keychain/securityd/SecDbQuery.c

   1
   2 /*
   3  * Copyright (c) 2006-2014 Apple Inc. All Rights Reserved.
   4  *
   5  * @APPLE_LICENSE_HEADER_START@
   6  *
   7  * This file contains Original Code and/or Modifications of Original Code
   8  * as defined in and that are subject to the Apple Public Source License
   9  * Version 2.0 (the 'License'). You may not use this file except in
  10  * compliance with the License. Please obtain a copy of the License at
  11  * http://www.opensource.apple.com/apsl/ and read it before using this
  12  * file.
  13  *
  14  * The Original Code and all software distributed under the License are
  15  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  16  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  17  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  19  * Please see the License for the specific language governing rights and
  20  * limitations under the License.
  21  *
  22  * @APPLE_LICENSE_HEADER_END@
  23  */
  24
  25 /*
  26  *  SecDbQuery.c - CoreFoundation-based constants and functions for
  27     access to Security items (certificates, keys, identities, and
  28     passwords.)
  29  */
  30
  31 #include "keychain/securityd/SecDbQuery.h"
  32
  33 #include "keychain/securityd/SecItemDb.h"
  34 #include "keychain/securityd/SecItemSchema.h"
  35 #include "keychain/securityd/SecItemServer.h"
  36 #include "keychain/securityd/spi.h"
  37 #include <Security/SecBasePriv.h>
  38 #include <Security/SecCertificateInternal.h>
  39 #include <Security/SecItem.h>
  40 #include <Security/SecItemPriv.h>
  41 #include <Security/SecItemInternal.h>
  42 #include <Security/SecAccessControl.h>
  43 #include <Security/SecAccessControlPriv.h>
  44 #include <Security/SecPolicyPriv.h>
  45 #include <Security/SecuritydXPC.h>
  46 #include <CommonCrypto/CommonDigest.h>
  47 #include <CommonCrypto/CommonDigestSPI.h>
  48
  49 #include <pthread/pthread.h>
  50
  51 #if USE_KEYSTORE
  52 #include <LocalAuthentication/LAPublicDefines.h>
  53 #include <coreauthd_spi.h>
  54 #include <libaks_acl_cf_keys.h>
  55 #endif
  56
  57 /* Upper limit for number of keys in a QUERY dictionary. */
  58 #define QUERY_KEY_LIMIT_BASE    (128)
  59 #ifdef NO_SERVER
  60 #define QUERY_KEY_LIMIT  (31 + QUERY_KEY_LIMIT_BASE)
  61 #else
  62 #define QUERY_KEY_LIMIT  QUERY_KEY_LIMIT_BASE
  63 #endif
  64
  65
  66 static const uint8_t systemKeychainUUID[] = "\xF6\x23\xAE\x5C\xCC\x81\x4C\xAC\x8A\xD4\xF0\x01\x3F\x31\x35\x11";
  67
  68 CFDataRef
  69 SecMUSRCopySystemKeychainUUID(void)
  70 {
  71     return CFDataCreateWithBytesNoCopy(NULL, (const UInt8 *)systemKeychainUUID, 16, kCFAllocatorNull);
  72 }
  73
  74 CFDataRef
  75 SecMUSRGetSystemKeychainUUID(void)
  76 {
  77     static dispatch_once_t onceToken;
  78     static CFDataRef systemKeychainData = NULL;
  79     dispatch_once(&onceToken, ^{
  80         systemKeychainData = CFDataCreateWithBytesNoCopy(NULL, (const UInt8 *)systemKeychainUUID, 16, kCFAllocatorNull);
  81     });
  82     return systemKeychainData;
  83 }
  84
  85 CFDataRef
  86 SecMUSRGetSingleUserKeychainUUID(void)
  87 {
  88     static dispatch_once_t onceToken;
  89     static CFDataRef singleUser = NULL;
  90     dispatch_once(&onceToken, ^{
  91         singleUser = CFDataCreateWithBytesNoCopy(NULL, NULL, 0, kCFAllocatorNull);
  92     });
  93     return singleUser;
  94 }
  95
  96 bool
  97 SecMUSRIsSingleUserView(CFDataRef musr)
  98 {
  99     return CFEqual(musr, SecMUSRGetSingleUserKeychainUUID());
 100 }
 101
 102 static const uint8_t allKeychainViewsUUID[16] = "\xC8\x60\x07\xEC\x89\x62\x4D\xAF\x85\x65\x1F\xE6\x0F\x50\x5D\xB7";
 103
 104 CFDataRef
 105 SecMUSRGetAllViews(void)
 106 {
 107     static dispatch_once_t onceToken;
 108     static CFDataRef allKeychainViewsData = NULL;
 109     dispatch_once(&onceToken, ^{
 110         allKeychainViewsData = CFDataCreateWithBytesNoCopy(NULL, (const UInt8 *)allKeychainViewsUUID, 16, kCFAllocatorNull);
 111     });
