key_interests_need_updating
;
100 @
property (nonatomic
, retain
) NSMutableArray
*change_blocks
;
102 @
property (nonatomic
, retain
) NSMutableDictionary
*waitForInitialSync_blocks
;
103 @
property (nonatomic
, assign
) BOOL isInitialSyncing
;
105 @
property (nonatomic
) NSData
* accountKeyDerivationParamters
;
107 @
property (nonatomic
, assign
) BOOL accountKeyIsTrusted
;
108 @
property (nonatomic
) SecKeyRef accountKey
;
109 @
property (nonatomic
) SecKeyRef previousAccountKey
;
111 @
property (copy
) SOSAccountSaveBlock saveBlock
;
114 // Identity access properties, all delegated to the trust object
115 @
property (readonly
, nonatomic
) BOOL hasPeerInfo
;
116 @
property (readonly
, nonatomic
) SOSPeerInfoRef peerInfo
;
117 @
property (readonly
, nonatomic
) SOSFullPeerInfoRef fullPeerInfo
;
118 @
property (readonly
, nonatomic
) NSString
* peerID
;
120 @
property (nonatomic
, assign
) BOOL notifyCircleChangeOnExit
;
121 @
property (nonatomic
, assign
) BOOL notifyViewChangeOnExit
;
122 @
property (nonatomic
, assign
) BOOL notifyBackupOnExit
;
124 @
property (nonatomic
, retain
) NSUserDefaults
* settings
;
129 -(id
) initWithGestalt
:(CFDictionaryRef
)gestalt factory
:(SOSDataSourceFactoryRef
)factory
;
131 void SOSAccountAddSyncablePeerBlock(SOSAccount
* a
,
133 SOSAccountSyncablePeersBlock changeBlock
);
135 -(bool) ensureFactoryCircles
;
136 -(void) ensureOctagonPeerKeys
;
138 -(void) flattenToSaveBlock
;
140 void SOSAccountSetToNew(SOSAccount
* a
);
142 bool SOSAccountIsMyPeerActive(SOSAccount
* account
, CFErrorRef
* error
);
144 // MARK: In Sync checking
145 typedef bool (^SOSAccountWaitForInitialSyncBlock
)(SOSAccount
* account
);
147 CF_RETURNS_RETAINED CFStringRef
SOSAccountCallWhenInSync(SOSAccount
* account
, SOSAccountWaitForInitialSyncBlock syncBlock
);
148 bool SOSAccountUnregisterCallWhenInSync(SOSAccount
* account
, CFStringRef id
);
150 bool SOSAccountHandleOutOfSyncUpdate(SOSAccount
* account
, CFSetRef oldOOSViews
, CFSetRef newOOSViews
);
152 void SOSAccountEnsureSyncChecking(SOSAccount
* account
);
153 void SOSAccountCancelSyncChecking(SOSAccount
* account
);
155 CFMutableSetRef
SOSAccountCopyOutstandingViews(SOSAccount
* account
);
156 void SOSAccountNotifyEngines(SOSAccount
* account
);
157 CFMutableSetRef
SOSAccountCopyOutstandingViews(SOSAccount
* account
);
158 bool SOSAccountIsViewOutstanding(SOSAccount
* account
, CFStringRef view
);
159 CFMutableSetRef
SOSAccountCopyIntersectionWithOustanding(SOSAccount
* account
, CFSetRef inSet
);
160 bool SOSAccountIntersectsWithOutstanding(SOSAccount
* account
, CFSetRef views
