keychain/SecureObjectSync/SOSRingTypes.m

   1 /*
   2  * Copyright (c) 2015-2016 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 //
  25 //  SOSRingTypes.c
  26 //
  27
  28 #include "SOSRing.h"
  29 #include "SOSRingTypes.h"
  30 #include "SOSRingBasic.h"
  31 #include "SOSRingBackup.h"
  32 #include "SOSRingRecovery.h"
  33 #include "keychain/SecureObjectSync/SOSAccountPriv.h"
  34 #include "keychain/SecureObjectSync/SOSInternal.h"
  35 #include <Security/SecureObjectSync/SOSBackupSliceKeyBag.h>
  36 #include <AssertMacros.h>
  37
  38 // These need to track the ring type enums in SOSRingTypes.h
  39 static ringFuncs ringTypes[] = {
  40     &basic,     // kSOSRingBase
  41     &backup,    // kSOSRingBackup
  42     NULL,       // kSOSRingPeerKeyed
  43     NULL,       // kSOSRingEntropyKeyed
  44     NULL,       // kSOSRingPKKeyed
  45     &recovery,  // kSOSRingRecovery
  46 };
  47 static const size_t typecount = sizeof(ringTypes) / sizeof(ringFuncs);
  48
  49 static bool SOSRingValidType(SOSRingType type) {
  50     if(type >= typecount || ringTypes[type] == NULL) return false;
  51     return true;
  52 }
  53
  54 // MARK: Exported Functions
  55
  56
  57 SOSRingRef SOSRingCreate(CFStringRef name, CFStringRef myPeerID, SOSRingType type, CFErrorRef *error) {
  58     if(!SOSRingValidType(type)){
  59         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
  60         return NULL;
  61     }
  62     if(!(ringTypes[type]->sosRingCreate)){
  63         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
  64         return NULL;
  65     }
  66     return ringTypes[type]->sosRingCreate(name, myPeerID, error);
  67 }
  68
  69 bool SOSRingResetToEmpty(SOSRingRef ring, CFStringRef myPeerID, CFErrorRef *error) {
  70     SOSRingAssertStable(ring);
  71     SOSRingType type = SOSRingGetType(ring);
  72     if(!SOSRingValidType(type)){
  73         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
  74         return false;
  75     }
  76     if(!ringTypes[type]->sosRingResetToEmpty){
  77         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
  78         return false;
  79     }
  80     return ringTypes[type]->sosRingResetToEmpty(ring, myPeerID, error);
  81 }
  82
  83 bool SOSRingResetToOffering(SOSRingRef ring, SecKeyRef user_privkey, SOSFullPeerInfoRef requestor, CFErrorRef *error) {
  84     SOSRingAssertStable(ring);
  85     SOSRingType type = SOSRingGetType(ring);
  86     if(!SOSRingValidType(type)){
  87         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
  88         return false;
  89     }
  90     if(!ringTypes[type]->sosRingResetToOffering){
  91         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
  92         return false;
  93     }
  94     return ringTypes[type]->sosRingResetToOffering(ring, user_privkey, requestor, error);
  95 }
  96
  97 SOSRingStatus SOSRingDeviceIsInRing(SOSRingRef ring, CFStringRef peerID) {
  98     SOSRingAssertStable(ring);
  99     SOSRingType type = SOSRingGetType(ring);
 100     if(!(SOSRingValidType(type))){
 101         return kSOSRingError;
 102     }
 103        if(!(ringTypes[type]->sosRingDeviceIsInRing)){
 104            return kSOSRingError;
 105        }
 106     return ringTypes[type]->sosRingDeviceIsInRing(ring, peerID);
 107 }
 108
 109 bool SOSRingApply(SOSRingRef ring, SecKeyRef user_pubkey, SOSFullPeerInfoRef fpi, CFErrorRef *error) {
 110     SOSRingAssertStable(ring);
 111     SOSRingType type = SOSRingGetType(ring);
 112     if(!(SOSRingValidType(type))){
 113         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
 114         return false;
 115     }
 116     if(!(ringTypes[type]->sosRingApply)){
 117         return true;
 118     }
 119     if(!(SOSPeerInfoApplicationVerify(SOSFullPeerInfoGetPeerInfo(fpi), user_pubkey, error))){
 120         SOSCreateError(kSOSErrorBadSignature, CFSTR("FullPeerInfo fails userkey signature check"), NULL, error);
 121         return false;
 122     }
 123
 124     return ringTypes[type]->sosRingApply(ring, user_pubkey, fpi, error);
 125 }
 126
 127 bool SOSRingWithdraw(SOSRingRef ring, SecKeyRef user_privkey, SOSFullPeerInfoRef requestor, CFErrorRef *error) {
 128     SOSRingAssertStable(ring);
 129     SOSRingType type = SOSRingGetType(ring);