 112     return allKeychainViewsData;
 113 }
 114
 115 bool
 116 SecMUSRIsViewAllViews(CFDataRef musr)
 117 {
 118     return CFEqual(musr, SecMUSRGetAllViews());
 119 }
 120
 121 #if TARGET_OS_IPHONE
 122
 123 CFDataRef
 124 SecMUSRCreateActiveUserUUID(uid_t uid)
 125 {
 126     uint8_t uuid[16] = "\xA7\x5A\x3A\x35\xA5\x57\x4B\x10\xBE\x2E\x83\x94\x7E\x4A\x34\x72";
 127     uint32_t num = htonl(uid);
 128     memcpy(&uuid[12], &num, sizeof(num));
 129     return CFDataCreate(NULL, uuid, sizeof(uuid));
 130 }
 131
 132 CFDataRef
 133 SecMUSRCreateSyncBubbleUserUUID(uid_t uid)
 134 {
 135     uint8_t uuid[16] = "\x82\x1A\xAB\x9F\xA3\xC8\x4E\x11\xAA\x90\x4C\xE8\x9E\xA6\xD7\xEC";
 136     uint32_t num = htonl(uid);
 137     memcpy(&uuid[12], &num, sizeof(num));
 138     return CFDataCreate(NULL, uuid, sizeof(uuid));
 139 }
 140
 141 static const uint8_t bothUserAndSystemUUID[12] = "\x36\xC4\xBE\x2E\x99\x0A\x46\x9A\xAC\x89\x09\xA4";
 142
 143
 144 CFDataRef
 145 SecMUSRCreateBothUserAndSystemUUID(uid_t uid)
 146 {
 147     uint8_t uuid[16];
 148     memcpy(uuid, bothUserAndSystemUUID, 12);
 149     uint32_t num = htonl(uid);
 150     memcpy(&uuid[12], &num, sizeof(num));
 151     return CFDataCreate(NULL, uuid, sizeof(uuid));
 152 }
 153
 154 bool
 155 SecMUSRGetBothUserAndSystemUUID(CFDataRef musr, uid_t *uid)
 156 {
 157     if (CFDataGetLength(musr) != 16)
 158         return false;
 159     const uint8_t *uuid = CFDataGetBytePtr(musr);
 160     if (memcmp(uuid, bothUserAndSystemUUID, 12) != 0)
 161         return false;
 162     if (uid) {
 163         uint32_t num;
 164         memcpy(&num, &uuid[12], sizeof(num));
 165         *uid = htonl(num);
 166     }
 167     return true;
 168 }
 169
 170 #endif
 171
 172 /* Inline accessors to attr and match values in a query. */
 173 CFIndex query_attr_count(const Query *q)
 174 {
 175     return q->q_attr_end;
 176 }
 177
 178 Pair query_attr_at(const Query *q, CFIndex ix)
 179 {
 180     return q->q_pairs[ix];
 181 }
 182
 183 CFIndex query_match_count(const Query *q)
 184 {
 185     return q->q_match_end - q->q_match_begin;
 186 }
 187
 188 __unused static inline Pair query_match_at(const Query *q, CFIndex ix)
 189 {
 190     return q->q_pairs[q->q_match_begin + ix];
 191 }
 192
 193 /* Private routines used to parse a query. */
 194
 195 const SecDbClass *kc_class_with_name(CFStringRef name) {
 196     if (isString(name)) {
 197         if (CFEqual(name, kSecClassGenericPassword))
 198             return genp_class();
 199         else if (CFEqual(name, kSecClassInternetPassword))
 200             return inet_class();
 201         else if (CFEqual(name, kSecClassCertificate))
 202             return cert_class();
 203         else if (CFEqual(name, kSecClassKey))
 204             return keys_class();
 205         else if (CFEqual(name, kSecClassIdentity))
 206             return identity_class();
 207     }
 208     return NULL;
 209 }
 210
 211 static void query_set_access_control(Query *q, SecAccessControlRef access_control) {
 212     if (q->q_access_control) {
 213         if (!CFEqual(q->q_access_control, access_control)) {
 214             SecError(errSecItemIllegalQuery, &q->q_error, CFSTR("conflicting kSecAccess and kSecAccessControl attributes"));
 215         }
 216     } else {
 217         /* Store access control virtual attribute. */
 218         q->q_access_control = (SecAccessControlRef)CFRetain(access_control);
 219
 220         /* Also set legacy access attribute. */
 221         CFTypeRef protection = SecAccessControlGetProtection(q->q_access_control);
 222         if (!protection) {
 223             SecError(errSecParam, &q->q_error, CFSTR("kSecAccessControl missing protection"));
 224             return;
 225         }
 226         CFDictionarySetValue(q->q_item, kSecAttrAccessible, protection);
 227     }
 228 }
 229
 230 /* AUDIT[securityd](done):
 231  key (ok) is a caller provided, string or number of length 4.
 232  value (ok) is a caller provided, non NULL CFTypeRef.
