OSX/sec/Security/SecItemBackup.c

   1 /*
   2  * Copyright (c) 2015 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 /*
  26  * SecItemBackup.c -  Client side backup interfaces and support code
  27  */
  28
  29 #include <Security/SecItemBackup.h>
  30
  31 #include <Security/SecItemPriv.h>
  32 #include <Security/SecuritydXPC.h>
  33 #include <Security/SecFramework.h>
  34 #include <securityd/SecItemServer.h>
  35 #include <ipc/securityd_client.h>
  36 #include <Security/SecureObjectSync/SOSBackupEvent.h>
  37 #include <Security/SecureObjectSync/SOSCloudCircle.h>
  38 #include <Security/SecureObjectSync/SOSViews.h>
  39 #include <corecrypto/ccsha1.h>
  40 #include <utilities/SecCFError.h>
  41 #include <utilities/SecCFRelease.h>
  42 #include <utilities/SecCFCCWrappers.h>
  43 #include <utilities/array_size.h>
  44 #include <utilities/der_plist.h>
  45 #include <utilities/der_plist_internal.h>
  46 #include <AssertMacros.h>
  47 #include <os/activity.h>
  48 #include <notify.h>
  49
  50 #include <sys/stat.h>
  51
  52 static CFDataRef client_data_data_to_data_error_request(enum SecXPCOperation op, SecurityClient *client, CFDataRef keybag, CFDataRef passcode, CFErrorRef *error) {
  53     __block CFDataRef result = NULL;
  54     securityd_send_sync_and_do(op, error, ^bool(xpc_object_t message, CFErrorRef *error) {
  55         return SecXPCDictionarySetDataOptional(message, kSecXPCKeyKeybag, keybag, error)
  56         && SecXPCDictionarySetDataOptional(message, kSecXPCKeyUserPassword, passcode, error);
  57     }, ^bool(xpc_object_t response, CFErrorRef *error) {
  58         return (result = SecXPCDictionaryCopyData(response, kSecXPCKeyResult, error));
  59     });
  60     return result;
  61 }
  62
  63 static bool data_client_data_data_to_error_request(enum SecXPCOperation op, CFDataRef backup, SecurityClient *client, CFDataRef keybag, CFDataRef passcode, CFErrorRef *error) {
  64     return securityd_send_sync_and_do(op, error, ^bool(xpc_object_t message, CFErrorRef *error) {
  65         return SecXPCDictionarySetData(message, kSecXPCKeyBackup, backup, error)
  66         && SecXPCDictionarySetData(message, kSecXPCKeyKeybag, keybag, error)
  67         && SecXPCDictionarySetDataOptional(message, kSecXPCKeyUserPassword, passcode, error);
  68     } , NULL);
  69 }
  70
  71 static bool dict_data_data_to_error_request(enum SecXPCOperation op, CFDictionaryRef backup, CFDataRef keybag, CFDataRef passcode, CFErrorRef *error) {
  72     return securityd_send_sync_and_do(op, error, ^bool(xpc_object_t message, CFErrorRef *error) {
  73         return SecXPCDictionarySetPList(message, kSecXPCKeyBackup, backup, error)
  74         && SecXPCDictionarySetData(message, kSecXPCKeyKeybag, keybag, error)
  75         && SecXPCDictionarySetDataOptional(message, kSecXPCKeyUserPassword, passcode, error);
  76     } , NULL);
  77 }
  78
  79 static CFDictionaryRef data_data_dict_to_dict_error_request(enum SecXPCOperation op, CFDictionaryRef backup, CFDataRef keybag, CFDataRef passcode, CFErrorRef *error) {
  80     __block CFDictionaryRef dict = NULL;
  81     securityd_send_sync_and_do(op, error, ^bool(xpc_object_t message, CFErrorRef *error) {
  82         return SecXPCDictionarySetPListOptional(message, kSecXPCKeyBackup, backup, error)
  83         && SecXPCDictionarySetData(message, kSecXPCKeyKeybag, keybag, error)
  84         && SecXPCDictionarySetDataOptional(message, kSecXPCKeyUserPassword, passcode, error);
  85     }, ^bool(xpc_object_t response, CFErrorRef *error) {
  86         return (dict = SecXPCDictionaryCopyDictionary(response, kSecXPCKeyResult, error));
  87     });
  88     return dict;
  89 }
  90
  91 static int string_to_fd_error_request(enum SecXPCOperation op, CFStringRef backupName, CFErrorRef *error) {