 130     if(!SOSRingValidType(type)){
 131         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
 132         return false;
 133     }
 134     if(!ringTypes[type]->sosRingWithdraw)
 135         return true;
 136
 137     return ringTypes[type]->sosRingWithdraw(ring, user_privkey, requestor, error);
 138 }
 139
 140 bool SOSRingGenerationSign(SOSRingRef ring, SecKeyRef user_privkey, SOSFullPeerInfoRef requestor, CFErrorRef *error) {
 141     SOSRingAssertStable(ring);
 142     SOSRingType type = SOSRingGetType(ring);
 143     if(!(SOSRingValidType(type))){
 144         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
 145         return false;
 146     }
 147     if(!(ringTypes[type]->sosRingGenerationSign)){
 148         return true;
 149     }
 150     return ringTypes[type]->sosRingGenerationSign(ring, user_privkey, requestor, error);
 151 }
 152
 153 bool SOSRingConcordanceSign(SOSRingRef ring, SOSFullPeerInfoRef requestor, CFErrorRef *error) {
 154     SOSRingAssertStable(ring);
 155     SOSRingType type = SOSRingGetType(ring);
 156     if(!(SOSRingValidType(type))){
 157         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
 158         return false;
 159     }
 160     if(!(ringTypes[type]->sosRingConcordanceSign)){
 161         return true;
 162     }
 163     return ringTypes[type]->sosRingConcordanceSign(ring, requestor, error);
 164 }
 165
 166 SOSConcordanceStatus SOSRingConcordanceTrust(SOSFullPeerInfoRef me, CFSetRef peers,
 167                                              SOSRingRef knownRing, SOSRingRef proposedRing,
 168                                              SecKeyRef knownPubkey, SecKeyRef userPubkey,
 169                                              CFStringRef excludePeerID, CFErrorRef *error) {
 170     SOSRingAssertStable(knownRing);
 171     SOSRingAssertStable(proposedRing);
 172     SOSRingType type1 = SOSRingGetType(knownRing);
 173     SOSRingType type2 = SOSRingGetType(proposedRing);
 174     if(!(SOSRingValidType(type1))){
 175         return kSOSConcordanceError;
 176     }
 177     if(!(SOSRingValidType(type2))){
 178         return kSOSConcordanceError;
 179     }
 180     if((type1 != type2)){
 181         return kSOSConcordanceError;
 182     }
 183
 184     secnotice("ring", "concordance trust (%s) knownRing: %@ proposedRing: %@ knownkey: %@ userkey: %@ excluded: %@",
 185               ringTypes[type1]->typeName, knownRing, proposedRing, knownPubkey, userPubkey, excludePeerID);
 186
 187     if(!(ringTypes[type1]->sosRingConcordanceTrust)){
 188         return kSOSConcordanceError;
 189     }
 190     return ringTypes[type1]->sosRingConcordanceTrust(me, peers, knownRing, proposedRing, knownPubkey, userPubkey, excludePeerID, error);
 191 }
 192
 193 bool SOSRingAccept(SOSRingRef ring, SecKeyRef user_privkey, SOSFullPeerInfoRef requestor, CFErrorRef *error) {
 194     SOSRingAssertStable(ring);
 195     SOSRingType type = SOSRingGetType(ring);
 196     if(!(SOSRingValidType(type))){
 197         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
 198         return false;
 199     }
 200     if(!(ringTypes[type]->sosRingAccept)){
 201          return true;
 202     }
 203     return ringTypes[type]->sosRingAccept(ring, user_privkey, requestor, error);
 204 }
 205
 206 bool SOSRingReject(SOSRingRef ring, SecKeyRef user_privkey, SOSFullPeerInfoRef requestor, CFErrorRef *error) {
 207     SOSRingAssertStable(ring);
 208     SOSRingType type = SOSRingGetType(ring);
 209     if(!(SOSRingValidType(type))){
 210         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
 211         return false;
 212     }
 213     if(!(ringTypes[type]->sosRingReject)){
 214         return true;
 215     }
 216     return ringTypes[type]->sosRingReject(ring, user_privkey, requestor, error);
 217 }
 218
 219 bool SOSRingSetPayload(SOSRingRef ring, SecKeyRef user_privkey, CFDataRef payload, SOSFullPeerInfoRef requestor, CFErrorRef *error) {
 220     SOSRingAssertStable(ring);
 221     SOSRingType type = SOSRingGetType(ring);
 222     if(!(SOSRingValidType(type))){
 223         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
 224         return false;
 225     }
 226     if(!(ringTypes[type]->sosRingSetPayload)){
