OSX/sec/securityd/SecDbQuery.c

   1
   2 /*
   3  * Copyright (c) 2006-2014 Apple Inc. All Rights Reserved.
   4  *
   5  * @APPLE_LICENSE_HEADER_START@
   6  *
   7  * This file contains Original Code and/or Modifications of Original Code
   8  * as defined in and that are subject to the Apple Public Source License
   9  * Version 2.0 (the 'License'). You may not use this file except in
  10  * compliance with the License. Please obtain a copy of the License at
  11  * http://www.opensource.apple.com/apsl/ and read it before using this
  12  * file.
  13  *
  14  * The Original Code and all software distributed under the License are
  15  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  16  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  17  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  19  * Please see the License for the specific language governing rights and
  20  * limitations under the License.
  21  *
  22  * @APPLE_LICENSE_HEADER_END@
  23  */
  24
  25 /*
  26  *  SecDbQuery.c - CoreFoundation-based constants and functions for
  27     access to Security items (certificates, keys, identities, and
  28     passwords.)
  29  */
  30
  31 #include <securityd/SecDbQuery.h>
  32
  33 #include <securityd/SecItemDb.h>
  34 #include <securityd/SecItemSchema.h>
  35 #include <securityd/SecItemServer.h>
  36 #include <securityd/spi.h>
  37 #include <Security/SecBasePriv.h>
  38 #include <Security/SecCertificateInternal.h>
  39 #include <Security/SecItem.h>
  40 #include <Security/SecItemPriv.h>
  41 #include <Security/SecItemInternal.h>
  42 #include <Security/SecAccessControl.h>
  43 #include <Security/SecAccessControlPriv.h>
  44 #include <Security/SecPolicyPriv.h>
  45 #include <Security/SecuritydXPC.h>
  46 #include <CommonCrypto/CommonDigest.h>
  47 #include <CommonCrypto/CommonDigestSPI.h>
  48
  49 #include <pthread/pthread.h>
  50
  51 #if USE_KEYSTORE
  52 #include <LocalAuthentication/LAPublicDefines.h>
  53 #include <coreauthd_spi.h>
  54 #include <libaks_acl_cf_keys.h>
  55 #endif
  56
  57 /* Upper limit for number of keys in a QUERY dictionary. */
  58 #define QUERY_KEY_LIMIT_BASE    (128)
  59 #ifdef NO_SERVER
  60 #define QUERY_KEY_LIMIT  (31 + QUERY_KEY_LIMIT_BASE)
  61 #else
  62 #define QUERY_KEY_LIMIT  QUERY_KEY_LIMIT_BASE
  63 #endif
  64
  65
  66 static const uint8_t systemKeychainUUID[] = "\xF6\x23\xAE\x5C\xCC\x81\x4C\xAC\x8A\xD4\xF0\x01\x3F\x31\x35\x11";
  67
  68 CFDataRef
  69 SecMUSRCopySystemKeychainUUID(void)
  70 {
  71     return CFDataCreateWithBytesNoCopy(NULL, (const UInt8 *)systemKeychainUUID, 16, kCFAllocatorNull);
  72 }
  73
  74 CFDataRef
  75 SecMUSRGetSystemKeychainUUID(void)
  76 {
  77     static dispatch_once_t onceToken;
  78     static CFDataRef systemKeychainData = NULL;
  79     dispatch_once(&onceToken, ^{
  80         systemKeychainData = CFDataCreateWithBytesNoCopy(NULL, (const UInt8 *)systemKeychainUUID, 16, kCFAllocatorNull);
  81     });
  82     return systemKeychainData;
  83 }
  84
  85 CFDataRef
  86 SecMUSRGetSingleUserKeychainUUID(void)
  87 {
  88     static dispatch_once_t onceToken;
  89     static CFDataRef singleUser = NULL;
  90     dispatch_once(&onceToken, ^{
  91         singleUser = CFDataCreateWithBytesNoCopy(NULL, NULL, 0, kCFAllocatorNull);
  92     });
  93     return singleUser;
  94 }
  95
  96 bool
  97 SecMUSRIsSingleUserView(CFDataRef musr)
  98 {
  99     return CFEqual(musr, SecMUSRGetSingleUserKeychainUUID());
 100 }
 101
 102 static const uint8_t allKeychainViewsUUID[16] = "\xC8\x60\x07\xEC\x89\x62\x4D\xAF\x85\x65\x1F\xE6\x0F\x50\x5D\xB7";
 103
 104 CFDataRef
 105 SecMUSRGetAllViews(void)
 106 {
 107     static dispatch_once_t onceToken;
 108     static CFDataRef allKeychainViewsData = NULL;
 109     dispatch_once(&onceToken, ^{
 110         allKeychainViewsData = CFDataCreateWithBytesNoCopy(NULL, (const UInt8 *)allKeychainViewsUUID, 16, kCFAllocatorNull);
 111     });
 112     return allKeychainViewsData;
