keychain/ckks/CKKSKeychainView.m

   1 /*
   2  * Copyright (c) 2016 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import "CKKSKeychainView.h"
  25
  26
  27
  28 #if OCTAGON
  29 #import "CloudKitDependencies.h"
  30 #import <CloudKit/CloudKit.h>
  31 #import <CloudKit/CloudKit_Private.h>
  32 #endif
  33
  34 #import "CKKS.h"
  35 #import "CKKSAPSReceiver.h"
  36 #import "CKKSIncomingQueueEntry.h"
  37 #import "CKKSOutgoingQueueEntry.h"
  38 #import "CKKSCurrentKeyPointer.h"
  39 #import "CKKSKey.h"
  40 #import "CKKSMirrorEntry.h"
  41 #import "CKKSZoneStateEntry.h"
  42 #import "CKKSItemEncrypter.h"
  43 #import "CKKSIncomingQueueOperation.h"
  44 #import "CKKSNewTLKOperation.h"
  45 #import "CKKSProcessReceivedKeysOperation.h"
  46 #import "CKKSZone.h"
  47 #import "CKKSFetchAllRecordZoneChangesOperation.h"
  48 #import "CKKSHealKeyHierarchyOperation.h"
  49 #import "CKKSReencryptOutgoingItemsOperation.h"
  50 #import "CKKSScanLocalItemsOperation.h"
  51 #import "CKKSSynchronizeOperation.h"
  52 #import "CKKSRateLimiter.h"
  53 #import "CKKSManifest.h"
  54 #import "CKKSManifestLeafRecord.h"
  55 #import "CKKSZoneChangeFetcher.h"
  56 #import "keychain/ckks/CKKSDeviceStateEntry.h"
  57 #import "keychain/ckks/CKKSNearFutureScheduler.h"
  58 #import "keychain/ckks/CKKSCurrentItemPointer.h"
  59 #import "keychain/ckks/CKKSUpdateCurrentItemPointerOperation.h"
  60 #import "keychain/ckks/CKKSUpdateDeviceStateOperation.h"
  61 #import "keychain/ckks/CKKSLockStateTracker.h"
  62 #import "keychain/ckks/CKKSNotifier.h"
  63 #import "keychain/ckks/CloudKitCategories.h"
  64
  65 #include <utilities/SecCFWrappers.h>
  66 #include <utilities/SecDb.h>
  67 #include <securityd/SecDbItem.h>
  68 #include <securityd/SecItemDb.h>
  69 #include <securityd/SecItemSchema.h>
  70 #include <securityd/SecItemServer.h>
  71 #include <utilities/debugging.h>
  72 #include <Security/SecItemPriv.h>
  73 #include <Security/SecureObjectSync/SOSAccountTransaction.h>
  74 #include <utilities/SecADWrapper.h>
  75 #include <utilities/SecPLWrappers.h>
  76
  77 #if OCTAGON
  78 @interface CKKSKeychainView()
  79 @property bool setupSuccessful;
  80 @property bool keyStateFetchRequested;
  81 @property bool keyStateFullRefetchRequested;
  82 @property bool keyStateProcessRequested;
  83 @property (atomic) NSString *activeTLK;
  84
  85 @property (readonly) Class<CKKSNotifier> notifierClass;
  86
  87 @property CKKSNearFutureScheduler* initializeScheduler;
  88
  89 @property CKKSResultOperation* processIncomingQueueAfterNextUnlockOperation;
  90
  91 @property NSMutableDictionary<NSString*, SecBoolNSErrorCallback>* pendingSyncCallbacks;
  92 @end
  93 #endif
  94
  95 @implementation CKKSKeychainView
  96 #if OCTAGON
  97
  98 - (instancetype)initWithContainer:     (CKContainer*) container
  99                              zoneName: (NSString*) zoneName
 100                        accountTracker:(CKKSCKAccountStateTracker*) accountTracker
 101                      lockStateTracker:(CKKSLockStateTracker*) lockStateTracker
 102                      savedTLKNotifier:(CKKSNearFutureScheduler*) savedTLKNotifier
 103  fetchRecordZoneChangesOperationClass: (Class<CKKSFetchRecordZoneChangesOperation>) fetchRecordZoneChangesOperationClass
 104     modifySubscriptionsOperationClass: (Class<CKKSModifySubscriptionsOperation>) modifySubscriptionsOperationClass
 105       modifyRecordZonesOperationClass: (Class<CKKSModifyRecordZonesOperation>) modifyRecordZonesOperationClass
 106                    apsConnectionClass: (Class<CKKSAPSConnection>) apsConnectionClass
 107                         notifierClass: (Class<CKKSNotifier>) notifierClass
 108 {
 109
 110     if(self = [super initWithContainer:container
 111                               zoneName:zoneName
 112                         accountTracker:accountTracker
 113   fetchRecordZoneChangesOperationClass:fetchRecordZoneChangesOperationClass
 114      modifySubscriptionsOperationClass:modifySubscriptionsOperationClass
 115        modifyRecordZonesOperationClass:modifyRecordZonesOperationClass
 116                     apsConnectionClass:apsConnectionClass]) {
 117         __weak __typeof(self) weakSelf = self;
 118
 119         _incomingQueueOperations = [NSHashTable weakObjectsHashTable];
 120         _outgoingQueueOperations = [NSHashTable weakObjectsHashTable];
 121         _zoneChangeFetcher = [[CKKSZoneChangeFetcher alloc] initWithCKKSKeychainView: self];
 122
 123         _notifierClass = notifierClass;
 124         _notifyViewChangedScheduler = [[CKKSNearFutureScheduler alloc] initWithName:[NSString stringWithFormat: @"%@-notify-scheduler", self.zoneName]
 125                                                             initialDelay:250*NSEC_PER_MSEC
 126                                                          continuingDelay:1*NSEC_PER_SEC
 127                                                         keepProcessAlive:true
 128                                                                    block:^{
 129                                                                        __strong __typeof(self) strongSelf = weakSelf;
 130                                                                        ckksnotice("ckks", strongSelf, "");
 131                                                                        [strongSelf.notifierClass post:[NSString stringWithFormat:@"com.apple.security.view-change.%@", strongSelf.zoneName]];
 132
 133                                                                        // Ugly, but: the Manatee and Engram views need to send a fake 'PCS' view change.
 134                                                                        // TODO: make this data-driven somehow
 135                                                                        if([strongSelf.zoneName isEqualToString:@"Manatee"] || [strongSelf.zoneName isEqualToString:@"Engram"]) {
 136                                                                            [strongSelf.notifierClass post:@"com.apple.security.view-change.PCS"];
 137                                                                        }
 138                                                                    }];
 139
 140         _pendingSyncCallbacks = [[NSMutableDictionary alloc] init];
 141
 142         _lockStateTracker = lockStateTracker;
 143         _savedTLKNotifier = savedTLKNotifier;
 144
 145         _setupSuccessful = false;
 146
 147         _keyHierarchyConditions = [[NSMutableDictionary alloc] init];
 148         [CKKSZoneKeyStateMap() enumerateKeysAndObjectsUsingBlock:^(CKKSZoneKeyState * _Nonnull key, NSNumber * _Nonnull obj, BOOL * _Nonnull stop) {
 149             [self.keyHierarchyConditions setObject: [[CKKSCondition alloc] init] forKey:key];
 150         }];
 151
 152         self.keyHierarchyState = SecCKKSZoneKeyStateInitializing;
 153         _keyHierarchyError = nil;
 154         _keyHierarchyOperationGroup = nil;
 155         _keyStateMachineOperation = nil;
 156         _keyStateFetchRequested = false;
 157         _keyStateProcessRequested = false;
 158
 159         _keyStateReadyDependency = [CKKSResultOperation operationWithBlock:^{
 160             ckksnotice("ckkskey", weakSelf, "Key state has become ready for the first time.");
 161         }];
 162         self.keyStateReadyDependency.name = [NSString stringWithFormat: @"%@-key-state-ready", self.zoneName];
 163
 164         dispatch_time_t initializeDelay = SecCKKSTestsEnabled() ? NSEC_PER_MSEC * 500 : NSEC_PER_SEC * 30;
 165         _initializeScheduler = [[CKKSNearFutureScheduler alloc] initWithName:[NSString stringWithFormat: @"%@-zone-initializer", self.zoneName]
 166                                                                 initialDelay:0
 167                                                              continuingDelay:initializeDelay
 168                                                             keepProcessAlive:false
 169                                                                        block:^{
 170                                                                            __strong __typeof(self) strongSelf = weakSelf;
 171                                                                            ckksnotice("ckks", strongSelf, "initialize-scheduler restarting setup");
 172                                                                            [strongSelf maybeRestartSetup];
 173                                                                        }];
 174
 175     }
 176     return self;
 177 }
 178
 179 - (NSString*)description {
 180     return [NSString stringWithFormat:@"<%@: %@>", NSStringFromClass([self class]), self.zoneName];
 181 }
 182
 183 - (NSString*)debugDescription {
 184     return [NSString stringWithFormat:@"<%@: %@ %p>", NSStringFromClass([self class]), self.zoneName, self];
 185 }
 186
 187 - (CKKSZoneKeyState*)keyHierarchyState {
 188     return _keyHierarchyState;
 189 }
 190
 191 - (void)setKeyHierarchyState:(CKKSZoneKeyState *)keyHierarchyState {
 192     if((keyHierarchyState == nil && _keyHierarchyState == nil) || ([keyHierarchyState isEqualToString:_keyHierarchyState])) {
 193         // No change, do nothing.
 194     } else {
 195         // Fixup the condition variables
 196         if(_keyHierarchyState) {
 197             self.keyHierarchyConditions[_keyHierarchyState] = [[CKKSCondition alloc] init];
 198         }
 199         if(keyHierarchyState) {
 200             [self.keyHierarchyConditions[keyHierarchyState] fulfill];
 201         }
 202     }
 203
 204     _keyHierarchyState = keyHierarchyState;
 205 }
 206
 207 - (NSString *)lastActiveTLKUUID
 208 {
 209     return self.activeTLK;
 210 }
 211
 212 - (void) initializeZone {
 213     // Unfortunate, but makes retriggering easy.
 214     [self.initializeScheduler trigger];
 215 }
 216
 217 - (void)maybeRestartSetup {
 218     [self dispatchSync: ^bool{
 219         if(self.setupStarted && !self.setupComplete) {
 220             ckksdebug("ckks", self, "setup has restarted. Ignoring timer fire");
 221             return false;
 222         }
 223
 224         if(self.setupSuccessful) {
 225             ckksdebug("ckks", self, "setup has completed successfully. Ignoring timer fire");
 226             return false;
 227         }
 228
 229         [self resetSetup];
 230         [self _onqueueInitializeZone];
 231         return true;
 232     }];
 233 }
 234
 235 - (void)resetSetup {
 236     [super resetSetup];
 237     self.setupSuccessful = false;
 238
 239     // Key hierarchy state machine resets, too
 240     self.keyHierarchyState = SecCKKSZoneKeyStateInitializing;
 241     _keyHierarchyError = nil;
 242 }
 243
 244  - (void)_onqueueInitializeZone {
 245     if(!SecCKKSIsEnabled()) {
 246         ckksnotice("ckks", self, "Skipping CloudKit initialization due to disabled CKKS");
 247         return;
 248     }
 249
 250     dispatch_assert_queue(self.queue);
 251
 252     __weak __typeof(self) weakSelf = self;
 253
 254     NSBlockOperation* afterZoneSetup = [NSBlockOperation blockOperationWithBlock: ^{
 255         __strong __typeof(weakSelf) strongSelf = weakSelf;
 256         if(!strongSelf) {
 257             ckkserror("ckks", strongSelf, "received callback for released object");
 258             return;
 259         }
 260
 261         __block bool quit = false;
 262
 263         [strongSelf dispatchSync: ^bool {
 264             ckksnotice("ckks", strongSelf, "Zone setup progress: %@ %d %@ %d %@",
 265                        [CKKSCKAccountStateTracker stringFromAccountStatus:strongSelf.accountStatus],
 266                        strongSelf.zoneCreated, strongSelf.zoneCreatedError, strongSelf.zoneSubscribed, strongSelf.zoneSubscribedError);
 267
 268             NSError* error = nil;
 269             CKKSZoneStateEntry* ckse = [CKKSZoneStateEntry state: strongSelf.zoneName];
 270             ckse.ckzonecreated = strongSelf.zoneCreated;
 271             ckse.ckzonesubscribed = strongSelf.zoneSubscribed;
 272
 273             // Although, if the zone subscribed error says there's no zone, mark down that there's no zone
 274             if(strongSelf.zoneSubscribedError &&
 275                [strongSelf.zoneSubscribedError.domain isEqualToString:CKErrorDomain] && strongSelf.zoneSubscribedError.code == CKErrorPartialFailure) {
 276                 NSError* subscriptionError = strongSelf.zoneSubscribedError.userInfo[CKPartialErrorsByItemIDKey][strongSelf.zoneID];
 277                 if(subscriptionError && [subscriptionError.domain isEqualToString:CKErrorDomain] && subscriptionError.code == CKErrorZoneNotFound) {
 278
 279                     ckkserror("ckks", strongSelf, "zone subscription error appears to say the zone doesn't exist, fixing status: %@", strongSelf.zoneSubscribedError);
 280                     ckse.ckzonecreated = false;
 281                 }
 282             }
 283
 284             [ckse saveToDatabase: &error];
 285             if(error) {
 286                 ckkserror("ckks", strongSelf, "couldn't save zone creation status for %@: %@", strongSelf.zoneName, error);
 287             }
 288
 289             if(!strongSelf.zoneCreated || !strongSelf.zoneSubscribed || strongSelf.accountStatus != CKAccountStatusAvailable) {
 290                 // Something has gone very wrong. Error out and maybe retry.
 291                 quit = true;
 292
 293                 // Note that CKKSZone has probably called [handleLogout]; which means we have a key hierarchy reset queued up. Error here anyway.
 294                 NSError* realReason = strongSelf.zoneCreatedError ? strongSelf.zoneCreatedError : strongSelf.zoneSubscribedError;
 295                 [strongSelf _onqueueAdvanceKeyStateMachineToState: SecCKKSZoneKeyStateError withError: realReason];
 296
 297                 // We're supposed to be up, but something has gone wrong. Blindly retry until it works.
 298                 if(strongSelf.accountStatus == CKKSAccountStatusAvailable) {
 299                     [strongSelf.initializeScheduler trigger];
 300                     ckksnotice("ckks", strongSelf, "We're logged in, but setup didn't work. Scheduling retry for %@", strongSelf.initializeScheduler.nextFireTime);
 301                 }
 302                 return true;
 303             } else {
 304                 strongSelf.setupSuccessful = true;
 305             }
 306
 307             return true;
 308         }];
 309
 310         if(quit) {
 311             ckkserror("ckks", strongSelf, "Quitting setup.");
 312             return;
 313         }
 314
 315         // We can't enter the account queue until an account exists. Before this point, we don't know if one does.
 316         [strongSelf dispatchSyncWithAccountQueue: ^bool{
 317             CKKSZoneStateEntry* ckse = [CKKSZoneStateEntry state: strongSelf.zoneName];
 318
 319             // Check if we believe we've synced this zone before.
 320             if(ckse.changeToken == nil) {
 321                 strongSelf.keyHierarchyOperationGroup = [CKOperationGroup CKKSGroupWithName:@"initial-setup"];
 322
 323                 ckksnotice("ckks", strongSelf, "No existing change token; going to try to match local items with CloudKit ones.");
 324
 325                 // Onboard this keychain: there's likely items in it that we haven't synced yet.
 326                 // But, there might be items in The Cloud that correspond to these items, with UUIDs that we don't know yet.