  92     __block int fd = -1;
  93     securityd_send_sync_and_do(op, error, ^bool(xpc_object_t message, CFErrorRef *error) {
  94         return SecXPCDictionarySetString(message, kSecXPCKeyBackup, backupName, error);
  95     }, ^bool(xpc_object_t response, CFErrorRef *error) {
  96         fd = SecXPCDictionaryDupFileDescriptor(response, kSecXPCKeyResult, error);
  97         return true;
  98     });
  99     return fd;
 100 }
 101
 102 static bool string_data_data_to_bool_error_request(enum SecXPCOperation op, CFStringRef backupName, CFDataRef keybagDigest, CFDataRef manifest, CFErrorRef *error)
 103 {
 104     return securityd_send_sync_and_do(op, error, ^bool(xpc_object_t message, CFErrorRef *error) {
 105         return SecXPCDictionarySetString(message, kSecXPCKeyBackup, backupName, error) &&
 106                 SecXPCDictionarySetDataOptional(message, kSecXPCKeyKeybag, keybagDigest, error) &&
 107                 SecXPCDictionarySetDataOptional(message, kSecXPCData, manifest, error);
 108     }, ^bool(xpc_object_t response, __unused CFErrorRef *error) {
 109         return xpc_dictionary_get_bool(response, kSecXPCKeyResult);
 110     });
 111 }
 112
 113 static bool string_string_data_data_data_to_bool_error_request(enum SecXPCOperation op, CFStringRef backupName, CFStringRef peerID, CFDataRef keybag, CFDataRef secret, CFDataRef backup, CFErrorRef *error)
 114 {
 115     return securityd_send_sync_and_do(op, error, ^bool(xpc_object_t message, CFErrorRef *error) {
 116         return SecXPCDictionarySetString(message, kSecXPCKeyBackup, backupName, error) &&
 117         SecXPCDictionarySetStringOptional(message, kSecXPCKeyDigest, peerID, error) &&
 118         SecXPCDictionarySetData(message, kSecXPCKeyKeybag, keybag, error) &&
 119         SecXPCDictionarySetData(message, kSecXPCKeyUserPassword, secret, error) &&
 120         SecXPCDictionarySetData(message, kSecXPCData, backup, error);
 121     }, ^bool(xpc_object_t response, __unused CFErrorRef *error) {
 122         return xpc_dictionary_get_bool(response, kSecXPCKeyResult);
 123     });
 124 }
 125
 126 static CFArrayRef to_array_error_request(enum SecXPCOperation op, CFErrorRef *error)
 127 {
 128     __block CFArrayRef result = NULL;
 129     securityd_send_sync_and_do(op, error, ^bool(xpc_object_t message, CFErrorRef *error) {
 130         return true;
 131     }, ^bool(xpc_object_t response, CFErrorRef *error) {
 132         return result = SecXPCDictionaryCopyArray(response, kSecXPCKeyResult, error);
 133     });
 134     return result;
 135 }
 136
 137 // XPC calls
 138
 139 static int SecItemBackupHandoffFD(CFStringRef backupName, CFErrorRef *error) {
 140     __block int fileDesc = -1;
 141     os_activity_initiate("SecItemBackupHandoffFD", OS_ACTIVITY_FLAG_DEFAULT, ^{
 142         fileDesc = SECURITYD_XPC(sec_item_backup_handoff_fd, string_to_fd_error_request, backupName, error);
 143     });
 144     return fileDesc;
 145 }
 146
 147 CFDataRef _SecKeychainCopyOTABackup(void) {
 148     __block CFDataRef result;
 149     os_activity_initiate("_SecKeychainCopyOTABackup", OS_ACTIVITY_FLAG_DEFAULT, ^{
 150         result = SECURITYD_XPC(sec_keychain_backup, client_data_data_to_data_error_request, SecSecurityClientGet(), NULL, NULL, NULL);
 151     });
 152     return result;
 153 }
 154
 155 CFDataRef _SecKeychainCopyBackup(CFDataRef backupKeybag, CFDataRef password) {
 156     __block CFDataRef result;
 157     os_activity_initiate("_SecKeychainCopyBackup", OS_ACTIVITY_FLAG_DEFAULT, ^{
 158         result = SECURITYD_XPC(sec_keychain_backup, client_data_data_to_data_error_request, SecSecurityClientGet(), backupKeybag, password, NULL);
 159     });
 160     return result;
 161 }
 162
 163 bool _SecKeychainWriteBackupToFileDescriptor(CFDataRef backupKeybag, CFDataRef password, int fd, CFErrorRef *error) {