 113 }
 114
 115 bool
 116 SecMUSRIsViewAllViews(CFDataRef musr)
 117 {
 118     return CFEqual(musr, SecMUSRGetAllViews());
 119 }
 120
 121 #if TARGET_OS_IPHONE
 122
 123 CFDataRef
 124 SecMUSRCreateActiveUserUUID(uid_t uid)
 125 {
 126     uint8_t uuid[16] = "\xA7\x5A\x3A\x35\xA5\x57\x4B\x10\xBE\x2E\x83\x94\x7E\x4A\x34\x72";
 127     uint32_t num = htonl(uid);
 128     memcpy(&uuid[12], &num, sizeof(num));
 129     return CFDataCreate(NULL, uuid, sizeof(uuid));
 130 }
 131
 132 CFDataRef
 133 SecMUSRCreateSyncBubbleUserUUID(uid_t uid)
 134 {
 135     uint8_t uuid[16] = "\x82\x1A\xAB\x9F\xA3\xC8\x4E\x11\xAA\x90\x4C\xE8\x9E\xA6\xD7\xEC";
 136     uint32_t num = htonl(uid);
 137     memcpy(&uuid[12], &num, sizeof(num));
 138     return CFDataCreate(NULL, uuid, sizeof(uuid));
 139 }
 140
 141 static const uint8_t bothUserAndSystemUUID[12] = "\x36\xC4\xBE\x2E\x99\x0A\x46\x9A\xAC\x89\x09\xA4";
 142
 143
 144 CFDataRef
 145 SecMUSRCreateBothUserAndSystemUUID(uid_t uid)
 146 {
 147     uint8_t uuid[16];
 148     memcpy(uuid, bothUserAndSystemUUID, 12);
 149     uint32_t num = htonl(uid);
 150     memcpy(&uuid[12], &num, sizeof(num));
 151     return CFDataCreate(NULL, uuid, sizeof(uuid));
 152 }
 153
 154 bool
 155 SecMUSRGetBothUserAndSystemUUID(CFDataRef musr, uid_t *uid)
 156 {
 157     if (CFDataGetLength(musr) != 16)
 158         return false;
 159     const uint8_t *uuid = CFDataGetBytePtr(musr);
 160     if (memcmp(uuid, bothUserAndSystemUUID, 12) != 0)
 161         return false;
 162     if (uid) {
 163         uint32_t num;
 164         memcpy(&num, &uuid[12], sizeof(num));
 165         *uid = htonl(num);
 166     }
 167     return true;
 168 }
 169
 170 #endif
 171
 172 /* Inline accessors to attr and match values in a query. */
 173 CFIndex query_attr_count(const Query *q)
 174 {
 175     return q->q_attr_end;
 176 }
 177
 178 Pair query_attr_at(const Query *q, CFIndex ix)
 179 {
 180     return q->q_pairs[ix];
 181 }
 182
 183 CFIndex query_match_count(const Query *q)
 184 {
 185     return q->q_match_end - q->q_match_begin;
 186 }
 187
 188 __unused static inline Pair query_match_at(const Query *q, CFIndex ix)
 189 {
 190     return q->q_pairs[q->q_match_begin + ix];
 191 }
 192
 193 /* Private routines used to parse a query. */
 194
 195 const SecDbClass *kc_class_with_name(CFStringRef name) {
 196     if (isString(name)) {
 197         if (CFEqual(name, kSecClassGenericPassword))
 198             return genp_class();
 199         else if (CFEqual(name, kSecClassInternetPassword))
 200             return inet_class();
 201         else if (CFEqual(name, kSecClassCertificate))
 202             return cert_class();
 203         else if (CFEqual(name, kSecClassKey))
 204             return keys_class();
 205         else if (CFEqual(name, kSecClassIdentity))
 206             return identity_class();
 207     }
 208     return NULL;
 209 }
 210
 211 static void query_set_access_control(Query *q, SecAccessControlRef access_control) {
 212     if (q->q_access_control) {
 213         if (!CFEqual(q->q_access_control, access_control)) {
 214             SecError(errSecItemIllegalQuery, &q->q_error, CFSTR("conflicting kSecAccess and kSecAccessControl attributes"));
 215         }
 216     } else {
 217         /* Store access control virtual attribute. */
 218         q->q_access_control = (SecAccessControlRef)CFRetain(access_control);
 219
 220         /* Also set legacy access attribute. */
 221         CFTypeRef protection = SecAccessControlGetProtection(q->q_access_control);
 222         if (!protection) {
 223             SecError(errSecParam, &q->q_error, CFSTR("kSecAccessControl missing protection"));
 224             return;
 225         }
 226         CFDictionarySetValue(q->q_item, kSecAttrAccessible, protection);
 227     }
 228 }
 229
 230 /* AUDIT[securityd](done):
 231  key (ok) is a caller provided, string or number of length 4.
 232  value (ok) is a caller provided, non NULL CFTypeRef.