 327                 // First, fetch all remote items.
 328                 CKKSResultOperation* fetch = [strongSelf.zoneChangeFetcher requestSuccessfulFetch:CKKSFetchBecauseInitialStart];
 329                 fetch.name = @"initial-fetch";
 330
 331                 // Next, try to process them (replacing local entries)
 332                 CKKSIncomingQueueOperation* initialProcess = [strongSelf processIncomingQueue: true after: fetch ];
 333                 initialProcess.name = @"initial-process-incoming-queue";
 334
 335                 // If all that succeeds, iterate through all keychain items and find the ones which need to be uploaded
 336                 strongSelf.initialScanOperation = [[CKKSScanLocalItemsOperation alloc] initWithCKKSKeychainView:strongSelf ckoperationGroup:strongSelf.keyHierarchyOperationGroup];
 337                 strongSelf.initialScanOperation.name = @"initial-scan-operation";
 338                 [strongSelf.initialScanOperation addNullableDependency:strongSelf.lockStateTracker.unlockDependency];
 339                 [strongSelf.initialScanOperation addDependency: initialProcess];
 340                 [strongSelf scheduleOperation: strongSelf.initialScanOperation];
 341
 342             } else {
 343                 // Likely a restart of securityd!
 344
 345                 strongSelf.keyHierarchyOperationGroup = [CKOperationGroup CKKSGroupWithName:@"restart-setup"];
 346
 347                 if ([CKKSManifest shouldSyncManifests]) {
 348                     strongSelf.egoManifest = [CKKSEgoManifest tryCurrentEgoManifestForZone:strongSelf.zoneName];
 349                 }
 350
 351                 // If it's been more than 24 hours since the last fetch, fetch and process everything.
 352                 // Otherwise, just kick off the local queue processing.
 353
 354                 NSDate* now = [NSDate date];
 355                 NSDateComponents* offset = [[NSDateComponents alloc] init];
 356                 [offset setHour:-24];
 357                 NSDate* deadline = [[NSCalendar currentCalendar] dateByAddingComponents:offset toDate:now options:0];
 358
 359                 NSOperation* initialProcess = nil;
 360                 if(ckse.lastFetchTime == nil || [ckse.lastFetchTime compare: deadline] == NSOrderedAscending) {
 361                     initialProcess = [strongSelf fetchAndProcessCKChanges:CKKSFetchBecauseSecuritydRestart];
 362                 } else {
 363                     initialProcess = [strongSelf processIncomingQueue:false];
 364                 }
 365
 366                 if(!strongSelf.egoManifest) {
 367                     ckksnotice("ckksmanifest", strongSelf, "No ego manifest on restart; rescanning");
 368                     strongSelf.initialScanOperation = [[CKKSScanLocalItemsOperation alloc] initWithCKKSKeychainView:strongSelf ckoperationGroup:strongSelf.keyHierarchyOperationGroup];
 369                     strongSelf.initialScanOperation.name = @"initial-scan-operation";
 370                     [strongSelf.initialScanOperation addNullableDependency:strongSelf.lockStateTracker.unlockDependency];
 371                     [strongSelf.initialScanOperation addDependency: initialProcess];
 372                     [strongSelf scheduleOperation: strongSelf.initialScanOperation];
 373                 }
 374
 375                 [strongSelf processOutgoingQueue:strongSelf.keyHierarchyOperationGroup];
 376             }
 377
 378             // Tell the key state machine to fire off.
 379             [strongSelf _onqueueAdvanceKeyStateMachineToState: SecCKKSZoneKeyStateInitialized withError: nil];
 380             return true;
 381         }];
 382     }];
 383     afterZoneSetup.name = @"view-setup";
 384
 385     CKKSZoneStateEntry* ckse = [CKKSZoneStateEntry state: self.zoneName];
 386     NSOperation* zoneSetupOperation = [self createSetupOperation: ckse.ckzonecreated zoneSubscribed: ckse.ckzonesubscribed];
 387
 388     self.viewSetupOperation = [[CKKSGroupOperation alloc] init];
 389     self.viewSetupOperation.name = @"view-setup-group";
 390     if(!zoneSetupOperation.isFinished) {
 391         [self.viewSetupOperation runBeforeGroupFinished: zoneSetupOperation];
 392     }
 393
 394     [afterZoneSetup addDependency: zoneSetupOperation];
 395     [self.viewSetupOperation runBeforeGroupFinished: afterZoneSetup];
 396
 397     [self scheduleAccountStatusOperation: self.viewSetupOperation];
 398 }
 399
 400 - (bool)_onqueueResetLocalData: (NSError * __autoreleasing *) error {
 401     dispatch_assert_queue(self.queue);
 402
 403     NSError* localerror = nil;
 404     bool setError = false; // Ugly, but this is the only way to return the first error given
 405
 406     CKKSZoneStateEntry* ckse = [CKKSZoneStateEntry state: self.zoneName];
 407     ckse.ckzonecreated = false;
 408     ckse.ckzonesubscribed = false; // I'm actually not sure about this: can you be subscribed to a non-existent zone?
 409     ckse.changeToken = NULL;
 410     [ckse saveToDatabase: &localerror];
 411     if(localerror) {
 412         ckkserror("ckks", self, "couldn't reset zone status for %@: %@", self.zoneName, localerror);
 413         if(error && !setError) {
 414             *error = localerror; setError = true;
 415         }
 416     }
 417
 418     [CKKSMirrorEntry deleteAll:self.zoneID error: &localerror];
 419     if(localerror) {
 420         ckkserror("ckks", self, "couldn't delete all CKKSMirrorEntry: %@", localerror);
 421         if(error && !setError) {
 422             *error = localerror; setError = true;
 423         }
 424     }
 425
 426     [CKKSOutgoingQueueEntry deleteAll:self.zoneID error: &localerror];
 427     if(localerror) {
 428         ckkserror("ckks", self, "couldn't delete all CKKSOutgoingQueueEntry: %@", localerror);
 429         if(error && !setError) {
 430             *error = localerror; setError = true;
 431         }
 432     }
 433
 434     [CKKSIncomingQueueEntry deleteAll:self.zoneID error: &localerror];
 435     if(localerror) {
 436         ckkserror("ckks", self, "couldn't delete all CKKSIncomingQueueEntry: %@", localerror);
 437         if(error && !setError) {
 438             *error = localerror; setError = true;
 439         }
 440     }
 441
 442     [CKKSKey deleteAll:self.zoneID error: &localerror];
 443     if(localerror) {
 444         ckkserror("ckks", self, "couldn't delete all CKKSKey: %@", localerror);
 445         if(error && !setError) {
 446             *error = localerror; setError = true;
 447         }
 448     }
 449
 450     [CKKSCurrentKeyPointer deleteAll:self.zoneID error: &localerror];
 451     if(localerror) {
 452         ckkserror("ckks", self, "couldn't delete all CKKSCurrentKeyPointer: %@", localerror);
 453         if(error && !setError) {
 454             *error = localerror; setError = true;
 455         }
 456     }
 457
 458     [CKKSDeviceStateEntry deleteAll:self.zoneID error:&localerror];
 459     if(localerror) {
 460         ckkserror("ckks", self, "couldn't delete all CKKSDeviceStateEntry: %@", localerror);
 461         if(error && !setError) {
 462             *error = localerror; setError = true;
 463         }
 464     }
 465
 466     [self _onqueueAdvanceKeyStateMachineToState: SecCKKSZoneKeyStateInitializing withError:nil];
 467
 468     return (localerror == nil && !setError);
 469 }
 470
 471 - (CKKSResultOperation*)resetLocalData {
 472     __weak __typeof(self) weakSelf = self;
 473
 474     CKKSGroupOperation* resetFollowUp = [[CKKSGroupOperation alloc] init];
 475     resetFollowUp.name = @"local-reset-follow-up-group";
 476     __weak __typeof(resetFollowUp) weakResetFollowUp = resetFollowUp;
 477
 478     CKKSResultOperation* op = [[CKKSResultOperation alloc] init];
 479     op.name = @"local-reset";
 480
 481     __weak __typeof(op) weakOp = op;
 482     [op addExecutionBlock:^{
 483         __strong __typeof(self) strongSelf = weakSelf;
 484         __strong __typeof(op) strongOp = weakOp;
 485         __strong __typeof(resetFollowUp) strongResetFollowUp = weakResetFollowUp;
 486         if(!strongSelf || !strongOp || !strongResetFollowUp) {
 487             return;
 488         }
 489
 490         __block NSError* error = nil;
 491
 492         [strongSelf dispatchSync: ^bool{
 493             [self _onqueueResetLocalData: &error];
 494             return true;
 495         }];
 496
 497         [strongSelf resetSetup];
 498
 499         if(error) {
 500             ckksnotice("ckksreset", strongSelf, "Local reset finished with error %@", error);
 501             strongOp.error = error;
 502         } else {
 503             if(strongSelf.accountStatus == CKKSAccountStatusAvailable) {
 504                 // Since we're logged in, we expect a reset to fix up the key hierarchy
 505                 ckksnotice("ckksreset", strongSelf, "logged in; re-initializing zone");
 506                 [strongSelf initializeZone];
 507
 508                 ckksnotice("ckksreset", strongSelf, "waiting for key hierarchy to become ready");
 509                 CKKSResultOperation* waitOp = [CKKSResultOperation named:@"waiting-for-key-hierarchy" withBlock:^{}];
 510                 [waitOp timeout: 60*NSEC_PER_SEC];
 511                 [waitOp addNullableDependency:strongSelf.keyStateReadyDependency];
 512
 513                 [strongResetFollowUp runBeforeGroupFinished:waitOp];
 514             } else {
 515                 ckksnotice("ckksreset", strongSelf, "logged out; not initializing zone");
 516             }
 517         }
 518     }];
 519
 520     [resetFollowUp runBeforeGroupFinished:op];
 521     [self scheduleOperationWithoutDependencies:resetFollowUp];
 522     return resetFollowUp;
 523 }
 524
 525 - (CKKSResultOperation*)resetCloudKitZone {
 526     if(!SecCKKSIsEnabled()) {
 527         ckksinfo("ckks", self, "Skipping CloudKit reset due to disabled CKKS");
 528         return nil;
 529     }
 530
 531     CKKSResultOperation* reset = [super beginResetCloudKitZoneOperation];
 532
 533     __weak __typeof(self) weakSelf = self;
 534     CKKSGroupOperation* resetFollowUp = [[CKKSGroupOperation alloc] init];
 535     resetFollowUp.name = @"cloudkit-reset-follow-up-group";
 536
 537     __weak __typeof(resetFollowUp) weakResetFollowUp = resetFollowUp;
 538     [resetFollowUp runBeforeGroupFinished: [CKKSResultOperation named:@"cloudkit-reset-follow-up" withBlock: ^{
 539         __strong __typeof(weakSelf) strongSelf = weakSelf;
 540         if(!strongSelf) {
 541             ckkserror("ckks", strongSelf, "received callback for released object");
 542             return;
 543         }
 544         __strong __typeof(resetFollowUp) strongResetFollowUp = weakResetFollowUp;
 545
 546         if(!reset.error) {
 547             ckksnotice("ckks", strongSelf, "Successfully deleted zone %@", strongSelf.zoneName);
 548             __block NSError* error = nil;
 549
 550             [strongSelf dispatchSync: ^bool{
 551                 [strongSelf _onqueueResetLocalData: &error];
 552                 strongSelf.setupSuccessful = false;
 553                 return true;
 554             }];
 555
 556             if(strongSelf.accountStatus == CKKSAccountStatusAvailable) {
 557                 // Since we're logged in, we expect a reset to fix up the key hierarchy
 558                 ckksnotice("ckksreset", strongSelf, "re-initializing zone");
 559                 [strongSelf initializeZone];
 560
 561                 ckksnotice("ckksreset", strongSelf, "waiting for key hierarchy to become ready");
 562                 CKKSResultOperation* waitOp = [CKKSResultOperation named:@"waiting-for-reset" withBlock:^{}];
 563                 [waitOp timeout: 60*NSEC_PER_SEC];
 564                 [waitOp addNullableDependency:strongSelf.keyStateReadyDependency];
 565
 566                 [strongResetFollowUp runBeforeGroupFinished:waitOp];
 567             } else {
 568                 ckksnotice("ckksreset", strongSelf, "logged out; not initializing zone");
 569             }
 570         } else {
 571             // Shouldn't ever happen, since reset is a successDependency
 572             ckkserror("ckks", strongSelf, "Couldn't reset zone %@: %@", strongSelf.zoneName, reset.error);
 573         }
 574     }]];
 575
 576     [resetFollowUp addSuccessDependency:reset];
 577     [self scheduleOperationWithoutDependencies:resetFollowUp];
 578     return resetFollowUp;
 579 }
 580
 581 - (void)advanceKeyStateMachine {
 582     __weak __typeof(self) weakSelf = self;
 583
 584     [self dispatchAsync: ^bool{
 585         __strong __typeof(weakSelf) strongSelf = weakSelf;
 586         if(!strongSelf) {
 587             ckkserror("ckks", strongSelf, "received callback for released object");
 588             false;
 589         }
 590
 591         [strongSelf _onqueueAdvanceKeyStateMachineToState: nil withError: nil];
 592         return true;
 593     }];
 594 };
 595
 596 - (void)_onqueueKeyStateMachineRequestFetch {
 597     dispatch_assert_queue(self.queue);
 598
 599     // We're going to set this flag, then nudge the key state machine.
 600     // If it was idle, then it should launch a fetch. If there was an active process, this flag will stay high
 601     // and the fetch will be launched later.
 602
 603     self.keyStateFetchRequested = true;
 604     [self _onqueueAdvanceKeyStateMachineToState: nil withError: nil];
 605 }
 606
 607 - (void)_onqueueKeyStateMachineRequestFullRefetch {
 608     dispatch_assert_queue(self.queue);
 609
 610     self.keyStateFullRefetchRequested = true;
 611     [self _onqueueAdvanceKeyStateMachineToState: nil withError: nil];
 612 }
 613
 614 - (void)keyStateMachineRequestProcess {
 615     __weak __typeof(self) weakSelf = self;
 616     [self dispatchAsync: ^bool{
 617         __strong __typeof(weakSelf) strongSelf = weakSelf;
 618         if(!strongSelf) {
 619             ckkserror("ckks", strongSelf, "received callback for released object");
 620             return false;
 621         }
 622
 623         [strongSelf _onqueueKeyStateMachineRequestProcess];
 624         return true;
 625     }];
 626 }
 627
 628 - (void)_onqueueKeyStateMachineRequestProcess {
 629     dispatch_assert_queue(self.queue);
 630
 631     // Set the request flag, then nudge the key state machine.
 632     // If it was idle, then it should launch a fetch. If there was an active process, this flag will stay high
 633     // and the fetch will be launched later.
 634
 635     self.keyStateProcessRequested = true;
 636     [self _onqueueAdvanceKeyStateMachineToState: nil withError: nil];
 637 }
 638
 639 // The operations suggested by this state machine should call _onqueueAdvanceKeyStateMachineToState once they are complete.
 640 // At no other time should keyHierarchyState be modified.
 641
 642 // Note that this function cannot rely on doing any database work; it might get rolled back, especially in an error state
 643 - (void)_onqueueAdvanceKeyStateMachineToState: (CKKSZoneKeyState*) state withError: (NSError*) error {
 644     dispatch_assert_queue(self.queue);
 645     __weak __typeof(self) weakSelf = self;
 646
 647     // Resetting back to 'initializing' takes all precedence.