 227         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
 228         return false;
 229     }
 230     return ringTypes[type]->sosRingSetPayload(ring, user_privkey, payload, requestor, error);
 231 }
 232
 233 CFDataRef SOSRingGetPayload(SOSRingRef ring, CFErrorRef *error) {
 234     SOSRingAssertStable(ring);
 235     SOSRingType type = SOSRingGetType(ring);
 236     if(!SOSRingValidType(type)){
 237         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
 238         return NULL;
 239     }
 240     if(!ringTypes[type]->sosRingGetPayload){
 241         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
 242         return NULL;
 243     };
 244     return ringTypes[type]->sosRingGetPayload(ring, error);
 245 }
 246
 247 CFSetRef SOSRingGetBackupViewset(SOSRingRef ring, CFErrorRef *error) {
 248     SOSRingAssertStable(ring);
 249     SOSRingType type = SOSRingGetType(ring);
 250     if(kSOSRingBackup != type){
 251         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not backup ring type"), NULL, error);
 252         return NULL;
 253     }
 254     return SOSRingGetBackupViewset_Internal(ring);
 255 }
 256
 257 // This returns one string with the view for the ring - we never used multi-view rings
 258 CFStringRef SOSRingGetBackupView(SOSRingRef ring, CFErrorRef *error) {
 259     __block CFStringRef result = NULL;
 260     CFSetRef allTheViews = SOSRingGetBackupViewset(ring, error);
 261     if(allTheViews) {
 262         if(CFSetGetCount(allTheViews) == 1) {
 263             CFSetForEach(allTheViews, ^(const void *value) {
 264                 result = asString(value, error);
 265             });
 266         }
 267     } else {
 268         SOSCreateError(kSOSErrorParam, CFSTR("Wrong set count for one return"), NULL, error);
 269     }
 270     return result;
 271 }
 272
 273 static bool isBackupRing(SOSRingRef ring, CFErrorRef *error) {
 274     SOSRingType type = SOSRingGetType(ring);
 275     if(kSOSRingBackup != type){
 276         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not backup ring type"), NULL, error);
 277         return false;
 278     }
 279     return true;
 280 }
 281
 282 bool SOSRingSetBackupKeyBag(SOSRingRef ring, SOSFullPeerInfoRef fpi, CFSetRef viewSet, SOSBackupSliceKeyBagRef bskb, CFErrorRef *error) {
 283     SOSRingAssertStable(ring);
 284     CFDataRef bskb_as_data = NULL;
 285     bool result = false;
 286     if(!isBackupRing(ring, error)){
 287         CFReleaseNull(bskb_as_data);
 288         return result;
 289     }
 290
 291     bskb_as_data = SOSBSKBCopyEncoded(bskb, error);
 292     result = bskb_as_data &&
 293              SOSRingSetBackupViewset_Internal(ring, viewSet) &&
 294              SOSRingSetPayload(ring, NULL, bskb_as_data, fpi, error);
 295     CFReleaseNull(bskb_as_data);
 296     return result;
 297 }
 298
 299 SOSBackupSliceKeyBagRef SOSRingCopyBackupSliceKeyBag(SOSRingRef ring, CFErrorRef *error) {
 300     SOSRingAssertStable(ring);
 301
 302     CFDataRef bskb_as_data = NULL;
 303     SOSBackupSliceKeyBagRef result = NULL;
 304     if(!isBackupRing(ring, error)){
 305         return result;
 306     }
 307
 308     bskb_as_data = SOSRingGetPayload(ring, error);
 309     if(!bskb_as_data){
 310         return result;
 311     }
 312     result = SOSBackupSliceKeyBagCreateFromData(kCFAllocatorDefault, bskb_as_data, error);
 313     return result;
 314 }
 315
 316 bool SOSRingPKTrusted(SOSRingRef ring, SecKeyRef pubkey, CFErrorRef *error) {
 317     SOSRingAssertStable(ring);
 318     SOSRingType type = SOSRingGetType(ring);
 319     if(!(SOSRingValidType(type))){
 320         SOSCreateError(kSOSErrorUnexpectedType, CFSTR("Not valid ring type"), NULL, error);
 321         return false;
 322     };
 323     return SOSRingVerify(ring, pubkey, error);
 324 }
 325
 326 bool SOSRingPeerTrusted(SOSRingRef ring, SOSFullPeerInfoRef requestor, CFErrorRef *error) {
 327     bool retval = false;
 328     SOSPeerInfoRef pi = SOSFullPeerInfoGetPeerInfo(requestor);
 329     SecKeyRef pubkey = SOSPeerInfoCopyPubKey(pi, error);
 330     require_quiet(pubkey, exit);
 331     retval = SOSRingPKTrusted(ring, pubkey, error);
 332 exit:
 333     CFReleaseNull(pubkey);
 334     return retval;
 335 }