 233  */
 234 void query_add_attribute_with_desc(const SecDbAttr *desc, const void *value, Query *q)
 235 {
 236     if (CFEqual(desc->name, kSecAttrSynchronizable)) {
 237         q->q_sync = true;
 238         if (CFEqual(value, kSecAttrSynchronizableAny))
 239             return; /* skip the attribute so it isn't part of the search */
 240     }
 241
 242     CFTypeRef attr = NULL;
 243     switch (desc->kind) {
 244         case kSecDbDataAttr:
 245             attr = copyData(value);
 246             break;
 247         case kSecDbBlobAttr:
 248         case kSecDbAccessControlAttr:
 249             attr = copyBlob(value);
 250             break;
 251         case kSecDbDateAttr:
 252         case kSecDbCreationDateAttr:
 253         case kSecDbModificationDateAttr:
 254             attr = copyDate(value);
 255             break;
 256         case kSecDbNumberAttr:
 257         case kSecDbSyncAttr:
 258         case kSecDbTombAttr:
 259             attr = copyNumber(value);
 260             break;
 261         case kSecDbAccessAttr:
 262         case kSecDbStringAttr:
 263             attr = copyString(value);
 264             break;
 265         case kSecDbSHA1Attr:
 266             attr = copySHA1(value);
 267             break;
 268         case kSecDbRowIdAttr:
 269         case kSecDbPrimaryKeyAttr:
 270         case kSecDbEncryptedDataAttr:
 271         case kSecDbUTombAttr:
 272             break;
 273         case kSecDbUUIDAttr:
 274             attr = copyUUID(value);
 275             break;
 276     }
 277
 278     if (!attr) {
 279         SecError(errSecItemInvalidValue, &q->q_error, CFSTR("attribute %@: value: %@ failed to convert"), desc->name, value);
 280         return;
 281     }
 282
 283     /* Store plaintext attr data in q_item unless it's a kSecDbSHA1Attr. */
 284     if (q->q_item && desc->kind != kSecDbSHA1Attr) {
 285         CFDictionarySetValue(q->q_item, desc->name, attr);
 286     }
 287
 288     /* Convert attr to (sha1) digest if requested. */
 289     if (desc->flags & kSecDbSHA1ValueInFlag) {
 290         CFDataRef data = copyData(attr);
 291         CFRelease(attr);
 292         if (!data) {
 293             SecError(errSecInternal, &q->q_error, CFSTR("failed to get attribute %@ data"), desc->name);
 294             return;
 295         }
 296
 297         CFMutableDataRef digest = CFDataCreateMutable(0, CC_SHA1_DIGEST_LENGTH);
 298         CFDataSetLength(digest, CC_SHA1_DIGEST_LENGTH);
 299         /* 64 bits cast: worst case is we generate the wrong hash */
 300         assert((unsigned long)CFDataGetLength(data)<UINT32_MAX); /* Debug check. Correct as long as CFIndex is long */
 301         CCDigest(kCCDigestSHA1, CFDataGetBytePtr(data), (CC_LONG)CFDataGetLength(data),
 302                  CFDataGetMutableBytePtr(digest));
 303         CFRelease(data);
 304         attr = digest;
 305     }
 306
 307     if (desc->kind != kSecDbAccessControlAttr) {
 308         /* Record the new attr key, value in q_pairs. */
 309         if (q->q_attr_end + 1 < q->q_pairs_count) {
 310             q->q_pairs[q->q_attr_end].key = desc->name;
 311             q->q_pairs[q->q_attr_end++].value = attr;
 312         } else {
 313             SecError(errSecInternal, &q->q_error, CFSTR("q_pairs overflow"));
 314             CFReleaseSafe(attr);
 315         }
 316     } else {
 317         CFReleaseSafe(attr);
 318     }
 319 }
 320
 321 void query_add_attribute(const void *key, const void *value, Query *q)
 322 {
 323     if (CFEqual(key, kSecAttrDeriveSyncIDFromItemAttributes)) {
 324         q->q_uuid_from_primary_key = CFBooleanGetValue(value);
 325         return; /* skip the attribute so it isn't part of the search */
 326     }
 327
 328     const SecDbAttr *desc = SecDbAttrWithKey(q->q_class, key, &q->q_error);
 329     if (desc) {
 330         query_add_attribute_with_desc(desc, value, q);
 331
 332         if (desc->kind == kSecDbAccessControlAttr) {
 333             CFDataRef attr = (CFDataRef)CFDictionaryGetValue(q->q_item, desc->name);
 334             if (attr) {
 335                 SecAccessControlRef access_control = SecAccessControlCreateFromData(kCFAllocatorDefault, attr, &q->q_error);
 336                 if (access_control) {
 337                     query_set_access_control(q, access_control);
 338                     CFRelease(access_control);
 339                 }
 340             }
 341         }
 342
 343         if (desc->kind == kSecDbAccessAttr) {
 344             SecAccessControlRef access_control = SecAccessControlCreate(kCFAllocatorDefault, &q->q_error);
 345             if (access_control) {
 346                 CFStringRef attr = (CFStringRef)CFDictionaryGetValue(q->q_item, desc->name);
 347                 if (attr) {
 348                     if (SecAccessControlSetProtection(access_control, attr, &q->q_error))
 349                         query_set_access_control(q, access_control);
 350                 }
 351                 CFRelease(access_control);
 352             }
 353         }
 354     }
 355 }
 356
 357 void query_add_or_attribute(const void *key, const void *value, Query *q)
 358 {
 359     const SecDbAttr *desc = SecDbAttrWithKey(q->q_class, key, &q->q_error);
 360     if (desc) {
 361         CFTypeRef oldValue = CFDictionaryGetValue(q->q_item, desc->name);
 362         CFMutableArrayRef array = NULL;
 363         if (oldValue) {
 364             if (isArray(oldValue)) {
 365                 array = (CFMutableArrayRef)CFRetain(oldValue);
 366             } else {
 367                 array = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
 368                 CFArrayAppendValue(array, oldValue);
 369             }
 370             CFDictionaryRemoveValue(q->q_item, desc->name);
 371         } else {
 372             array = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
 373         }
 374         if (array) {
 375             query_add_attribute_with_desc(desc, value, q);
 376             CFTypeRef newValue = CFDictionaryGetValue(q->q_item, desc->name);
 377             CFArrayAppendValue(array, newValue);
 378             CFDictionarySetValue(q->q_item, desc->name, array);
 379             CFRelease(array);
 380         }
 381     }
 382 }
 383
 384 void query_add_not_attribute(const void *key, const void *value, Query *q)
 385 {
 386     const SecDbAttr *desc = SecDbAttrWithKey(q->q_class, key, &q->q_error);
 387     if (desc) {
 388         CFTypeRef oldValue = CFDictionaryGetValue(q->q_item, desc->name);
 389         CFMutableArrayRef array = NULL;
 390         if (oldValue) {
 391             if (isArray(oldValue)) {
 392                 array = (CFMutableArrayRef)CFRetain(oldValue);
 393             } else {
 394                 // This should never run, as we shouldn't be turning a attr = value into a attr not in (value, value2)
 395                 secerror("negating %@ = %@ in query", desc->name, oldValue);
 396                 array = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
 397                 CFArrayAppendValue(array, kCFNull);
 398                 CFArrayAppendValue(array, oldValue);
 399             }
 400             CFDictionaryRemoveValue(q->q_item, desc->name);
 401         } else {
 402             array = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
 403             CFArrayAppendValue(array, kCFNull);
 404         }
 405         if (array) {
 406             query_add_attribute_with_desc(desc, value, q);
 407             CFTypeRef newValue = CFDictionaryGetValue(q->q_item, desc->name);
 408             CFArrayAppendValue(array, newValue);
 409             CFDictionarySetValue(q->q_item, desc->name, array);
 410             CFRelease(array);
 411         }
 412     }
 413 }
 414
 415
 416 /* AUDIT[securityd](done):
 417  key (ok) is a caller provided, string starting with 'm'.
