2 * Copyright (c) 2016 Apple Inc. All Rights Reserved.
4 * @APPLE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
21 * @APPLE_LICENSE_HEADER_END@
24 #import "CKKSKeychainView.h"
25 #import "CKKSIncomingQueueOperation.h"
26 #import "CKKSIncomingQueueEntry.h"
27 #import "CKKSItemEncrypter.h"
28 #import "CKKSOutgoingQueueEntry.h"
30 #import "CKKSManifest.h"
31 #import "CKKSAnalyticsLogger.h"
32 #import "keychain/ckks/CKKSCurrentItemPointer.h"
34 #include <securityd/SecItemServer.h>
35 #include <securityd/SecItemDb.h>
36 #include <Security/SecItemPriv.h>
38 #include <utilities/SecADWrapper.h>
42 @interface CKKSIncomingQueueOperation ()
43 @property bool newOutgoingEntries;
44 @property bool pendingClassAEntries;
47 @implementation CKKSIncomingQueueOperation
49 - (instancetype)init {
52 - (instancetype)initWithCKKSKeychainView:(CKKSKeychainView*)ckks errorOnClassAFailure:(bool)errorOnClassAFailure {
53 if(self = [super init]) {
56 // Can't process unless we have a reasonable key hierarchy.
57 if(ckks.keyStateReadyDependency) {
58 [self addDependency: ckks.keyStateReadyDependency];
61 _errorOnClassAFailure = errorOnClassAFailure;
62 _pendingClassAEntries = false;
64 [self linearDependencies:ckks.incomingQueueOperations];
66 if ([CKKSManifest shouldSyncManifests]) {
67 __weak __typeof(self) weakSelf = self;
68 __weak CKKSKeychainView* weakCKKS = ckks;
69 CKKSResultOperation* updateManifestOperation = [CKKSResultOperation operationWithBlock:^{
70 __strong __typeof(self) strongSelf = weakSelf;
71 __strong CKKSKeychainView* strongCKKS = weakCKKS;
72 __block NSError* error = nil;
73 if (!strongCKKS || !strongSelf) {
74 ckkserror("ckksincoming", strongCKKS, "update manifest operation fired for released object");
78 [strongCKKS dispatchSyncWithAccountQueue:^bool{
79 strongCKKS.latestManifest = [CKKSManifest latestTrustedManifestForZone:strongCKKS.zoneName error:&error];
81 strongSelf.error = error;
82 ckkserror("ckksincoming", strongCKKS, "failed to get latest manifest: %@", error);
90 updateManifestOperation.name = @"update-manifest-operation";
92 [ckks scheduleOperation:updateManifestOperation];
93 [self addSuccessDependency:updateManifestOperation];
99 - (bool)processNewCurrentItemPointers:(NSArray<CKKSCurrentItemPointer*>*)queueEntries withManifest:(CKKSManifest*)manifest egoManifest:(CKKSEgoManifest*)egoManifest
101 CKKSKeychainView* ckks = self.ckks;
103 NSError* error = nil;
104 for(CKKSCurrentItemPointer* p in queueEntries) {
105 if ([CKKSManifest shouldSyncManifests]) {
106 if (![manifest validateCurrentItem:p withError:&error]) {
107 ckkserror("ckksincoming", ckks, "Unable to validate current item pointer (%@) against manifest (%@)", p, manifest);
108 [[CKKSAnalyticsLogger logger] logSoftFailureForEventNamed:@"CKKSManifestCurrentItemPointerValidation" withAttributes:@{CKKSManifestZoneKey : ckks.zoneID.zoneName, CKKSManifestSignerIDKey : manifest.signerID ?: @"no signer", CKKSManifestGenCountKey : @(manifest.generationCount)}];
109 if ([CKKSManifest shouldEnforceManifests]) {
114 [[CKKSAnalyticsLogger logger] logSuccessForEventNamed:@"CKKSManifestCurrentItemPointerValidation"];
118 p.state = SecCKKSProcessedStateLocal;
120 [p saveToDatabase:&error];
121 ckksnotice("ckkspointer", ckks, "Saving new current item pointer: %@", p);
123 ckkserror("ckksincoming", ckks, "Error saving new current item pointer: %@ %@", error, p);
126 // Schedule a view change notification
127 [ckks.notifyViewChangedScheduler trigger];
130 if(queueEntries.count > 0) {
131 // Schedule a view change notification
132 [ckks.notifyViewChangedScheduler trigger];
135 return (error == nil);
138 - (bool)processQueueEntries:(NSArray<CKKSIncomingQueueEntry*>*)queueEntries withManifest:(CKKSManifest*)manifest egoManifest:(CKKSEgoManifest*)egoManifest
140 CKKSKeychainView* ckks = self.ckks;
142 NSMutableArray* newOrChangedRecords = [[NSMutableArray alloc] init];
143 NSMutableArray* deletedRecordIDs = [[NSMutableArray alloc] init];
144 NSInteger manifestGenerationCount = manifest.generationCount;
145 NSString* manifestSignerID = manifest.signerID ?: @"no signer";
147 for(id entry in queueEntries) {
149 ckksnotice("ckksincoming", ckks, "CKKSIncomingQueueOperation cancelled, quitting");
153 NSError* error = nil;
155 CKKSIncomingQueueEntry* iqe = (CKKSIncomingQueueEntry*) entry;
156 ckksnotice("ckksincoming", ckks, "ready to process an incoming queue entry: %@ %@ %@", iqe, iqe.uuid, iqe.action);
158 // Note that we currently unencrypt the item before deleting it, instead of just deleting it
159 // This finds the class, which is necessary for the deletion process. We could just try to delete
160 // across all classes, though...
