OSX/sec/SOSCircle/SecureObjectSync/SOSAccountBackup.m

   1 //
   2 //  SOSAccountCircles.c
   3 //  sec
   4 //
   5
   6 #include "SOSAccount.h"
   7 #include "SOSCloudKeychainClient.h"
   8
   9 #include <Security/SecureObjectSync/SOSBackupSliceKeyBag.h>
  10 #include <Security/SecureObjectSync/SOSPeerInfoCollections.h>
  11 #include <Security/SecureObjectSync/SOSViews.h>
  12 #include <Security/SecureObjectSync/SOSAccountTrustClassic+Circle.h>
  13 #include <Security/SecureObjectSync/SOSAccountTrustClassic+Expansion.h>
  14
  15 #include "SOSInternal.h"
  16
  17
  18
  19 //
  20 // MARK: V0 Keybag keychain stuff
  21 //
  22 static bool SecItemUpdateOrAdd(CFDictionaryRef query, CFDictionaryRef update, CFErrorRef *error)
  23 {
  24     OSStatus saveStatus = SecItemUpdate(query, update);
  25
  26     if (errSecItemNotFound == saveStatus) {
  27         CFMutableDictionaryRef add = CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 0, query);
  28         CFDictionaryForEach(update, ^(const void *key, const void *value) {
  29             CFDictionaryAddValue(add, key, value);
  30         });
  31         saveStatus = SecItemAdd(add, NULL);
  32         CFReleaseNull(add);
  33     }
  34
  35     return SecError(saveStatus, error, CFSTR("Error saving %@"), query);
  36 }
  37
  38 static CFDictionaryRef SOSCopyV0Attributes() {
  39     return  CFDictionaryCreateForCFTypes(kCFAllocatorDefault,
  40                                          kSecClass,           kSecClassGenericPassword,
  41                                          kSecAttrAccessGroup, CFSTR("com.apple.sbd"),
  42                                          kSecAttrAccessible,  kSecAttrAccessibleWhenUnlocked,
  43                                          kSecAttrAccount,     CFSTR("SecureBackupPublicKeybag"),
  44                                          kSecAttrService,     CFSTR("SecureBackupService"),
  45                                          kSecAttrSynchronizable, kCFBooleanTrue,
  46                                          NULL);
  47 }
  48
  49 bool SOSDeleteV0Keybag(CFErrorRef *error) {
  50     CFDictionaryRef attributes = SOSCopyV0Attributes();
  51
  52     OSStatus result = SecItemDelete(attributes);
  53
  54     CFReleaseNull(attributes);
  55
  56     return SecError(result != errSecItemNotFound ? result : errSecSuccess, error, CFSTR("Deleting V0 Keybag failed - %d"), (int)result);
  57 }
  58
  59 static bool SOSSaveV0Keybag(CFDataRef v0Keybag, CFErrorRef *error) {
  60     CFDictionaryRef attributes = SOSCopyV0Attributes();
  61
  62     CFDictionaryRef update = CFDictionaryCreateForCFTypes(kCFAllocatorDefault,
  63                                                           kSecValueData,           v0Keybag,
  64                                                           NULL);
  65
  66
  67     bool result = SecItemUpdateOrAdd(attributes, update, error);
  68     CFReleaseNull(attributes);
  69     CFReleaseNull(update);
  70
  71     return result;
  72 }
  73
  74
  75 static bool SOSPeerInfoIsViewBackupEnabled(SOSPeerInfoRef peerInfo, CFStringRef viewName) {
  76     if (CFEqualSafe(kSOSViewKeychainV0, viewName))
  77         return false;
  78
  79     return SOSPeerInfoHasBackupKey(peerInfo) && SOSPeerInfoIsViewPermitted(peerInfo, viewName);
  80 }
  81
  82 static CFSetRef SOSAccountCopyBackupPeersForView(SOSAccount*  account, CFStringRef viewName) {
  83     CFMutableSetRef backupPeers = CFSetCreateMutableForSOSPeerInfosByID(kCFAllocatorDefault);
  84
  85     SOSCircleRef circle = [account.trust getCircle:NULL];
  86