 233  */
 234 void query_add_attribute_with_desc(const SecDbAttr *desc, const void *value, Query *q)
 235 {
 236     if (CFEqual(desc->name, kSecAttrSynchronizable)) {
 237         q->q_sync = true;
 238         if (CFEqual(value, kSecAttrSynchronizableAny))
 239             return; /* skip the attribute so it isn't part of the search */
 240     }
 241
 242     CFTypeRef attr = NULL;
 243     switch (desc->kind) {
 244         case kSecDbDataAttr:
 245             attr = copyData(value);
 246             break;
 247         case kSecDbBlobAttr:
 248         case kSecDbAccessControlAttr:
 249             attr = copyBlob(value);
 250             break;
 251         case kSecDbDateAttr:
 252         case kSecDbCreationDateAttr:
 253         case kSecDbModificationDateAttr:
 254             attr = copyDate(value);
 255             break;
 256         case kSecDbNumberAttr:
 257         case kSecDbSyncAttr:
 258         case kSecDbTombAttr:
 259             attr = copyNumber(value);
 260             break;
 261         case kSecDbAccessAttr:
 262         case kSecDbStringAttr:
 263             attr = copyString(value);
 264             break;
 265         case kSecDbSHA1Attr:
 266             attr = copySHA1(value);
 267             break;
 268         case kSecDbRowIdAttr:
 269         case kSecDbPrimaryKeyAttr:
 270         case kSecDbEncryptedDataAttr:
 271         case kSecDbUTombAttr:
 272             break;
 273         case kSecDbUUIDAttr:
 274             attr = copyUUID(value);
 275             break;
 276     }
 277
 278     if (!attr) {
 279         SecError(errSecItemInvalidValue, &q->q_error, CFSTR("attribute %@: value: %@ failed to convert"), desc->name, value);
 280         return;
 281     }
 282
 283     /* Store plaintext attr data in q_item unless it's a kSecDbSHA1Attr. */
 284     if (q->q_item && desc->kind != kSecDbSHA1Attr) {
 285         CFDictionarySetValue(q->q_item, desc->name, attr);
 286     }
 287
 288     /* Convert attr to (sha1) digest if requested. */
 289     if (desc->flags & kSecDbSHA1ValueInFlag) {
 290         CFDataRef data = copyData(attr);
 291         CFRelease(attr);
 292         if (!data) {
 293             SecError(errSecInternal, &q->q_error, CFSTR("failed to get attribute %@ data"), desc->name);
 294             return;
 295         }
 296
 297         CFMutableDataRef digest = CFDataCreateMutable(0, CC_SHA1_DIGEST_LENGTH);
 298         CFDataSetLength(digest, CC_SHA1_DIGEST_LENGTH);
 299         /* 64 bits cast: worst case is we generate the wrong hash */
 300         assert((unsigned long)CFDataGetLength(data)<UINT32_MAX); /* Debug check. Correct as long as CFIndex is long */
 301         CCDigest(kCCDigestSHA1, CFDataGetBytePtr(data), (CC_LONG)CFDataGetLength(data),
 302                  CFDataGetMutableBytePtr(digest));
 303         CFRelease(data);
 304         attr = digest;
 305     }
 306
 307     if (desc->kind != kSecDbAccessControlAttr) {
 308         /* Record the new attr key, value in q_pairs. */
 309         if (q->q_attr_end + 1 < q->q_pairs_count) {
 310             q->q_pairs[q->q_attr_end].key = desc->name;
 311             q->q_pairs[q->q_attr_end++].value = attr;
 312         } else {
 313             SecError(errSecInternal, &q->q_error, CFSTR("q_pairs overflow"));
 314             CFReleaseSafe(attr);
 315         }
 316     } else {
 317         CFReleaseSafe(attr);
 318     }
 319 }
 320
 321 void query_add_attribute(const void *key, const void *value, Query *q)
 322 {
 323     if (CFEqual(key, kSecAttrDeriveSyncIDFromItemAttributes)) {
 324         q->q_uuid_from_primary_key = CFBooleanGetValue(value);
 325         return; /* skip the attribute so it isn't part of the search */
 326     }
 327
 328     const SecDbAttr *desc = SecDbAttrWithKey(q->q_class, key, &q->q_error);
 329     if (desc) {
 330         query_add_attribute_with_desc(desc, value, q);
 331
 332         if (desc->kind == kSecDbAccessControlAttr) {
 333             CFDataRef attr = (CFDataRef)CFDictionaryGetValue(q->q_item, desc->name);
 334             if (attr) {
 335                 SecAccessControlRef access_control = SecAccessControlCreateFromData(kCFAllocatorDefault, attr, &q->q_error);
 336                 if (access_control) {
 337                     query_set_access_control(q, access_control);
 338                     CFRelease(access_control);
 339                 }
 340             }
 341         }
 342
 343         if (desc->kind == kSecDbAccessAttr) {
 344             SecAccessControlRef access_control = SecAccessControlCreate(kCFAllocatorDefault, &q->q_error);
 345             if (access_control) {
 346                 CFStringRef attr = (CFStringRef)CFDictionaryGetValue(q->q_item, desc->name);
 347                 if (attr) {
 348                     if (SecAccessControlSetProtection(access_control, attr, &q->q_error))
 349                         query_set_access_control(q, access_control);
 350                 }
 351                 CFRelease(access_control);
 352             }
 353         }
 354     }
 355 }
 356
 357 void query_add_or_attribute(const void *key, const void *value, Query *q)
 358 {
 359     const SecDbAttr *desc = SecDbAttrWithKey(q->q_class, key, &q->q_error);
