keychain/SecureObjectSync/SOSAccountFullPeerInfo.m

   1 /*
   2  * Copyright (c) 2013-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #include <AssertMacros.h>
  25
  26 #include <stdio.h>
  27 #include "SOSAccountPriv.h"
  28 #include "keychain/SecureObjectSync/SOSInternal.h"
  29 #include "SOSViews.h"
  30 #include "SOSPeerInfoV2.h"
  31 #include "SOSPeerInfoPriv.h"
  32 #import "keychain/SecureObjectSync/SOSAccountPriv.h"
  33 #import "keychain/SecureObjectSync/SOSAccountTrust.h"
  34 #import "keychain/SecureObjectSync/SOSAccountTrustClassic.h"
  35 #include "keychain/SecureObjectSync/SOSAccountTrustClassic+Circle.h"
  36 #include "keychain/SecureObjectSync/SOSAccountTrustClassic+Expansion.h"
  37
  38 static CFStringRef kicloud_identity_name = CFSTR("Cloud Identity");
  39
  40 SecKeyRef SOSAccountCopyDeviceKey(SOSAccount* account, CFErrorRef *error) {
  41     SecKeyRef privateKey = NULL;
  42     if(account.peerPublicKey) {
  43         privateKey = SecKeyCopyMatchingPrivateKey(account.peerPublicKey, error);
  44     } else {
  45         SOSErrorCreate(kSOSErrorPeerNotFound, error, NULL, CFSTR("No identity to get key from"));
  46     }
  47     return privateKey;
  48 }
  49
  50 SOSFullPeerInfoRef CopyCloudKeychainIdentity(SOSPeerInfoRef cloudPeer, CFErrorRef *error) {
  51     return SOSFullPeerInfoCreateCloudIdentity(NULL, cloudPeer, error);
  52 }
  53
  54
  55 static CF_RETURNS_RETAINED SecKeyRef GeneratePermanentFullECKey_internal(int keySize, CFStringRef name, CFTypeRef accessibility, CFBooleanRef sync,  CFErrorRef* error)
  56 {
  57     SecKeyRef full_key = NULL;
  58
  59     CFNumberRef key_size_num = CFNumberCreate(kCFAllocatorDefault, kCFNumberIntType, &keySize);
  60
  61     CFDictionaryRef priv_key_attrs = CFDictionaryCreateForCFTypes(kCFAllocatorDefault,
  62                                                                   kSecAttrIsPermanent,    kCFBooleanTrue,
  63                                                                   NULL);
  64
  65     CFDictionaryRef keygen_parameters = CFDictionaryCreateForCFTypes(kCFAllocatorDefault,
  66                                                                      kSecAttrKeyType,        kSecAttrKeyTypeEC,
  67                                                                      kSecAttrKeySizeInBits,  key_size_num,
  68                                                                      kSecPrivateKeyAttrs,    priv_key_attrs,
  69                                                                      kSecAttrAccessible,     accessibility,
  70                                                                      kSecAttrAccessGroup,    kSOSInternalAccessGroup,
  71                                                                      kSecAttrLabel,          name,
  72                                                                      kSecAttrSynchronizable, sync,
  73                                                                      kSecUseTombstones,      kCFBooleanTrue,
  74                                                                      NULL);
  75
  76     CFReleaseNull(priv_key_attrs);
  77
  78     CFReleaseNull(key_size_num);
  79     OSStatus status = SecKeyGeneratePair(keygen_parameters, NULL, &full_key);
  80     CFReleaseNull(keygen_parameters);
  81
  82     if (status)
  83         secerror("status: %ld", (long)status);
  84     if (status != errSecSuccess && error != NULL && *error == NULL) {
  85         *error = CFErrorCreate(kCFAllocatorDefault, kCFErrorDomainOSStatus, status, NULL);
  86     }
  87
  88     return full_key;
  89 }
  90
  91 CF_RETURNS_RETAINED SecKeyRef GeneratePermanentFullECKey(int keySize, CFStringRef name, CFErrorRef* error) {
  92     return GeneratePermanentFullECKey_internal(keySize, name, kSecAttrAccessibleWhenUnlockedThisDeviceOnly, kCFBooleanFalse, error);
  93 }
  94
  95 static CF_RETURNS_RETAINED SecKeyRef GeneratePermanentFullECKeyForCloudIdentity(int keySize, CFStringRef name, CFErrorRef* error) {
  96     return GeneratePermanentFullECKey_internal(keySize, name, kSecAttrAccessibleWhenUnlocked, kCFBooleanTrue, error);
  97 }
  98
  99 static SecKeyRef sosKeyForLabel(CFStringRef label) {
 100     CFTypeRef queryResult = NULL;
 101     SecKeyRef retval = NULL;
 102     CFDictionaryRef query = CFDictionaryCreateForCFTypes(kCFAllocatorDefault,