 164     __block bool result = false;
 165     os_activity_initiate("_SecKeychainWriteBackupToFile", OS_ACTIVITY_FLAG_DEFAULT, ^{
 166
 167         securityd_send_sync_and_do(sec_keychain_backup_id, error, ^bool(xpc_object_t message, CFErrorRef *error) {
 168             return SecXPCDictionarySetDataOptional(message, kSecXPCKeyKeybag, backupKeybag, error)
 169                 && SecXPCDictionarySetDataOptional(message, kSecXPCKeyUserPassword, password, error)
 170                 && SecXPCDictionarySetFileDescriptor(message, kSecXPCKeyFileDescriptor, fd, error);
 171         }, ^bool(xpc_object_t response, CFErrorRef *error) {
 172             return (result = SecXPCDictionaryGetBool(response, kSecXPCKeyResult, error));
 173         });
 174     });
 175     return result;
 176 }
 177
 178 bool
 179 _SecKeychainRestoreBackupFromFileDescriptor(int fd, CFDataRef backupKeybag, CFDataRef password, CFErrorRef *error)
 180 {
 181     __block bool result;
 182     os_activity_initiate("_SecKeychainRestoreBackup", OS_ACTIVITY_FLAG_DEFAULT, ^{
 183         securityd_send_sync_and_do(sec_keychain_restore_id, error, ^bool(xpc_object_t message, CFErrorRef *error) {
 184             return SecXPCDictionarySetFileDescriptor(message, kSecXPCKeyFileDescriptor, fd, error)
 185                 && SecXPCDictionarySetData(message, kSecXPCKeyKeybag, backupKeybag, error)
 186                 && SecXPCDictionarySetDataOptional(message, kSecXPCKeyUserPassword, password, error);
 187         }, ^bool(xpc_object_t response, CFErrorRef *error) {
 188             return (result = SecXPCDictionaryGetBool(response, kSecXPCKeyResult, error));
 189         });
 190     });
 191     return result;
 192 }
 193
 194 /*
 195  * Current promise is that this is low memory usage, so in the current format, ask securityd
 196  * to resolve the item for us.
 197  */
 198
 199 CFStringRef
 200 _SecKeychainCopyKeybagUUIDFromFileDescriptor(int fd, CFErrorRef *error)
 201 {
 202     __block CFStringRef result;
 203     os_activity_initiate("_SecKeychainCopyKeybagUUID", OS_ACTIVITY_FLAG_DEFAULT, ^{
 204         securityd_send_sync_and_do(sec_keychain_backup_keybag_uuid_id, error, ^bool(xpc_object_t message, CFErrorRef *error) {
 205             return SecXPCDictionarySetFileDescriptor(message, kSecXPCKeyFileDescriptor, fd, error);
 206         }, ^bool(xpc_object_t response, CFErrorRef *error) {
 207             return (result = SecXPCDictionaryCopyString(response, kSecXPCKeyResult, error));
 208         });
 209     });
 210     return result;
 211 }
 212
 213
 214 OSStatus _SecKeychainRestoreBackup(CFDataRef backup, CFDataRef backupKeybag,
 215                                    CFDataRef password) {
 216     __block OSStatus result;
 217     os_activity_initiate("_SecKeychainRestoreBackup", OS_ACTIVITY_FLAG_DEFAULT, ^{
 218         result = SecOSStatusWith(^bool (CFErrorRef *error) {
 219             return SECURITYD_XPC(sec_keychain_restore, data_client_data_data_to_error_request, backup, SecSecurityClientGet(), backupKeybag, password, error);
 220         });
 221     });
 222     return result;
 223 }
 224
 225
 226 static int compareDigests(const void *l, const void *r) {
 227     return memcmp(l, r, CCSHA1_OUTPUT_SIZE);
 228 }
 229
 230 CFDataRef SecItemBackupCreateManifest(CFDictionaryRef backup, CFErrorRef *error)
 231 {
 232     CFIndex count = backup ? CFDictionaryGetCount(backup) : 0;
 233     CFMutableDataRef manifest = CFDataCreateMutable(kCFAllocatorDefault, CCSHA1_OUTPUT_SIZE * count);
 234     if (backup) {
 235         CFDictionaryForEach(backup, ^void (const void *key, const void *value) {
 236             if (isDictionary(value)) {
 237                 /* converting key back to binary blob is horrible */
