keychain/SecureObjectSync/SOSFullPeerInfo.m

   1 /*
   2  * Copyright (c) 2012-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 #include <AssertMacros.h>
  26
  27 #include "keychain/SecureObjectSync/SOSFullPeerInfo.h"
  28 #include "keychain/SecureObjectSync/SOSPeerInfoV2.h"
  29 #include "keychain/SecureObjectSync/SOSPeerInfoDER.h"
  30 #include "keychain/SecureObjectSync/SOSPeerInfoPriv.h"
  31
  32 #include "keychain/SecureObjectSync/SOSCircle.h"
  33
  34 #include "keychain/SecureObjectSync/SOSInternal.h"
  35
  36 #include <Security/SecKeyPriv.h>
  37 #include <Security/SecItemPriv.h>
  38 #include <Security/SecOTR.h>
  39 #include <CoreFoundation/CFArray.h>
  40 #include <dispatch/dispatch.h>
  41 #include <Security/SecFramework.h>
  42
  43 #include <stdlib.h>
  44 #include <assert.h>
  45
  46 #include <utilities/SecCFWrappers.h>
  47 #include <utilities/SecCFRelease.h>
  48
  49 #include <utilities/der_plist.h>
  50 #include <utilities/der_plist_internal.h>
  51 #include <corecrypto/ccder.h>
  52
  53 #include <CommonCrypto/CommonDigest.h>
  54 #include <CommonCrypto/CommonDigestSPI.h>
  55
  56 #include <CoreFoundation/CoreFoundation.h>
  57
  58 #include "utilities/iOSforOSX.h"
  59
  60 #include <AssertMacros.h>
  61
  62 #include <utilities/SecCFError.h>
  63
  64 // for OS X
  65 #ifdef __cplusplus
  66 extern "C" {
  67 #endif
  68
  69 //---- missing
  70
  71 extern OSStatus SecKeyCopyPublicBytes(SecKeyRef key, CFDataRef* publicBytes);
  72 extern SecKeyRef SecKeyCreatePublicFromPrivate(SecKeyRef privateKey);
  73 #ifdef __cplusplus
  74 }
  75 #endif
  76
  77 struct __OpaqueSOSFullPeerInfo {
  78     CFRuntimeBase          _base;
  79
  80     SOSPeerInfoRef         peer_info;
  81     CFDataRef              key_ref;
  82     CFDataRef              octagon_peer_signing_key_ref;
  83     CFDataRef              octagon_peer_encryption_key_ref;
  84 };
  85
  86 CFGiblisWithHashFor(SOSFullPeerInfo);
  87
  88
  89
  90 CFStringRef kSOSFullPeerInfoDescriptionKey = CFSTR("SOSFullPeerInfoDescription");
  91 CFStringRef kSOSFullPeerInfoSignatureKey = CFSTR("SOSFullPeerInfoSignature");
  92 CFStringRef kSOSFullPeerInfoNameKey = CFSTR("SOSFullPeerInfoName");
  93
  94
  95 bool SOSFullPeerInfoUpdate(SOSFullPeerInfoRef fullPeerInfo, CFErrorRef *error, SOSPeerInfoRef (^create_modification)(SOSPeerInfoRef peer, SecKeyRef key, CFErrorRef *error)) {
  96     bool result = false;
  97
  98     SOSPeerInfoRef newPeer = NULL;
  99     SecKeyRef device_key = SOSFullPeerInfoCopyDeviceKey(fullPeerInfo, error);
 100     require_quiet(device_key, fail);
 101
 102     newPeer = create_modification(fullPeerInfo->peer_info, device_key, error);
 103     require_quiet(newPeer, fail);
 104
 105     CFTransferRetained(fullPeerInfo->peer_info, newPeer);
 106     result = true;
 107
 108 fail:
 109     CFReleaseNull(device_key);
 110     CFReleaseNull(newPeer);
 111     return result;
 112 }
 113
 114 bool SOSFullPeerInfoUpdateToThisPeer(SOSFullPeerInfoRef peer, SOSPeerInfoRef pi, CFErrorRef *error) {
 115     return SOSFullPeerInfoUpdate(peer, error, ^SOSPeerInfoRef(SOSPeerInfoRef peer, SecKeyRef key, CFErrorRef *error) {
 116         return SOSPeerInfoSign(key, pi, error) ? CFRetainSafe(pi): NULL;
 117     });
 118 }