 360     if (desc) {
 361         CFTypeRef oldValue = CFDictionaryGetValue(q->q_item, desc->name);
 362         CFMutableArrayRef array = NULL;
 363         if (oldValue) {
 364             if (isArray(oldValue)) {
 365                 array = (CFMutableArrayRef)CFRetain(oldValue);
 366             } else {
 367                 array = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
 368                 CFArrayAppendValue(array, oldValue);
 369             }
 370             CFDictionaryRemoveValue(q->q_item, desc->name);
 371         } else {
 372             array = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
 373         }
 374         if (array) {
 375             query_add_attribute_with_desc(desc, value, q);
 376             CFTypeRef newValue = CFDictionaryGetValue(q->q_item, desc->name);
 377             CFArrayAppendValue(array, newValue);
 378             CFDictionarySetValue(q->q_item, desc->name, array);
 379             CFRelease(array);
 380         }
 381     }
 382 }
 383
 384 void query_add_not_attribute(const void *key, const void *value, Query *q)
 385 {
 386     const SecDbAttr *desc = SecDbAttrWithKey(q->q_class, key, &q->q_error);
 387     if (desc) {
 388         CFTypeRef oldValue = CFDictionaryGetValue(q->q_item, desc->name);
 389         CFMutableArrayRef array = NULL;
 390         if (oldValue) {
 391             if (isArray(oldValue)) {
 392                 array = (CFMutableArrayRef)CFRetain(oldValue);
 393             } else {
 394                 // This should never run, as we shouldn't be turning a attr = value into a attr not in (value, value2)
 395                 secerror("negating %@ = %@ in query", desc->name, oldValue);
 396                 array = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
 397                 CFArrayAppendValue(array, kCFNull);
 398                 CFArrayAppendValue(array, oldValue);
 399             }
 400             CFDictionaryRemoveValue(q->q_item, desc->name);
 401         } else {
 402             array = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
 403             CFArrayAppendValue(array, kCFNull);
 404         }
 405         if (array) {
 406             query_add_attribute_with_desc(desc, value, q);
 407             CFTypeRef newValue = CFDictionaryGetValue(q->q_item, desc->name);
 408             CFArrayAppendValue(array, newValue);
 409             CFDictionarySetValue(q->q_item, desc->name, array);
 410             CFRelease(array);
 411         }
 412     }
 413 }
 414
 415 static void query_add_match(const void *key, const void *value, Query *q)
 416 {
 417     /* Record the match key, value in q_pairs. */
 418     --(q->q_match_begin);
 419     q->q_pairs[q->q_match_begin].key = key;
 420     q->q_pairs[q->q_match_begin].value = value;
 421
 422     if (CFEqual(kSecMatchLimit, key)) {
 423         /* Figure out what the value for kSecMatchLimit is if specified. */
 424         if (CFGetTypeID(value) == CFNumberGetTypeID()) {
 425             if (!CFNumberGetValue(value, kCFNumberCFIndexType, &q->q_limit))
 426                 SecError(errSecItemInvalidValue, &q->q_error, CFSTR("failed to convert match limit %@ to CFIndex"), value);
 427         } else if (CFEqual(kSecMatchLimitAll, value)) {
 428             q->q_limit = kSecMatchUnlimited;
 429         } else if (CFEqual(kSecMatchLimitOne, value)) {
 430             q->q_limit = 1;
 431         } else {
 432             SecError(errSecItemInvalidValue, &q->q_error, CFSTR("unsupported match limit %@"), value);
 433         }
 434     } else if (CFEqual(kSecMatchIssuers, key) &&
 435                (CFGetTypeID(value) == CFArrayGetTypeID()))
 436     {
 437         CFMutableArrayRef canonical_issuers = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
 438         if (canonical_issuers) {
 439             CFIndex i, count = CFArrayGetCount(value);
 440             for (i = 0; i < count; i++) {
 441                 CFTypeRef issuer_data = CFArrayGetValueAtIndex(value, i);
 442                 CFDataRef issuer_canonical = NULL;
 443                 if (CFDataGetTypeID() == CFGetTypeID(issuer_data))
 444                     issuer_canonical = SecDistinguishedNameCopyNormalizedContent((CFDataRef)issuer_data);
 445                 if (issuer_canonical) {
 446                     CFArrayAppendValue(canonical_issuers, issuer_canonical);
 447                     CFRelease(issuer_canonical);
 448                 }
 449             }
 450
 451             if (CFArrayGetCount(canonical_issuers) > 0) {
 452                 q->q_match_issuer = canonical_issuers;
 453             } else
 454                 CFRelease(canonical_issuers);
 455         }
 456     } else if (CFEqual(kSecMatchPolicy, key)) {
 457         if (CFGetTypeID(value) != CFArrayGetTypeID()) {
 458             SecError(errSecParam, &q->q_error, CFSTR("unsupported value for kSecMatchPolicy attribute"));
 459             return;
 460         }
 461         xpc_object_t policiesArrayXPC = _CFXPCCreateXPCObjectFromCFObject(value);
 462         if (!policiesArrayXPC) {
 463             SecError(errSecParam, &q->q_error, CFSTR("unsupported kSecMatchPolicy object in query"));