  87     require_quiet(circle, exit);
  88
  89     SOSCircleForEachValidPeer(circle, account.accountKey, ^(SOSPeerInfoRef peer) {
  90         if (SOSPeerInfoIsViewBackupEnabled(peer, viewName))
  91             CFSetAddValue(backupPeers, peer);
  92     });
  93
  94 exit:
  95     return backupPeers;
  96 }
  97
  98 static void SOSAccountWithBackupPeersForView(SOSAccount*  account, CFStringRef viewName, void (^action)(CFSetRef peers)) {
  99     CFSetRef backupPeersForView = SOSAccountCopyBackupPeersForView(account, viewName);
 100
 101     action(backupPeersForView);
 102
 103     CFReleaseNull(backupPeersForView);
 104 }
 105
 106
 107 static bool SOSAccountWithBSKBForView(SOSAccount*  account, CFStringRef viewName, CFErrorRef *error,
 108                                       bool (^action)(SOSBackupSliceKeyBagRef bskb, CFErrorRef *error)) {
 109     __block SOSBackupSliceKeyBagRef bskb = NULL;
 110     bool result = false;
 111     CFDataRef rkbg = SOSAccountCopyRecoveryPublic(kCFAllocatorDefault, account, NULL);
 112
 113     SOSAccountWithBackupPeersForView(account, viewName, ^(CFSetRef peers) {
 114         if(! rkbg) {
 115             bskb = SOSBackupSliceKeyBagCreate(kCFAllocatorDefault, peers, error);
 116         } else {
 117             CFMutableDictionaryRef additionalKeys = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
 118             CFDictionaryAddValue(additionalKeys, bskbRkbgPrefix, rkbg);
 119             bskb = SOSBackupSliceKeyBagCreateWithAdditionalKeys(kCFAllocatorDefault, peers, additionalKeys, error);
 120             CFReleaseNull(additionalKeys);
 121         }
 122     });
 123     CFReleaseNull(rkbg);
 124
 125     require_quiet(bskb, exit);
 126
 127     action(bskb, error);
 128
 129     result = true;
 130
 131 exit:
 132     CFReleaseNull(bskb);
 133     return result;
 134 }
 135
 136 CFStringRef SOSBackupCopyRingNameForView(CFStringRef viewName) {
 137     return CFStringCreateWithFormat(kCFAllocatorDefault, NULL, CFSTR("%@-tomb"), viewName);
 138 }
 139
 140 static bool SOSAccountUpdateBackupRing(SOSAccount*  account, CFStringRef viewName, CFErrorRef *error,
 141                                        SOSRingRef (^modify)(SOSRingRef existing, CFErrorRef *error)) {
 142
 143     CFStringRef ringName = SOSBackupCopyRingNameForView(viewName);
 144
 145     bool result = SOSAccountUpdateNamedRing(account, ringName, error, ^SOSRingRef(CFStringRef ringName, CFErrorRef *error) {
 146         return SOSRingCreate(ringName, (__bridge CFStringRef) account.peerID, kSOSRingBackup, error);
 147     }, modify);
 148
 149     CFReleaseNull(ringName);
 150
 151     return result;
 152 }
 153
 154
 155
 156 static bool SOSAccountSetKeybagForViewBackupRing(SOSAccount*  account, CFStringRef viewName, SOSBackupSliceKeyBagRef keyBag, CFErrorRef *error) {
 157     CFMutableSetRef backupViewSet = CFSetCreateMutableForCFTypes(NULL);
 158     bool result = false;
 159
 160     if(!SecAllocationError(backupViewSet, error, CFSTR("No backup view set created"))){
 161         secnotice("backupring", "Got error setting keybag for backup view '%@': %@", viewName, error ? (CFTypeRef) *error : (CFTypeRef) CFSTR("No error space."));
 162
 163         return result;
 164     }
 165     CFSetAddValue(backupViewSet, viewName);
 166
 167     result = SOSAccountUpdateBackupRing(account, viewName, error, ^SOSRingRef(SOSRingRef existing, CFErrorRef *error) {
 168         SOSRingRef newRing = NULL;
 169         CFSetRef viewPeerSet = [account.trust copyPeerSetForView:viewName];
 170         CFMutableSetRef cleared = CFSetCreateMutableForCFTypes(NULL);