);
161 bool SOSAccountHasOustandingViews(SOSAccount
* account
);
162 bool SOSAccountHasCompletedInitialSync(SOSAccount
* account
);
163 bool SOSAccountHasCompletedRequiredBackupSync(SOSAccount
* account
);
164 CFMutableSetRef
SOSAccountCopyOutstandingViews(SOSAccount
* account
);
165 bool SOSAccountSyncingV0(SOSAccount
* account
);
170 size_t der_sizeof_fullpeer_or_null(SOSFullPeerInfoRef data
, CFErrorRef
* error
);
172 uint8_t* der_encode_fullpeer_or_null(SOSFullPeerInfoRef data
, CFErrorRef
* error
, const uint8_t* der
, uint8_t* der_end
);
174 const uint8_t* der_decode_fullpeer_or_null(CFAllocatorRef allocator
, SOSFullPeerInfoRef
* data
,
176 const uint8_t* der
, const uint8_t* der_end
);
179 size_t der_sizeof_public_bytes(SecKeyRef publicKey
, CFErrorRef
* error
);
181 uint8_t* der_encode_public_bytes(SecKeyRef publicKey
, CFErrorRef
* error
, const uint8_t* der
, uint8_t* der_end
);
183 const uint8_t* der_decode_public_bytes(CFAllocatorRef allocator
, CFIndex algorithmID
, SecKeyRef
* publicKey
, CFErrorRef
* error
, const uint8_t* der
, const uint8_t* der_end
);
187 -(SOSCCStatus
) getCircleStatus
:(CFErrorRef
*) error
;
188 -(bool) isInCircle
:(CFErrorRef
*)error
;
190 bool SOSAccountHandleCircleMessage(SOSAccount
* account
,
191 CFStringRef circleName
, CFDataRef encodedCircleMessage
, CFErrorRef
*error
);
194 CFDictionaryRef
SOSAccountHandleRetirementMessages(SOSAccount
* account
, CFDictionaryRef circle_retirement_messages
, CFErrorRef
*error
);
196 void SOSAccountRecordRetiredPeersInCircle(SOSAccount
* account
);
198 bool SOSAccountHandleUpdateCircle(SOSAccount
* account
,
199 SOSCircleRef prospective_circle
,
205 bool SOSAccountHasFullPeerInfo(SOSAccount
* account
, CFErrorRef
* error
);
207 bool SOSAccountIsMyPeerInBackupAndCurrentInView(SOSAccount
* account
, CFStringRef viewname
);
208 bool SOSAccountUpdateOurPeerInBackup(SOSAccount
* account
, SOSRingRef oldRing
, CFErrorRef
*error
);
209 bool SOSAccountIsPeerInBackupAndCurrentInView(SOSAccount
* account
, SOSPeerInfoRef testPeer
, CFStringRef viewname
);
210 bool SOSDeleteV0Keybag(CFErrorRef
*error
);
211 void SOSAccountForEachBackupView(SOSAccount
* account
, void (^operation
)(const void *value
));
212 bool SOSAccountUpdatePeerInfo(SOSAccount
* account
, CFStringRef updateDescription
, CFErrorRef
*error
, bool (^update
)(SOSFullPeerInfoRef fpi
, CFErrorRef
*error
));
213 bool SOSAccountUpdatePeerInfoAndPush(SOSAccount
* account
, CFStringRef updateDescription
, CFErrorRef
*error
,
214 bool (^update
)(SOSPeerInfoRef pi
, CFErrorRef
*error
));
216 // Currently permitted backup rings.