 418  value (ok) is a caller provided, non NULL CFTypeRef.
 419  */
 420 static void query_add_match(const void *key, const void *value, Query *q)
 421 {
 422     /* Record the match key, value in q_pairs. */
 423     --(q->q_match_begin);
 424     q->q_pairs[q->q_match_begin].key = key;
 425     q->q_pairs[q->q_match_begin].value = value;
 426
 427     if (CFEqual(kSecMatchLimit, key)) {
 428         /* Figure out what the value for kSecMatchLimit is if specified. */
 429         if (CFGetTypeID(value) == CFNumberGetTypeID()) {
 430             if (!CFNumberGetValue(value, kCFNumberCFIndexType, &q->q_limit))
 431                 SecError(errSecItemInvalidValue, &q->q_error, CFSTR("failed to convert match limit %@ to CFIndex"), value);
 432         } else if (CFEqual(kSecMatchLimitAll, value)) {
 433             q->q_limit = kSecMatchUnlimited;
 434         } else if (CFEqual(kSecMatchLimitOne, value)) {
 435             q->q_limit = 1;
 436         } else {
 437             SecError(errSecItemInvalidValue, &q->q_error, CFSTR("unsupported match limit %@"), value);
 438         }
 439     } else if (CFEqual(kSecMatchIssuers, key) &&
 440                (CFGetTypeID(value) == CFArrayGetTypeID()))
 441     {
 442         CFMutableArrayRef canonical_issuers = CFArrayCreateMutable(kCFAllocatorDefault, 0, &kCFTypeArrayCallBacks);
 443         if (canonical_issuers) {
 444             CFIndex i, count = CFArrayGetCount(value);
 445             for (i = 0; i < count; i++) {
 446                 CFTypeRef issuer_data = CFArrayGetValueAtIndex(value, i);
 447                 CFDataRef issuer_canonical = NULL;
 448                 if (CFDataGetTypeID() == CFGetTypeID(issuer_data))
 449                     issuer_canonical = SecDistinguishedNameCopyNormalizedContent((CFDataRef)issuer_data);
 450                 if (issuer_canonical) {
 451                     CFArrayAppendValue(canonical_issuers, issuer_canonical);
 452                     CFRelease(issuer_canonical);
 453                 }
 454             }
 455
 456             if (CFArrayGetCount(canonical_issuers) > 0) {
 457                 q->q_match_issuer = canonical_issuers;
 458             } else
 459                 CFRelease(canonical_issuers);
 460         }
 461     } else if (CFEqual(kSecMatchPolicy, key)) {
 462         if (CFGetTypeID(value) != CFArrayGetTypeID()) {
 463             SecError(errSecParam, &q->q_error, CFSTR("unsupported value for kSecMatchPolicy attribute"));
 464             return;
 465         }
 466         xpc_object_t policiesArrayXPC = _CFXPCCreateXPCObjectFromCFObject(value);
 467         if (!policiesArrayXPC) {
 468             SecError(errSecParam, &q->q_error, CFSTR("unsupported kSecMatchPolicy object in query"));
 469             return;
 470         }
 471
 472         CFArrayRef policiesArray = SecPolicyXPCArrayCopyArray(policiesArrayXPC, &q->q_error);
 473         xpc_release(policiesArrayXPC);
 474         if (!policiesArray)
 475             return;
 476
 477         if (CFArrayGetCount(policiesArray) != 1 || CFGetTypeID(CFArrayGetValueAtIndex(policiesArray, 0)) != SecPolicyGetTypeID()) {
 478             CFRelease(policiesArray);
 479             SecError(errSecParam, &q->q_error, CFSTR("unsupported array of policies"));
 480             return;
 481         }
 482
 483         query_set_policy(q, (SecPolicyRef)CFArrayGetValueAtIndex(policiesArray, 0));
 484         CFRelease(policiesArray);
 485     } else if (CFEqual(kSecMatchValidOnDate, key)) {
 486         if (CFGetTypeID(value) == CFNullGetTypeID()) {
 487             CFDateRef date = CFDateCreate(kCFAllocatorDefault, CFAbsoluteTimeGetCurrent());
 488             query_set_valid_on_date(q, date);
 489             CFRelease(date);
 490         } else if (CFGetTypeID(value) == CFDateGetTypeID()) {
 491             query_set_valid_on_date(q, value);
 492         } else {
 493             SecError(errSecParam, &q->q_error, CFSTR("unsupported value for kSecMatchValidOnDate attribute"));