 238                 CFDataRef sha1 = CFDictionaryGetValue(value, kSecItemBackupHashKey);
 239                 if (isData(sha1) && CFDataGetLength(sha1) == CCSHA1_OUTPUT_SIZE) {
 240                     CFDataAppend(manifest, sha1);
 241                 } else {
 242                     CFStringRef sha1Hex = CFDataCopyHexString(sha1);
 243                     secerror("bad hash %@ in backup", sha1Hex);
 244                     CFReleaseSafe(sha1Hex);
 245                     // TODO: Drop this key from dictionary (outside the loop)
 246                 }
 247             }
 248         });
 249         qsort(CFDataGetMutableBytePtr(manifest), CFDataGetLength(manifest) / CCSHA1_OUTPUT_SIZE, CCSHA1_OUTPUT_SIZE, compareDigests);
 250     }
 251     return manifest;
 252 }
 253
 254 OSStatus _SecKeychainBackupSyncable(CFDataRef keybag, CFDataRef password, CFDictionaryRef backup_in, CFDictionaryRef *backup_out)
 255 {
 256     return SecOSStatusWith(^bool (CFErrorRef *error) {
 257         *backup_out = SECURITYD_XPC(sec_keychain_backup_syncable, data_data_dict_to_dict_error_request, backup_in, keybag, password, error);
 258         return *backup_out != NULL;
 259     });
 260 }
 261
 262 OSStatus _SecKeychainRestoreSyncable(CFDataRef keybag, CFDataRef password, CFDictionaryRef backup_in)
 263 {
 264     __block OSStatus result;
 265     os_activity_initiate("_SecKeychainRestoreSyncable", OS_ACTIVITY_FLAG_DEFAULT, ^{
 266         result = SecOSStatusWith(^bool (CFErrorRef *error) {
 267             return SECURITYD_XPC(sec_keychain_restore_syncable, dict_data_data_to_error_request, backup_in, keybag, password, error);
 268         });
 269     });
 270     return result;
 271 }
 272
 273 // Client code
 274
 275 static bool SecKeychainWithBackupFile(CFStringRef backupName, CFErrorRef *error, void(^with)(FILE *bufile)) {
 276     int fd = SecItemBackupHandoffFD(backupName, error);
 277     if (fd < 0) {
 278         secdebug("backup", "SecItemBackupHandoffFD returned %d", fd);
 279         return false;
 280     }
 281
 282     // Rewind file to start
 283     lseek(fd, 0, SEEK_SET);
 284
 285     FILE *backup = fdopen(fd, "r");
 286     if (!backup) {
 287         close(fd);
 288         secdebug("backup", "Receiving file for %@ failed, %d", backupName, errno);
 289         return SecCheckErrno(!backup, error, CFSTR("fdopen"));
 290     } else {
 291         struct stat sb;
 292         fstat(fd, &sb);
 293         secdebug("backup", "Receiving file for %@ with fd %d of size %llu", backupName, fd, sb.st_size);
 294     }
 295
 296     with(backup);
 297     fclose(backup);
 298     return true;
 299 }
 300
 301 static CFArrayRef SecItemBackupCopyNames(CFErrorRef *error)
 302 {
 303     __block CFArrayRef result;
 304     os_activity_initiate("SecItemBackupCopyNames", OS_ACTIVITY_FLAG_DEFAULT, ^{
 305         result = SECURITYD_XPC(sec_item_backup_copy_names, to_array_error_request, error);
 306     });
 307     return result;
 308 }
 309
 310 bool SecItemBackupWithRegisteredBackups(CFErrorRef *error, void(^backup)(CFStringRef backupName)) {
 311     CFArrayRef backupNames = SecItemBackupCopyNames(error);
 312     if (!backupNames) return false;
 313     CFStringRef name;
 314     CFArrayForEachC(backupNames, name) {
 315         backup(name);
 316     }
 317     CFRelease(backupNames);
 318     return true;
 319 }
 320
 321 static bool SecItemBackupDoResetEventBody(const uint8_t *der, const uint8_t *der_end, CFErrorRef *error, void (^handleEvent)(SecBackupEventType et, CFTypeRef key, CFTypeRef item)) {
 322     size_t sequence_len;
 323     const uint8_t *sequence_body = ccder_decode_len(&sequence_len, der, der_end);
 324     bool ok = sequence_body;
 325     if (ok && sequence_body + sequence_len != der_end) {
 326         // Can't ever happen!