217 void SOSAccountForEachBackupRingName(SOSAccount
* account
, void (^operation
)(CFStringRef value
));
218 void SOSAccountForEachRingName(SOSAccount
* account
, void (^operation
)(CFStringRef value
));
221 bool SOSAccountHasCircle(SOSAccount
* account
, CFErrorRef
* error
);
222 SOSCircleRef CF_RETURNS_RETAINED
SOSAccountEnsureCircle(SOSAccount
* a
, CFStringRef name
, CFErrorRef
*error
);
224 void AppendCircleKeyName(CFMutableArrayRef array
, CFStringRef name
);
226 CFStringRef
SOSInterestListCopyDescription(CFArrayRef interests
);
229 // FullPeerInfos - including Cloud Identity
230 SOSFullPeerInfoRef
CopyCloudKeychainIdentity(SOSPeerInfoRef cloudPeer
, CFErrorRef
*error
);
232 bool SOSAccountIsAccountIdentity(SOSAccount
* account
, SOSPeerInfoRef peer_info
, CFErrorRef
*error
);
233 bool SOSAccountFullPeerInfoVerify(SOSAccount
* account
, SecKeyRef privKey
, CFErrorRef
*error
);
234 CF_RETURNS_RETAINED SOSPeerInfoRef
GenerateNewCloudIdentityPeerInfo(CFErrorRef
*error
);
237 bool SOSAccountHasPublicKey(SOSAccount
* account
, CFErrorRef
* error
);
238 bool SOSAccountPublishCloudParameters(SOSAccount
* account
, CFErrorRef
* error
);
239 bool SOSAccountRetrieveCloudParameters(SOSAccount
* account
, SecKeyRef
*newKey
,
241 CFDataRef
*newParameters
, CFErrorRef
* error
);
244 void SOSAccountAssertDSID(SOSAccount
* account
, CFStringRef dsid
);
250 SecKeyRef
SOSAccountCopyDeviceKey(SOSAccount
* account
, CFErrorRef
*error
);
251 SecKeyRef CF_RETURNS_RETAINED
GeneratePermanentFullECKey(int keySize
, CFStringRef name
, CFErrorRef
* error
);
254 void SOSAccountSetLastDepartureReason(SOSAccount
* account
, enum DepartureReason reason
);
255 void SOSAccountSetUserPublicTrustedForTesting(SOSAccount
* account
);
257 void SOSAccountPurgeIdentity(SOSAccount
*);
258 bool sosAccountLeaveCircle(SOSAccount
* account
, SOSCircleRef circle
, CFErrorRef
* error
);
259 bool sosAccountLeaveCircleWithAnalytics(SOSAccount
* account
, SOSCircleRef circle
, NSData
* parentData
, CFErrorRef
* error
);
261 bool sosAccountLeaveRing(SOSAccount
* account
, SOSRingRef ring
, CFErrorRef
* error
);
262 bool SOSAccountForEachRing(SOSAccount
* account
, SOSRingRef (^action
)(CFStringRef name
, SOSRingRef ring
));
263 bool SOSAccountUpdateBackUp(SOSAccount
* account
, CFStringRef viewname
, CFErrorRef
*error
);
264 void SOSAccountEnsureRecoveryRing(SOSAccount
* account
);
265 bool SOSAccountEnsureInBackupRings(SOSAccount
* account
);
267 bool SOSAccountEnsurePeerRegistration(SOSAccount
* account
, CFErrorRef
*error
);
269 extern const CFStringRef kSOSUnsyncedViewsKey
;
270 extern const CFStringRef kSOSPendingEnableViewsToBeSetKey
;
271 extern const CFStringRef kSOSPendingDisableViewsToBeSetKey
;
272 extern const CFStringRef kSOSRecoveryKey
;
275 kSOSTransportNone
= 0,
276 kSOSTransportIDS
= 1,
277 kSOSTransportKVS
= 2,
278 kSOSTransportFuture
= 3,
279 kSOSTransportPresent
= 4
282 SOSPeerInfoRef
SOSAccountCopyPeerWithID(SOSAccount
* account
, CFStringRef peerid
, CFErrorRef
*error
);
284 bool SOSAccountSetValue(SOSAccount
* account
, CFStringRef key
, CFTypeRef value
, CFErrorRef
*error
);
285 bool SOSAccountClearValue(SOSAccount
* account
, CFStringRef key
, CFErrorRef
*error
);
286 CFTypeRef
SOSAccountGetValue(SOSAccount
* account
, CFStringRef key
, CFErrorRef
*error
);