 464             return;
 465         }
 466
 467         CFArrayRef policiesArray = SecPolicyXPCArrayCopyArray(policiesArrayXPC, &q->q_error);
 468         xpc_release(policiesArrayXPC);
 469         if (!policiesArray)
 470             return;
 471
 472         if (CFArrayGetCount(policiesArray) != 1 || CFGetTypeID(CFArrayGetValueAtIndex(policiesArray, 0)) != SecPolicyGetTypeID()) {
 473             CFRelease(policiesArray);
 474             SecError(errSecParam, &q->q_error, CFSTR("unsupported array of policies"));
 475             return;
 476         }
 477
 478         query_set_policy(q, (SecPolicyRef)CFArrayGetValueAtIndex(policiesArray, 0));
 479         CFRelease(policiesArray);
 480     } else if (CFEqual(kSecMatchValidOnDate, key)) {
 481         if (CFGetTypeID(value) == CFNullGetTypeID()) {
 482             CFDateRef date = CFDateCreate(kCFAllocatorDefault, CFAbsoluteTimeGetCurrent());
 483             query_set_valid_on_date(q, date);
 484             CFRelease(date);
 485         } else if (CFGetTypeID(value) == CFDateGetTypeID()) {
 486             query_set_valid_on_date(q, value);
 487         } else {
 488             SecError(errSecParam, &q->q_error, CFSTR("unsupported value for kSecMatchValidOnDate attribute"));
 489             return;
 490         }
 491     } else if (CFEqual(kSecMatchTrustedOnly, key)) {
 492         if ((CFGetTypeID(value) == CFBooleanGetTypeID())) {
 493             query_set_trusted_only(q, value);
 494         } else {
 495             SecError(errSecParam, &q->q_error, CFSTR("unsupported value for kSecMatchTrustedOnly attribute"));
 496             return;
 497         }
 498     }
 499 }
 500
 501 static bool query_set_class(Query *q, CFStringRef c_name, CFErrorRef *error) {
 502     const SecDbClass *value;
 503     if (c_name && CFGetTypeID(c_name) == CFStringGetTypeID() &&
 504         (value = kc_class_with_name(c_name)) &&
 505         (q->q_class == 0 || q->q_class == value)) {
 506         q->q_class = value;
 507         return true;
 508     }
 509
 510     if (error && !*error)
 511         SecError((c_name ? errSecNoSuchClass : errSecItemClassMissing), error, CFSTR("can find class named: %@"), c_name);
 512
 513
 514     return false;
 515 }
 516
 517 static const SecDbClass *query_get_class(CFDictionaryRef query, CFErrorRef *error) {
 518     CFStringRef c_name = NULL;
 519     const void *value = CFDictionaryGetValue(query, kSecClass);
 520     if (isString(value)) {
 521         c_name = value;
 522     } else {
 523         value = CFDictionaryGetValue(query, kSecValuePersistentRef);
 524         if (isData(value)) {
 525             CFDataRef pref = value;
 526             _SecItemParsePersistentRef(pref, &c_name, NULL, NULL);
 527         }
 528     }
 529
 530     if (c_name && (value = kc_class_with_name(c_name))) {
 531         return value;
 532     } else {
 533         if (c_name)
 534             SecError(errSecNoSuchClass, error, CFSTR("can't find class named: %@"), c_name);
 535         else
 536             SecError(errSecItemClassMissing, error, CFSTR("query missing class name"));
 537         return NULL;
 538     }
 539 }
 540
 541 /* AUDIT[securityd](done):
 542  key (ok) is a caller provided, string starting with 'c'.
 543  value (ok) is a caller provided, non NULL CFTypeRef.
 544  */
 545 static void query_add_class(const void *key, const void *value, Query *q)
 546 {
 547     if (CFEqual(key, kSecClass)) {
 548         query_set_class(q, value, &q->q_error);
 549     } else {
 550         SecError(errSecItemInvalidKey, &q->q_error, CFSTR("add_class: key %@ is not %@"), key, kSecClass);
 551     }
 552 }
 553
 554 /* AUDIT[securityd](done):
 555  key (ok) is a caller provided, string starting with 'r'.
 556  value (ok) is a caller provided, non NULL CFTypeRef.
 557  */
 558 static void query_add_return(const void *key, const void *value, Query *q)
 559 {
 560     ReturnTypeMask mask;
 561     if (CFGetTypeID(value) != CFBooleanGetTypeID()) {
 562         SecError(errSecItemInvalidValue, &q->q_error, CFSTR("add_return: value %@ is not CFBoolean"), value);
 563         return;
 564     }
 565
 566     int set_it = CFEqual(value, kCFBooleanTrue);
 567
 568     if (CFEqual(key, kSecReturnData))
 569         mask = kSecReturnDataMask;
 570     else if (CFEqual(key, kSecReturnAttributes))
 571         mask = kSecReturnAttributesMask;
 572     else if (CFEqual(key, kSecReturnRef))
 573         mask = kSecReturnRefMask;
 574     else if (CFEqual(key, kSecReturnPersistentRef))
 575         mask = kSecReturnPersistentRefMask;
 576     else {
 577         SecError(errSecItemInvalidKey, &q->q_error, CFSTR("add_return: unknown key %@"), key);
 578         return;
 579     }
 580
 581     if ((q->q_return_type & mask) && !set_it) {
 582         /* Clear out this bit (it's set so xor with the mask will clear it). */
 583         q->q_return_type ^= mask;
 584     } else if (!(q->q_return_type & mask) && set_it) {
 585         /* Set this bit. */
 586         q->q_return_type |= mask;
 587     }
 588 }
 589
 590 /* AUDIT[securityd](done):
 591  key (ok) is a caller provided, string starting with 'u'.