 327         SecError(errSecDecode, error, CFSTR("trailing junk after reset"));
 328         ok = false;
 329     }
 330     if (ok) {
 331         CFDataRef keybag = NULL;
 332         if (sequence_body != der_end) {
 333             size_t keybag_len = 0;
 334             const uint8_t *keybag_start = ccder_decode_tl(CCDER_OCTET_STRING, &keybag_len, sequence_body, der_end);
 335             if (!keybag_start) {
 336                 ok = SecError(errSecDecode, error, CFSTR("failed to decode keybag"));
 337             } else if (keybag_start + keybag_len != der_end) {
 338                 ok = SecError(errSecDecode, error, CFSTR("trailing junk after keybag"));
 339             } else {
 340                 keybag = CFDataCreate(kCFAllocatorDefault, keybag_start, keybag_len);
 341             }
 342         }
 343         handleEvent(kSecBackupEventReset, keybag, NULL);
 344         CFReleaseSafe(keybag);
 345     }
 346
 347     return ok;
 348 }
 349
 350 static bool SecItemBackupDoAddEvent(const uint8_t *der, const uint8_t *der_end, CFErrorRef *error, void (^handleEvent)(SecBackupEventType et, CFTypeRef key, CFTypeRef item)) {
 351     CFDictionaryRef eventDict = NULL;
 352     const uint8_t *der_end_of_dict = der_decode_dictionary(kCFAllocatorDefault, kCFPropertyListImmutable, &eventDict, error, der, der_end);
 353     if (der_end_of_dict && der_end_of_dict != der_end) {
 354         // Can't ever happen!
 355         SecError(errSecDecode, error, CFSTR("trailing junk after add"));
 356         der_end_of_dict = NULL;
 357     }
 358     if (der_end_of_dict) {
 359         CFDataRef hash = CFDictionaryGetValue(eventDict, kSecItemBackupHashKey);
 360         handleEvent(kSecBackupEventAdd, hash, eventDict);
 361     }
 362
 363     CFReleaseSafe(eventDict);
 364     return der_end_of_dict;
 365 }
 366
 367 static bool SecItemBackupDoCompleteEvent(const uint8_t *der, const uint8_t *der_end, CFErrorRef *error, void (^handleEvent)(SecBackupEventType et, CFTypeRef key, CFTypeRef item)) {
 368     uint64_t event_num = 0;
 369     const uint8_t *der_end_of_num = ccder_decode_uint64(&event_num, der, der_end);
 370     if (der_end_of_num && der_end_of_num != der_end) {
 371         // Can't ever happen!
 372         SecError(errSecDecode, error, CFSTR("trailing junk after complete"));
 373         der_end_of_num = NULL;
 374     }
 375     if (der_end_of_num) {
 376         handleEvent(kSecBackupEventComplete, NULL, NULL);
 377     }
 378     return der_end_of_num;
 379 }
 380
 381 static bool SecItemBackupDoDeleteEventBody(const uint8_t *der, const uint8_t *der_end, CFErrorRef *error, void (^handleEvent)(SecBackupEventType et, CFTypeRef key, CFTypeRef item)) {
 382     size_t digest_len = 0;
 383     const uint8_t *digest_start = ccder_decode_len(&digest_len, der, der_end);
 384     if (digest_start && digest_start + digest_len != der_end) {
 385         // Can't ever happen!