 648     if([state isEqual: SecCKKSZoneKeyStateInitializing]) {
 649         ckksnotice("ckkskey", self, "Resetting the key hierarchy state machine back to 'initializing'");
 650
 651         [self.keyStateMachineOperation cancel];
 652         self.keyStateMachineOperation = nil;
 653
 654         self.keyHierarchyState = SecCKKSZoneKeyStateInitializing;
 655         self.keyHierarchyError = nil;
 656         self.keyStateFetchRequested = false;
 657         self.keyStateProcessRequested = false;
 658
 659         self.keyHierarchyOperationGroup = [CKOperationGroup CKKSGroupWithName:@"key-state-reset"];
 660         self.keyStateReadyDependency = [CKKSResultOperation operationWithBlock:^{
 661             ckksnotice("ckkskey", weakSelf, "Key state has become ready for the first time (after reset).");
 662         }];
 663         self.keyStateReadyDependency.name = [NSString stringWithFormat: @"%@-key-state-ready", self.zoneName];
 664         return;
 665     }
 666
 667     // Cancels and error states take precedence
 668     if([self.keyHierarchyState isEqualToString: SecCKKSZoneKeyStateError] ||
 669        [self.keyHierarchyState isEqualToString: SecCKKSZoneKeyStateCancelled] ||
 670        self.keyHierarchyError != nil) {
 671         // Error state: nowhere to go. Early-exit.
 672         ckkserror("ckkskey", self, "Asked to advance state machine from non-exit state %@: %@", self.keyHierarchyState, self.keyHierarchyError);
 673         return;
 674     }
 675
 676     if(error != nil || [state isEqual: SecCKKSZoneKeyStateError]) {
 677         // But wait! Is this a "we're locked" error?
 678         if([self.lockStateTracker isLockedError:error]) {
 679             ckkserror("ckkskey", self, "advised of 'keychain locked' error, ignoring: coming from state (%@): %@", self.keyHierarchyState, error);
 680             // After the next unlock, fake that we received the last zone transition
 681             CKKSZoneKeyState* lastState = self.keyHierarchyState;
 682             self.keyStateMachineOperation = [NSBlockOperation named:@"key-state-after-unlock" withBlock:^{
 683                 __strong __typeof(self) strongSelf = weakSelf;
 684                 if(!strongSelf) {
 685                     return;
 686                 }
 687                 [strongSelf dispatchSync:^bool{
 688                     [strongSelf _onqueueAdvanceKeyStateMachineToState:lastState withError:nil];
 689                     return true;
 690                 }];
 691             }];
 692             state = nil;
 693             [self.keyStateMachineOperation addNullableDependency:self.lockStateTracker.unlockDependency];
 694             [self scheduleOperation:self.keyStateMachineOperation];
 695
 696         } else {
 697             // Error state: record the error and exit early
 698             ckkserror("ckkskey", self, "advised of error: coming from state (%@): %@", self.keyHierarchyState, error);
 699             self.keyHierarchyState = SecCKKSZoneKeyStateError;
 700             self.keyHierarchyError = error;
 701             return;
 702         }
 703     }
 704
 705     if([state isEqual: SecCKKSZoneKeyStateCancelled]) {
 706         ckkserror("ckkskey", self, "advised of cancel: coming from state (%@): %@", self.keyHierarchyState, error);
 707         self.keyHierarchyState = SecCKKSZoneKeyStateCancelled;
 708         self.keyHierarchyError = error;
 709
 710         // Cancel the key ready dependency. Strictly Speaking, this will cause errors down the line, but we're in a cancel state: those operations should be canceled anyway.
 711         self.keyHierarchyOperationGroup = nil;
 712         [self.keyStateReadyDependency cancel];
 713         self.keyStateReadyDependency = nil;
 714         return;
 715     }
 716
 717     // Now that the current or new state isn't an error or a cancel, proceed.
 718
 719     if(self.keyStateMachineOperation && ![self.keyStateMachineOperation isFinished]) {
 720         if(state == nil) {
 721             // we started this operation to move the state machine. Since you aren't asking for a state transition, and there's an active operation, no need to do anything
 722             ckksnotice("ckkskey", self, "Not advancing state machine: waiting for %@", self.keyStateMachineOperation);
 723             return;
 724         }
 725     }
 726
 727     if(state) {
 728         self.keyStateMachineOperation = nil;
 729
 730         ckksnotice("ckkskey", self, "Advancing key hierarchy state machine from %@ to %@", self.keyHierarchyState, state);
 731         self.keyHierarchyState = state;
 732     }
 733
 734     // Many of our decisions below will be based on what keys exist. Help them out.
 735     CKKSCurrentKeySet* keyset = [[CKKSCurrentKeySet alloc] initForZone:self.zoneID];
 736     NSError* localerror = nil;
 737     NSArray<CKKSKey*>* localKeys = [CKKSKey localKeys:self.zoneID error:&localerror];
 738     NSArray<CKKSKey*>* remoteKeys = [CKKSKey remoteKeys:self.zoneID error: &localerror];
 739
 740     // We also are checking for OutgoingQueueEntries in the reencrypt state; this is a sign that our key hierarchy is out of date.
 741     NSArray<CKKSOutgoingQueueEntry*>* outdatedOQEs = [CKKSOutgoingQueueEntry allInState: SecCKKSStateReencrypt zoneID:self.zoneID error: &localerror];
 742
 743     SecADSetValueForScalarKey((__bridge CFStringRef) SecCKKSAggdViewKeyCount, [localKeys count]);
 744
 745     if(localerror) {
 746         ckkserror("ckkskey", self, "couldn't fetch keys and OQEs from local database, entering error state: %@", localerror);
 747         self.keyHierarchyState = SecCKKSZoneKeyStateError;
 748         self.keyHierarchyError = localerror;
 749         return;
 750     }
 751
 752 #if !defined(NDEBUG)
 753     NSArray<CKKSKey*>* allKeys = [CKKSKey allKeys:self.zoneID error:&localerror];
 754     ckksdebug("ckkskey", self, "All keys: %@", allKeys);
 755 #endif
 756
 757     NSError* hierarchyError = nil;
 758
 759     if([self.keyHierarchyState isEqualToString: SecCKKSZoneKeyStateInitializing]) {
 760         if(state != nil) {
 761             // Wait for CKKSZone to finish initialization.
 762             ckkserror("ckkskey", self, "Asked to advance state machine (to %@) while CK zone still initializing.", state);
 763         }
 764         return;
 765
 766     } else if([self.keyHierarchyState isEqualToString: SecCKKSZoneKeyStateReady]) {
 767         if(self.keyStateProcessRequested || [remoteKeys count] > 0) {
 768             // We've either received some remote keys from the last fetch, or someone has requested a reprocess.
 769             ckksnotice("ckkskey", self, "Kicking off a key reprocess based on request:%d and remote key count %lu", self.keyStateProcessRequested, (unsigned long)[remoteKeys count]);
 770             [self _onqueueKeyHierarchyProcess];
 771
 772         } else if(self.keyStateFullRefetchRequested) {
 773             // In ready, but someone has requested a full fetch. Kick it off.
 774             ckksnotice("ckkskey", self, "Kicking off a key refetch based on request:%d", self.keyStateFetchRequested);
 775             [self _onqueueKeyHierarchyRefetch];
 776
 777         } else if(self.keyStateFetchRequested) {
 778             // In ready, but someone has requested a fetch. Kick it off.
 779             ckksnotice("ckkskey", self, "Kicking off a key refetch based on request:%d", self.keyStateFetchRequested);
 780             [self _onqueueKeyHierarchyFetch];
 781         }
 782         // TODO: kick off a key roll if one has been requested
 783
 784         if(!self.keyStateMachineOperation) {
 785             // We think we're ready. Double check.
 786             bool ready = [self _onqueueEnsureKeyHierarchyHealth:&hierarchyError];
 787             if(!ready || hierarchyError) {
 788                 // Things is bad. Kick off a heal to fix things up.
 789                 ckksnotice("ckkskey", self, "Thought we were ready, but the key hierarchy is unhealthy: %@", hierarchyError);
 790                 self.keyHierarchyState = SecCKKSZoneKeyStateUnhealthy;
 791
 792             } else {
 793                 // In ready, nothing to do. Notify waiters and quit.
 794                 self.keyHierarchyOperationGroup = nil;
 795                 if(self.keyStateReadyDependency) {
 796                     [self scheduleOperation: self.keyStateReadyDependency];
 797                     self.keyStateReadyDependency = nil;
 798                 }
 799
 800                 // If there are any OQEs waiting to be encrypted, launch an op to fix them
 801                 if([outdatedOQEs count] > 0u) {
 802                     ckksnotice("ckksreencrypt", self, "Reencrypting outgoing items as the key hierarchy is ready");
 803                     CKKSReencryptOutgoingItemsOperation* op = [[CKKSReencryptOutgoingItemsOperation alloc] initWithCKKSKeychainView:self ckoperationGroup:self.keyHierarchyOperationGroup];
 804                     [self scheduleOperation:op];
 805                 }
 806
 807                 return;
 808             }
 809         }
 810
 811     } else if([self.keyHierarchyState isEqualToString: SecCKKSZoneKeyStateInitialized]) {
 812         // We're initialized and CloudKit is ready. See what needs done...
 813
 814         // Check if we have an existing key hierarchy
 815         CKKSKey* tlk    = [CKKSKey currentKeyForClass:SecCKKSKeyClassTLK zoneID:self.zoneID error:&error];
 816         CKKSKey* classA = [CKKSKey currentKeyForClass:SecCKKSKeyClassA   zoneID:self.zoneID error:&error];
 817         CKKSKey* classC = [CKKSKey currentKeyForClass:SecCKKSKeyClassC   zoneID:self.zoneID error:&error];
 818
 819         if(error && !([error.domain isEqual: @"securityd"] && error.code == errSecItemNotFound)) {
 820             ckkserror("ckkskey", self, "Error examining existing key hierarchy: %@", error);
 821         }
 822
 823         if(tlk && classA && classC && !error) {
 824             // This is likely a restart of securityd, and we think we're ready. Double check.
 825             bool ready = [self _onqueueEnsureKeyHierarchyHealth:&hierarchyError];
 826             if(ready && !hierarchyError) {
 827                 ckksnotice("ckkskey", self, "Already have existing key hierarchy for %@; using it.", self.zoneID.zoneName);
 828             } else if(hierarchyError && [self.lockStateTracker isLockedError:hierarchyError]) {
 829                 ckksnotice("ckkskey", self, "Initial scan shows key hierarchy is unavailable since keychain is locked: %@", hierarchyError);
 830                 self.keyHierarchyState = SecCKKSZoneKeyStateWaitForUnlock;
 831             } else {
 832                 ckksnotice("ckkskey", self, "Initial scan shows key hierarchy is unhealthy: %@", hierarchyError);
 833                 self.keyHierarchyState = SecCKKSZoneKeyStateUnhealthy;
 834             }
 835
 836         } else {
 837             // We have no local key hierarchy. One might exist in CloudKit, or it might not.
 838             ckksnotice("ckkskey", self, "No existing key hierarchy for %@. Check if there's one in CloudKit...", self.zoneID.zoneName);
 839
 840             [self _onqueueKeyHierarchyFetch];
 841         }
 842
 843     } else if([self.keyHierarchyState isEqualToString: SecCKKSZoneKeyStateFetchComplete]) {
 844         // We're initializing this zone, and just completed a fetch of everything. Are there any remote keys?
 845         if(remoteKeys.count > 0u) {
 846             // Process the keys we received.
 847             self.keyStateMachineOperation = [[CKKSProcessReceivedKeysOperation alloc] initWithCKKSKeychainView: self];
 848         } else if( (keyset.currentTLKPointer || keyset.currentClassAPointer || keyset.currentClassCPointer) &&
 849                   !(keyset.tlk && keyset.classA && keyset.classC)) {
 850             // Huh. We appear to have current key pointers, but the keys themselves don't exist. That's weird.
 851             // Transfer to the "unhealthy" state to request a fix
 852             ckksnotice("ckkskey", self, "We appear to have current key pointers but no keys to match them. Moving to 'unhealthy'");
 853             self.keyHierarchyState = SecCKKSZoneKeyStateUnhealthy;
 854
 855         } else if([remoteKeys count] == 0) {
 856             // No keys, no pointers? make some new ones!
 857             self.keyStateMachineOperation = [[CKKSNewTLKOperation alloc] initWithCKKSKeychainView: self ckoperationGroup:self.keyHierarchyOperationGroup];
 858         }
 859
 860     } else if([self.keyHierarchyState isEqualToString: SecCKKSZoneKeyStateWaitForTLK]) {
 861         // We're in a hold state: waiting for the TLK bytes to arrive.
 862
 863         if(self.keyStateProcessRequested) {
 864             // Someone has requsted a reprocess! Run a ProcessReceivedKeysOperation.
 865             ckksnotice("ckkskey", self, "Received a nudge that our TLK might be here! Starting operation to check.");
 866             [self _onqueueKeyHierarchyProcess];
 867         }
 868
 869     } else if([self.keyHierarchyState isEqualToString: SecCKKSZoneKeyStateWaitForUnlock]) {
 870         // We're in a hold state: waiting for the keybag to unlock so we can process the keys again.
 871
 872         [self _onqueueKeyHierarchyProcess];
 873         [self.keyStateMachineOperation addNullableDependency: self.lockStateTracker.unlockDependency];
 874
 875     } else if([self.keyHierarchyState isEqualToString: SecCKKSZoneKeyStateBadCurrentPointers]) {
 876         // The current key pointers are broken, but we're not sure why.
 877         ckksnotice("ckkskey", self, "Our current key pointers are reported broken. Attempting a fix!");
 878         self.keyStateMachineOperation = [[CKKSHealKeyHierarchyOperation alloc] initWithCKKSKeychainView: self ckoperationGroup:self.keyHierarchyOperationGroup];
 879
 880     } else if([self.keyHierarchyState isEqualToString: SecCKKSZoneKeyStateNewTLKsFailed]) {
 881         ckksnotice("ckkskey", self, "Creating new TLKs didn't work. Attempting to refetch!");
 882         [self _onqueueKeyHierarchyFetch];
 883
 884     } else if([self.keyHierarchyState isEqualToString: SecCKKSZoneKeyStateNeedFullRefetch]) {
 885         ckksnotice("ckkskey", self, "Informed of request for full refetch");
 886         [self _onqueueKeyHierarchyRefetch];
 887
 888     } else {
 889         ckkserror("ckks", self, "asked to advance state machine to unknown state: %@", self.keyHierarchyState);
 890         return;
 891     }
 892
 893     if(self.keyStateMachineOperation) {
 894
 895         if(self.keyStateReadyDependency == nil || [self.keyStateReadyDependency isFinished]) {
 896             ckksnotice("ckkskey", self, "reloading keyStateReadyDependency due to operation %@", self.keyStateMachineOperation);
 897
 898             __weak __typeof(self) weakSelf = self;
 899             self.keyHierarchyOperationGroup = [CKOperationGroup CKKSGroupWithName:@"key-state-broken"];
 900             self.keyStateReadyDependency = [CKKSResultOperation operationWithBlock:^{
 901                 ckksnotice("ckkskey", weakSelf, "Key state has become ready again.");
 902             }];
 903             self.keyStateReadyDependency.name = [NSString stringWithFormat: @"%@-key-state-ready", self.zoneName];
 904         }
 905
 906         [self scheduleOperation: self.keyStateMachineOperation];
 907     } else if([self.keyHierarchyState isEqualToString:SecCKKSZoneKeyStateWaitForTLK]) {
 908         ckksnotice("ckkskey", self, "Entering %@", self.keyHierarchyState);
 909
 910     } else if([self.keyHierarchyState isEqualToString:SecCKKSZoneKeyStateUnhealthy]) {
 911         ckksnotice("ckkskey", self, "Looks like the key hierarchy is unhealthy. Launching fix.");
 912         self.keyStateMachineOperation = [[CKKSHealKeyHierarchyOperation alloc] initWithCKKSKeychainView:self ckoperationGroup:self.keyHierarchyOperationGroup];
 913         [self scheduleOperation: self.keyStateMachineOperation];
 914
 915     } else {
 916         // Nothing to do and not in a waiting state? Awesome; we must be in the ready state.