 171
 172         SOSRingSetPeerIDs(existing, cleared);
 173         SOSRingAddAll(existing, viewPeerSet);
 174
 175         require_quiet(SOSRingSetBackupKeyBag(existing, account.fullPeerInfo, backupViewSet, keyBag, error), exit);
 176
 177         newRing = CFRetainSafe(existing);
 178     exit:
 179         CFReleaseNull(viewPeerSet);
 180         CFReleaseNull(cleared);
 181         return newRing;
 182     });
 183
 184     if (result && NULL != error && NULL != *error) {
 185         secerror("Got Success and Error (dropping error): %@", *error);
 186         CFReleaseNull(*error);
 187     }
 188
 189     if (!result) {
 190         secnotice("backupring", "Got error setting keybag for backup view '%@': %@", viewName, error ? (CFTypeRef) *error : (CFTypeRef) CFSTR("No error space."));
 191     }
 192
 193     CFReleaseNull(backupViewSet);
 194     return result;
 195 }
 196
 197 bool SOSAccountNewBKSBForView(SOSAccount* account, CFStringRef viewName, CFErrorRef *error)
 198 {
 199     return SOSAccountWithBSKBForView(account, viewName, error, ^(SOSBackupSliceKeyBagRef bskb, CFErrorRef *error) {
 200         bool result = SOSAccountSetKeybagForViewBackupRing(account, viewName, bskb, error);
 201         return result;
 202     });
 203 }
 204
 205 bool SOSAccountIsBackupRingEmpty(SOSAccount*  account, CFStringRef viewName) {
 206     CFStringRef backupRing = SOSBackupCopyRingNameForView(viewName);
 207     SOSRingRef ring = [account.trust copyRing:backupRing err:NULL];
 208     CFReleaseNull(backupRing);
 209     int peercnt = 0;
 210     if(ring) peercnt = SOSRingCountPeers(ring);
 211     CFReleaseNull(ring);
 212     return peercnt == 0;
 213 }
 214
 215 bool SOSAccountUpdatePeerInfo(SOSAccount*  account, CFStringRef updateDescription, CFErrorRef *error, bool (^update)(SOSFullPeerInfoRef fpi, CFErrorRef *error)) {
 216
 217     if (!account.hasPeerInfo)
 218         return true;
 219
 220     bool result = update(account.fullPeerInfo, error);
 221
 222     if (result && SOSAccountHasCircle(account, NULL)) {
 223         return [account.trust modifyCircle:account.circle_transport err:error action:^(SOSCircleRef circle_to_change) {
 224             secnotice("circleChange", "Calling SOSCircleUpdatePeerInfo for %@", updateDescription);
 225             return SOSCircleUpdatePeerInfo(circle_to_change, account.peerInfo);
 226         }];
 227     }
 228
 229     return result;
 230 }
 231
 232 bool SOSAccountIsMyPeerInBackupAndCurrentInView(SOSAccount*  account, CFStringRef viewname){
 233     bool result = false;
 234     CFErrorRef bsError = NULL;
 235     CFDataRef backupSliceData = NULL;
 236     SOSRingRef ring = NULL;
 237     SOSBackupSliceKeyBagRef backupSlice = NULL;
 238
 239     require_quiet(SOSPeerInfoIsViewBackupEnabled(account.peerInfo, viewname), errOut);
 240
 241     CFStringRef ringName = SOSBackupCopyRingNameForView(viewname);
 242     ring = [account.trust copyRing:ringName err:&bsError];
 243     CFReleaseNull(ringName);
 244
 245     require_quiet(ring, errOut);
 246
 247     //grab the backup slice from the ring
 248     backupSliceData = SOSRingGetPayload(ring, &bsError);
 249     require_quiet(backupSliceData, errOut);
 250
 251     backupSlice = SOSBackupSliceKeyBagCreateFromData(kCFAllocatorDefault, backupSliceData, &bsError);
 252     require_quiet(backupSlice, errOut);
 253
 254     CFSetRef peers = SOSBSKBGetPeers(backupSlice);
 255     SOSPeerInfoRef myPeer = account.peerInfo;
 256
 257     SOSPeerInfoRef myPeerInBSKB = (SOSPeerInfoRef) CFSetGetValue(peers, myPeer);
