keychain/ckks/CKKSLocalSynchronizeOperation.m

   1 /*
   2  * Copyright (c) 2016 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import "keychain/ckks/CKKSKeychainView.h"
  25 #import "keychain/ckks/CKKSGroupOperation.h"
  26 #import "keychain/ckks/CKKSLocalSynchronizeOperation.h"
  27 #import "keychain/ckks/CKKSFetchAllRecordZoneChangesOperation.h"
  28 #import "keychain/ckks/CKKSScanLocalItemsOperation.h"
  29 #import "keychain/ckks/CKKSMirrorEntry.h"
  30 #import "keychain/ckks/CKKSIncomingQueueEntry.h"
  31 #import "keychain/ckks/CloudKitCategories.h"
  32 #import "keychain/categories/NSError+UsefulConstructors.h"
  33 #import "keychain/ot/ObjCImprovements.h"
  34
  35 #if OCTAGON
  36
  37 @interface CKKSLocalSynchronizeOperation ()
  38 @property int32_t restartCount;
  39 @end
  40
  41 @implementation CKKSLocalSynchronizeOperation
  42
  43 - (instancetype)init {
  44     return nil;
  45 }
  46 - (instancetype)initWithCKKSKeychainView:(CKKSKeychainView*)ckks
  47 {
  48     if(self = [super init]) {
  49         _ckks = ckks;
  50         _restartCount = 0;
  51
  52         [self addNullableDependency:ckks.holdLocalSynchronizeOperation];
  53     }
  54     return self;
  55 }
  56
  57 - (void)groupStart {
  58     WEAKIFY(self);
  59
  60     /*
  61      * A local synchronize is very similar to a CloudKit synchronize, but it won't cause any (non-essential)
  62      * CloudKit operations to occur.
  63      *
  64      *  1. Finish processing the outgoing queue. You can't be in-sync with cloudkit if you have an update that hasn't propagated.
  65      *  2. Process anything in the incoming queue as normal.
  66      *          (Note that this might require the keybag to be unlocked.)
  67      *
  68      *  3. Take every item in the CKMirror, and check for its existence in the local keychain. If not present, add to the incoming queue.
  69      *  4. Process the incoming queue again.
  70      *  5. Scan the local keychain for items which exist locally but are not in CloudKit. Upload them.
  71      *  6. If there are any such items in 4, restart the sync.
  72      */
  73
  74     CKKSKeychainView* ckks = self.ckks;
  75
  76     // Synchronous, on some thread. Get back on the CKKS queue for SQL thread-safety.
  77     [ckks dispatchSyncWithSQLTransaction:^CKKSDatabaseTransactionResult{
  78         if(self.cancelled) {
  79             ckksnotice("ckksresync", ckks, "CKKSSynchronizeOperation cancelled, quitting");
  80             return CKKSDatabaseTransactionRollback;
  81         }
  82
  83         //ckks.lastLocalSynchronizeOperation = self;
  84
  85         uint32_t steps = 5;
  86
  87         ckksinfo("ckksresync", ckks, "Beginning local resynchronize (attempt %u)", self.restartCount);
  88
  89         CKOperationGroup* operationGroup = [CKOperationGroup CKKSGroupWithName:@"ckks-resync-local"];
  90
  91         // Step 1
  92         CKKSOutgoingQueueOperation* outgoingOp = [ckks processOutgoingQueue: operationGroup];
  93         outgoingOp.name = [NSString stringWithFormat: @"resync-step%u-outgoing", self.restartCount * steps + 1];
  94         [self dependOnBeforeGroupFinished:outgoingOp];
  95
  96         // Step 2
  97         CKKSIncomingQueueOperation* incomingOp = [[CKKSIncomingQueueOperation alloc] initWithDependencies:ckks.operationDependencies
  98                                                                                                      ckks:ckks
  99                                                                                                 intending:SecCKKSZoneKeyStateReady
 100                                                                                                errorState:SecCKKSZoneKeyStateUnhealthy
 101                                                                                      errorOnClassAFailure:true
 102                                                                                 handleMismatchedViewItems:false];
 103
 104         incomingOp.name = [NSString stringWithFormat: @"resync-step%u-incoming", self.restartCount * steps + 2];
 105         [incomingOp addSuccessDependency:outgoingOp];
 106         [self runBeforeGroupFinished:incomingOp];
 107
 108         // Step 3:
 109         CKKSResultOperation* reloadOp = [[CKKSReloadAllItemsOperation alloc] initWithCKKSKeychainView:ckks];
 110         reloadOp.name = [NSString stringWithFormat: @"resync-step%u-reload", self.restartCount * steps + 3];
 111         [self runBeforeGroupFinished:reloadOp];
 112
 113         // Step 4
 114         CKKSIncomingQueueOperation* incomingResyncOp = [[CKKSIncomingQueueOperation alloc] initWithDependencies:ckks.operationDependencies
 115                                                                                                            ckks:ckks
 116                                                                                                       intending:SecCKKSZoneKeyStateReady
 117                                                                                                      errorState:SecCKKSZoneKeyStateUnhealthy