 103         kSecMatchLimit,            kSecMatchLimitOne,
 104         kSecClass,                 kSecClassKey,
 105         kSecAttrKeyClass,          kSecAttrKeyClassPrivate,
 106         kSecAttrSynchronizable,    kSecAttrSynchronizableAny,
 107         kSecAttrAccessGroup,       kSOSInternalAccessGroup,
 108         kSecAttrLabel,              label,
 109         kSecReturnRef,             kCFBooleanTrue,
 110         NULL);
 111     OSStatus stat = SecItemCopyMatching(query, &queryResult);
 112     if(errSecSuccess == stat) {
 113         retval = (SecKeyRef) queryResult;
 114         secnotice("iCloudIdentity", "Got key for label (%@)", label);
 115     } else {
 116         secnotice("iCloudIdentity", "Failed query(%d) for %@", (int) stat, label);
 117     }
 118     CFReleaseNull(query);
 119     return retval;
 120 }
 121
 122 void SOSiCloudIdentityPrivateKeyForEach(void (^complete)(SecKeyRef privKey)) {
 123     CFTypeRef queryResult = NULL;
 124     CFArrayRef iCloudPrivKeys = NULL;
 125
 126     CFDictionaryRef query = CFDictionaryCreateForCFTypes(kCFAllocatorDefault,
 127         kSecMatchLimit,            kSecMatchLimitAll,
 128         kSecClass,                 kSecClassKey,
 129         kSecAttrKeyClass,          kSecAttrKeyClassPrivate,
 130         kSecAttrSynchronizable,    kSecAttrSynchronizableAny,
 131         kSecAttrAccessGroup,       kSOSInternalAccessGroup,
 132         kSecReturnAttributes,      kCFBooleanTrue,
 133         NULL);
 134
 135     if((errSecSuccess == SecItemCopyMatching(query, &queryResult)) && (iCloudPrivKeys = asArray(queryResult, NULL))) {
 136         secnotice("iCloudIdentity", "Screening %ld icloud private key candidates", (long)CFArrayGetCount(iCloudPrivKeys));
 137         CFReleaseNull(query);
 138     } else {
 139         secnotice("iCloudIdentity", "Can't get iCloud Identity private key candidates");
 140         CFReleaseNull(query);
 141         CFReleaseNull(queryResult);
 142         return;
 143     }
 144
 145     CFArrayForEach(iCloudPrivKeys, ^(const void *value) {
 146         CFDictionaryRef privKeyDict = (CFDictionaryRef) value;
 147         CFStringRef label = CFDictionaryGetValue(privKeyDict, kSecAttrLabel);
 148         if(!label) {
 149             return;
 150         }
 151         if(CFStringHasPrefix(label, CFSTR("Cloud Identity"))) {
 152             SecKeyRef privKey = sosKeyForLabel(label);
 153             if(privKey) {
 154                 complete(privKey);
 155                 CFReleaseNull(privKey);
 156             }
 157         }
 158     });
 159     CFReleaseNull(queryResult);
 160 }
 161
 162 bool SOSAccountHasCircle(SOSAccount* account, CFErrorRef* error) {
 163     SOSAccountTrustClassic *trust = account.trust;
 164     SOSCircleRef circle = trust.trustedCircle;
 165
 166     if (!circle)
 167         SOSCreateErrorWithFormat(kSOSErrorNoCircle, NULL, error, NULL, CFSTR("No trusted circle"));
 168
 169     return circle != NULL;
 170 }
 171
 172 bool SOSAccountHasFullPeerInfo(SOSAccount* account, CFErrorRef* error) {
 173     bool hasPeer = false;
 174     SOSAccountTrustClassic *trust = account.trust;
 175     SOSFullPeerInfoRef identity = trust.fullPeerInfo;
 176
 177     require(SOSAccountHasCircle(account, error), fail);
 178
 179     hasPeer = identity != NULL;
 180
 181     if (!hasPeer)
 182         SOSCreateErrorWithFormat(kSOSErrorPeerNotFound, NULL, error, NULL, CFSTR("No peer for circle"));
 183
 184 fail:
 185     return hasPeer;
 186 }
 187
 188 bool SOSAccountIsAccountIdentity(SOSAccount* account, SOSPeerInfoRef peer_info, CFErrorRef *error)
 189 {
 190     SOSFullPeerInfoRef identity = NULL;
 191
 192     SOSAccountTrustClassic *trust = account.trust;
 193     identity = trust.fullPeerInfo;
 194     return CFEqualSafe(peer_info, SOSFullPeerInfoGetPeerInfo(identity));
 195 }
 196
 197 bool SOSAccountFullPeerInfoVerify(SOSAccount* account, SecKeyRef privKey, CFErrorRef *error) {
 198     SOSFullPeerInfoRef identity = NULL;
 199
 200     SOSAccountTrustClassic *trust = account.trust;
 201     identity = trust.fullPeerInfo;
 202     if(!identity) return false;
 203     SecKeyRef pubKey = SecKeyCreatePublicFromPrivate(privKey);
 204     bool retval = SOSPeerInfoApplicationVerify(SOSFullPeerInfoGetPeerInfo(identity), pubKey, error);