 494             return;
 495         }
 496     } else if (CFEqual(kSecMatchTrustedOnly, key)) {
 497         if ((CFGetTypeID(value) == CFBooleanGetTypeID())) {
 498             query_set_trusted_only(q, value);
 499         } else {
 500             SecError(errSecParam, &q->q_error, CFSTR("unsupported value for kSecMatchTrustedOnly attribute"));
 501             return;
 502         }
 503     }
 504 }
 505
 506 static bool query_set_class(Query *q, CFStringRef c_name, CFErrorRef *error) {
 507     const SecDbClass *value;
 508     if (c_name && CFGetTypeID(c_name) == CFStringGetTypeID() &&
 509         (value = kc_class_with_name(c_name)) &&
 510         (q->q_class == 0 || q->q_class == value)) {
 511         q->q_class = value;
 512         return true;
 513     }
 514
 515     if (error && !*error)
 516         SecError((c_name ? errSecNoSuchClass : errSecItemClassMissing), error, CFSTR("can find class named: %@"), c_name);
 517
 518
 519     return false;
 520 }
 521
 522 static const SecDbClass *query_get_class(CFDictionaryRef query, CFErrorRef *error) {
 523     CFStringRef c_name = NULL;
 524     const void *value = CFDictionaryGetValue(query, kSecClass);
 525     if (isString(value)) {
 526         c_name = value;
 527     } else {
 528         value = CFDictionaryGetValue(query, kSecValuePersistentRef);
 529         if (isData(value)) {
 530             CFDataRef pref = value;
 531             _SecItemParsePersistentRef(pref, &c_name, NULL, NULL);
 532         }
 533     }
 534
 535     if (c_name && (value = kc_class_with_name(c_name))) {
 536         return value;
 537     } else {
 538         if (c_name)
 539             SecError(errSecNoSuchClass, error, CFSTR("can't find class named: %@"), c_name);
 540         else
 541             SecError(errSecItemClassMissing, error, CFSTR("query missing class name"));
 542         return NULL;
 543     }
 544 }
 545
 546 /* AUDIT[securityd](done):
 547  key (ok) is a caller provided, string starting with 'c'.
 548  value (ok) is a caller provided, non NULL CFTypeRef.
 549  */
 550 static void query_add_class(const void *key, const void *value, Query *q)
 551 {
 552     if (CFEqual(key, kSecClass)) {
 553         query_set_class(q, value, &q->q_error);
 554     } else {
 555         SecError(errSecItemInvalidKey, &q->q_error, CFSTR("add_class: key %@ is not %@"), key, kSecClass);
 556     }
 557 }
 558
 559 /* AUDIT[securityd](done):
 560  key (ok) is a caller provided, string starting with 'r'.
 561  value (ok) is a caller provided, non NULL CFTypeRef.
 562  */
 563 static void query_add_return(const void *key, const void *value, Query *q)
 564 {
 565     ReturnTypeMask mask;
 566     if (CFGetTypeID(value) != CFBooleanGetTypeID()) {
 567         SecError(errSecItemInvalidValue, &q->q_error, CFSTR("add_return: value %@ is not CFBoolean"), value);
 568         return;
 569     }
 570
 571     int set_it = CFEqual(value, kCFBooleanTrue);
 572
 573     if (CFEqual(key, kSecReturnData))
 574         mask = kSecReturnDataMask;
 575     else if (CFEqual(key, kSecReturnAttributes))
 576         mask = kSecReturnAttributesMask;
 577     else if (CFEqual(key, kSecReturnRef))
 578         mask = kSecReturnRefMask;
 579     else if (CFEqual(key, kSecReturnPersistentRef))
 580         mask = kSecReturnPersistentRefMask;
 581     else {
 582         SecError(errSecItemInvalidKey, &q->q_error, CFSTR("add_return: unknown key %@"), key);
 583         return;
 584     }
 585
 586     if ((q->q_return_type & mask) && !set_it) {
 587         /* Clear out this bit (it's set so xor with the mask will clear it). */
 588         q->q_return_type ^= mask;
 589     } else if (!(q->q_return_type & mask) && set_it) {
 590         /* Set this bit. */
 591         q->q_return_type |= mask;
 592     }
 593 }
 594
 595 /* AUDIT[securityd](done):
 596  key (ok) is a caller provided, string starting with 'u'.