 258     require_quiet(isSOSPeerInfo(myPeerInBSKB), errOut);
 259
 260     CFDataRef myBK = SOSPeerInfoCopyBackupKey(myPeer);
 261     CFDataRef myPeerInBSKBBK = SOSPeerInfoCopyBackupKey(myPeerInBSKB);
 262     result = CFEqualSafe(myBK, myPeerInBSKBBK);
 263     CFReleaseNull(myBK);
 264     CFReleaseNull(myPeerInBSKBBK);
 265
 266 errOut:
 267     CFReleaseNull(ring);
 268
 269     if (bsError) {
 270         secnotice("backup", "Failed to find BKSB: %@, %@ (%@)", backupSliceData, backupSlice, bsError);
 271     }
 272     CFReleaseNull(bsError);
 273     return result;
 274 }
 275
 276 bool SOSAccountIsPeerInBackupAndCurrentInView(SOSAccount*  account, SOSPeerInfoRef testPeer, CFStringRef viewname){
 277     bool result = false;
 278     CFErrorRef bsError = NULL;
 279     CFDataRef backupSliceData = NULL;
 280     SOSRingRef ring = NULL;
 281     SOSBackupSliceKeyBagRef backupSlice = NULL;
 282
 283     require_quiet(testPeer, errOut);
 284
 285     CFStringRef ringName = SOSBackupCopyRingNameForView(viewname);
 286
 287     ring = [account.trust copyRing:ringName err:&bsError];
 288     CFReleaseNull(ringName);
 289
 290     require_quiet(ring, errOut);
 291
 292     //grab the backup slice from the ring
 293     backupSliceData = SOSRingGetPayload(ring, &bsError);
 294     require_quiet(backupSliceData, errOut);
 295
 296     backupSlice = SOSBackupSliceKeyBagCreateFromData(kCFAllocatorDefault, backupSliceData, &bsError);
 297     require_quiet(backupSlice, errOut);
 298
 299     CFSetRef peers = SOSBSKBGetPeers(backupSlice);
 300
 301     SOSPeerInfoRef peerInBSKB = (SOSPeerInfoRef) CFSetGetValue(peers, testPeer);
 302     require_quiet(isSOSPeerInfo(peerInBSKB), errOut);
 303
 304     result = CFEqualSafe(testPeer, peerInBSKB);
 305
 306 errOut:
 307     CFReleaseNull(ring);
 308
 309     if (bsError) {
 310         secnotice("backup", "Failed to find BKSB: %@, %@ (%@)", backupSliceData, backupSlice, bsError);
 311     }
 312     CFReleaseNull(bsError);
 313     return result;
 314
 315 }
 316
 317 bool SOSAccountUpdateOurPeerInBackup(SOSAccount*  account, SOSRingRef oldRing, CFErrorRef *error){
 318     bool result = false;
 319     CFSetRef viewNames = SOSBackupRingGetViews(oldRing, error);
 320     __block CFStringRef viewName = NULL;
 321     require_quiet(viewNames, fail);
 322     require_quiet(SecRequirementError(1 == CFSetGetCount(viewNames), error, CFSTR("Only support single view backup rings")), fail);
 323
 324     CFSetForEach(viewNames, ^(const void *value) {
 325         if (isString(value)) {
 326             viewName = CFRetainSafe((CFStringRef) value);
 327         }
 328     });
 329
 330     result = SOSAccountNewBKSBForView(account, viewName, error);
 331
 332 fail:
 333     CFReleaseNull(viewName);
 334     return result;
 335 }
 336
 337 void SOSAccountForEachBackupRingName(SOSAccount*  account, void (^operation)(CFStringRef value)) {
 338     SOSPeerInfoRef myPeer = account.peerInfo;
 339     if (myPeer) {
 340         CFSetRef allViews = SOSViewCopyViewSet(kViewSetAll); // All non virtual views.
 341
 342         CFSetForEach(allViews, ^(const void *value) {
 343             CFStringRef viewName = asString(value, NULL);
 344
 345             if (viewName) {
 346                 CFStringRef ringName = SOSBackupCopyRingNameForView(viewName);
 347                 operation(ringName);
 348                 CFReleaseNull(ringName);
 349             }
 350         });
 351         CFReleaseNull(allViews);
 352         // Only one "ring" now (other than backup rings) when there's more this will need to be modified.