161 NSMutableDictionary* attributes = [[CKKSItemEncrypter decryptItemToDictionary: iqe.item error:&error] mutableCopy];
162 if(!attributes || error) {
163 if([ckks.lockStateTracker isLockedError:error]) {
164 NSError* localerror = nil;
165 ckkserror("ckksincoming", ckks, "Keychain is locked; can't decrypt IQE %@", iqe);
166 CKKSKey* key = [CKKSKey tryFromDatabase:iqe.item.parentKeyUUID zoneID:ckks.zoneID error:&localerror];
167 if(localerror || ([key.keyclass isEqualToString:SecCKKSKeyClassA] && self.errorOnClassAFailure)) {
171 // If this isn't an error, make sure it gets processed later.
172 if([key.keyclass isEqualToString:SecCKKSKeyClassA] && !self.errorOnClassAFailure) {
173 self.pendingClassAEntries = true;
176 } else if ([error.domain isEqualToString:@"securityd"] && error.code == errSecItemNotFound) {
177 ckkserror("ckksincoming", ckks, "Coudn't find key in keychain; attempting to poke key hierarchy: %@", error)
178 [ckks _onqueueAdvanceKeyStateMachineToState: nil withError: nil];
181 ckkserror("ckksincoming", ckks, "Couldn't decrypt IQE %@ for some reason: %@", iqe, error);
187 // Add the UUID (which isn't stored encrypted)
188 [attributes setValue: iqe.item.uuid forKey: (__bridge NSString*) kSecAttrUUID];
190 // Add the PCS plaintext fields, if they exist
191 if(iqe.item.plaintextPCSServiceIdentifier) {
192 [attributes setValue: iqe.item.plaintextPCSServiceIdentifier forKey: (__bridge NSString*) kSecAttrPCSPlaintextServiceIdentifier];
194 if(iqe.item.plaintextPCSPublicKey) {
195 [attributes setValue: iqe.item.plaintextPCSPublicKey forKey: (__bridge NSString*) kSecAttrPCSPlaintextPublicKey];
197 if(iqe.item.plaintextPCSPublicIdentity) {
198 [attributes setValue: iqe.item.plaintextPCSPublicIdentity forKey: (__bridge NSString*) kSecAttrPCSPlaintextPublicIdentity];
201 // This item is also synchronizable (by definition)
202 [attributes setValue: @(YES) forKey: (__bridge NSString*) kSecAttrSynchronizable];
204 NSString* classStr = [attributes objectForKey: (__bridge NSString*) kSecClass];
205 if(![classStr isKindOfClass: [NSString class]]) {
206 self.error = [NSError errorWithDomain:@"securityd"
207 code:errSecInternalError
208 userInfo:@{NSLocalizedDescriptionKey : [NSString stringWithFormat:@"Item did not have a reasonable class: %@", classStr]}];
209 ckkserror("ckksincoming", ckks, "Synced item seems wrong: %@", self.error);
213 const SecDbClass * classP = !classStr ? NULL : kc_class_with_name((__bridge CFStringRef) classStr);
216 ckkserror("ckksincoming", ckks, "unknown class in object: %@ %@", classStr, iqe);
217 iqe.state = SecCKKSStateError;
218 [iqe saveToDatabase:&error];
220 ckkserror("ckksincoming", ckks, "Couldn't save errored IQE to database: %@", error);
226 if([iqe.action isEqualToString: SecCKKSActionAdd] || [iqe.action isEqualToString: SecCKKSActionModify]) {
227 BOOL requireManifestValidation = [CKKSManifest shouldEnforceManifests];
228 BOOL manifestValidatesItem = [manifest validateItem:iqe.item withError:&error];
229 if (manifestValidatesItem) {