 118                                                                                            errorOnClassAFailure:true
 119                                                                                       handleMismatchedViewItems:false];
 120
 121         incomingResyncOp.name = [NSString stringWithFormat: @"resync-step%u-incoming-again", self.restartCount * steps + 4];
 122         [incomingResyncOp addSuccessDependency: reloadOp];
 123         [self runBeforeGroupFinished:incomingResyncOp];
 124
 125         // Step 5
 126         CKKSScanLocalItemsOperation* scan = [[CKKSScanLocalItemsOperation alloc] initWithDependencies:ckks.operationDependencies
 127                                                                                                  ckks:ckks
 128                                                                                             intending:SecCKKSZoneKeyStateReady
 129                                                                                            errorState:SecCKKSZoneKeyStateError
 130                                                                                      ckoperationGroup:operationGroup];
 131         scan.name = [NSString stringWithFormat: @"resync-step%u-scan", self.restartCount * steps + 5];
 132         [scan addSuccessDependency: incomingResyncOp];
 133         [self runBeforeGroupFinished: scan];
 134
 135         // Step 6
 136         CKKSResultOperation* restart = [[CKKSResultOperation alloc] init];
 137         restart.name = [NSString stringWithFormat: @"resync-step%u-consider-restart", self.restartCount * steps + 6];
 138         [restart addExecutionBlock:^{
 139             STRONGIFY(self);
 140             if(!self) {
 141                 ckkserror("ckksresync", ckks, "received callback for released object");
 142                 return;
 143             }
 144
 145             NSError* error = nil;
 146             NSArray<NSString*>* iqes = [CKKSIncomingQueueEntry allUUIDs:ckks.zoneID error:&error];
 147             if(error) {
 148                 ckkserror("ckksresync", ckks, "Couldn't fetch IQEs: %@", error);
 149             }
 150
 151             if(scan.recordsFound > 0 || iqes.count > 0) {
 152                 if(self.restartCount >= 3) {
 153                     // we've restarted too many times. Fail and stop.
 154                     ckkserror("ckksresync", ckks, "restarted synchronization too often; Failing");
 155                     self.error = [NSError errorWithDomain:@"securityd"
 156                                                            code:2
 157                                                        userInfo:@{NSLocalizedDescriptionKey: @"resynchronization restarted too many times; churn in database?"}];
 158                 } else {
 159                     // restart the sync operation.
 160                     self.restartCount += 1;
 161                     ckkserror("ckksresync", ckks, "restarting synchronization operation due to new local items");
 162                     [self groupStart];
 163                 }
 164             }
 165         }];
 166
 167         [restart addSuccessDependency: scan];
 168         [self runBeforeGroupFinished: restart];
 169
 170         return CKKSDatabaseTransactionCommit;
 171     }];
 172 }
 173
 174 @end;
 175
 176 #pragma mark - CKKSReloadAllItemsOperation
 177
 178 @implementation CKKSReloadAllItemsOperation
 179
 180 - (instancetype)init {
 181     return nil;
 182 }
 183 - (instancetype)initWithCKKSKeychainView:(CKKSKeychainView*)ckks
 184 {
 185     if(self = [super init]) {
 186         _ckks = ckks;
 187     }
 188     return self;
 189 }
 190
 191 - (void)main {
 192     CKKSKeychainView* strongCKKS = self.ckks;
 193
 194     [strongCKKS dispatchSyncWithSQLTransaction:^CKKSDatabaseTransactionResult{
 195        NSError* error = nil;
 196        NSArray<CKKSMirrorEntry*>* mirrorItems = [CKKSMirrorEntry all:strongCKKS.zoneID error:&error];
 197
 198        if(error) {
 199            ckkserror("ckksresync", strongCKKS, "Couldn't fetch mirror items: %@", error);
 200            self.error = error;
 201            return CKKSDatabaseTransactionRollback;
 202        }
 203
 204        // Reload all entries back into the local keychain
 205        // We _could_ scan for entries, but that'd be expensive
 206        // In 36044942, we used to store only the CKRecord system fields in the ckrecord. To work around this, make a whole new CKRecord from the item.
 207        for(CKKSMirrorEntry* ckme in mirrorItems) {
 208            CKRecord* ckmeRecord = [ckme.item CKRecordWithZoneID:strongCKKS.zoneID];
 209            if(!ckmeRecord) {
 210                ckkserror("ckksresync", strongCKKS, "Couldn't make CKRecord for item: %@", ckme);
 211                continue;
 212            }
 213
 214            [strongCKKS _onqueueCKRecordChanged:ckmeRecord resync:true];
 215        }
 216
 217        return CKKSDatabaseTransactionCommit;
 218     }];
 219 }
 220 @end
 221 #endif
 222