 353         operation(kSOSRecoveryRing);
 354     }
 355 }
 356
 357
 358 void SOSAccountForEachRingName(SOSAccount* account, void (^operation)(CFStringRef value)) {
 359     SOSPeerInfoRef myPeer = account.peerInfo;
 360     if (myPeer) {
 361         CFSetRef allViews = SOSViewCopyViewSet(kViewSetAll); // All non virtual views.
 362
 363         CFSetForEach(allViews, ^(const void *value) {
 364             CFStringRef viewName = asString(value, NULL);
 365
 366             if (viewName) {
 367                 CFStringRef ringName = SOSBackupCopyRingNameForView(viewName);
 368                 operation(ringName);
 369                 CFReleaseNull(ringName);
 370             }
 371         });
 372         CFReleaseNull(allViews);
 373         // Only one "ring" now (other than backup rings) when there's more this will need to be modified.
 374         operation(kSOSRecoveryRing);
 375     }
 376 }
 377
 378 void SOSAccountForEachBackupView(SOSAccount*  account,  void (^operation)(const void *value)) {
 379     SOSPeerInfoRef myPeer = account.peerInfo;
 380
 381     if (myPeer) {
 382         CFMutableSetRef myBackupViews = CFSetCreateMutableCopy(kCFAllocatorDefault, 0, SOSPeerInfoGetPermittedViews(myPeer));
 383         CFSetRemoveValue(myBackupViews, kSOSViewKeychainV0);
 384         CFSetForEach(myBackupViews, operation);
 385         CFReleaseNull(myBackupViews);
 386     }
 387 }
 388
 389
 390 bool SOSAccountSetBackupPublicKey(SOSAccountTransaction* aTxn, CFDataRef cfBackupKey, CFErrorRef *error)
 391 {
 392     SOSAccount*  account = aTxn.account;
 393     NSData* backupKey = [[NSData alloc]initWithData:(__bridge NSData * _Nonnull)(cfBackupKey)];
 394
 395     __block bool result = false;
 396
 397     CFDataPerformWithHexString((__bridge CFDataRef)(backupKey), ^(CFStringRef backupKeyString) {
 398         CFDataPerformWithHexString((__bridge CFDataRef)((account.backup_key)), ^(CFStringRef oldBackupKey) {
 399             secnotice("backup", "SetBackupPublic: %@ from %@", backupKeyString, oldBackupKey);
 400         });
 401     });
 402
 403     require_quiet([account.trust isInCircle:error], exit);
 404
 405     if ([backupKey isEqual:account.backup_key])
 406         return true;
 407
 408     account.backup_key = [[NSData alloc] initWithData:backupKey];
 409
 410     account.circle_rings_retirements_need_attention = true;
 411
 412     result = true;
 413
 414 exit:
 415     if (!result) {
 416         secnotice("backupkey", "SetBackupPublic Failed: %@", error ? (CFTypeRef) *error : (CFTypeRef) CFSTR("No error space"));
 417     }
 418     return result;
 419 }
 420
 421 static bool SOSAccountWithBSKBAndPeerInfosForView(SOSAccount*  account, CFArrayRef retiree, CFStringRef viewName, CFErrorRef *error,
 422                                                   bool (^action)(SOSBackupSliceKeyBagRef bskb, CFErrorRef *error)) {
 423     __block SOSBackupSliceKeyBagRef bskb = NULL;
 424     bool result = false;
 425
 426     SOSAccountWithBackupPeersForView(account, viewName, ^(CFSetRef peers) {
 427         CFMutableSetRef newPeerList = CFSetCreateMutableCopy(kCFAllocatorDefault, CFSetGetCount(peers), peers);
 428         CFArrayForEach(retiree, ^(const void *value) {
 429             if (!isSOSPeerInfo(value)) {
 430                 secerror("Peer list contains a non-peerInfo element");
 431             } else {
 432                 SOSPeerInfoRef retiringPeer = (SOSPeerInfoRef)value;
 433                 CFStringRef retiringPeerID = SOSPeerInfoGetPeerID(retiringPeer);
 434
 435                 CFSetForEach(newPeerList, ^(const void *peerFromAccount) {