 917         if(![self.keyHierarchyState isEqual: SecCKKSZoneKeyStateReady]) {
 918             ckksnotice("ckkskey", self, "No action to take in state %@; we must be ready.", self.keyHierarchyState);
 919             self.keyHierarchyState = SecCKKSZoneKeyStateReady;
 920
 921             self.keyHierarchyOperationGroup = nil;
 922             if(self.keyStateReadyDependency) {
 923                 [self scheduleOperation: self.keyStateReadyDependency];
 924                 self.keyStateReadyDependency = nil;
 925             }
 926         }
 927     }
 928 }
 929
 930 - (bool)_onqueueEnsureKeyHierarchyHealth:(NSError* __autoreleasing *)error {
 931     dispatch_assert_queue(self.queue);
 932
 933     NSError* localerror = nil;
 934
 935     // Check if we have an existing key hierarchy
 936     CKKSKey* tlk    = [CKKSKey currentKeyForClass:SecCKKSKeyClassTLK zoneID:self.zoneID error:&localerror];
 937     CKKSKey* classA = [CKKSKey currentKeyForClass:SecCKKSKeyClassA   zoneID:self.zoneID error:&localerror];
 938     CKKSKey* classC = [CKKSKey currentKeyForClass:SecCKKSKeyClassC   zoneID:self.zoneID error:&localerror];
 939
 940     if(localerror || !tlk || !classA || !classC) {
 941         ckkserror("ckkskey", self, "Error examining existing key hierarchy: %@", localerror);
 942         ckkserror("ckkskey", self, "Keys are: %@ %@ %@", tlk, classA, classC);
 943         if(error) {
 944             *error = localerror;
 945         }
 946         return false;
 947     }
 948
 949     // keychain being locked is not a fatal error here
 950     [tlk loadKeyMaterialFromKeychain:&localerror];
 951     if(localerror && !([localerror.domain isEqual: @"securityd"] && localerror.code == errSecInteractionNotAllowed)) {
 952         ckksinfo("ckkskey", self, "Error loading TLK(%@): %@", tlk, localerror);
 953         if(error) {
 954             *error = localerror;
 955         }
 956         return false;
 957     } else if(localerror) {
 958         ckksinfo("ckkskey", self, "Error loading TLK(%@), maybe locked: %@", tlk, localerror);
 959     }
 960     localerror = nil;
 961
 962     // keychain being locked is not a fatal error here
 963     [classA loadKeyMaterialFromKeychain:&localerror];
 964     if(localerror && !([localerror.domain isEqual: @"securityd"] && localerror.code == errSecInteractionNotAllowed)) {
 965         ckksinfo("ckkskey", self, "Error loading classA key(%@): %@", classA, localerror);
 966         if(error) {
 967             *error = localerror;
 968         }
 969         return false;
 970     } else if(localerror) {
 971         ckksinfo("ckkskey", self, "Error loading classA key(%@), maybe locked: %@", classA, localerror);
 972     }
 973     localerror = nil;
 974
 975     // keychain being locked is a fatal error here, since this is class C
 976     [classA loadKeyMaterialFromKeychain:&localerror];
 977     if(localerror) {
 978         ckksinfo("ckkskey", self, "Error loading classC(%@): %@", classC, localerror);
 979         if(error) {
 980             *error = localerror;
 981         }
 982         return false;
 983     }
 984
 985     self.activeTLK = [tlk uuid];
 986
 987     // Got to the bottom? Cool! All keys are present and accounted for.
 988     return true;
 989 }
 990
 991 - (void)_onqueueKeyHierarchyFetch {
 992     dispatch_assert_queue(self.queue);
 993
 994     __weak __typeof(self) weakSelf = self;
 995     self.keyStateMachineOperation = [NSBlockOperation blockOperationWithBlock: ^{
 996         __strong __typeof(weakSelf) strongSelf = weakSelf;
 997         if(!strongSelf) {
 998             ckkserror("ckks", strongSelf, "received callback for released object");
 999             return;
1000         }
1001
1002         [strongSelf dispatchSync: ^bool{
1003             [strongSelf _onqueueAdvanceKeyStateMachineToState: SecCKKSZoneKeyStateFetchComplete withError: nil];
1004             return true;
1005         }];
1006     }];
1007     self.keyStateMachineOperation.name = @"waiting-for-fetch";
1008
1009     NSOperation* fetchOp = [self.zoneChangeFetcher requestSuccessfulFetch: CKKSFetchBecauseKeyHierarchy];
1010     [self.keyStateMachineOperation addDependency: fetchOp];
1011
1012     self.keyStateFetchRequested = false;
1013 }
1014
1015 - (void)_onqueueKeyHierarchyRefetch {
1016     dispatch_assert_queue(self.queue);
1017
1018     __weak __typeof(self) weakSelf = self;
1019     self.keyStateMachineOperation = [NSBlockOperation blockOperationWithBlock: ^{
1020         __strong __typeof(weakSelf) strongSelf = weakSelf;
1021         if(!strongSelf) {
1022             ckkserror("ckks", strongSelf, "received callback for released object");
1023             return;
1024         }
1025
1026         [strongSelf dispatchSync: ^bool{
1027             [strongSelf _onqueueAdvanceKeyStateMachineToState: SecCKKSZoneKeyStateFetchComplete withError: nil];
1028             return true;
1029         }];
1030     }];
1031     self.keyStateMachineOperation.name = @"waiting-for-refetch";
1032
1033     NSOperation* fetchOp = [self.zoneChangeFetcher requestSuccessfulResyncFetch: CKKSFetchBecauseKeyHierarchy];
1034     [self.keyStateMachineOperation addDependency: fetchOp];
1035
1036     self.keyStateMachineRefetched = true;
1037     self.keyStateFullRefetchRequested = false;
1038     self.keyStateFetchRequested = false;
1039 }
1040
1041
1042 - (void)_onqueueKeyHierarchyProcess {
1043     dispatch_assert_queue(self.queue);
1044
1045     self.keyStateMachineOperation = [[CKKSProcessReceivedKeysOperation alloc] initWithCKKSKeychainView: self];
1046
1047     // Since we're starting a reprocess, this is answering all previous requests.
1048     self.keyStateProcessRequested = false;
1049 }
1050
1051 - (void) handleKeychainEventDbConnection: (SecDbConnectionRef) dbconn
1052                                    added: (SecDbItemRef) added
1053                                  deleted: (SecDbItemRef) deleted
1054                              rateLimiter: (CKKSRateLimiter*) rateLimiter
1055                             syncCallback: (SecBoolNSErrorCallback) syncCallback {
1056     if(!SecCKKSIsEnabled()) {
1057         ckksinfo("ckks", self, "Skipping handleKeychainEventDbConnection due to disabled CKKS");
1058         return;
1059     }
1060
1061     __block NSError* error = nil;
1062
1063     if(self.accountStatus != CKKSAccountStatusAvailable && syncCallback) {
1064         // We're not logged into CloudKit, and therefore don't expect this item to be synced anytime particularly soon.
1065         CKKSAccountStatus accountStatus = self.accountStatus;
1066         dispatch_async(self.queue, ^{
1067             syncCallback(false, [NSError errorWithDomain:@"securityd"
1068                                                     code:errSecNotLoggedIn
1069                                                 userInfo:@{NSLocalizedDescriptionKey:
1070                                                                [NSString stringWithFormat: @"No iCloud account available(%d); item is not expected to sync", (int)accountStatus]}]);
1071         });
1072
1073         syncCallback = nil;
1074     }
1075
1076     // Tombstones come in as item modifications or item adds. Handle modifications here.
1077     bool addedTombstone   = added   && SecDbItemIsTombstone(added);
1078     bool deletedTombstone = deleted && SecDbItemIsTombstone(deleted);
1079
1080     bool addedSync   = added   && SecDbItemIsSyncable(added);
1081     bool deletedSync = deleted && SecDbItemIsSyncable(deleted);
1082
1083     bool isAdd    = ( added && !deleted) || (added && deleted && !addedTombstone &&  deletedTombstone) || (added && deleted &&  addedSync && !deletedSync);
1084     bool isDelete = (!added &&  deleted) || (added && deleted &&  addedTombstone && !deletedTombstone) || (added && deleted && !addedSync &&  deletedSync);
1085     bool isModify = ( added &&  deleted) && (!isAdd) && (!isDelete);
1086
1087     // On an update that changes an item's primary key, SecDb modifies the existing item, then adds a new tombstone to replace the old primary key.
1088     // Therefore, we might receive an added tombstone here with no deleted item to accompany it. This should be considered a deletion.
1089     if(addedTombstone && !deleted) {
1090         isAdd = false;
1091         isDelete = true;
1092         isModify = false;
1093
1094         // Passed to withItem: below
1095         deleted = added;
1096     }
1097
1098     // If neither item is syncable, don't proceed further in the syncing system
1099     bool proceed = addedSync || deletedSync;
1100
1101     if(!proceed) {
1102         ckksinfo("ckks", self, "skipping sync of non-sync item");
1103         return;
1104     }
1105
1106     // Only synchronize items which can transfer between devices
1107     NSString* protection = (__bridge NSString*)SecDbItemGetCachedValueWithName(added ? added : deleted, kSecAttrAccessible);
1108     if(! ([protection isEqualToString: (__bridge NSString*)kSecAttrAccessibleWhenUnlocked] ||
1109           [protection isEqualToString: (__bridge NSString*)kSecAttrAccessibleAfterFirstUnlock] ||
1110           [protection isEqualToString: (__bridge NSString*)kSecAttrAccessibleAlways])) {
1111         ckksinfo("ckks", self, "skipping sync of device-bound item");
1112         return;
1113     }
1114
1115     // Our caller gave us a database connection. We must get on the local queue to ensure atomicity
1116     // Note that we're at the mercy of the surrounding db transaction, so don't try to rollback here
1117     [self dispatchSyncWithConnection: dbconn block: ^bool {
1118         if(![self.keyHierarchyState isEqualToString: SecCKKSZoneKeyStateReady]) {
1119             ckksnotice("ckks", self, "Key state not ready for new items; skipping");
1120             return true;
1121         }
1122
1123         CKKSOutgoingQueueEntry* oqe = nil;
1124         if       (isAdd) {
1125             oqe = [CKKSOutgoingQueueEntry withItem: added   action: SecCKKSActionAdd    ckks:self error: &error];
1126         } else if(isDelete) {
1127             oqe = [CKKSOutgoingQueueEntry withItem: deleted action: SecCKKSActionDelete ckks:self error: &error];
1128         } else if(isModify) {
1129             oqe = [CKKSOutgoingQueueEntry withItem: added   action: SecCKKSActionModify ckks:self error: &error];
1130         } else {
1131             ckkserror("ckks", self, "processKeychainEventItemAdded given garbage: %@ %@", added, deleted);
1132             return true;
1133         }
1134
1135         CKOperationGroup* operationGroup = [CKOperationGroup CKKSGroupWithName:@"keychain-api-use"];
1136
1137         if(error) {
1138             ckkserror("ckks", self, "Couldn't create outgoing queue entry: %@", error);
1139
1140             // If the problem is 'no UUID', launch a scan operation to find and fix it
1141             // We don't want to fix it up here, in the closing moments of a transaction
1142             if([error.domain isEqualToString:@"securityd"] && error.code == CKKSNoUUIDOnItem) {
1143                 ckksnotice("ckks", self, "Launching scan operation");
1144                 CKKSScanLocalItemsOperation* scanOperation = [[CKKSScanLocalItemsOperation alloc] initWithCKKSKeychainView: self ckoperationGroup:operationGroup];
1145                 [self scheduleOperation: scanOperation];
1146             }
1147
1148             // If the problem is 'couldn't load key', tell the key hierarchy state machine to fix it
1149             // Then, launch a scan operation to find this item and upload it
1150             if([error.domain isEqualToString:@"securityd"] && error.code == errSecItemNotFound) {
1151                 [self _onqueueAdvanceKeyStateMachineToState: nil withError: nil];
1152
1153                 ckksnotice("ckks", self, "Launching scan operation to refind %@", added);
1154                 CKKSScanLocalItemsOperation* scanOperation = [[CKKSScanLocalItemsOperation alloc] initWithCKKSKeychainView: self ckoperationGroup:operationGroup];
1155                 [scanOperation addNullableDependency:self.keyStateReadyDependency];
1156                 [self scheduleOperation: scanOperation];
1157             }
1158
1159             return true;
1160         }
1161
1162         if(rateLimiter) {
1163             NSDate* limit = nil;
1164             NSInteger value = [rateLimiter judge:oqe at:[NSDate date] limitTime:&limit];
1165             if(limit) {
1166                 oqe.waitUntil = limit;
1167                 SecPLLogRegisteredEvent(@"CKKSSyncing", @{ @"ratelimit" : @(value), @"accessgroup" : oqe.accessgroup});
1168             }
1169         }
1170
1171         [oqe saveToDatabaseWithConnection: dbconn error: &error];
1172         if(error) {
1173             ckkserror("ckks", self, "Couldn't save outgoing queue entry to database: %@", error);
1174             return true;
1175         }
1176
1177         // This update supercedes all other local modifications to this item (_except_ those in-flight).
1178         // Delete all items in reencrypt or error.
1179         CKKSOutgoingQueueEntry* reencryptOQE = [CKKSOutgoingQueueEntry tryFromDatabase:oqe.uuid state:SecCKKSStateReencrypt zoneID:self.zoneID error:&error];
1180         if(error) {
1181             ckkserror("ckks", self, "Couldn't load reencrypt OQE sibling for %@: %@", oqe, error);
1182         }
1183         if(reencryptOQE) {
1184             [reencryptOQE deleteFromDatabase:&error];
1185             if(error) {
1186                 ckkserror("ckks", self, "Couldn't delete reencrypt OQE sibling(%@) for %@: %@", reencryptOQE, oqe, error);
1187             }
1188             error = nil;
1189         }
1190
1191         CKKSOutgoingQueueEntry* errorOQE = [CKKSOutgoingQueueEntry tryFromDatabase:oqe.uuid state:SecCKKSStateError zoneID:self.zoneID error:&error];
1192         if(error) {
1193             ckkserror("ckks", self, "Couldn't load error OQE sibling for %@: %@", oqe, error);
1194         }
1195         if(errorOQE) {
1196             [errorOQE deleteFromDatabase:&error];
1197             if(error) {
1198                 ckkserror("ckks", self, "Couldn't delete error OQE sibling(%@) for %@: %@", reencryptOQE, oqe, error);
1199             }
1200         }
1201
1202         if(syncCallback) {
1203             self.pendingSyncCallbacks[oqe.uuid] = syncCallback;
1204         }
1205
1206         // Schedule a "view changed" notification
1207         [self.notifyViewChangedScheduler trigger];
1208
1209         [self processOutgoingQueue:operationGroup];
1210
1211         return true;
1212     }];
1213 }
1214
1215 -(void)setCurrentItemForAccessGroup:(SecDbItemRef)newItem
1216                                hash:(NSData*)newItemSHA1
1217                         accessGroup:(NSString*)accessGroup
1218                          identifier:(NSString*)identifier
1219                           replacing:(SecDbItemRef)oldItem
1220                                hash:(NSData*)oldItemSHA1
1221                            complete:(void (^) (NSError* operror)) complete
1222 {
1223     if(accessGroup == nil || identifier == nil) {
1224         NSError* error = [NSError errorWithDomain:@"securityd" code:errSecParam userInfo:@{NSLocalizedDescriptionKey: @"No access group or identifier given"}];
1225         ckkserror("ckkscurrent", self, "Cancelling request: %@", error);
1226         complete(error);
1227         return;
1228     }
1229
1230     __weak __typeof(self) weakSelf = self;
1231
1232     [self dispatchSync:^bool {
1233         NSError* error = nil;
1234         CFErrorRef cferror = NULL;
1235
1236         NSString* newItemUUID = nil;
1237         NSString* oldItemUUID = nil;
1238
1239         // Now that we're on the db queue, ensure that the given hashes for the items match the hashes as they are now.