 386         SecError(errSecDecode, error, CFSTR("trailing junk after delete"));
 387         digest_start = NULL;
 388     }
 389     if (digest_start) {
 390         CFDataRef hash = CFDataCreate(kCFAllocatorDefault, digest_start, digest_len);
 391         handleEvent(kSecBackupEventRemove, hash, NULL);
 392         CFRelease(hash);
 393     }
 394
 395     return digest_start;
 396 }
 397
 398 static void debugDisplayBackupEventTag(ccder_tag tag) {
 399 #if !defined(NDEBUG)
 400     const char *eventDesc;
 401     switch (tag) {
 402         case CCDER_CONSTRUCTED_SEQUENCE:    eventDesc = "ResetEvent"; break;
 403         case CCDER_CONSTRUCTED_SET:         eventDesc = "AddEvent"; break;
 404         case CCDER_INTEGER:                 eventDesc = "ResetEvent"; break;
 405         case CCDER_OCTET_STRING:            eventDesc = "DeleteEvent"; break;
 406         default:                            eventDesc = "UnknownEvent"; break;
 407     }
 408     secdebug("backup", "processing event %s (tag %08lX)", eventDesc, tag);
 409 #endif
 410 }
 411
 412 static bool SecItemBackupDoEvent(const uint8_t *der, const uint8_t *der_end, CFErrorRef *error, void (^handleEvent)(SecBackupEventType et, CFTypeRef key, CFTypeRef item)) {
 413     ccder_tag tag;
 414     const uint8_t *der_start_of_len = ccder_decode_tag(&tag, der, der_end);
 415     debugDisplayBackupEventTag(tag);
 416     switch (tag) {
 417         case CCDER_CONSTRUCTED_SEQUENCE:
 418             return SecItemBackupDoResetEventBody(der_start_of_len, der_end, error, handleEvent);
 419         case CCDER_CONSTRUCTED_SET:
 420             return SecItemBackupDoAddEvent(der, der_end, error, handleEvent);
 421         case CCDER_INTEGER:
 422             return SecItemBackupDoCompleteEvent(der, der_end, error, handleEvent);
 423         case CCDER_OCTET_STRING:
 424             return SecItemBackupDoDeleteEventBody(der_start_of_len, der_end, error, handleEvent);
 425         default:
 426             return SecError(errSecDecode, error, CFSTR("unsupported event tag: %lu"), tag);
 427     }
 428 }
 429
 430 // TODO: Move to ccder and give better name.
 431 static const uint8_t *ccder_decode_len_unchecked(size_t *lenp, const uint8_t *der, const uint8_t *der_end) {
 432     if (der && der < der_end) {
 433         size_t len = *der++;
 434         if (len < 0x80) {
 435         } else if (len == 0x81) {
 436             if (der_end - der < 1) goto errOut;
 437             len = *der++;
 438         } else if (len == 0x82) {
 439             if (der_end - der < 2) goto errOut;
 440             len = *(der++) << 8;
 441             len += *der++;
 442         } else if (len == 0x83) {
 443             if (der_end - der < 3) goto errOut;
 444             len = *(der++) << 16;
 445             len += *(der++) << 8;
 446             len += *(der++);
 447         } else {
 448             goto errOut;
 449         }
 450         *lenp = len;
 451         return der;
 452     }
 453 errOut:
 454     return NULL;
 455 }
 456
 457 static bool SecKeychainWithBackupFileParse(FILE *backup, CFErrorRef *error, void (^handleEvent)(SecBackupEventType et, CFTypeRef key, CFTypeRef item)) {
 458     __block bool ok = true;
 459     size_t buf_remaining = 0;
 460     const size_t read_ahead = 16;
 461     size_t buf_len = read_ahead;
 462     uint8_t *buf = malloc(buf_len);
 463     for (;;) {
 464         const size_t bytes_read = fread(buf + buf_remaining, 1, read_ahead - buf_remaining, backup);
 465         if (bytes_read <= 0) {
 466             if (!feof(backup))
 467                 ok = SecCheckErrno(true, error, CFSTR("read backup event header"));
 468             else if (!buf_remaining) {
 469                 // Nothing read, nothing in buffer, clean eof.
 470             }
 471             break;
 472         }
 473         const size_t buf_avail = bytes_read + buf_remaining;
 474
 475         const uint8_t *der = buf;
 476         const uint8_t *der_end = der + buf_avail;
 477         ccder_tag tag;
 478         size_t body_len;
 479         der = ccder_decode_tag(&tag, der, der_end);
 480         der = ccder_decode_len_unchecked(&body_len, der, der_end);
 481
 482         if (!der) {
 483             ok = SecError(errSecDecode, error, CFSTR("failed to decode backup event header"));
 484             break;
 485         }
 486
 487         const size_t decoded_len = der - buf;
 488         size_t event_len = decoded_len + body_len;
 489         if (event_len > buf_avail) {
 490             // We need to read the rest of this event, first
 491             // ensure we have enough space.