 436                     CFStringRef peerFromAccountID = SOSPeerInfoGetPeerID((SOSPeerInfoRef)peerFromAccount);
 437                     if (peerFromAccountID && retiringPeerID && CFStringCompare(peerFromAccountID, retiringPeerID, 0) == 0){
 438                         CFSetRemoveValue(newPeerList, peerFromAccount);
 439                     }
 440                 });
 441             }
 442         });
 443         bskb = SOSBackupSliceKeyBagCreate(kCFAllocatorDefault, newPeerList, error);
 444         CFReleaseNull(newPeerList);
 445     });
 446
 447     require_quiet(bskb, exit);
 448
 449     action(bskb, error);
 450
 451     result = true;
 452
 453 exit:
 454     CFReleaseNull(bskb);
 455     return result;
 456 }
 457
 458 bool SOSAccountRemoveBackupPublickey(SOSAccountTransaction* aTxn, CFErrorRef *error)
 459 {
 460     SOSAccount*  account = aTxn.account;
 461
 462     __block bool result = false;
 463     __block CFArrayRef removals = NULL;
 464
 465     account.backup_key = nil;
 466
 467     if(!SOSAccountUpdatePeerInfo(account, CFSTR("Backup public key"), error,
 468                                  ^bool(SOSFullPeerInfoRef fpi, CFErrorRef *error) {
 469                                      return SOSFullPeerInfoUpdateBackupKey(fpi, NULL, error);
 470                                  })){
 471                                      return result;
 472                                  }
 473
 474     removals = CFArrayCreateForCFTypes(kCFAllocatorDefault,
 475                                        account.peerInfo, NULL);
 476
 477     SOSAccountForEachBackupView(account, ^(const void *value) {
 478         CFStringRef viewName = (CFStringRef)value;
 479         result = SOSAccountWithBSKBAndPeerInfosForView(account, removals, viewName, error, ^(SOSBackupSliceKeyBagRef bskb, CFErrorRef *error) {
 480             bool result = SOSAccountSetKeybagForViewBackupRing(account, viewName, bskb, error);
 481             return result;
 482         });
 483     });
 484
 485
 486     result = true;
 487
 488     return result;
 489
 490 }
 491
 492 bool SOSAccountSetBSKBagForAllSlices(SOSAccount*  account, CFDataRef aks_bag, bool setupV0Only, CFErrorRef *error){
 493     __block bool result = false;
 494     SOSBackupSliceKeyBagRef backup_slice = NULL;
 495
 496     require_quiet([account.trust isInCircle:error], exit);
 497
 498     if (setupV0Only) {
 499         result = SOSSaveV0Keybag(aks_bag, error);
 500         require_action_quiet(result, exit, secnotice("keybag", "failed to set V0 keybag (%@)", *error));
 501     } else {
 502         result = true;
 503
 504         backup_slice = SOSBackupSliceKeyBagCreateDirect(kCFAllocatorDefault, aks_bag, error);
 505
 506         SOSAccountForEachBackupView(account, ^(const void *value) {
 507             CFStringRef viewname = (CFStringRef) value;
 508             result &= SOSAccountSetKeybagForViewBackupRing(account, viewname, backup_slice, error);
 509         });
 510     }
 511
 512 exit:
 513     CFReleaseNull(backup_slice);
 514     return result;
 515 }
 516
 517 static CFMutableArrayRef SOSAccountIsRetiredPeerIDInBackupPeerList(SOSAccount*  account, CFArrayRef peers, CFSetRef peersInBackup){
 518     CFMutableArrayRef removals = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
 519
 520     CFSetForEach(peersInBackup, ^(const void *value) {
 521         SOSPeerInfoRef peer = (SOSPeerInfoRef)value;
 522         CFArrayForEach(peers, ^(const void *value) {
 523             CFStringRef peerID = SOSPeerInfoGetPeerID((SOSPeerInfoRef)value);
 524             CFStringRef piPeerID = SOSPeerInfoGetPeerID(peer);