288 bool SOSAccountAddEscrowToPeerInfo(SOSAccount
* account
, SOSFullPeerInfoRef myPeer
, CFErrorRef
*error
);
289 bool SOSAccountAddEscrowRecords(SOSAccount
* account
, CFStringRef dsid
, CFDictionaryRef record
, CFErrorRef
*error
);
290 void SOSAccountRemoveRing(SOSAccount
* a
, CFStringRef ringName
);
291 SOSRingRef
SOSAccountCopyRingNamed(SOSAccount
* a
, CFStringRef ringName
, CFErrorRef
*error
);
292 SOSRingRef
SOSAccountRingCreateForName(SOSAccount
* a
, CFStringRef ringName
, CFErrorRef
*error
);
293 bool SOSAccountUpdateRingFromRemote(SOSAccount
* account
, SOSRingRef newRing
, CFErrorRef
*error
);
294 bool SOSAccountUpdateRing(SOSAccount
* account
, SOSRingRef newRing
, CFErrorRef
*error
);
295 bool SOSAccountRemoveBackupPeers(SOSAccount
* account
, CFArrayRef peerIDs
, CFErrorRef
*error
);
296 bool SOSAccountResetRing(SOSAccount
* account
, CFStringRef ringName
, CFErrorRef
*error
);
297 bool SOSAccountCheckPeerAvailability(SOSAccount
* account
, CFErrorRef
*error
);
298 bool SOSAccountUpdateNamedRing(SOSAccount
* account
, CFStringRef ringName
, CFErrorRef
*error
,
299 SOSRingRef (^create
)(CFStringRef ringName
, CFErrorRef
*error
),
300 SOSRingRef (^copyModified
)(SOSRingRef existing
, CFErrorRef
*error
));
303 // MARK: Backup translation functions
306 CFStringRef
SOSBackupCopyRingNameForView(CFStringRef viewName
);
309 // Security tool test/debug functions
311 bool SOSAccountPostDebugScope(SOSAccount
* account
, CFTypeRef scope
, CFErrorRef
*error
);
312 CFDataRef
SOSAccountCopyAccountStateFromKeychain(CFErrorRef
*error
);
313 bool SOSAccountDeleteAccountStateFromKeychain(CFErrorRef
*error
);
314 CFDataRef
SOSAccountCopyEngineStateFromKeychain(CFErrorRef
*error
);
315 bool SOSAccountDeleteEngineStateFromKeychain(CFErrorRef
*error
);
317 bool SOSAccountIsNew(SOSAccount
* account
, CFErrorRef
*error
);
318 bool SOSAccountCheckForAlwaysOnViews(SOSAccount
* account
);
319 // UUID, no setter just getter and ensuring value.
320 void SOSAccountEnsureUUID(SOSAccount
* account
);
321 CFStringRef CF_RETURNS_RETAINED
SOSAccountCopyUUID(SOSAccount
* account
);
322 const uint8_t* der_decode_cloud_parameters(CFAllocatorRef allocator
,
323 CFIndex algorithmID
, SecKeyRef
* publicKey
,
324 CFDataRef
*parameters
,
326 const uint8_t* der
, const uint8_t* der_end
);
332 CFDataRef
SOSPiggyBackBlobCopyEncodedData(SOSGenCountRef gencount
, SecKeyRef pubKey
, CFDataRef signature
, CFErrorRef
*error
);
335 NSData
*SOSPiggyCreateInitialSyncData(NSArray
<NSData
*> *identities
, NSArray
<NSDictionary
*>* tlks
);
336 NSDictionary
* SOSPiggyCopyInitialSyncData(const uint8_t** der
, const uint8_t *der_end
);
337 NSArray
<NSDictionary
*>* SOSAccountSortTLKS(NSArray
<NSDictionary
*>* tlks
);
340 bool SOSAccountCleanupAllKVSKeys(SOSAccount
* account
, CFErrorRef
* error
);
341 bool SOSAccountPopulateKVSWithBadKeys(SOSAccount
* account
, CFErrorRef
* error
);
345 @interface
SOSAccount (Persistence
)
347 +(instancetype
) accountFromData
: (NSData
*) data
348 factory
: (SOSDataSourceFactoryRef
) factory
349 error
: (NSError
**) error
;
350 +(instancetype
) accountFromDER
: (const uint8_t**) der
351 end
: (const uint8_t*) der_end
352 factory
: (SOSDataSourceFactoryRef
) factory
353 error
: (NSError
**) error
;
355 -(NSData
*) encodedData
: (NSError
**) error
;
358 #endif /* SOSAccount_h */