 492             if (buf_len < event_len) {
 493                 // TODO: Think about a max for buf_len here to prevent attacks.
 494                 uint8_t *new_buf = realloc(buf, event_len);
 495                 if (!new_buf) {
 496                     ok = SecError(errSecAllocate, error, CFSTR("realloc buf failed"));
 497                     break;
 498                 }
 499                 buf = new_buf;
 500                 buf_len = event_len;
 501             }
 502
 503             // Read tail of current event.
 504             const size_t tail_len = fread(buf + buf_avail, 1, event_len - buf_avail, backup);
 505             if (tail_len < event_len - buf_avail) {
 506                 if (!feof(backup)) {
 507                     ok = SecCheckErrno(true, error, CFSTR("failed to read event body"));
 508                 } else {
 509                     ok = SecError(errSecDecode, error, CFSTR("unexpected end of event file %zu of %zu bytes read"), tail_len, event_len - buf_avail);
 510                 }
 511                 break;
 512             }
 513         }
 514
 515         // Adjust der_end to the end of the event.
 516         der_end = buf + event_len;
 517
 518         ok &= SecItemBackupDoEvent(buf, der_end, error, handleEvent);
 519
 520         if (event_len < buf_avail) {
 521             // Shift remaining bytes to start of buffer.
 522             buf_remaining = buf_avail - event_len;
 523             memmove(buf, der_end, buf_remaining);
 524         } else {
 525             buf_remaining = 0;
 526         }
 527     }
 528     free(buf);
 529     return ok;
 530 }
 531
 532 bool SecItemBackupWithChanges(CFStringRef backupName, CFErrorRef *error, void (^handleEvent)(SecBackupEventType et, CFTypeRef key, CFTypeRef item)) {
 533     __block bool ok = true;
 534     __block CFErrorRef localError = NULL;
 535     ok &= SecKeychainWithBackupFile(backupName, &localError, ^(FILE *backup) {
 536         ok &= SecKeychainWithBackupFileParse(backup, &localError, handleEvent);
 537     });
 538     if (!ok) {   // TODO: remove this logging
 539         secdebug("backup", "SecItemBackupWithChanges failed: %@", localError);
 540         handleEvent(kSecBackupEventComplete, NULL, NULL);
 541         CFErrorPropagate(localError, error);
 542     }
 543
 544     return ok;
 545 }
 546
 547 bool SecItemBackupSetConfirmedManifest(CFStringRef backupName, CFDataRef keybagDigest, CFDataRef manifest, CFErrorRef *error) {
 548     __block bool result;
 549     os_activity_initiate("SecItemBackupSetConfirmedManifest", OS_ACTIVITY_FLAG_DEFAULT, ^{
 550         result = SECURITYD_XPC(sec_item_backup_set_confirmed_manifest, string_data_data_to_bool_error_request, backupName, keybagDigest, manifest, error);
 551     });
 552     return result;
 553 }
 554
 555 void SecItemBackupRestore(CFStringRef backupName, CFStringRef peerID, CFDataRef keybag, CFDataRef secret, CFTypeRef backup, void (^completion)(CFErrorRef error)) {
 556     __block CFErrorRef localError = NULL;
 557     os_activity_initiate("SecItemBackupRestore", OS_ACTIVITY_FLAG_DEFAULT, ^{
 558         SECURITYD_XPC(sec_item_backup_restore, string_string_data_data_data_to_bool_error_request, backupName, peerID, keybag, secret, backup, &localError);
 559     });
 560     completion(localError);
 561     CFReleaseSafe(localError);
 562 }
 563
 564 CFDictionaryRef SecItemBackupCopyMatching(CFDataRef keybag, CFDataRef secret, CFDictionaryRef backup, CFDictionaryRef query, CFErrorRef *error) {
 565     SecError(errSecUnimplemented, error, CFSTR("SecItemBackupCopyMatching unimplemented"));
 566     return NULL;
 567 }
 568
 569