 205     CFReleaseNull(pubKey);
 206     return retval;
 207 }
 208
 209 static bool UpdateKeyName(SecKeyRef key, SOSPeerInfoRef peer, CFErrorRef* error)
 210 {
 211     CFDictionaryRef query = CFDictionaryCreateForCFTypes(kCFAllocatorDefault,
 212                                                          kSecClass,             kSecClassKey,
 213                                                          kSecAttrSynchronizable,kCFBooleanTrue,
 214                                                          kSecUseTombstones,     kCFBooleanTrue,
 215                                                          kSecValueRef,          key,
 216                                                          NULL);
 217
 218     CFStringRef new_name = CFStringCreateWithFormat(kCFAllocatorDefault, NULL,
 219                                                     CFSTR("Cloud Identity - '%@'"), SOSPeerInfoGetPeerID(peer));
 220
 221     CFDictionaryRef change = CFDictionaryCreateForCFTypes(kCFAllocatorDefault,
 222                                                           kSecAttrLabel,        new_name,
 223                                                           NULL);
 224
 225     bool result = SecError(SecItemUpdate(query, change), error, CFSTR("Couldn't update name"));
 226
 227     CFReleaseNull(new_name);
 228     CFReleaseNull(query);
 229     CFReleaseNull(change);
 230     return result;
 231 }
 232
 233 SOSPeerInfoRef GenerateNewCloudIdentityPeerInfo(CFErrorRef *error) {
 234     SecKeyRef cloud_key = GeneratePermanentFullECKeyForCloudIdentity(256, kicloud_identity_name, error);
 235     SOSPeerInfoRef cloud_peer = NULL;
 236
 237     CFDictionaryRef gestalt = NULL;
 238
 239     require_action_quiet(cloud_key, fail, SecError(errSecAllocate, error, CFSTR("Can't generate keypair for icloud identity")));
 240
 241     gestalt = CFDictionaryCreateForCFTypes(kCFAllocatorDefault,
 242                                                            kPIUserDefinedDeviceNameKey, CFSTR("iCloud"),
 243                                                            NULL);
 244     require_action_quiet(gestalt, fail, SecError(errSecAllocate, error, CFSTR("Can't allocate gestalt")));
 245
 246     cloud_peer = SOSPeerInfoCreateCloudIdentity(kCFAllocatorDefault, gestalt, cloud_key, error);
 247
 248     require(cloud_peer, fail);
 249
 250     UpdateKeyName(cloud_key, cloud_peer, error);
 251
 252 fail:
 253     CFReleaseNull(gestalt);
 254     CFReleaseNull(cloud_key);
 255
 256     return cloud_peer;
 257 }
 258
 259
 260 bool SOSAccountUpdatePeerInfo(SOSAccount*  account, CFStringRef updateDescription, CFErrorRef *error, bool (^update)(SOSFullPeerInfoRef fpi, CFErrorRef *error)) {
 261
 262     if (!account.hasPeerInfo)
 263         return true;
 264
 265     bool result = update(account.fullPeerInfo, error);
 266
 267     if (result && SOSAccountHasCircle(account, NULL)) {
 268         return [account.trust modifyCircle:account.circle_transport err:error action:^(SOSCircleRef circle_to_change) {
 269             secnotice("circleChange", "Calling SOSCircleUpdatePeerInfo for %@", updateDescription);
 270             return SOSCircleUpdatePeerInfo(circle_to_change, account.peerInfo);
 271         }];
 272     }
 273
 274     return result;
 275 }
 276
 277
 278 bool SOSAccountUpdatePeerInfoAndPush(SOSAccount* account, CFStringRef updateDescription, CFErrorRef *error,
 279                                             bool (^update)(SOSPeerInfoRef pi, CFErrorRef *error)) {
 280     return SOSAccountUpdatePeerInfo(account, updateDescription, error, ^bool(SOSFullPeerInfoRef fpi, CFErrorRef *localError) {
 281         return SOSFullPeerInfoUpdate(fpi, localError, ^SOSPeerInfoRef(SOSPeerInfoRef pi, SecKeyRef peerPriv, CFErrorRef *localError) {
 282             SOSPeerInfoRef newPI = SOSPeerInfoCreateCopy(kCFAllocatorDefault, pi, localError);
 283             if(update(newPI, error)) {
 284                 if(peerPriv && SOSPeerInfoSign(peerPriv, newPI, localError)) {
 285                     secnotice("circleOp", "Signed Peerinfo to update");
 286                     return newPI;
 287                 }
 288             }
 289             secnotice("circleOp", "Failed updating PeerInfo");
 290             CFReleaseNull(newPI);
 291             return NULL;
 292         });
 293     });
 294 }