 597  value (ok since q_use_item_list is unused) is a caller provided, non
 598  NULL CFTypeRef.
 599  */
 600 static void query_add_use(const void *key, const void *value, Query *q)
 601 {
 602     // Gotta use a string literal because we just outlawed this symbol on iOS
 603     if (CFEqual(key, CFSTR("u_ItemList"))) {
 604         /* TODO: Add sanity checking when we start using this. */
 605         q->q_use_item_list = value;
 606     } else if (CFEqual(key, kSecUseTombstones)) {
 607         if (CFGetTypeID(value) == CFBooleanGetTypeID()) {
 608             q->q_use_tomb = value;
 609         } else if (CFGetTypeID(value) == CFNumberGetTypeID()) {
 610             q->q_use_tomb = CFBooleanGetValue(value) ? kCFBooleanTrue : kCFBooleanFalse;
 611         } else if (CFGetTypeID(value) == CFStringGetTypeID()) {
 612             q->q_use_tomb = CFStringGetIntValue(value) ? kCFBooleanTrue : kCFBooleanFalse;
 613         } else {
 614             SecError(errSecItemInvalidValue, &q->q_error, CFSTR("add_use: value %@ for key %@ is neither CFBoolean nor CFNumber"), value, key);
 615             return;
 616         }
 617     } else if (CFEqual(key, kSecUseCredentialReference)) {
 618         if (isData(value)) {
 619             CFRetainAssign(q->q_use_cred_handle, value);
 620         } else {
 621             SecError(errSecItemInvalidValue, &q->q_error, CFSTR("add_use: value %@ for key %@ is not CFData"), value, key);
 622             return;
 623         }
 624     } else if (CFEqual(key, kSecUseAuthenticationUI)) {
 625         if (isString(value)) {
 626             q->q_skip_acl_items = CFEqualSafe(kSecUseAuthenticationUISkip, value);
 627         } else {
 628             SecError(errSecItemInvalidValue, &q->q_error, CFSTR("add_use: value %@ for key %@ is not CFString"), value, key);
 629             return;
 630         }
 631 #if TARGET_OS_IPHONE
 632     } else if (CFEqual(key, kSecUseSystemKeychain)) {
 633 #if TARGET_OS_EMBEDDED
 634         q->q_keybag = KEYBAG_DEVICE;
 635 #endif
 636         q->q_system_keychain = true;
 637     } else if (CFEqual(key, kSecUseSyncBubbleKeychain)) {
 638         if (isNumber(value) && CFNumberGetValue(value, kCFNumberSInt32Type, &q->q_sync_bubble) && q->q_sync_bubble > 0) {
 639 #if TARGET_OS_EMBEDDED
 640             q->q_keybag = KEYBAG_DEVICE;
 641 #endif
 642         } else {
 643             SecError(errSecItemInvalidValue, &q->q_error, CFSTR("add_use: value %@ for key %@ is not valid uid"), value, key);
 644             return;
 645         }
 646 #endif
 647     } else {
 648         SecError(errSecItemInvalidKey, &q->q_error, CFSTR("add_use: unknown key %@"), key);
 649         return;
 650     }
 651 }
 652
 653 static void query_set_data(const void *value, Query *q) {
 654     if (!isData(value)) {
 655         SecError(errSecItemInvalidValue, &q->q_error, CFSTR("set_data: value %@ is not type data"), value);
 656     } else {
 657         q->q_data = value;
 658         if (q->q_item)
 659             CFDictionarySetValue(q->q_item, kSecValueData, value);
 660     }
 661 }
 662
 663 static void query_set_token_persistent_ref(Query *q, CFDictionaryRef token_persistent_ref) {
 664     if (token_persistent_ref) {
 665         query_add_attribute(kSecAttrTokenID, CFDictionaryGetValue(token_persistent_ref, kSecAttrTokenID), q);
 666         CFRetainAssign(q->q_token_object_id, CFDictionaryGetValue(token_persistent_ref, kSecAttrTokenOID));
 667     }
 668 }
 669
 670 /* AUDIT[securityd](done):
 671  key (ok) is a caller provided, string starting with 'u'.
 672  value (ok) is a caller provided, non NULL CFTypeRef.
 673  */
 674 static void query_add_value(const void *key, const void *value, Query *q)
 675 {
 676     if (CFEqual(key, kSecValueData)) {
 677         query_set_data(value, q);
 678 #ifdef NO_SERVER
 679     } else if (CFEqual(key, kSecValueRef)) {
 680         q->q_ref = value;
 681         /* TODO: Add value type sanity checking. */
 682 #endif
 683     } else if (CFEqual(key, kSecValuePersistentRef)) {
 684         CFStringRef c_name;
 685         CFDictionaryRef token_persistent_ref = NULL;
 686         if (_SecItemParsePersistentRef(value, &c_name, &q->q_row_id, &token_persistent_ref)) {
 687             query_set_class(q, c_name, &q->q_error);
 688             query_set_token_persistent_ref(q, token_persistent_ref);
 689             CFReleaseNull(token_persistent_ref);
 690         } else
 691             SecError(errSecItemInvalidValue, &q->q_error, CFSTR("add_value: value %@ is not a valid persitent ref"), value);
 692     } else {
 693         SecError(errSecItemInvalidKey, &q->q_error, CFSTR("add_value: unknown key %@"), key);
 694         return;
 695     }
 696 }
 697
 698 /* AUDIT[securityd](done):
 699  key (ok) is a caller provided, unchecked.
 700  value (ok) is a caller provided, unchecked.
 701  */
 702 static void query_update_applier(const void *key, const void *value,
 703                                  void *context)
 704 {
 705     Query *q = (Query *)context;
 706     /* If something went wrong there is no point processing any more args. */
 707     if (q->q_error)
 708         return;
 709
 710     /* Make sure we have a string key. */
 711     if (!isString(key)) {
 712         SecError(errSecItemInvalidKeyType, &q->q_error, CFSTR("update_applier: unknown key type %@"), key);
 713         return;
 714     }
 715
 716     if (!value) {
 717         SecError(errSecItemInvalidValue, &q->q_error, CFSTR("update_applier: key %@ has NULL value"), key);
 718         return;
 719     }
 720
 721     if (CFEqual(key, CFSTR("musr"))) {
 722         secnotice("item", "update_applier: refusing to update musr");
 723         return;
 724     }
 725
 726     if (CFEqual(key, kSecValueData)) {
 727         query_set_data(value, q);
 728     } else {
 729         query_add_attribute(key, value, q);
 730     }
 731 }
 732
 733 /* AUDIT[securityd](done):
 734  key (ok) is a caller provided, unchecked.