1240         // That is, the items haven't changed since the caller knew about the item.
1241         NSData* newItemComputedSHA1 = (NSData*) CFBridgingRelease(CFRetainSafe(SecDbItemGetSHA1(newItem, &cferror)));
1242         if(!newItemComputedSHA1 || cferror ||
1243            ![newItemComputedSHA1 isEqual:newItemSHA1]) {
1244             ckksnotice("ckkscurrent", self, "Hash mismatch for new item: %@ vs %@", newItemComputedSHA1, newItemSHA1);
1245             error = [NSError errorWithDomain:@"securityd" code:errSecItemInvalidValue userInfo:@{NSLocalizedDescriptionKey: @"New item has changed; hashes mismatch. Refetch and try again."}];
1246             complete(error);
1247             CFReleaseNull(cferror);
1248             return false;
1249         }
1250
1251         newItemUUID = (NSString*) CFBridgingRelease(CFRetainSafe(SecDbItemGetValue(newItem, &v10itemuuid, &cferror)));
1252         if(!newItemUUID || cferror) {
1253             ckkserror("ckkscurrent", self, "Error fetching UUID for new item: %@", cferror);
1254             complete((__bridge NSError*) cferror);
1255             CFReleaseNull(cferror);
1256             return false;
1257         }
1258
1259         if(oldItem) {
1260             NSData* oldItemComputedSHA1 = (NSData*) CFBridgingRelease(CFRetainSafe(SecDbItemGetSHA1(oldItem, &cferror)));
1261             if(!oldItemComputedSHA1 || cferror ||
1262                ![oldItemComputedSHA1 isEqual:oldItemSHA1]) {
1263                 ckksnotice("ckkscurrent", self, "Hash mismatch for old item: %@ vs %@", oldItemComputedSHA1, oldItemSHA1);
1264                 error = [NSError errorWithDomain:@"securityd" code:errSecItemInvalidValue userInfo:@{NSLocalizedDescriptionKey: @"Old item has changed; hashes mismatch. Refetch and try again."}];
1265                 complete(error);
1266                 CFReleaseNull(cferror);
1267                 return false;
1268             }
1269
1270             oldItemUUID = (NSString*) CFBridgingRelease(CFRetainSafe(SecDbItemGetValue(oldItem, &v10itemuuid, &cferror)));
1271             if(!oldItemUUID || cferror) {
1272                 ckkserror("ckkscurrent", self, "Error fetching UUID for old item: %@", cferror);
1273                 complete((__bridge NSError*) cferror);
1274                 CFReleaseNull(cferror);
1275                 return false;
1276             }
1277         }
1278
1279         // Not being in a CloudKit account is an automatic failure.
1280         if(self.accountStatus != CKKSAccountStatusAvailable) {
1281             ckksnotice("ckkscurrent", self, "Rejecting current item pointer set since we don't have an iCloud account.");
1282             error = [NSError errorWithDomain:@"securityd" code:errSecNotLoggedIn userInfo:@{NSLocalizedDescriptionKey: @"User is not signed into iCloud."}];
1283             complete(error);
1284             return false;
1285         }
1286
1287         // At this point, we've completed all the checks we need for the SecDbItems. Try to launch this boat!
1288         NSString* currentIdentifier = [NSString stringWithFormat:@"%@-%@", accessGroup, identifier];
1289         ckksnotice("ckkscurrent", self, "Setting current pointer for %@ to %@ (from %@)", currentIdentifier, newItemUUID, oldItemUUID);
1290         CKKSUpdateCurrentItemPointerOperation* ucipo = [[CKKSUpdateCurrentItemPointerOperation alloc] initWithCKKSKeychainView:self
1291                                                                                                                 currentPointer:(NSString*)currentIdentifier
1292                                                                                                                    oldItemUUID:(NSString*)oldItemUUID
1293                                                                                                                    newItemUUID:(NSString*)newItemUUID
1294                                                                                                               ckoperationGroup:[CKOperationGroup CKKSGroupWithName:@"currentitem-api"]];
1295         CKKSResultOperation* returnCallback = [CKKSResultOperation operationWithBlock:^{
1296             __strong __typeof(self) strongSelf = weakSelf;
1297
1298             if(ucipo.error) {
1299                 ckkserror("ckkscurrent", strongSelf, "Failed setting a current item pointer with %@", ucipo.error);
1300             } else {
1301                 ckksnotice("ckkscurrent", strongSelf, "Finished setting a current item pointer");
1302             }
1303             complete(ucipo.error);
1304         }];
1305         returnCallback.name = @"setCurrentItem-return-callback";
1306         [returnCallback addDependency: ucipo];
1307         [self scheduleOperation: returnCallback];
1308
1309         // Now, schedule ucipo. It modifies the CloudKit zone, so it should insert itself into the list of OutgoingQueueOperations.
1310         // Then, we won't have simultaneous zone-modifying operations.
1311         [ucipo linearDependencies:self.outgoingQueueOperations];
1312
1313         // If this operation hasn't started within 60 seconds, cancel it and return a "timed out" error.
1314         [ucipo timeout:60*NSEC_PER_SEC];
1315
1316         [self scheduleOperation:ucipo];
1317         return true;
1318     }];
1319     return;
1320 }
1321
1322 -(void)getCurrentItemForAccessGroup:(NSString*)accessGroup
1323                          identifier:(NSString*)identifier
1324                     fetchCloudValue:(bool)fetchCloudValue
1325                            complete:(void (^) (NSString* uuid, NSError* operror)) complete
1326 {
1327     if(accessGroup == nil || identifier == nil) {
1328         complete(NULL, [NSError errorWithDomain:@"securityd" code:errSecParam userInfo:@{NSLocalizedDescriptionKey: @"No access group or identifier given"}]);
1329         return;
1330     }
1331
1332     // Not being in a CloudKit account is an automatic failure.
1333     if(self.accountStatus != CKKSAccountStatusAvailable) {
1334         ckksnotice("ckkscurrent", self, "Rejecting current item pointer get since we don't have an iCloud account.");
1335         complete(NULL, [NSError errorWithDomain:@"securityd" code:errSecNotLoggedIn userInfo:@{NSLocalizedDescriptionKey: @"User is not signed into iCloud."}]);
1336         return;
1337     }
1338
1339     CKKSResultOperation* fetchAndProcess = nil;
1340     if(fetchCloudValue) {
1341         fetchAndProcess = [self fetchAndProcessCKChanges:CKKSFetchBecauseCurrentItemFetchRequest];
1342     }
1343
1344     __weak __typeof(self) weakSelf = self;
1345     CKKSResultOperation* getCurrentItem = [CKKSResultOperation operationWithBlock:^{
1346         if(fetchAndProcess.error) {
1347             complete(NULL, fetchAndProcess.error);
1348             return;
1349         }
1350
1351         __strong __typeof(self) strongSelf = weakSelf;
1352
1353         [strongSelf dispatchSync: ^bool {
1354             NSError* error = nil;
1355             NSString* currentIdentifier = [NSString stringWithFormat:@"%@-%@", accessGroup, identifier];
1356
1357             CKKSCurrentItemPointer* cip = [CKKSCurrentItemPointer fromDatabase:currentIdentifier
1358                                                                          state:SecCKKSProcessedStateLocal
1359                                                                         zoneID:strongSelf.zoneID
1360                                                                          error:&error];
1361             if(!cip || error) {
1362                 ckkserror("ckkscurrent", strongSelf, "No current item pointer for %@", currentIdentifier);
1363                 complete(nil, error);
1364                 return false;
1365             }
1366
1367             if(!cip.currentItemUUID) {
1368                 ckkserror("ckkscurrent", strongSelf, "Current item pointer is empty %@", cip);
1369                 complete(nil, [NSError errorWithDomain:@"securityd"
1370                                                   code:errSecInternalError
1371                                               userInfo:@{NSLocalizedDescriptionKey: @"Current item pointer is empty"}]);
1372                 return false;
1373             }
1374
1375             complete(cip.currentItemUUID, NULL);
1376
1377             return true;
1378         }];
1379     }];
1380     getCurrentItem.name = @"get-current-item-pointer";
1381
1382     [getCurrentItem addNullableDependency:fetchAndProcess];
1383     [self scheduleOperation: getCurrentItem];
1384 }
1385
1386 - (CKKSKey*) keyForItem: (SecDbItemRef) item error: (NSError * __autoreleasing *) error {
1387     CKKSKeyClass* class = nil;
1388
1389     NSString* protection = (__bridge NSString*)SecDbItemGetCachedValueWithName(item, kSecAttrAccessible);
1390     if([protection isEqualToString: (__bridge NSString*)kSecAttrAccessibleWhenUnlocked]) {
1391         class = SecCKKSKeyClassA;
1392     } else if([protection isEqualToString: (__bridge NSString*)kSecAttrAccessibleAlways] ||
1393               [protection isEqualToString: (__bridge NSString*)kSecAttrAccessibleAfterFirstUnlock]) {
1394         class = SecCKKSKeyClassC;
1395     } else {
1396         ckkserror("ckks", self, "can't pick key class for protection %@: %@", protection, item);
1397         if(error) {
1398            *error =[NSError errorWithDomain:@"securityd"
1399                                 code:5
1400                             userInfo:@{NSLocalizedDescriptionKey:
1401                                            [NSString stringWithFormat:@"can't pick key class for protection %@: %@", protection, item]}];
1402         }
1403
1404         return nil;
1405     }
1406
1407     CKKSKey* key = [CKKSKey currentKeyForClass: class zoneID:self.zoneID error:error];
1408
1409     // and make sure it's unwrapped.
1410     if(![key ensureKeyLoaded:error]) {
1411         return nil;
1412     }
1413
1414     return key;
1415 }
1416
1417 // Use the following method to find the first pending operation in a weak collection
1418 - (NSOperation*)findFirstPendingOperation: (NSHashTable*) table {
1419     return [self findFirstPendingOperation:table ofClass:nil];
1420 }
1421
1422 // Use the following method to find the first pending operation in a weak collection
1423 - (NSOperation*)findFirstPendingOperation: (NSHashTable*) table ofClass:(Class)class {
1424     @synchronized(table) {
1425         for(NSOperation* op in table) {
1426             if(op != nil && [op isPending] && (class == nil || [op isKindOfClass: class])) {
1427                 return op;
1428             }
1429         }
1430         return nil;
1431     }
1432 }
1433
1434 // Use the following method to count the pending operations in a weak collection
1435 - (int64_t)countPendingOperations: (NSHashTable*) table {
1436     @synchronized(table) {
1437         int count = 0;
1438         for(NSOperation* op in table) {
1439             if(op != nil && !([op isExecuting] || [op isFinished])) {
1440                 count++;
1441             }
1442         }
1443         return count;
1444     }
1445 }
1446
1447 - (CKKSOutgoingQueueOperation*)processOutgoingQueue:(CKOperationGroup*)ckoperationGroup {
1448     return [self processOutgoingQueueAfter:nil ckoperationGroup:ckoperationGroup];
1449 }
1450
1451 - (CKKSOutgoingQueueOperation*)processOutgoingQueueAfter:(CKKSResultOperation*)after ckoperationGroup:(CKOperationGroup*)ckoperationGroup {
1452     if(!SecCKKSIsEnabled()) {
1453         ckksinfo("ckks", self, "Skipping processOutgoingQueue due to disabled CKKS");
1454         return nil;
1455     }
1456
1457     CKKSOutgoingQueueOperation* outgoingop =
1458             (CKKSOutgoingQueueOperation*) [self findFirstPendingOperation:self.outgoingQueueOperations
1459                                                                   ofClass:[CKKSOutgoingQueueOperation class]];
1460     if(outgoingop) {
1461         ckksinfo("ckks", self, "Skipping processOutgoingQueue due to at least one pending instance");
1462         if(after) {
1463             [outgoingop addDependency: after];
1464         }
1465         if([outgoingop isPending]) {
1466             if(!outgoingop.ckoperationGroup && ckoperationGroup) {
1467                 outgoingop.ckoperationGroup = ckoperationGroup;
1468             } else if(ckoperationGroup) {
1469                 ckkserror("ckks", self, "Throwing away CKOperationGroup(%@) in favor of %@", ckoperationGroup, outgoingop.ckoperationGroup);
1470             }
1471
1472             return outgoingop;
1473         }
1474     }
1475
1476     CKKSOutgoingQueueOperation* op = [[CKKSOutgoingQueueOperation alloc] initWithCKKSKeychainView:self ckoperationGroup:ckoperationGroup];
1477     op.name = @"outgoing-queue-operation";
1478     [op addNullableDependency:after];
1479
1480     [op addNullableDependency: self.initialScanOperation];
1481
1482     [self scheduleOperation: op];
1483     return op;
1484 }
1485
1486 - (void)processIncomingQueueAfterNextUnlock {
1487     // Thread races aren't so important here; we might end up with two or three copies of this operation, but that's okay.
1488     if(![self.processIncomingQueueAfterNextUnlockOperation isPending]) {
1489         __weak __typeof(self) weakSelf = self;
1490
1491         CKKSResultOperation* restartIncomingQueueOperation = [CKKSResultOperation operationWithBlock:^{
1492             __strong __typeof(self) strongSelf = weakSelf;
1493             // This IQO shouldn't error if the keybag has locked again. It will simply try again later.
1494             [strongSelf processIncomingQueue:false];
1495         }];
1496
1497         restartIncomingQueueOperation.name = @"reprocess-incoming-queue-after-unlock";
1498         self.processIncomingQueueAfterNextUnlockOperation = restartIncomingQueueOperation;
1499
1500         [restartIncomingQueueOperation addNullableDependency:self.lockStateTracker.unlockDependency];
1501         [self scheduleOperation: restartIncomingQueueOperation];
1502     }
1503 }
1504
1505 - (CKKSIncomingQueueOperation*)processIncomingQueue:(bool)failOnClassA {
1506     return [self processIncomingQueue:failOnClassA after: nil];
1507 }
1508
1509 - (CKKSIncomingQueueOperation*) processIncomingQueue:(bool)failOnClassA after: (CKKSResultOperation*) after {
1510     if(!SecCKKSIsEnabled()) {
1511         ckksinfo("ckks", self, "Skipping processIncomingQueue due to disabled CKKS");
1512         return nil;
1513     }
1514
1515     CKKSIncomingQueueOperation* incomingop = (CKKSIncomingQueueOperation*) [self findFirstPendingOperation:self.incomingQueueOperations];
1516     if(incomingop) {
1517         ckksinfo("ckks", self, "Skipping processIncomingQueue due to at least one pending instance");
1518         if(after) {
1519             [incomingop addDependency: after];
1520         }
1521         // check (again) for race condition; if the op has started we need to add another (for the dependency)
1522         if([incomingop isPending]) {
1523             incomingop.errorOnClassAFailure |= failOnClassA;
1524             return incomingop;
1525         }
1526     }
1527
1528     CKKSIncomingQueueOperation* op  = [[CKKSIncomingQueueOperation alloc] initWithCKKSKeychainView:self errorOnClassAFailure:failOnClassA];
1529     op.name = @"incoming-queue-operation";
1530     if(after != nil) {
1531         [op addSuccessDependency: after];
1532     }
1533
1534     [self scheduleOperation: op];
1535     return op;
1536 }
1537
1538 - (CKKSUpdateDeviceStateOperation*)updateDeviceState:(bool)rateLimit ckoperationGroup:(CKOperationGroup*)ckoperationGroup {
1539     if(!SecCKKSIsEnabled()) {
1540         ckksinfo("ckks", self, "Skipping updateDeviceState due to disabled CKKS");
1541         return nil;
1542     }
1543
1544     CKKSUpdateDeviceStateOperation* op = [[CKKSUpdateDeviceStateOperation alloc] initWithCKKSKeychainView:self rateLimit:rateLimit ckoperationGroup:ckoperationGroup];
1545     op.name = @"device-state-operation";
1546
1547     // op modifies the CloudKit zone, so it should insert itself into the list of OutgoingQueueOperations.