 592  value (ok since q_use_item_list is unused) is a caller provided, non
 593  NULL CFTypeRef.
 594  */
 595 static void query_add_use(const void *key, const void *value, Query *q)
 596 {
 597     // Gotta use a string literal because we just outlawed this symbol on iOS
 598     if (CFEqual(key, CFSTR("u_ItemList"))) {
 599         /* TODO: Add sanity checking when we start using this. */
 600         q->q_use_item_list = value;
 601     } else if (CFEqual(key, kSecUseTombstones)) {
 602         if (CFGetTypeID(value) == CFBooleanGetTypeID()) {
 603             q->q_use_tomb = value;
 604         } else if (CFGetTypeID(value) == CFNumberGetTypeID()) {
 605             q->q_use_tomb = CFBooleanGetValue(value) ? kCFBooleanTrue : kCFBooleanFalse;
 606         } else if (CFGetTypeID(value) == CFStringGetTypeID()) {
 607             q->q_use_tomb = CFStringGetIntValue(value) ? kCFBooleanTrue : kCFBooleanFalse;
 608         } else {
 609             SecError(errSecItemInvalidValue, &q->q_error, CFSTR("add_use: value %@ for key %@ is neither CFBoolean nor CFNumber"), value, key);
 610             return;
 611         }
 612     } else if (CFEqual(key, kSecUseCredentialReference)) {
 613         if (isData(value)) {
 614             CFRetainAssign(q->q_use_cred_handle, value);
 615         } else {
 616             SecError(errSecItemInvalidValue, &q->q_error, CFSTR("add_use: value %@ for key %@ is not CFData"), value, key);
 617             return;
 618         }
 619     } else if (CFEqual(key, kSecUseAuthenticationUI)) {
 620         if (isString(value)) {
 621             q->q_skip_acl_items = CFEqualSafe(kSecUseAuthenticationUISkip, value);
 622         } else {
 623             SecError(errSecItemInvalidValue, &q->q_error, CFSTR("add_use: value %@ for key %@ is not CFString"), value, key);
 624             return;
 625         }
 626 #if TARGET_OS_IPHONE
 627     } else if (CFEqual(key, kSecUseSystemKeychain)) {
 628 #if TARGET_OS_IPHONE && !TARGET_OS_SIMULATOR
 629         q->q_keybag = KEYBAG_DEVICE;
 630 #endif
 631         q->q_system_keychain = true;
 632     } else if (CFEqual(key, kSecUseSyncBubbleKeychain)) {
 633         if (isNumber(value) && CFNumberGetValue(value, kCFNumberSInt32Type, &q->q_sync_bubble) && q->q_sync_bubble > 0) {
 634 #if TARGET_OS_IPHONE && !TARGET_OS_SIMULATOR
 635             q->q_keybag = KEYBAG_DEVICE;
 636 #endif
 637         } else {
 638             SecError(errSecItemInvalidValue, &q->q_error, CFSTR("add_use: value %@ for key %@ is not valid uid"), value, key);
 639             return;
 640         }
 641 #endif
 642     } else {
 643         SecError(errSecItemInvalidKey, &q->q_error, CFSTR("add_use: unknown key %@"), key);
 644         return;
 645     }
 646 }
 647
 648 static void query_set_data(const void *value, Query *q) {
 649     if (!isData(value)) {
 650         SecError(errSecItemInvalidValue, &q->q_error, CFSTR("set_data: value %@ is not type data"), value);
 651     } else {
 652         q->q_data = value;
 653         if (q->q_item)
 654             CFDictionarySetValue(q->q_item, kSecValueData, value);
 655     }
 656 }
 657
 658 static void query_set_token_persistent_ref(Query *q, CFDictionaryRef token_persistent_ref) {
 659     if (token_persistent_ref) {
 660         query_add_attribute(kSecAttrTokenID, CFDictionaryGetValue(token_persistent_ref, kSecAttrTokenID), q);
 661         CFRetainAssign(q->q_token_object_id, CFDictionaryGetValue(token_persistent_ref, kSecAttrTokenOID));
 662     }
 663 }
 664
 665 /* AUDIT[securityd](done):
 666  key (ok) is a caller provided, string starting with 'u'.
 667  value (ok) is a caller provided, non NULL CFTypeRef.
 668  */
 669 static void query_add_value(const void *key, const void *value, Query *q)
 670 {
 671     if (CFEqual(key, kSecValueData)) {
 672         query_set_data(value, q);
 673 #ifdef NO_SERVER
 674     } else if (CFEqual(key, kSecValueRef)) {
 675         q->q_ref = value;
 676         /* TODO: Add value type sanity checking. */
 677 #endif
 678     } else if (CFEqual(key, kSecValuePersistentRef)) {
 679         CFStringRef c_name;
 680         CFDictionaryRef token_persistent_ref = NULL;
 681         if (_SecItemParsePersistentRef(value, &c_name, &q->q_row_id, &token_persistent_ref)) {
 682             query_set_class(q, c_name, &q->q_error);
 683             query_set_token_persistent_ref(q, token_persistent_ref);
 684             CFReleaseNull(token_persistent_ref);
 685         } else
 686             SecError(errSecItemInvalidValue, &q->q_error, CFSTR("add_value: value %@ is not a valid persitent ref"), value);
 687     } else {
 688         SecError(errSecItemInvalidKey, &q->q_error, CFSTR("add_value: unknown key %@"), key);
 689         return;
 690     }
 691 }
 692
 693 /* AUDIT[securityd](done):
 694  key (ok) is a caller provided, unchecked.
 695  value (ok) is a caller provided, unchecked.
 696  */
 697 static void query_update_applier(const void *key, const void *value,
 698                                  void *context)
 699 {
 700     Query *q = (Query *)context;
 701     /* If something went wrong there is no point processing any more args. */
 702     if (q->q_error)
 703         return;
 704
 705     /* Make sure we have a string key. */
 706     if (!isString(key)) {
 707         SecError(errSecItemInvalidKeyType, &q->q_error, CFSTR("update_applier: unknown key type %@"), key);
 708         return;
 709     }
 710
 711     if (!value) {
 712         SecError(errSecItemInvalidValue, &q->q_error, CFSTR("update_applier: key %@ has NULL value"), key);
 713         return;
 714     }
 715
 716     if (CFEqual(key, CFSTR("musr"))) {
 717         secnotice("item", "update_applier: refusing to update musr");
 718         return;
 719     }
 720
 721     if (CFEqual(key, kSecValueData)) {
 722         query_set_data(value, q);
 723     } else {
 724         query_add_attribute(key, value, q);
 725     }
 726 }
 727
 728 /* AUDIT[securityd](done):
 729  key (ok) is a caller provided, unchecked.