 735  value (ok) is a caller provided, unchecked.
 736  */
 737 static void query_applier(const void *key, const void *value, void *context)
 738 {
 739     Query *q = (Query *)context;
 740     /* If something went wrong there is no point processing any more args. */
 741     if (q->q_error)
 742         return;
 743
 744     /* Make sure we have a key. */
 745     if (!key) {
 746         SecError(errSecItemInvalidKeyType, &q->q_error, CFSTR("applier: NULL key"));
 747         return;
 748     }
 749
 750     /* Make sure we have a value. */
 751     if (!value) {
 752         SecError(errSecItemInvalidValue, &q->q_error, CFSTR("applier: key %@ has NULL value"), key);
 753         return;
 754     }
 755
 756     /* Figure out what type of key we are dealing with. */
 757     CFTypeID key_id = CFGetTypeID(key);
 758     if (key_id == CFStringGetTypeID()) {
 759         CFIndex key_len = CFStringGetLength(key);
 760         /* String keys can be different things.  The subtype is determined by:
 761          length 4 strings are all attributes.  Otherwise the first char
 762          determines the type:
 763          c: class must be kSecClass
 764          m: match like kSecMatchPolicy
 765          r: return like kSecReturnData
 766          u: use keys
 767          v: value
 768          f: callbacks (ignored by the query applier)
 769          */
 770         if (key_len == 4) {
 771             /* attributes */
 772             query_add_attribute(key, value, q);
 773         } else if (key_len > 1) {
 774             // We added a database column named 'persistref', which is returned as an attribute but doesn't comply with
 775             // these matching rules. skip it for now, since it isn't filled in anyway.
 776             if(CFEqualSafe(key, CFSTR("persistref"))) {
 777                 return;
 778             }
 779
 780             UniChar k_first_char = CFStringGetCharacterAtIndex(key, 0);
 781             switch (k_first_char)
 782             {
 783                 case 'c': /* class */
 784                     query_add_class(key, value, q);
 785                     break;
 786                 case 'm': /* match */
 787                     query_add_match(key, value, q);
 788                     break;
 789                 case 'r': /* return */
 790                     query_add_return(key, value, q);
 791                     break;
 792                 case 'u': /* use */
 793                     query_add_use(key, value, q);
 794                     break;
 795                 case 'v': /* value */
 796                     query_add_value(key, value, q);
 797                     break;
 798                 case 'f':
 799                     break;
 800                 default:
 801                     SecError(errSecItemInvalidKey, &q->q_error, CFSTR("applier: key %@ invalid"), key);
 802                     break;
 803             }
 804         } else {
 805             SecError(errSecItemInvalidKey, &q->q_error, CFSTR("applier: key %@ invalid length"), key);
 806         }
 807     } else if (key_id == CFNumberGetTypeID()) {
 808         /* Numeric keys are always (extended) attributes. */
 809         /* TODO: Why is this here? query_add_attribute() doesn't take numbers. */
 810         query_add_attribute(key, value, q);
 811     } else {
 812         /* We only support string and number type keys. */
 813         SecError(errSecItemInvalidKeyType, &q->q_error, CFSTR("applier: key %@ neither string nor number"), key);
 814     }
 815 }
 816
 817 static CFStringRef query_infer_keyclass(Query *q, CFStringRef agrp) {
 818     /* apsd are always dku. */
 819     if (CFEqual(agrp, CFSTR("com.apple.apsd"))) {
 820         return kSecAttrAccessibleAlwaysThisDeviceOnlyPrivate;
 821     }
 822     /* All other certs or in the apple agrp is dk. */
 823     if (q->q_class == cert_class()) {
 824         /* third party certs are always dk. */
 825         return kSecAttrAccessibleAlwaysPrivate;
 826     }
 827     /* The rest defaults to ak. */
 828     return kSecAttrAccessibleWhenUnlocked;
 829 }
 830
 831 void query_ensure_access_control(Query *q, CFStringRef agrp) {
 832     if (q->q_access_control == 0) {
 833         CFStringRef accessible = query_infer_keyclass(q, agrp);
 834         query_add_attribute(kSecAttrAccessible, accessible, q);
 835     }
 836 }
 837
 838 bool query_error(Query *q, CFErrorRef *error) {
 839     CFErrorRef tmp = q->q_error;
 840     q->q_error = NULL;
 841     return SecErrorPropagate(tmp, error);
 842 }
 843
 844 bool query_destroy(Query *q, CFErrorRef *error) {
 845     bool ok = query_error(q, error);
 846     CFIndex ix, attr_count = query_attr_count(q);
 847     for (ix = 0; ix < attr_count; ++ix) {
 848         CFReleaseSafe(query_attr_at(q, ix).value);
 849     }
 850     CFReleaseSafe(q->q_item);
 851     CFReleaseSafe(q->q_musrView);
 852     CFReleaseSafe(q->q_primary_key_digest);
 853     CFReleaseSafe(q->q_match_issuer);
 854     CFReleaseSafe(q->q_access_control);
 855     CFReleaseSafe(q->q_use_cred_handle);