1548     // Then, we won't have simultaneous zone-modifying operations and confuse ourselves.
1549     [op linearDependencies:self.outgoingQueueOperations];
1550
1551     // CKKSUpdateDeviceStateOperations are special: they should fire even if we don't believe we're in an iCloud account.
1552     [self scheduleAccountStatusOperation:op];
1553     return op;
1554 }
1555
1556 // There are some errors which won't be reported but will be reflected in the CDSE; any error coming out of here is fatal
1557 - (CKKSDeviceStateEntry*)_onqueueCurrentDeviceStateEntry: (NSError* __autoreleasing*)error {
1558     NSError* localerror = nil;
1559
1560     CKKSCKAccountStateTracker* accountTracker = self.accountTracker;
1561
1562     // We must have an iCloud account (with d2de on) to even create one of these
1563     if(accountTracker.currentCKAccountInfo.accountStatus != CKAccountStatusAvailable || accountTracker.currentCKAccountInfo.supportsDeviceToDeviceEncryption != YES) {
1564         ckkserror("ckksdevice", self, "No iCloud account active: %@", accountTracker.currentCKAccountInfo);
1565         localerror = [NSError errorWithDomain:@"securityd"
1566                                          code:errSecInternalError
1567                                      userInfo:@{NSLocalizedDescriptionKey: [NSString stringWithFormat: @"No active HSA2 iCloud account: %@", accountTracker.currentCKAccountInfo]}];
1568         if(error) {
1569             *error = localerror;
1570         }
1571         return nil;
1572     }
1573
1574     CKKSDeviceStateEntry* oldcdse = [CKKSDeviceStateEntry tryFromDatabase:accountTracker.ckdeviceID zoneID:self.zoneID error:&localerror];
1575     if(localerror) {
1576         ckkserror("ckksdevice", self, "Couldn't read old CKKSDeviceStateEntry from database: %@", localerror);
1577         if(error) {
1578             *error = localerror;
1579         }
1580         return nil;
1581     }
1582
1583     // Find out what we think the current keys are
1584     CKKSCurrentKeyPointer* currentTLKPointer    = [CKKSCurrentKeyPointer tryFromDatabase: SecCKKSKeyClassTLK zoneID:self.zoneID error:&localerror];
1585     CKKSCurrentKeyPointer* currentClassAPointer = [CKKSCurrentKeyPointer tryFromDatabase: SecCKKSKeyClassA   zoneID:self.zoneID error:&localerror];
1586     CKKSCurrentKeyPointer* currentClassCPointer = [CKKSCurrentKeyPointer tryFromDatabase: SecCKKSKeyClassC   zoneID:self.zoneID error:&localerror];
1587     if(localerror) {
1588         // Things is broken, but the whole point of this record is to share the brokenness. Continue.
1589         ckkserror("ckksdevice", self, "Couldn't read current key pointers from database: %@; proceeding", localerror);
1590         localerror = nil;
1591     }
1592
1593     CKKSKey* suggestedTLK       = currentTLKPointer.currentKeyUUID    ? [CKKSKey tryFromDatabase:currentTLKPointer.currentKeyUUID    zoneID:self.zoneID error:&localerror] : nil;
1594     CKKSKey* suggestedClassAKey = currentClassAPointer.currentKeyUUID ? [CKKSKey tryFromDatabase:currentClassAPointer.currentKeyUUID zoneID:self.zoneID error:&localerror] : nil;
1595     CKKSKey* suggestedClassCKey = currentClassCPointer.currentKeyUUID ? [CKKSKey tryFromDatabase:currentClassCPointer.currentKeyUUID zoneID:self.zoneID error:&localerror] : nil;
1596
1597     if(localerror) {
1598         // Things is broken, but the whole point of this record is to share the brokenness. Continue.
1599         ckkserror("ckksdevice", self, "Couldn't read keys from database: %@; proceeding", localerror);
1600         localerror = nil;
1601     }
1602
1603     // Check if we posess the keys in the keychain
1604     [suggestedTLK ensureKeyLoaded:&localerror];
1605     if(localerror && [self.lockStateTracker isLockedError:localerror]) {
1606         ckkserror("ckksdevice", self, "Device is locked; couldn't read TLK from keychain. Assuming it is present and continuing; error was %@", localerror);
1607         localerror = nil;
1608     } else if(localerror) {
1609         ckkserror("ckksdevice", self, "Couldn't read TLK from keychain. We do not have a current TLK. Error was %@", localerror);
1610         suggestedTLK = nil;
1611     }
1612
1613     [suggestedClassAKey ensureKeyLoaded:&localerror];
1614     if(localerror && [self.lockStateTracker isLockedError:localerror]) {
1615         ckkserror("ckksdevice", self, "Device is locked; couldn't read ClassA key from keychain. Assuming it is present and continuing; error was %@", localerror);
1616         localerror = nil;
1617     } else if(localerror) {
1618         ckkserror("ckksdevice", self, "Couldn't read ClassA key from keychain. We do not have a current ClassA key. Error was %@", localerror);
1619         suggestedClassAKey = nil;
1620     }
1621
1622     [suggestedClassCKey ensureKeyLoaded:&localerror];
1623     // class C keys are stored class C, so uh, don't check lock state.
1624     if(localerror) {
1625         ckkserror("ckksdevice", self, "Couldn't read ClassC key from keychain. We do not have a current ClassC key. Error was %@", localerror);
1626         suggestedClassCKey = nil;
1627     }
1628
1629     // We'd like to have the circle peer ID. Give the account state tracker a fighting chance, but not having it is not an error
1630     if([accountTracker.accountCirclePeerIDInitialized wait:500*NSEC_PER_MSEC] != 0 && !accountTracker.accountCirclePeerID) {
1631         ckkserror("ckksdevice", self, "No peer ID available");
1632     }
1633
1634     // We only really want the oldcdse for its encodedCKRecord, so make a new cdse here
1635     CKKSDeviceStateEntry* newcdse = [[CKKSDeviceStateEntry alloc] initForDevice:accountTracker.ckdeviceID
1636                                                                    circlePeerID:accountTracker.accountCirclePeerID
1637                                                                    circleStatus:accountTracker.currentCircleStatus
1638                                                                        keyState:self.keyHierarchyState
1639                                                                  currentTLKUUID:suggestedTLK.uuid
1640                                                               currentClassAUUID:suggestedClassAKey.uuid
1641                                                               currentClassCUUID:suggestedClassCKey.uuid
1642                                                                          zoneID:self.zoneID
1643                                                                 encodedCKRecord:oldcdse.encodedCKRecord];
1644     return newcdse;
1645 }
1646
1647 - (CKKSSynchronizeOperation*) resyncWithCloud {
1648     if(!SecCKKSIsEnabled()) {
1649         ckksinfo("ckks", self, "Skipping resyncWithCloud due to disabled CKKS");
1650         return nil;
1651     }
1652
1653     CKKSSynchronizeOperation* op = [[CKKSSynchronizeOperation alloc] initWithCKKSKeychainView: self];
1654     [self scheduleOperation: op];
1655     return op;
1656 }
1657
1658 - (CKKSResultOperation*)fetchAndProcessCKChanges:(CKKSFetchBecause*)because {
1659     if(!SecCKKSIsEnabled()) {
1660         ckksinfo("ckks", self, "Skipping fetchAndProcessCKChanges due to disabled CKKS");
1661         return nil;
1662     }
1663
1664     // We fetched some changes; try to process them!
1665     return [self processIncomingQueue:false after:[self.zoneChangeFetcher requestSuccessfulFetch:because]];
1666 }
1667
1668 // Lets the view know about a failed CloudKit write. If the error is "already have one of these records", it will
1669 // store the new records and kick off the new processing
1670 //
1671 // Note that you need to tell this function the records you wanted to save, so it can determine what needs deletion
1672 - (bool)_onqueueCKWriteFailed:(NSError*)ckerror attemptedRecordsChanged:(NSDictionary<CKRecordID*, CKRecord*>*)savedRecords {
1673     dispatch_assert_queue(self.queue);
1674
1675     NSDictionary<CKRecordID*,NSError*>* partialErrors = ckerror.userInfo[CKPartialErrorsByItemIDKey];
1676     if([ckerror.domain isEqual:CKErrorDomain] && ckerror.code == CKErrorPartialFailure && partialErrors) {
1677         // Check if this error was "you're out of date"
1678         bool recordChanged = true;
1679
1680         for(NSError* error in partialErrors.allValues) {
1681             if((![error.domain isEqual:CKErrorDomain]) || (error.code != CKErrorBatchRequestFailed && error.code != CKErrorServerRecordChanged && error.code != CKErrorUnknownItem)) {
1682                 // There's an error in there that isn't CKErrorServerRecordChanged, CKErrorBatchRequestFailed, or CKErrorUnknownItem. Don't handle nicely...
1683                 recordChanged = false;
1684             }
1685         }
1686
1687         if(recordChanged) {
1688             ckksnotice("ckks", self, "Received a ServerRecordChanged error, attempting to update new records and delete unknown ones");
1689
1690             bool updatedRecord = false;
1691
1692             for(CKRecordID* recordID in partialErrors.allKeys) {
1693                 NSError* error = partialErrors[recordID];
1694                 if([error.domain isEqual:CKErrorDomain] && error.code == CKErrorServerRecordChanged) {
1695                     CKRecord* newRecord = error.userInfo[CKRecordChangedErrorServerRecordKey];
1696                     ckksnotice("ckks", self, "On error: updating our idea of: %@", newRecord);
1697
1698                     updatedRecord |= [self _onqueueCKRecordChanged:newRecord resync:true];
1699                 } else if([error.domain isEqual:CKErrorDomain] && error.code == CKErrorUnknownItem) {
1700                     CKRecord* record = savedRecords[recordID];
1701                     ckksnotice("ckks", self, "On error: handling an unexpected delete of: %@ %@", recordID, record);
1702
1703                     updatedRecord |= [self _onqueueCKRecordDeleted:recordID recordType:record.recordType resync:true];
1704                 }
1705             }
1706
1707             if(updatedRecord) {
1708                 [self processIncomingQueue:false];
1709                 return true;
1710             }
1711         }
1712     }
1713
1714     return false;
1715 }
1716
1717 - (bool)_onqueueCKRecordDeleted:(CKRecordID*)recordID recordType:(NSString*)recordType resync:(bool)resync {
1718     dispatch_assert_queue(self.queue);
1719
1720     // TODO: resync doesn't really mean much here; what does it mean for a record to be 'deleted' if you're fetching from scratch?
1721
1722     if([recordType isEqual: SecCKRecordItemType]) {
1723         ckksinfo("ckks", self, "CloudKit notification: deleted record(%@): %@", recordType, recordID);
1724         NSError* error = nil;
1725         NSError* iqeerror = nil;
1726         CKKSMirrorEntry* ckme = [CKKSMirrorEntry fromDatabase: [recordID recordName] zoneID:self.zoneID error: &error];
1727
1728         // Deletes always succeed, not matter the generation count
1729         if(ckme) {
1730             [ckme deleteFromDatabase:&error];
1731
1732             CKKSIncomingQueueEntry* iqe = [[CKKSIncomingQueueEntry alloc] initWithCKKSItem:ckme.item action:SecCKKSActionDelete state:SecCKKSStateNew];
1733             [iqe saveToDatabase:&iqeerror];
1734             if(iqeerror) {
1735                 ckkserror("ckks", self, "Couldn't save incoming queue entry: %@", iqeerror);
1736             }
1737         }
1738         ckksinfo("ckks", self, "CKKSMirrorEntry was deleted: %@ %@ error: %@", recordID, ckme, error);
1739         // TODO: actually pass error back up
1740         return (error == nil);
1741
1742     } else if([recordType isEqual: SecCKRecordCurrentItemType]) {
1743         ckksinfo("ckks", self, "CloudKit notification: deleted current item pointer(%@): %@", recordType, recordID);
1744         NSError* error = nil;
1745
1746         [[CKKSCurrentItemPointer tryFromDatabase:[recordID recordName] state:SecCKKSProcessedStateRemote zoneID:self.zoneID error:&error] deleteFromDatabase:&error];
1747         [[CKKSCurrentItemPointer fromDatabase:[recordID recordName]    state:SecCKKSProcessedStateLocal  zoneID:self.zoneID error:&error] deleteFromDatabase:&error];
1748
1749         ckksinfo("ckks", self, "CKKSCurrentItemPointer was deleted: %@ error: %@", recordID, error);
1750         return (error == nil);
1751
1752     } else if([recordType isEqual: SecCKRecordIntermediateKeyType]) {
1753         // TODO: handle in some interesting way
1754         return true;
1755     } else if([recordType isEqual: SecCKRecordDeviceStateType]) {
1756         NSError* error = nil;
1757         ckksinfo("ckks", self, "CloudKit notification: deleted device state record(%@): %@", recordType, recordID);
1758
1759         CKKSDeviceStateEntry* cdse = [CKKSDeviceStateEntry tryFromDatabaseFromCKRecordID:recordID error:&error];
1760         [cdse deleteFromDatabase: &error];
1761         ckksinfo("ckks", self, "CKKSCurrentItemPointer(%@) was deleted: %@ error: %@", cdse, recordID, error);
1762
1763         return (error == nil);
1764
1765     } else if ([recordType isEqualToString:SecCKRecordManifestType]) {
1766         ckksinfo("ckks", self, "CloudKit notification: deleted manifest record (%@): %@", recordType, recordID);
1767
1768         NSError* error = nil;
1769         CKKSManifest* manifest = [CKKSManifest manifestForRecordName:recordID.recordName error:&error];
1770         if (manifest) {
1771             [manifest deleteFromDatabase:&error];
1772         }
1773
1774         ckksinfo("ckks", self, "CKKSManifest was deleted: %@ %@ error: %@", recordID, manifest, error);
1775         // TODO: actually pass error back up
1776         return error == nil;
1777     }
1778     else {
1779         ckkserror("ckksfetch", self, "unknown record type: %@ %@", recordType, recordID);
1780         return false;
1781     }
1782 }
1783
1784 - (bool)_onqueueCKRecordChanged:(CKRecord*)record resync:(bool)resync {
1785     dispatch_assert_queue(self.queue);
1786
1787     ckksinfo("ckksfetch", self, "Processing record modification(%@): %@", record.recordType, record);
1788
1789     if([[record recordType] isEqual: SecCKRecordItemType]) {
1790         [self _onqueueCKRecordItemChanged:record resync:resync];
1791         return true;
1792     } else if([[record recordType] isEqual: SecCKRecordCurrentItemType]) {
1793         [self _onqueueCKRecordCurrentItemPointerChanged:record resync:resync];
1794         return true;
1795     } else if([[record recordType] isEqual: SecCKRecordIntermediateKeyType]) {
1796         [self _onqueueCKRecordKeyChanged:record resync:resync];
1797         return true;
1798     } else if([[record recordType] isEqualToString: SecCKRecordCurrentKeyType]) {
1799         [self _onqueueCKRecordCurrentKeyPointerChanged:record resync:resync];
1800         return true;
1801     } else if ([[record recordType] isEqualToString:SecCKRecordManifestType]) {
1802         [self _onqueueCKRecordManifestChanged:record resync:resync];
1803         return true;
1804     } else if ([[record recordType] isEqualToString:SecCKRecordManifestLeafType]) {
1805         [self _onqueueCKRecordManifestLeafChanged:record resync:resync];
1806         return true;
1807     } else if ([[record recordType] isEqualToString:SecCKRecordDeviceStateType]) {
1808         [self _onqueueCKRecordDeviceStateChanged:record resync:resync];
1809         return true;
1810     } else {
1811         ckkserror("ckksfetch", self, "unknown record type: %@ %@", [record recordType], record);
1812         return false;
1813     }
1814 }
1815
1816 - (void)_onqueueCKRecordItemChanged:(CKRecord*)record resync:(bool)resync {
1817     dispatch_assert_queue(self.queue);
1818
1819     NSError* error = nil;
1820     // Find if we knew about this record in the past
1821     bool update = false;
1822     CKKSMirrorEntry* ckme = [CKKSMirrorEntry tryFromDatabase: [[record recordID] recordName] zoneID:self.zoneID error:&error];
1823
1824     if(error) {
1825         ckkserror("ckks", self, "error loading a CKKSMirrorEntry from database: %@", error);
1826         // TODO: quit?