230 [[CKKSAnalyticsLogger logger] logSuccessForEventNamed:@"CKKSManifestValidateItemAdd"];
233 [[CKKSAnalyticsLogger logger] logSoftFailureForEventNamed:@"CKKSManifestValidateItemAdd" withAttributes:@{CKKSManifestZoneKey : ckks.zoneID.zoneName, CKKSManifestSignerIDKey : manifestSignerID, CKKSManifestGenCountKey : @(manifestGenerationCount)}];
236 if (!requireManifestValidation || manifestValidatesItem) {
237 [self _onqueueHandleIQEChange: iqe attributes:attributes class:classP];
238 [newOrChangedRecords addObject:[iqe.item CKRecordWithZoneID:ckks.zoneID]];
241 ckkserror("ckksincoming", ckks, "could not validate incoming item against manifest with error: %@", error);
242 if (![self _onqueueUpdateIQE:iqe withState:SecCKKSStateUnauthenticated error:&error]) {
243 ckkserror("ckksincoming", ckks, "failed to save incoming item back to database in unauthenticated state with error: %@", error);
249 } else if ([iqe.action isEqualToString: SecCKKSActionDelete]) {
250 BOOL requireManifestValidation = [CKKSManifest shouldEnforceManifests];
251 BOOL manifestValidatesDelete = ![manifest itemUUIDExistsInManifest:iqe.uuid];
252 if (manifestValidatesDelete) {
253 [[CKKSAnalyticsLogger logger] logSuccessForEventNamed:@"CKKSManifestValidateItemDelete"];
256 [[CKKSAnalyticsLogger logger] logSoftFailureForEventNamed:@"CKKSManifestValidateItemDelete" withAttributes:@{CKKSManifestZoneKey : ckks.zoneID.zoneName, CKKSManifestSignerIDKey : manifestSignerID, CKKSManifestGenCountKey : @(manifestGenerationCount)}];
259 if (!requireManifestValidation || manifestValidatesDelete) {
260 // if the item does not exist in the latest manifest, we're good to delete it
261 [self _onqueueHandleIQEDelete: iqe class:classP];
262 [deletedRecordIDs addObject:[[CKRecordID alloc] initWithRecordName:iqe.uuid zoneID:ckks.zoneID]];
265 // if the item DOES exist in the manifest, we can't trust the deletion
266 ckkserror("ckksincoming", ckks, "could not validate incoming item deletion against manifest");
267 if (![self _onqueueUpdateIQE:iqe withState:SecCKKSStateUnauthenticated error:&error]) {
268 ckkserror("ckksincoming", ckks, "failed to save incoming item deletion back to database in unauthenticated state with error: %@", error);
275 if(newOrChangedRecords.count > 0 || deletedRecordIDs > 0) {
276 // Schedule a view change notification
277 [ckks.notifyViewChangedScheduler trigger];
280 if ([CKKSManifest shouldSyncManifests]) {
281 [egoManifest updateWithNewOrChangedRecords:newOrChangedRecords deletedRecordIDs:deletedRecordIDs];
286 - (bool)_onqueueUpdateIQE:(CKKSIncomingQueueEntry*)iqe withState:(NSString*)newState error:(NSError**)error
288 if (![iqe.state isEqualToString:newState]) {
289 NSMutableDictionary* oldWhereClause = iqe.whereClauseToFindSelf.mutableCopy;
290 oldWhereClause[@"state"] = iqe.state;
291 iqe.state = newState;
292 if ([iqe saveToDatabase:error]) {
293 if (![CKKSSQLDatabaseObject deleteFromTable:[iqe.class sqlTable] where:oldWhereClause connection:NULL error:error]) {
306 // Synchronous, on some thread. Get back on the CKKS queue for thread-safety.