 730  value (ok) is a caller provided, unchecked.
 731  */
 732 static void query_applier(const void *key, const void *value, void *context)
 733 {
 734     Query *q = (Query *)context;
 735     /* If something went wrong there is no point processing any more args. */
 736     if (q->q_error)
 737         return;
 738
 739     /* Make sure we have a key. */
 740     if (!key) {
 741         SecError(errSecItemInvalidKeyType, &q->q_error, CFSTR("applier: NULL key"));
 742         return;
 743     }
 744
 745     /* Make sure we have a value. */
 746     if (!value) {
 747         SecError(errSecItemInvalidValue, &q->q_error, CFSTR("applier: key %@ has NULL value"), key);
 748         return;
 749     }
 750
 751     /* Figure out what type of key we are dealing with. */
 752     CFTypeID key_id = CFGetTypeID(key);
 753     if (key_id == CFStringGetTypeID()) {
 754         CFIndex key_len = CFStringGetLength(key);
 755         /* String keys can be different things.  The subtype is determined by:
 756          length 4 strings are all attributes.  Otherwise the first char
 757          determines the type:
 758          c: class must be kSecClass
 759          m: match like kSecMatchPolicy
 760          r: return like kSecReturnData
 761          u: use keys
 762          v: value
 763          f: callbacks (ignored by the query applier)
 764          */
 765         if (key_len == 4) {
 766             /* attributes */
 767             query_add_attribute(key, value, q);
 768         } else if (key_len > 1) {
 769             // We added a database column named 'persistref', which is returned as an attribute but doesn't comply with
 770             // these matching rules. skip it for now, since it isn't filled in anyway.
 771             if(CFEqualSafe(key, CFSTR("persistref"))) {
 772                 return;
 773             }
 774
 775             UniChar k_first_char = CFStringGetCharacterAtIndex(key, 0);
 776             switch (k_first_char)
 777             {
 778                 case 'c': /* class */
 779                     query_add_class(key, value, q);
 780                     break;
 781                 case 'm': /* match */
 782                     query_add_match(key, value, q);
 783                     break;
 784                 case 'r': /* return */
 785                     query_add_return(key, value, q);
 786                     break;
 787                 case 'u': /* use */
 788                     query_add_use(key, value, q);
 789                     break;
 790                 case 'v': /* value */
 791                     query_add_value(key, value, q);
 792                     break;
 793                 case 'f':
 794                     break;
 795                 default:
 796                     SecError(errSecItemInvalidKey, &q->q_error, CFSTR("applier: key %@ invalid"), key);
 797                     break;
 798             }
 799         } else {
 800             SecError(errSecItemInvalidKey, &q->q_error, CFSTR("applier: key %@ invalid length"), key);
 801         }
 802     } else if (key_id == CFNumberGetTypeID()) {
 803         /* Numeric keys are always (extended) attributes. */
 804         /* TODO: Why is this here? query_add_attribute() doesn't take numbers. */
 805         query_add_attribute(key, value, q);
 806     } else {
 807         /* We only support string and number type keys. */
 808         SecError(errSecItemInvalidKeyType, &q->q_error, CFSTR("applier: key %@ neither string nor number"), key);
 809     }
 810 }
 811
 812 static CFStringRef query_infer_keyclass(Query *q, CFStringRef agrp) {
 813     /* apsd are always dku. */
 814     if (CFEqual(agrp, CFSTR("com.apple.apsd"))) {
 815         return kSecAttrAccessibleAlwaysThisDeviceOnlyPrivate;
 816     }
 817     /* All other certs or in the apple agrp is dk. */
 818     if (q->q_class == cert_class()) {
 819         /* third party certs are always dk. */
 820         return kSecAttrAccessibleAlwaysPrivate;
 821     }
 822     /* The rest defaults to ak. */
 823     return kSecAttrAccessibleWhenUnlocked;
 824 }
 825
 826 void query_ensure_access_control(Query *q, CFStringRef agrp) {
 827     if (q->q_access_control == 0) {
 828         CFStringRef accessible = query_infer_keyclass(q, agrp);
 829         query_add_attribute(kSecAttrAccessible, accessible, q);
 830     }
 831 }
 832
 833 bool query_error(Query *q, CFErrorRef *error) {
 834     CFErrorRef tmp = q->q_error;
 835     q->q_error = NULL;
 836     return SecErrorPropagate(tmp, error);
 837 }
 838
 839 bool query_destroy(Query *q, CFErrorRef *error) {
 840     bool ok = query_error(q, error);
 841     CFIndex ix, attr_count = query_attr_count(q);
 842     for (ix = 0; ix < attr_count; ++ix) {
 843         CFReleaseSafe(query_attr_at(q, ix).value);
 844     }
 845     CFReleaseSafe(q->q_item);
 846     CFReleaseSafe(q->q_musrView);
 847     CFReleaseSafe(q->q_primary_key_digest);
 848     CFReleaseSafe(q->q_match_issuer);
 849     CFReleaseSafe(q->q_access_control);
 850     CFReleaseSafe(q->q_use_cred_handle);
 851     CFReleaseSafe(q->q_caller_access_groups);
 852     CFReleaseSafe(q->q_match_policy);
 853     CFReleaseSafe(q->q_match_valid_on_date);
 854     CFReleaseSafe(q->q_match_trusted_only);
 855     CFReleaseSafe(q->q_token_object_id);
 856
 857     free(q);
 858     return ok;
 859 }
 860
 861 bool query_notify_and_destroy(Query *q, bool ok, CFErrorRef *error) {
 862     if (ok && !q->q_error && (q->q_sync_changed || (q->q_changed && !SecMUSRIsSingleUserView(q->q_musrView)))) {
 863         SecKeychainChanged();
 864     }
 865     return query_destroy(q, error) && ok;
 866 }
 867
 868 /* Allocate and initialize a Query object for query. */
 869 Query *query_create(const SecDbClass *qclass,
 870                     CFDataRef musr,
 871                     CFDictionaryRef query,
 872                     SecurityClient* client,
 873                     CFErrorRef *error)
 874 {
 875     if (!qclass) {
 876         if (error && !*error)
 877             SecError(errSecItemClassMissing, error, CFSTR("Missing class"));
 878         return NULL;
 879     }
 880
 881     if (musr == NULL)
 882         musr = SecMUSRGetSingleUserKeychainUUID();
 883
 884     /* Number of pairs we need is the number of attributes in this class
 885      plus the number of keys in the dictionary, minus one for each key in
 886      the dictionary that is a regular attribute. */
 887     CFIndex key_count = SecDbClassAttrCount(qclass);
 888     if (key_count == 0) {
 889         // Identities claim to have 0 attributes, but they really support any keys or cert attribute.
