Security/sec/securityd/SecDbQuery.h

   1 /*
   2  * Copyright (c) 2013-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*!
  25  @header SecDbQuery.h - The thing that does the stuff with the gibli.
  26  */
  27
  28 #ifndef _SECURITYD_SECDBQUERY_H_
  29 #define _SECURITYD_SECDBQUERY_H_
  30
  31 #include <securityd/SecKeybagSupport.h>
  32 #include <securityd/SecDbItem.h>
  33
  34 __BEGIN_DECLS
  35
  36 typedef struct Pair *SecDbPairRef;
  37 typedef struct Query *SecDbQueryRef;
  38
  39 /* Return types. */
  40 typedef uint32_t ReturnTypeMask;
  41 enum
  42 {
  43     kSecReturnDataMask = 1 << 0,
  44     kSecReturnAttributesMask = 1 << 1,
  45     kSecReturnRefMask = 1 << 2,
  46     kSecReturnPersistentRefMask = 1 << 3,
  47 };
  48
  49 /* Constant indicating there is no limit to the number of results to return. */
  50 enum
  51 {
  52     kSecMatchUnlimited = kCFNotFound
  53 };
  54
  55 typedef struct Pair
  56 {
  57     const void *key;
  58     const void *value;
  59 } Pair;
  60
  61 /* Nothing in this struct is retained since all the
  62  values below are extracted from the dictionary passed in by the
  63  caller. */
  64 typedef struct Query
  65 {
  66     /* Class of this query. */
  67     const SecDbClass *q_class;
  68
  69     /* Dictionary with all attributes and values in clear (to be encrypted). */
  70     CFMutableDictionaryRef q_item;
  71
  72     /* q_pairs is an array of Pair structs.  Elements with indices
  73      [0, q_attr_end) contain attribute key value pairs.  Elements with
  74      indices [q_match_begin, q_match_end) contain match key value pairs.
  75      Thus q_attr_end is the number of attrs in q_pairs and
  76      q_match_begin - q_match_end is the number of matches in q_pairs.  */
  77     CFIndex q_match_begin;
  78     CFIndex q_match_end;
  79     CFIndex q_attr_end;
  80
  81     CFErrorRef q_error;
  82     ReturnTypeMask q_return_type;
  83
  84     CFDataRef q_data;
  85     CFTypeRef q_ref;
  86     sqlite_int64 q_row_id;
  87
  88     CFArrayRef q_use_item_list;
  89     CFBooleanRef q_use_tomb;
  90 #if defined(MULTIPLE_KEYCHAINS)
  91     CFArrayRef q_use_keychain;
  92     CFArrayRef q_use_keychain_list;
  93 #endif /* !defined(MULTIPLE_KEYCHAINS) */
  94
  95     /* Value of kSecMatchLimit key if present. */
  96     CFIndex q_limit;
  97
  98     /* True if query contained a kSecAttrSynchronizable attribute,
  99      * regardless of its actual value. If this is false, then we
 100      * will add an explicit sync=0 to the query. */
 101     bool q_sync;
 102
 103     // Set to true if we modified any item as part of executing this query
 104     bool q_changed;
 105
 106     // Set to true if we modified any synchronizable item as part of executing this query
 107     bool q_sync_changed;
 108
 109     // Set to true if we want to delete item
 110     enum SecKsCryptoOp q_crypto_op;
 111
 112     /* Keybag handle to use for this item. */
 113     keybag_handle_t q_keybag;
 114
 115     /* ACL and credHandle passed to the query. q_use_cred_handle can contain either CFDataRef passed from outside
 116      * or CoreAuth context object. */
 117     SecAccessControlRef q_access_control;
 118     CFTypeRef q_use_cred_handle;
 119
 120     // Array filled during the query execution with CFDataRef conatining serialized SecAccessControl objects
 121     // which need to be verified in order to include all items in the results.
 122     CFMutableArrayRef q_required_access_controls;
 123
 124     // Text describing the operation for which the application is attempting to authenticate.
 125     CFStringRef q_use_operation_prompt;
 126
 127     // True if the authentication UI is not allowed.
 128     CFBooleanRef q_use_no_authentication_ui;
 129
 130     // SHA1 digest of DER encoded primary key
 131     CFDataRef q_primary_key_digest;
 132
 133     CFArrayRef q_match_issuer;
 134
 135     /* Caller acces groups for AKS */
 136     CFArrayRef q_caller_access_groups;
 137
 138     Pair q_pairs[];
 139 } Query;
 140
 141 Query *query_create(const SecDbClass *qclass, CFDictionaryRef query, CFErrorRef *error);
 142 bool query_destroy(Query *q, CFErrorRef *error);
 143 bool query_error(Query *q, CFErrorRef *error);
 144 Query *query_create_with_limit(CFDictionaryRef query, CFIndex limit, CFErrorRef *error);
 145 void query_add_attribute(const void *key, const void *value, Query *q);
 146 void query_ensure_access_control(Query *q, CFStringRef agrp);
 147 void query_pre_add(Query *q, bool force_date);
 148 bool query_notify_and_destroy(Query *q, bool ok, CFErrorRef *error);
 149 CFIndex query_match_count(const Query *q);
 150 CFIndex query_attr_count(const Query *q);
 151 Pair query_attr_at(const Query *q, CFIndex ix);
 152 bool query_update_parse(Query *q, CFDictionaryRef update, CFErrorRef *error);
 153 void query_pre_update(Query *q);
 154 void query_enable_interactive(Query *q);
 155 bool query_needs_authentication(Query *q);
 156 bool query_authenticate(Query *q, CFErrorRef **error);
 157 const SecDbClass *kc_class_with_name(CFStringRef name);
 158 void query_set_caller_access_groups(Query *q, CFArrayRef caller_access_groups);
 159
 160
 161 __END_DECLS
 162
 163 #endif /* _SECURITYD_SECDBQUERY_H_ */