307 CKKSKeychainView* ckks = self.ckks;
309 ckkserror("ckksincoming", ckks, "no CKKS object");
313 [ckks dispatchSyncWithAccountQueue: ^bool{
315 ckksnotice("ckksincoming", ckks, "CKKSIncomingQueueOperation cancelled, quitting");
318 ckks.lastIncomingQueueOperation = self;
320 ckksnotice("ckksincoming", ckks, "Processing incoming queue");
322 if ([CKKSManifest shouldSyncManifests]) {
323 if (!ckks.latestManifest) {
324 // Until we can make manifests in our unit tests, we can't abort here
325 ckkserror("ckksincoming", ckks, "no manifest in ckks");
327 if (!ckks.egoManifest) {
328 ckkserror("ckksincoming", ckks, "no ego manifest in ckks");
332 bool ok = true; // Should commit transaction?
333 __block NSError* error = nil;
335 if ([CKKSManifest shouldSyncManifests]) {
336 NSDictionary<NSString*, NSNumber*>* stateCounts = [CKKSIncomingQueueEntry countsByState:ckks.zoneID error:&error];
338 ckkserror("ckksincoming", ckks, "Error fetching incoming queue state counts: %@", error);
342 NSUInteger unauthenticatedItemCount = stateCounts[SecCKKSStateUnauthenticated].unsignedIntegerValue;
344 // take any existing unauthenticated entries and put them back in the new state
345 NSArray<CKKSIncomingQueueEntry*>* unauthenticatedEntries = nil;
346 NSString* lastMaxUUID = nil;
347 NSUInteger numEntriesProcessed = 0;
348 while (numEntriesProcessed < unauthenticatedItemCount && (unauthenticatedEntries == nil || unauthenticatedEntries.count == SecCKKSIncomingQueueItemsAtOnce)) {
350 ckksnotice("ckksincoming", ckks, "CKKSIncomingQueueOperation cancelled, quitting");
354 unauthenticatedEntries = [CKKSIncomingQueueEntry fetch:SecCKKSIncomingQueueItemsAtOnce
355 startingAtUUID:lastMaxUUID
356 state:SecCKKSStateUnauthenticated
360 ckkserror("ckksincoming", ckks, "Error fetching unauthenticated queue records: %@", error);
365 if (unauthenticatedEntries.count == 0) {
366 ckksinfo("ckksincoming", ckks, "No unauthenticated entries in incoming queue to process");
370 for (CKKSIncomingQueueEntry* unauthenticatedEntry in unauthenticatedEntries) {
371 if (![self _onqueueUpdateIQE:unauthenticatedEntry withState:SecCKKSStateNew error:&error]) {
372 ckkserror("ckksincoming", ckks, "Error saving unauthenticated entry back to new state: %@", error);
377 lastMaxUUID = ([lastMaxUUID compare:unauthenticatedEntry.uuid] == NSOrderedDescending) ? lastMaxUUID : unauthenticatedEntry.uuid;
382 // Iterate through all incoming queue entries a chunk at a time (for peak memory concerns)
383 NSArray<CKKSIncomingQueueEntry*> * queueEntries = nil;
384 NSString* lastMaxUUID = nil;
385 NSUInteger processedItems = 0;
386 while(queueEntries == nil || queueEntries.count == SecCKKSIncomingQueueItemsAtOnce) {
388 ckksnotice("ckksincoming", ckks, "CKKSIncomingQueueOperation cancelled, quitting");
392 queueEntries = [CKKSIncomingQueueEntry fetch: SecCKKSIncomingQueueItemsAtOnce
393 startingAtUUID:lastMaxUUID
394 state:SecCKKSStateNew
399 ckkserror("ckksincoming", ckks, "Error fetching incoming queue records: %@", error);
404 if([queueEntries count] == 0) {
405 // Nothing to do! exit.
406 ckksnotice("ckksincoming", ckks, "Nothing in incoming queue to process");
410 if (![self processQueueEntries:queueEntries withManifest:ckks.latestManifest egoManifest:ckks.egoManifest]) {
411 ckksnotice("ckksincoming", ckks, "processQueueEntries didn't complete successfully");
414 processedItems += [queueEntries count];
416 // Find the highest UUID for the next fetch.