 890         key_count = SecDbClassAttrCount(cert_class()) + SecDbClassAttrCount(keys_class());
 891     }
 892
 893     if (query) {
 894         key_count += CFDictionaryGetCount(query);
 895         SecDbForEachAttr(qclass, attr) {
 896             if (CFDictionaryContainsKey(query, attr->name))
 897                 --key_count;
 898         }
 899     }
 900
 901     if (key_count > QUERY_KEY_LIMIT) {
 902         if (error && !*error)
 903         {
 904             secerror("key_count: %ld, QUERY_KEY_LIMIT: %d", (long)key_count, QUERY_KEY_LIMIT);
 905             SecError(errSecItemIllegalQuery, error, CFSTR("Past query key limit"));
 906         }
 907         return NULL;
 908     }
 909
 910     Query *q = calloc(1, sizeof(Query) + sizeof(Pair) * key_count);
 911     if (q == NULL) {
 912         if (error && !*error)
 913             SecError(errSecAllocate, error, CFSTR("Out of memory"));
 914         return NULL;
 915     }
 916
 917     q->q_pairs_count = key_count;
 918     q->q_musrView = (CFDataRef)CFRetain(musr);
 919     q->q_uuid_from_primary_key = false;
 920     q->q_keybag = KEYBAG_DEVICE;
 921     q->q_class = qclass;
 922     q->q_match_begin = q->q_match_end = key_count;
 923     q->q_item = CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 924
 925     if (client) {
 926         // If not, don't do anything. Parent apps, schema migration, etc. all need access to all items, clip or no
 927         if (client->isAppClip) {
 928             secdebug("query", "Client is app clip, adding restriction to query attribute");
 929             CFDictionaryAddValue(q->q_item, kSecAttrAppClipItem, kCFBooleanTrue);
 930         }
 931     } else {
 932         secdebug("query", "no client information specified so not tweaking query attributes");
 933     }
 934
 935     return q;
 936 }
 937
 938 /* Parse query for a Query object q. */
 939 static bool query_parse_with_applier(Query *q, CFDictionaryRef query,
 940                                      CFDictionaryApplierFunction applier,
 941                                      CFErrorRef *error) {
 942     CFDictionaryApplyFunction(query, applier, q);
 943     return query_error(q, error);
 944 }
 945
 946 /* Parse query for a Query object q. */
 947 static bool query_parse(Query *q, CFDictionaryRef query,
 948                         CFErrorRef *error) {
 949     return query_parse_with_applier(q, query, query_applier, error);
 950 }
 951
 952 /* Parse query for a Query object q. */
 953 bool query_update_parse(Query *q, CFDictionaryRef update,
 954                                CFErrorRef *error) {
 955     return query_parse_with_applier(q, update, query_update_applier, error);
 956 }
 957
 958 Query *query_create_with_limit(CFDictionaryRef query, CFDataRef musr, CFIndex limit, SecurityClient* client, CFErrorRef *error) {
 959     Query *q;
 960     q = query_create(query_get_class(query, error), musr, query, client, error);
 961     if (q) {
 962         q->q_limit = limit;
 963         if (!query_parse(q, query, error)) {
 964             query_destroy(q, error);
 965             return NULL;
 966         }
 967         if (!q->q_sync && !q->q_row_id && !q->q_token_object_id) {
 968             /* query did not specify a kSecAttrSynchronizable attribute,
 969              * and did not contain a persistent reference. */
 970             query_add_attribute(kSecAttrSynchronizable, kCFBooleanFalse, q);
 971         }
 972     }
 973     return q;
 974 }
 975
 976
 977 void
 978 query_set_caller_access_groups(Query *q, CFArrayRef caller_access_groups) {
 979     CFRetainAssign(q->q_caller_access_groups, caller_access_groups);
 980 }
 981
 982 void
 983 query_set_policy(Query *q, SecPolicyRef policy) {
 984     CFRetainAssign(q->q_match_policy, policy);
 985 }
 986
 987 void query_set_valid_on_date(Query *q, CFDateRef date) {
 988     CFRetainAssign(q->q_match_valid_on_date, date);
 989 }
 990
 991 void query_set_trusted_only(Query *q, CFBooleanRef trusted_only) {
 992     CFRetainAssign(q->q_match_trusted_only, trusted_only);
 993 }