 856     CFReleaseSafe(q->q_caller_access_groups);
 857     CFReleaseSafe(q->q_match_policy);
 858     CFReleaseSafe(q->q_match_valid_on_date);
 859     CFReleaseSafe(q->q_match_trusted_only);
 860     CFReleaseSafe(q->q_token_object_id);
 861
 862     free(q);
 863     return ok;
 864 }
 865
 866 bool query_notify_and_destroy(Query *q, bool ok, CFErrorRef *error) {
 867     if (ok && !q->q_error && (q->q_sync_changed || (q->q_changed && !SecMUSRIsSingleUserView(q->q_musrView)))) {
 868         SecKeychainChanged();
 869     }
 870     return query_destroy(q, error) && ok;
 871 }
 872
 873 /* Allocate and initialize a Query object for query. */
 874 Query *query_create(const SecDbClass *qclass,
 875                     CFDataRef musr,
 876                     CFDictionaryRef query,
 877                     CFErrorRef *error)
 878 {
 879     if (!qclass) {
 880         if (error && !*error)
 881             SecError(errSecItemClassMissing, error, CFSTR("Missing class"));
 882         return NULL;
 883     }
 884
 885     if (musr == NULL)
 886         musr = SecMUSRGetSingleUserKeychainUUID();
 887
 888     /* Number of pairs we need is the number of attributes in this class
 889      plus the number of keys in the dictionary, minus one for each key in
 890      the dictionary that is a regular attribute. */
 891     CFIndex key_count = SecDbClassAttrCount(qclass);
 892     if (key_count == 0) {
 893         // Identities claim to have 0 attributes, but they really support any keys or cert attribute.
 894         key_count = SecDbClassAttrCount(cert_class()) + SecDbClassAttrCount(keys_class());
 895     }
 896
 897     if (query) {
 898         key_count += CFDictionaryGetCount(query);
 899         SecDbForEachAttr(qclass, attr) {
 900             if (CFDictionaryContainsKey(query, attr->name))
 901                 --key_count;
 902         }
 903     }
 904
 905     if (key_count > QUERY_KEY_LIMIT) {
 906         if (error && !*error)
 907         {
 908             secerror("key_count: %ld, QUERY_KEY_LIMIT: %d", (long)key_count, QUERY_KEY_LIMIT);
 909             SecError(errSecItemIllegalQuery, error, CFSTR("Past query key limit"));
 910         }
 911         return NULL;
 912     }
 913
 914     Query *q = calloc(1, sizeof(Query) + sizeof(Pair) * key_count);
 915     if (q == NULL) {
 916         if (error && !*error)
 917             SecError(errSecAllocate, error, CFSTR("Out of memory"));
 918         return NULL;
 919     }
 920
 921     q->q_pairs_count = key_count;
 922     q->q_musrView = (CFDataRef)CFRetain(musr);
 923     q->q_uuid_from_primary_key = false;
 924     q->q_keybag = KEYBAG_DEVICE;
 925     q->q_class = qclass;
 926     q->q_match_begin = q->q_match_end = key_count;
 927     q->q_item = CFDictionaryCreateMutable(0, 0, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 928
 929     return q;
 930 }
 931
 932 /* Parse query for a Query object q. */
 933 static bool query_parse_with_applier(Query *q, CFDictionaryRef query,
 934                                      CFDictionaryApplierFunction applier,
 935                                      CFErrorRef *error) {
 936     CFDictionaryApplyFunction(query, applier, q);
 937     return query_error(q, error);
 938 }
 939
 940 /* Parse query for a Query object q. */
 941 static bool query_parse(Query *q, CFDictionaryRef query,
 942                         CFErrorRef *error) {
 943     return query_parse_with_applier(q, query, query_applier, error);
 944 }
 945
 946 /* Parse query for a Query object q. */
 947 bool query_update_parse(Query *q, CFDictionaryRef update,
 948                                CFErrorRef *error) {
 949     return query_parse_with_applier(q, update, query_update_applier, error);
 950 }
 951
 952 Query *query_create_with_limit(CFDictionaryRef query, CFDataRef musr, CFIndex limit, CFErrorRef *error) {
 953     Query *q;
 954     q = query_create(query_get_class(query, error), musr, query, error);
 955     if (q) {
 956         q->q_limit = limit;
 957         if (!query_parse(q, query, error)) {
 958             query_destroy(q, error);
 959             return NULL;
 960         }
 961         if (!q->q_sync && !q->q_row_id && !q->q_token_object_id) {
 962             /* query did not specify a kSecAttrSynchronizable attribute,
 963              * and did not contain a persistent reference. */
 964             query_add_attribute(kSecAttrSynchronizable, kCFBooleanFalse, q);
 965         }
 966     }
 967     return q;
 968 }
 969
 970
 971 void
 972 query_set_caller_access_groups(Query *q, CFArrayRef caller_access_groups) {
 973     CFRetainAssign(q->q_caller_access_groups, caller_access_groups);
 974 }
 975
 976 void
 977 query_set_policy(Query *q, SecPolicyRef policy) {
 978     CFRetainAssign(q->q_match_policy, policy);
 979 }
 980
 981 void query_set_valid_on_date(Query *q, CFDateRef date) {
 982     CFRetainAssign(q->q_match_valid_on_date, date);
 983 }
 984
 985 void query_set_trusted_only(Query *q, CFBooleanRef trusted_only) {
 986     CFRetainAssign(q->q_match_trusted_only, trusted_only);
 987 }