417 for(CKKSIncomingQueueEntry* iqe in queueEntries) {
418 lastMaxUUID = ([lastMaxUUID compare:iqe.uuid] == NSOrderedDescending) ? lastMaxUUID : iqe.uuid;
422 // Process other queues: CKKSCurrentItemPointers
423 ckksnotice("ckksincoming", ckks, "Processed %lu items in incoming queue", processedItems);
425 NSArray<CKKSCurrentItemPointer*>* newCIPs = [CKKSCurrentItemPointer remoteItemPointers:ckks.zoneID error:&error];
426 if(error || !newCIPs) {
427 ckkserror("ckksincoming", ckks, "Could not load remote item pointers: %@", error);
429 if (![self processNewCurrentItemPointers:newCIPs withManifest:ckks.latestManifest egoManifest:ckks.egoManifest]) {
432 ckksnotice("ckksincoming", ckks, "Processed %lu items in CIP queue", newCIPs.count);
435 if(self.newOutgoingEntries) {
436 // No operation group
437 [ckks processOutgoingQueue:nil];
440 if(self.pendingClassAEntries) {
441 [self.ckks processIncomingQueueAfterNextUnlock];
444 __weak __typeof(self) weakSelf = self;
445 self.completionBlock = ^(void) {
446 __strong __typeof(self) strongSelf = weakSelf;
448 ckkserror("ckksincoming", ckks, "received callback for released object");
452 if (!strongSelf.error) {
453 CKKSAnalyticsLogger* logger = [CKKSAnalyticsLogger logger];
454 [logger logSuccessForEvent:CKKSEventProcessIncomingQueueClassC inView:ckks];
455 if (!strongSelf.pendingClassAEntries) {
456 [logger logSuccessForEvent:CKKSEventProcessIncomingQueueClassA inView:ckks];
465 - (void)_onqueueHandleIQEChange: (CKKSIncomingQueueEntry*) iqe attributes:(NSDictionary*)attributes class:(const SecDbClass *)classP {
466 CKKSKeychainView* ckks = self.ckks;
468 ckkserror("ckksincoming", ckks, "no CKKS object");
472 dispatch_assert_queue(ckks.queue);
475 __block CFErrorRef cferror = NULL;
476 __block NSError* error = NULL;
478 SecDbItemRef item = SecDbItemCreateWithAttributes(NULL, classP, (__bridge CFDictionaryRef) attributes, KEYBAG_DEVICE, &cferror);
480 __block NSDate* moddate = (__bridge NSDate*) CFDictionaryGetValue(item->attributes, kSecAttrModificationDate);
482 ok = kc_with_dbt(true, &cferror, ^(SecDbConnectionRef dbt){
483 bool replaceok = SecDbItemInsertOrReplace(item, dbt, &cferror, ^(SecDbItemRef olditem, SecDbItemRef *replace) {
484 // If the UUIDs do not match, then select the item with the 'lower' UUID, and tell CKKS to
485 // delete the item with the 'higher' UUID.
486 // Otherwise, the cloud wins.
488 SecADAddValueForScalarKey((__bridge CFStringRef) SecCKKSAggdPrimaryKeyConflict,1);
490 // Note that SecDbItemInsertOrReplace CFReleases any replace pointer it's given, so, be careful
492 if(!CFDictionaryContainsKey(olditem->attributes, kSecAttrUUID)) {
493 // No UUID -> no good.
494 ckksnotice("ckksincoming", ckks, "Replacing item (it doesn't have a UUID) for %@", iqe.uuid);
496 *replace = CFRetainSafe(item);
501 CFStringRef itemUUID = CFDictionaryGetValue(item->attributes, kSecAttrUUID);
502 CFStringRef olditemUUID = CFDictionaryGetValue(olditem->attributes, kSecAttrUUID);
504 CFComparisonResult compare = CFStringCompare(itemUUID, olditemUUID, 0);
505 CKKSOutgoingQueueEntry* oqe = nil;
507 case kCFCompareLessThan:
508 // item wins; delete olditem
509 ckksnotice("ckksincoming", ckks, "Primary key conflict; replacing %@ with CK item %@", olditem, item);
511 *replace = CFRetainSafe(item);
512 moddate = (__bridge NSDate*) CFDictionaryGetValue(item->attributes, kSecAttrModificationDate);
515 oqe = [CKKSOutgoingQueueEntry withItem:olditem action:SecCKKSActionDelete ckks:ckks error:&error];
516 [oqe saveToDatabase: &error];
517 self.newOutgoingEntries = true;
519 case kCFCompareGreaterThan:
520 // olditem wins; don't change olditem; delete item
521 ckksnotice("ckksincoming", ckks, "Primary key conflict; dropping CK item %@", item);
523 oqe = [CKKSOutgoingQueueEntry withItem:item action:SecCKKSActionDelete ckks:ckks error:&error];
524 [oqe saveToDatabase: &error];
525 self.newOutgoingEntries = true;
529 case kCFCompareEqualTo:
530 // remote item wins; this is the normal update case
531 ckksnotice("ckksincoming", ckks, "Primary key conflict; replacing %@ with CK item %@", olditem, item);
533 *replace = CFRetainSafe(item);
534 moddate = (__bridge NSDate*) CFDictionaryGetValue(item->attributes, kSecAttrModificationDate);
540 // SecDbItemInsertOrReplace returns an error even when it succeeds.