1827     }
1828
1829     if(resync) {
1830         if(!ckme) {
1831             ckkserror("ckksresync", self, "BUG: No local item matching resynced CloudKit record: %@", record);
1832         } else if(![ckme matchesCKRecord:record]) {
1833             ckkserror("ckksresync", self, "BUG: Local item doesn't match resynced CloudKit record: %@ %@", ckme, record);
1834         } else {
1835             ckksnotice("ckksresync", self, "Already know about this item record, skipping update: %@", record);
1836             return;
1837         }
1838     }
1839
1840     if(ckme && ckme.item && ckme.item.generationCount > [record[SecCKRecordGenerationCountKey] unsignedLongLongValue]) {
1841         ckkserror("ckks", self, "received a record from CloudKit with a bad generation count: %@ (%ld > %@)", ckme.uuid,
1842                  (long) ckme.item.generationCount,
1843                  record[SecCKRecordGenerationCountKey]);
1844         // Abort processing this record.
1845         return;
1846     }
1847
1848     // If we found an old version in the database; this might be an update
1849     if(ckme) {
1850         if([ckme matchesCKRecord:record]) {
1851             // This is almost certainly a record we uploaded; CKFetchChanges sends them back as new records
1852             ckksnotice("ckks", self, "CloudKit has told us of record we already know about; skipping update");
1853             return;
1854         }
1855
1856         update = true;
1857         // Set the CKKSMirrorEntry's fields to be whatever this record holds
1858         [ckme setFromCKRecord: record];
1859     } else {
1860         // Have to make a new CKKSMirrorEntry
1861         ckme = [[CKKSMirrorEntry alloc] initWithCKRecord: record];
1862     }
1863
1864     [ckme saveToDatabase: &error];
1865
1866     if(error) {
1867         ckkserror("ckks", self, "couldn't save new CKRecord to database: %@ %@", record, error);
1868     } else {
1869         ckksdebug("ckks", self, "CKKSMirrorEntry was created: %@", ckme);
1870     }
1871
1872     NSError* iqeerror = nil;
1873     CKKSIncomingQueueEntry* iqe = [[CKKSIncomingQueueEntry alloc] initWithCKKSItem:ckme.item
1874                                                                             action:(update ? SecCKKSActionModify : SecCKKSActionAdd)
1875                                                                              state:SecCKKSStateNew];
1876     [iqe saveToDatabase:&iqeerror];
1877     if(iqeerror) {
1878         ckkserror("ckks", self, "Couldn't save modified incoming queue entry: %@", iqeerror);
1879     } else {
1880         ckksdebug("ckks", self, "CKKSIncomingQueueEntry was created: %@", iqe);
1881     }
1882
1883     // A remote change has occured for this record. Delete any pending local changes; they will be overwritten.
1884     CKKSOutgoingQueueEntry* oqe = [CKKSOutgoingQueueEntry tryFromDatabase:ckme.uuid state: SecCKKSStateNew zoneID:self.zoneID error: &error];
1885     if(error) {
1886         ckkserror("ckks", self, "Couldn't load OutgoingQueueEntry: %@", error);
1887     }
1888     if(oqe) {
1889         [self _onqueueChangeOutgoingQueueEntry:oqe toState:SecCKKSStateDeleted error:&error];
1890     }
1891
1892     // Reencryptions are pending changes too
1893     oqe = [CKKSOutgoingQueueEntry tryFromDatabase:ckme.uuid state: SecCKKSStateReencrypt zoneID:self.zoneID error: &error];
1894     if(error) {
1895         ckkserror("ckks", self, "Couldn't load reencrypted OutgoingQueueEntry: %@", error);
1896     }
1897     if(oqe) {
1898         [oqe deleteFromDatabase:&error];
1899         if(error) {
1900             ckkserror("ckks", self, "Couldn't delete reencrypted oqe(%@): %@", oqe, error);
1901         }
1902     }
1903 }
1904
1905 - (void)_onqueueCKRecordKeyChanged:(CKRecord*)record resync:(bool)resync {
1906     dispatch_assert_queue(self.queue);
1907
1908     NSError* error = nil;
1909
1910     if(resync) {
1911         NSError* resyncerror = nil;
1912
1913         CKKSKey* key = [CKKSKey tryFromDatabaseAnyState:record.recordID.recordName zoneID:self.zoneID error:&resyncerror];
1914         if(resyncerror) {
1915             ckkserror("ckksresync", self, "error loading key: %@", resyncerror);
1916         }
1917         if(!key) {
1918             ckkserror("ckksresync", self, "BUG: No sync key matching resynced CloudKit record: %@", record);
1919         } else if(![key matchesCKRecord:record]) {
1920             ckkserror("ckksresync", self, "BUG: Local sync key doesn't match resynced CloudKit record(s): %@ %@", key, record);
1921         } else {
1922             ckksnotice("ckksresync", self, "Already know about this sync key, skipping update: %@", record);
1923             return;
1924         }
1925     }
1926
1927     // For now, drop into the synckeys table as a 'remote' key, then ask for a rekey operation.
1928     CKKSKey* remotekey = [[CKKSKey alloc] initWithCKRecord: record];
1929
1930     // We received this from an update. Don't use, yet.
1931     remotekey.state = SecCKKSProcessedStateRemote;
1932     remotekey.currentkey = false;
1933
1934     [remotekey saveToDatabase:&error];
1935     if(error) {
1936         ckkserror("ckkskey", self, "Couldn't save key record to database: %@: %@", remotekey, error);
1937         ckksinfo("ckkskey", self, "CKRecord was %@", record);
1938     }
1939
1940     // We've saved a new key in the database; trigger a rekey operation.
1941     [self _onqueueKeyStateMachineRequestProcess];
1942 }
1943
1944 - (void)_onqueueCKRecordCurrentKeyPointerChanged:(CKRecord*)record resync:(bool)resync {
1945     dispatch_assert_queue(self.queue);
1946
1947     if(resync) {
1948         NSError* ckperror = nil;
1949         CKKSCurrentKeyPointer* ckp = [CKKSCurrentKeyPointer tryFromDatabase:((CKKSKeyClass*) record.recordID.recordName) zoneID:self.zoneID error:&ckperror];
1950         if(ckperror) {
1951             ckkserror("ckksresync", self, "error loading ckp: %@", ckperror);
1952         }
1953         if(!ckp) {
1954             ckkserror("ckksresync", self, "BUG: No current key pointer matching resynced CloudKit record: %@", record);
1955         } else if(![ckp matchesCKRecord:record]) {
1956             ckkserror("ckksresync", self, "BUG: Local current key pointer doesn't match resynced CloudKit record: %@ %@", ckp, record);
1957         } else {
1958             ckksnotice("ckksresync", self, "Already know about this current key pointer, skipping update: %@", record);
1959             return;
1960         }
1961     }
1962
1963     NSError* error = nil;
1964     CKKSCurrentKeyPointer* currentkey = [[CKKSCurrentKeyPointer alloc] initWithCKRecord: record];
1965
1966     [currentkey saveToDatabase: &error];
1967     if(error) {
1968         ckkserror("ckkskey", self, "Couldn't save current key pointer to database: %@: %@", currentkey, error);
1969         ckksinfo("ckkskey", self, "CKRecord was %@", record);
1970     }
1971
1972     // We've saved a new key in the database; trigger a rekey operation.
1973     [self _onqueueKeyStateMachineRequestProcess];
1974 }
1975
1976 - (void)_onqueueCKRecordCurrentItemPointerChanged:(CKRecord*)record resync:(bool)resync {
1977     dispatch_assert_queue(self.queue);
1978
1979     if(resync) {
1980         NSError* ciperror = nil;
1981         CKKSCurrentItemPointer* localcip  = [CKKSCurrentItemPointer tryFromDatabase:record.recordID.recordName state:SecCKKSProcessedStateLocal  zoneID:self.zoneID error:&ciperror];
1982         CKKSCurrentItemPointer* remotecip = [CKKSCurrentItemPointer tryFromDatabase:record.recordID.recordName state:SecCKKSProcessedStateRemote zoneID:self.zoneID error:&ciperror];
1983         if(ciperror) {
1984             ckkserror("ckksresync", self, "error loading cip: %@", ciperror);
1985         }
1986         if(!(localcip || remotecip)) {
1987             ckkserror("ckksresync", self, "BUG: No current item pointer matching resynced CloudKit record: %@", record);
1988         } else if(! ([localcip matchesCKRecord:record] || [remotecip matchesCKRecord:record]) ) {
1989             ckkserror("ckksresync", self, "BUG: Local current item pointer doesn't match resynced CloudKit record(s): %@ %@ %@", localcip, remotecip, record);
1990         } else {
1991             ckksnotice("ckksresync", self, "Already know about this current item pointer, skipping update: %@", record);
1992             return;
1993         }
1994     }
1995
1996     NSError* error = nil;
1997     CKKSCurrentItemPointer* cip = [[CKKSCurrentItemPointer alloc] initWithCKRecord: record];
1998     cip.state = SecCKKSProcessedStateRemote;
1999
2000     [cip saveToDatabase: &error];
2001     if(error) {
2002         ckkserror("currentitem", self, "Couldn't save current item pointer to database: %@: %@ %@", cip, error, record);
2003     }
2004 }
2005
2006 - (void)_onqueueCKRecordManifestChanged:(CKRecord*)record resync:(bool)resync
2007 {
2008     NSError* error = nil;
2009     CKKSPendingManifest* manifest = [[CKKSPendingManifest alloc] initWithCKRecord:record];
2010     [manifest saveToDatabase:&error];
2011     if (error) {
2012         ckkserror("CKKS", self, "Failed to save fetched manifest record to database: %@: %@", manifest, error);
2013         ckksinfo("CKKS", self, "manifest CKRecord was %@", record);
2014     }
2015 }
2016
2017 - (void)_onqueueCKRecordManifestLeafChanged:(CKRecord*)record resync:(bool)resync
2018 {
2019     NSError* error = nil;
2020     CKKSManifestLeafRecord* manifestLeaf = [[CKKSManifestPendingLeafRecord alloc] initWithCKRecord:record];
2021     [manifestLeaf saveToDatabase:&error];
2022     if (error) {
2023         ckkserror("CKKS", self, "Failed to save fetched manifest leaf record to database: %@: %@", manifestLeaf, error);
2024         ckksinfo("CKKS", self, "manifest leaf CKRecord was %@", record);
2025     }
2026 }
2027
2028 - (void)_onqueueCKRecordDeviceStateChanged:(CKRecord*)record resync:(bool)resync {
2029     if(resync) {
2030         NSError* dserror = nil;
2031         CKKSDeviceStateEntry* cdse  = [CKKSDeviceStateEntry tryFromDatabase:record.recordID.recordName zoneID:self.zoneID error:&dserror];
2032         if(dserror) {
2033             ckkserror("ckksresync", self, "error loading cdse: %@", dserror);
2034         }
2035         if(!cdse) {
2036             ckkserror("ckksresync", self, "BUG: No current device state entry matching resynced CloudKit record: %@", record);
2037         } else if(![cdse matchesCKRecord:record]) {
2038             ckkserror("ckksresync", self, "BUG: Local current device state entry doesn't match resynced CloudKit record(s): %@ %@", cdse, record);
2039         } else {
2040             ckksnotice("ckksresync", self, "Already know about this current item pointer, skipping update: %@", record);
2041             return;
2042         }
2043     }
2044
2045     NSError* error = nil;
2046     CKKSDeviceStateEntry* cdse = [[CKKSDeviceStateEntry alloc] initWithCKRecord:record];
2047     [cdse saveToDatabase:&error];
2048     if (error) {
2049         ckkserror("ckksdevice", self, "Failed to save device record to database: %@: %@ %@", cdse, error, record);
2050     }
2051 }
2052
2053 - (bool)_onqueueChangeOutgoingQueueEntry: (CKKSOutgoingQueueEntry*) oqe toState: (NSString*) state error: (NSError* __autoreleasing*) error {
2054     dispatch_assert_queue(self.queue);
2055
2056     NSError* localerror = nil;
2057
2058     if([state isEqualToString: SecCKKSStateDeleted]) {
2059         // Hurray, this must be a success
2060         SecBoolNSErrorCallback callback = self.pendingSyncCallbacks[oqe.uuid];
2061         if(callback) {
2062             callback(true, nil);
2063         }
2064
2065         [oqe deleteFromDatabase: &localerror];
2066         if(localerror) {
2067             ckkserror("ckks", self, "Couldn't delete %@: %@", oqe, localerror);
2068         }
2069
2070     } else {
2071         oqe.state = state;
2072         [oqe saveToDatabase: &localerror];
2073         if(localerror) {
2074             ckkserror("ckks", self, "Couldn't save %@ as %@: %@", oqe, state, localerror);
2075         }
2076     }
2077
2078     if(error && localerror) {
2079         *error = localerror;
2080     }
2081     return localerror == nil;
2082 }
2083
2084 - (bool)_onqueueErrorOutgoingQueueEntry: (CKKSOutgoingQueueEntry*) oqe itemError: (NSError*) itemError error: (NSError* __autoreleasing*) error {
2085     dispatch_assert_queue(self.queue);
2086
2087     SecBoolNSErrorCallback callback = self.pendingSyncCallbacks[oqe.uuid];
2088     if(callback) {
2089         callback(false, itemError);
2090     }
2091     NSError* localerror = nil;
2092
2093     oqe.state = SecCKKSStateError;
2094     [oqe saveToDatabase: &localerror];
2095     if(localerror) {
2096         ckkserror("ckks", self, "Couldn't set %@ as error: %@", oqe, localerror);
2097     }
2098
2099     if(error && localerror) {
2100         *error = localerror;
2101     }
2102     return localerror == nil;
2103 }
2104
2105 - (bool)_onQueueUpdateLatestManifestWithError:(NSError**)error
2106 {
2107     dispatch_assert_queue(self.queue);
2108     CKKSManifest* manifest = [CKKSManifest latestTrustedManifestForZone:self.zoneName error:error];
2109     if (manifest) {
2110         self.latestManifest = manifest;
2111         return true;
2112     }
2113     else {
2114         return false;
2115     }
2116 }
2117
2118 - (bool)checkTLK: (CKKSKey*) proposedTLK error: (NSError * __autoreleasing *) error {
2119     // Until we have Octagon Trust, accept this TLK iff we have its actual AES key in the keychain
2120
2121     if([proposedTLK loadKeyMaterialFromKeychain:error]) {
2122         // Hurray!