 525             if (peerID && piPeerID && CFStringCompare(piPeerID, peerID, 0) == 0){
 526                 CFArrayAppendValue(removals, peer);
 527             }
 528         });
 529
 530     });
 531
 532     return removals;
 533
 534 }
 535
 536 bool SOSAccountRemoveBackupPeers(SOSAccount*  account, CFArrayRef peers, CFErrorRef *error){
 537     __block bool result = true;
 538
 539     SOSFullPeerInfoRef fpi = account.fullPeerInfo;
 540     SOSPeerInfoRef myPeer = SOSFullPeerInfoGetPeerInfo(fpi);
 541
 542     CFSetRef permittedViews = SOSPeerInfoGetPermittedViews(myPeer);
 543     CFSetForEach(permittedViews, ^(const void *value) {
 544         CFStringRef viewName = (CFStringRef)value;
 545         if(SOSPeerInfoIsViewBackupEnabled(myPeer, viewName)){
 546             //grab current peers list
 547             CFSetRef peersInBackup = SOSAccountCopyBackupPeersForView(account, viewName);
 548             //get peer infos that have retired but are still in the backup peer list
 549             CFMutableArrayRef removals = SOSAccountIsRetiredPeerIDInBackupPeerList(account, peers, peersInBackup);
 550             result = SOSAccountWithBSKBAndPeerInfosForView(account, removals, viewName, error, ^(SOSBackupSliceKeyBagRef bskb, CFErrorRef *error) {
 551                 bool result = SOSAccountSetKeybagForViewBackupRing(account, viewName, bskb, error);
 552                 return result;
 553             });
 554         }
 555     });
 556
 557     return result;
 558
 559 }
 560
 561 SOSBackupSliceKeyBagRef SOSAccountBackupSliceKeyBagForView(SOSAccount*  account, CFStringRef viewName, CFErrorRef* error){
 562     CFDataRef backupSliceData = NULL;
 563     CFStringRef ringName = NULL;
 564     SOSRingRef ring = NULL;
 565     SOSBackupSliceKeyBagRef bskb = NULL;
 566
 567     ringName = SOSBackupCopyRingNameForView(viewName);
 568     ring = [account.trust copyRing:ringName err:NULL];
 569     require_action_quiet(ring, exit, SOSCreateErrorWithFormat(kSOSErrorNoCircle, NULL, error, NULL, CFSTR("failed to get ring")));
 570
 571     //grab the backup slice from the ring
 572     backupSliceData = SOSRingGetPayload(ring, error);
 573     require_action_quiet(backupSliceData, exit, secnotice("backup", "failed to get backup slice (%@)", *error));
 574
 575     bskb = SOSBackupSliceKeyBagCreateFromData(kCFAllocatorDefault, backupSliceData, error);
 576
 577 exit:
 578     CFReleaseNull(ring);
 579     CFReleaseNull(ringName);
 580
 581     return bskb;
 582 }
 583
 584 bool SOSAccountIsLastBackupPeer(SOSAccount*  account, CFErrorRef *error) {
 585     __block bool retval = false;
 586     SOSPeerInfoRef pi = account.peerInfo;
 587     if(!SOSPeerInfoHasBackupKey(pi))
 588         return retval;
 589
 590     SOSCircleRef circle = [account.trust getCircle:error];
 591     if(![account.trust isInCircle:error])
 592         return retval;
 593     if(SOSCircleCountValidSyncingPeers(circle, SOSAccountGetTrustedPublicCredential(account, error)) == 1){
 594         retval = true;
 595         return retval;
 596     }
 597     // We're in a circle with more than 1 ActiveValidPeers - are they in the backups?
 598     SOSAccountForEachBackupView(account, ^(const void *value) {
 599         CFStringRef viewname = (CFStringRef) value;
 600         SOSBackupSliceKeyBagRef keybag = SOSAccountBackupSliceKeyBagForView(account, viewname, error);
 601         require_quiet(keybag, inner_errOut);
 602         retval |= ((SOSBSKBCountPeers(keybag) == 1) && (SOSBSKBPeerIsInKeyBag(keybag, pi)));
 603     inner_errOut:
 604         CFReleaseNull(keybag);
 605     });
 606
 607     return retval;
 608 }