541 if(!replaceok && SecErrorIsSqliteDuplicateItemError(cferror)) {
542 CFReleaseNull(cferror);
551 ckkserror("ckksincoming", ckks, "couldn't process item from IncomingQueue: %@", cferror);
552 SecTranslateError(&error, cferror);
555 iqe.state = SecCKKSStateError;
556 [iqe saveToDatabase:&error];
558 ckkserror("ckksincoming", ckks, "Couldn't save errored IQE to database: %@", error);
565 ckkserror("ckksincoming", ckks, "Couldn't handle IQE, but why?: %@", error);
571 ckksinfo("ckksincoming", ckks, "Correctly processed an IQE; deleting");
572 [iqe deleteFromDatabase: &error];
575 ckkserror("ckksincoming", ckks, "couldn't delete CKKSIncomingQueueEntry: %@", error);
580 // Log the number of seconds it took to propagate this change
581 uint64_t secondsDelay = (uint64_t) ([[NSDate date] timeIntervalSinceDate:moddate]);
582 SecADClientPushValueForDistributionKey((__bridge CFStringRef) SecCKKSAggdPropagationDelay, secondsDelay);
586 ckksnotice("ckksincoming", ckks, "IQE not correctly processed, but why? %@ %@", error, cferror);
589 iqe.state = SecCKKSStateError;
590 [iqe saveToDatabase:&error];
592 ckkserror("ckksincoming", ckks, "Couldn't save errored IQE to database: %@", error);
598 - (void)_onqueueHandleIQEDelete: (CKKSIncomingQueueEntry*) iqe class:(const SecDbClass *)classP {
599 CKKSKeychainView* ckks = self.ckks;
601 ckkserror("ckksincoming", ckks, "no CKKS object");
605 dispatch_assert_queue(ckks.queue);
608 __block CFErrorRef cferror = NULL;
609 NSError* error = NULL;
610 NSDictionary* queryAttributes = @{(__bridge NSString*) kSecClass: (__bridge NSString*) classP->name,
611 (__bridge NSString*) kSecAttrUUID: iqe.uuid,
612 (__bridge NSString*) kSecAttrSyncViewHint: ckks.zoneID.zoneName,
613 (__bridge NSString*) kSecAttrSynchronizable: @(YES)};
614 ckksnotice("ckksincoming", ckks, "trying to delete with query: %@", queryAttributes);
615 Query *q = query_create_with_limit( (__bridge CFDictionaryRef) queryAttributes, NULL, kSecMatchUnlimited, &cferror);
619 ckkserror("ckksincoming", ckks, "couldn't create query: %@", cferror);
620 SecTranslateError(&error, cferror);
625 ok = kc_with_dbt(true, &cferror, ^(SecDbConnectionRef dbt) {
626 return s3dl_query_delete(dbt, q, NULL, &cferror);
630 if(CFErrorGetCode(cferror) == errSecItemNotFound) {
631 ckkserror("ckksincoming", ckks, "couldn't delete item (as it's already gone); this is okay: %@", cferror);
633 CFReleaseNull(cferror);
635 ckkserror("ckksincoming", ckks, "couldn't delete item: %@", cferror);
636 SecTranslateError(&error, cferror);
638 query_destroy(q, NULL);
644 ok = query_notify_and_destroy(q, ok, &cferror);
647 ckkserror("ckksincoming", ckks, "couldn't delete query: %@", cferror);
648 SecTranslateError(&error, cferror);
654 ckksnotice("ckksincoming", ckks, "Correctly processed an IQE; deleting");
655 [iqe deleteFromDatabase: &error];
658 ckkserror("ckksincoming", ckks, "couldn't delete CKKSIncomingQueueEntry: %@", error);
662 ckkserror("ckksincoming", ckks, "IQE not correctly processed, but why? %@ %@", error, cferror);