2123         return true;
2124     } else {
2125         return false;
2126     }
2127 }
2128
2129 - (void) dispatchAsync: (bool (^)(void)) block {
2130     // We need to call kc_with_dbt, which blocks. Route up through a global queue...
2131     __weak __typeof(self) weakSelf = self;
2132
2133     dispatch_async(dispatch_get_global_queue(QOS_CLASS_DEFAULT, 0), ^{
2134         [weakSelf dispatchSync:block];
2135     });
2136 }
2137
2138 // Use this if you have a potential database connection already
2139 - (void) dispatchSyncWithConnection: (SecDbConnectionRef) dbconn block: (bool (^)(void)) block {
2140     if(dbconn) {
2141         dispatch_sync(self.queue, ^{
2142             CFErrorRef cferror = NULL;
2143             kc_transaction_type(dbconn, kSecDbExclusiveRemoteCKKSTransactionType, &cferror, block);
2144
2145             if(cferror) {
2146                 ckkserror("ckks", self, "error doing database transaction (sync), major problems ahead: %@", cferror);
2147             }
2148         });
2149     } else {
2150         [self dispatchSync: block];
2151     }
2152 }
2153
2154 - (void) dispatchSync: (bool (^)(void)) block {
2155     // important enough to block this thread. Must get a connection first, though!
2156     __weak __typeof(self) weakSelf = self;
2157
2158     CFErrorRef cferror = NULL;
2159     kc_with_dbt(true, &cferror, ^bool (SecDbConnectionRef dbt) {
2160         __strong __typeof(weakSelf) strongSelf = weakSelf;
2161         if(!strongSelf) {
2162             ckkserror("ckks", strongSelf, "received callback for released object");
2163             return false;
2164         }
2165
2166         __block bool ok = false;
2167         __block CFErrorRef cferror = NULL;
2168
2169         dispatch_sync(strongSelf.queue, ^{
2170             ok = kc_transaction_type(dbt, kSecDbExclusiveRemoteCKKSTransactionType, &cferror, block);
2171         });
2172         return ok;
2173     });
2174     if(cferror) {
2175         ckkserror("ckks", self, "error getting database connection (sync), major problems ahead: %@", cferror);
2176     }
2177 }
2178
2179 - (void)dispatchSyncWithAccountQueue:(bool (^)(void))block
2180 {
2181     [SOSAccount performOnAccountQueue:^{
2182         [CKKSManifest performWithAccountInfo:^{
2183             [self dispatchSync:^bool{
2184                 __block bool result = false;
2185                 [SOSAccount performWhileHoldingAccountQueue:^{ // so any calls through SOS account will know they can perform their work without dispatching to the account queue, which we already hold
2186                     result = block();
2187                 }];
2188                 return result;
2189             }];
2190         }];
2191     }];
2192 }
2193
2194 #pragma mark - CKKSZoneUpdateReceiver
2195
2196 - (void)notifyZoneChange: (CKRecordZoneNotification*) notification {
2197     ckksinfo("ckks", self, "hurray, got a zone change for %@ %@", self, notification);
2198
2199     [self fetchAndProcessCKChanges:CKKSFetchBecauseAPNS];
2200 }
2201
2202 // Must be on the queue when this is called
2203 - (void)handleCKLogin {
2204     dispatch_assert_queue(self.queue);
2205
2206     if(!self.setupStarted) {
2207         [self _onqueueInitializeZone];
2208     } else {
2209         ckksinfo("ckks", self, "ignoring login as setup has already started");
2210     }
2211 }
2212
2213 - (void)handleCKLogout {
2214     NSBlockOperation* logout = [NSBlockOperation blockOperationWithBlock: ^{
2215         [self dispatchSync:^bool {
2216             ckksnotice("ckks", self, "received a notification of CK logout for %@", self.zoneName);
2217             NSError* error = nil;
2218
2219             [self _onqueueResetLocalData: &error];
2220
2221             if(error) {
2222                 ckkserror("ckks", self, "error while resetting local data: %@", error);
2223             }
2224             return true;
2225         }];
2226     }];
2227
2228     logout.name = @"cloudkit-logout";
2229     [self scheduleAccountStatusOperation: logout];
2230 }
2231
2232 #pragma mark - CKKSChangeFetcherErrorOracle
2233
2234 - (bool) isFatalCKFetchError: (NSError*) error {
2235     __weak __typeof(self) weakSelf = self;
2236
2237     // Again, note that this handles exactly one zone. Mutli-zone errors are not supported.
2238     bool isChangeTokenExpiredError = false;
2239     if([error.domain isEqualToString:CKErrorDomain] && (error.code == CKErrorChangeTokenExpired)) {
2240         isChangeTokenExpiredError = true;
2241     } else if([error.domain isEqualToString:CKErrorDomain] && (error.code == CKErrorPartialFailure)) {
2242         NSDictionary* partialErrors = error.userInfo[CKPartialErrorsByItemIDKey];
2243         for(NSError* partialError in partialErrors.allValues) {
2244             if([partialError.domain isEqualToString:CKErrorDomain] && (partialError.code == CKErrorChangeTokenExpired)) {
2245                 isChangeTokenExpiredError = true;
2246             }
2247         }
2248     }
2249
2250     if(isChangeTokenExpiredError) {
2251         ckkserror("ckks", self, "Received notice that our change token is out of date. Resetting local data...");
2252         [self cancelAllOperations];
2253         CKKSResultOperation* resetOp = [self resetLocalData];
2254         CKKSResultOperation* resetHandler = [CKKSResultOperation named:@"local-reset-handler" withBlock:^{
2255             __strong __typeof(self) strongSelf = weakSelf;
2256             if(!strongSelf) {
2257                 ckkserror("ckks", strongSelf, "received callback for released object");
2258                 return;
2259             }
2260
2261             if(resetOp.error) {
2262                 ckksnotice("ckks", strongSelf, "CloudKit-inspired local reset of %@ ended with error: %@", strongSelf.zoneID, error);
2263             } else {
2264                 ckksnotice("ckksreset", strongSelf, "re-initializing zone %@", strongSelf.zoneID);
2265                 [strongSelf initializeZone];
2266             }
2267         }];
2268
2269         [resetHandler addDependency:resetOp];
2270         [self scheduleOperation:resetHandler];
2271         return true;
2272     }
2273
2274     bool isDeletedZoneError = false;
2275     if([error.domain isEqualToString:CKErrorDomain] && ((error.code == CKErrorUserDeletedZone) || (error.code == CKErrorZoneNotFound))) {
2276         isDeletedZoneError = true;
2277     } else if([error.domain isEqualToString:CKErrorDomain] && (error.code == CKErrorPartialFailure)) {
2278         NSDictionary* partialErrors = error.userInfo[CKPartialErrorsByItemIDKey];
2279         for(NSError* partialError in partialErrors.allValues) {
2280             if([partialError.domain isEqualToString:CKErrorDomain] && ((partialError.code == CKErrorUserDeletedZone) || (partialError.code == CKErrorZoneNotFound))) {
2281                 isDeletedZoneError = true;
2282             }
2283         }
2284     }
2285
2286     if(isDeletedZoneError) {
2287         ckkserror("ckks", self, "Received notice that our zone does not exist. Resetting all data.");
2288         [self cancelAllOperations];
2289         CKKSResultOperation* resetOp = [self resetCloudKitZone];
2290         CKKSResultOperation* resetHandler = [CKKSResultOperation named:@"reset-handler" withBlock:^{
2291             __strong __typeof(self) strongSelf = weakSelf;
2292             if(!strongSelf) {
2293                 ckkserror("ckks", strongSelf, "received callback for released object");
2294                 return;
2295             }
2296
2297             if(resetOp.error) {
2298                 ckksnotice("ckks", strongSelf, "CloudKit-inspired zone reset of %@ ended with error: %@", strongSelf.zoneID, resetOp.error);
2299             } else {
2300                 ckksnotice("ckksreset", strongSelf, "re-initializing zone %@", strongSelf.zoneID);
2301                 [strongSelf initializeZone];
2302             }
2303         }];
2304
2305         [resetHandler addDependency:resetOp];
2306         [self scheduleOperation:resetHandler];
2307         return true;
2308     }
2309
2310     if([error.domain isEqualToString:CKErrorDomain] && (error.code == CKErrorBadContainer)) {
2311         ckkserror("ckks", self, "Received notice that our container does not exist. Nothing to do.");
2312         return true;
2313     }
2314
2315     return false;
2316 }
2317
2318 #pragma mark - Test Support
2319
2320 - (bool) outgoingQueueEmpty: (NSError * __autoreleasing *) error {
2321     __block bool ret = false;
2322     [self dispatchSync: ^bool{
2323         NSArray* queueEntries = [CKKSOutgoingQueueEntry all: error];
2324         ret = queueEntries && ([queueEntries count] == 0);
2325         return true;
2326     }];
2327
2328     return ret;
2329 }
2330
2331 - (CKKSResultOperation*)waitForFetchAndIncomingQueueProcessing {
2332     if(!SecCKKSIsEnabled()) {
2333         ckksinfo("ckks", self, "Due to disabled CKKS, returning fast from waitForFetchAndIncomingQueueProcessing");
2334         return nil;
2335     }
2336
2337     CKKSResultOperation* op = [self fetchAndProcessCKChanges:CKKSFetchBecauseTesting];
2338     [op waitUntilFinished];
2339     return op;
2340 }
2341
2342 - (void)waitForKeyHierarchyReadiness {
2343     if(self.keyStateReadyDependency) {
2344         [self.keyStateReadyDependency waitUntilFinished];
2345     }
2346 }
2347
2348 - (void)cancelAllOperations {
2349     [self.zoneSetupOperation cancel];
2350     [self.keyStateMachineOperation cancel];
2351     [self.keyStateReadyDependency cancel];
2352     [self.zoneChangeFetcher cancel];
2353
2354     [super cancelAllOperations];
2355
2356     [self dispatchSync:^bool{
2357         [self _onqueueAdvanceKeyStateMachineToState: SecCKKSZoneKeyStateCancelled withError: nil];
2358         return true;
2359     }];
2360 }
2361
2362 - (NSDictionary*)status {
2363 #define stringify(obj) CKKSNilToNSNull([obj description])
2364 #define boolstr(obj) (!!(obj) ? @"yes" : @"no")
2365     __block NSDictionary* ret = nil;
2366     __block NSError* error = nil;
2367     CKKSManifest* manifest = [CKKSManifest latestTrustedManifestForZone:self.zoneName error:&error];
2368     [self dispatchSync: ^bool {
2369
2370         NSString* uuidTLK    = [CKKSKey currentKeyForClass:SecCKKSKeyClassTLK zoneID:self.zoneID error:&error].uuid;
2371         NSString* uuidClassA = [CKKSKey currentKeyForClass:SecCKKSKeyClassA   zoneID:self.zoneID error:&error].uuid;
2372         NSString* uuidClassC = [CKKSKey currentKeyForClass:SecCKKSKeyClassC   zoneID:self.zoneID error:&error].uuid;
2373
2374         NSString* manifestGeneration = manifest ? [NSString stringWithFormat:@"%lu", (unsigned long)manifest.generationCount] : nil;
2375
2376         if(error) {
2377             ckkserror("ckks", self, "error during status: %@", error);
2378         }
2379         // We actually don't care about this error, especially if it's "no current key pointers"...
2380         error = nil;
2381
2382         // Map deviceStates to strings to avoid NSXPC issues. Obj-c, why is this so hard?
2383         NSArray* deviceStates = [CKKSDeviceStateEntry allInZone:self.zoneID error:&error];
2384         NSMutableArray<NSString*>* mutDeviceStates = [[NSMutableArray alloc] init];
2385         [deviceStates enumerateObjectsUsingBlock:^(id  _Nonnull obj, NSUInteger idx, BOOL * _Nonnull stop) {
2386             [mutDeviceStates addObject: [obj description]];
2387         }];
2388
2389         ret = @{
2390                  @"view":                CKKSNilToNSNull(self.zoneName),
2391                  @"ckaccountstatus":     self.accountStatus == CKAccountStatusCouldNotDetermine ? @"could not determine" :
2392                                          self.accountStatus == CKAccountStatusAvailable         ? @"logged in" :
2393                                          self.accountStatus == CKAccountStatusRestricted        ? @"restricted" :
2394                                          self.accountStatus == CKAccountStatusNoAccount         ? @"logged out" : @"unknown",
2395                  @"lockstatetracker":    stringify(self.lockStateTracker),
2396                  @"accounttracker":      stringify(self.accountTracker),
2397                  @"fetcher":             stringify(self.zoneChangeFetcher),
2398                  @"setup":               boolstr(self.setupComplete),
2399                  @"zoneCreated":         boolstr(self.zoneCreated),
2400                  @"zoneCreatedError":    stringify(self.zoneCreatedError),
2401                  @"zoneSubscribed":      boolstr(self.zoneSubscribed),
2402                  @"zoneSubscribedError": stringify(self.zoneSubscribedError),
2403                  @"zoneInitializeScheduler": stringify(self.initializeScheduler),
2404                  @"keystate":            CKKSNilToNSNull(self.keyHierarchyState),
2405                  @"keyStateError":       stringify(self.keyHierarchyError),
2406                  @"statusError":         stringify(error),
2407                  @"oqe":                 CKKSNilToNSNull([CKKSOutgoingQueueEntry countsByState:self.zoneID error:&error]),
2408                  @"iqe":                 CKKSNilToNSNull([CKKSIncomingQueueEntry countsByState:self.zoneID error:&error]),
2409                  @"ckmirror":            CKKSNilToNSNull([CKKSMirrorEntry        countsByParentKey:self.zoneID error:&error]),
2410                  @"devicestates":        CKKSNilToNSNull(mutDeviceStates),
2411                  @"keys":                CKKSNilToNSNull([CKKSKey countsByClass:self.zoneID error:&error]),
2412                  @"currentTLK":          CKKSNilToNSNull(uuidTLK),
2413                  @"currentClassA":       CKKSNilToNSNull(uuidClassA),
2414                  @"currentClassC":       CKKSNilToNSNull(uuidClassC),
2415                  @"currentManifestGen":   CKKSNilToNSNull(manifestGeneration),
2416
2417                  @"zoneSetupOperation":                 stringify(self.zoneSetupOperation),
2418                  @"viewSetupOperation":                 stringify(self.viewSetupOperation),
2419                  @"keyStateOperation":                  stringify(self.keyStateMachineOperation),
2420                  @"lastIncomingQueueOperation":         stringify(self.lastIncomingQueueOperation),
2421                  @"lastNewTLKOperation":                stringify(self.lastNewTLKOperation),
2422                  @"lastOutgoingQueueOperation":         stringify(self.lastOutgoingQueueOperation),
2423                  @"lastRecordZoneChangesOperation":     stringify(self.lastRecordZoneChangesOperation),
2424                  @"lastProcessReceivedKeysOperation":   stringify(self.lastProcessReceivedKeysOperation),
2425                  @"lastReencryptOutgoingItemsOperation":stringify(self.lastReencryptOutgoingItemsOperation),
2426                  @"lastScanLocalItemsOperation":        stringify(self.lastScanLocalItemsOperation),
2427                  };
2428         return false;
2429     }];
2430     return ret;
2431 }
2432
2433
2434
2435 #endif /* OCTAGON */
2436 @end