 119
 120 SOSFullPeerInfoRef SOSFullPeerInfoCreate(CFAllocatorRef allocator, CFDictionaryRef gestalt,
 121                                          CFDataRef backupKey,
 122                                          SecKeyRef signingKey,
 123                                          SecKeyRef octagonPeerSigningKey,
 124                                          SecKeyRef octagonPeerEncryptionKey,
 125                                          CFErrorRef* error) {
 126     return SOSFullPeerInfoCreateWithViews(allocator, gestalt, backupKey, NULL, signingKey,
 127                                           octagonPeerSigningKey, octagonPeerEncryptionKey, error);
 128 }
 129
 130 SOSFullPeerInfoRef SOSFullPeerInfoCreateWithViews(CFAllocatorRef allocator,
 131                                                   CFDictionaryRef gestalt, CFDataRef backupKey, CFSetRef initialViews,
 132                                                   SecKeyRef signingKey,
 133                                                   SecKeyRef octagonPeerSigningKey,
 134                                                   SecKeyRef octagonPeerEncryptionKey,
 135                                                   CFErrorRef* error) {
 136
 137     SOSFullPeerInfoRef result = NULL;
 138     SOSFullPeerInfoRef fpi = CFTypeAllocate(SOSFullPeerInfo, struct __OpaqueSOSFullPeerInfo, allocator);
 139
 140     CFStringRef IDSID = CFSTR("");
 141     CFStringRef transportType = SOSTransportMessageTypeKVS;
 142     CFBooleanRef preferIDS = kCFBooleanFalse;
 143     CFBooleanRef preferIDSFragmentation = kCFBooleanTrue;
 144     CFBooleanRef preferACKModel = kCFBooleanTrue;
 145
 146     fpi->peer_info = SOSPeerInfoCreateWithTransportAndViews(allocator, gestalt, backupKey,
 147                                                             IDSID, transportType, preferIDS,
 148                                                             preferIDSFragmentation, preferACKModel, initialViews,
 149                                                             signingKey, octagonPeerSigningKey, octagonPeerEncryptionKey, error);
 150     require_quiet(fpi->peer_info, exit);
 151
 152     OSStatus status = SecKeyCopyPersistentRef(signingKey, &fpi->key_ref);
 153     require_quiet(SecError(status, error, CFSTR("Inflating persistent ref")), exit);
 154
 155     status = SecKeyCopyPersistentRef(octagonPeerSigningKey, &fpi->octagon_peer_signing_key_ref);
 156     require_quiet(SecError(status, error, CFSTR("Inflating octagon peer signing persistent ref")), exit);
 157     status = SecKeyCopyPersistentRef(octagonPeerSigningKey, &fpi->octagon_peer_encryption_key_ref);
 158     require_quiet(SecError(status, error, CFSTR("Inflating octagon peer encryption persistent ref")), exit);
 159
 160     CFTransferRetained(result, fpi);
 161
 162 exit:
 163     CFReleaseNull(fpi);
 164     return result;
 165 }
 166
 167 SOSFullPeerInfoRef SOSFullPeerInfoCopyFullPeerInfo(SOSFullPeerInfoRef toCopy) {
 168     SOSFullPeerInfoRef retval = NULL;
 169     SOSFullPeerInfoRef fpi = CFTypeAllocate(SOSFullPeerInfo, struct __OpaqueSOSFullPeerInfo, kCFAllocatorDefault);
 170     SOSPeerInfoRef piToCopy = SOSFullPeerInfoGetPeerInfo(toCopy);
 171
 172     require_quiet(piToCopy, errOut);
 173     require_quiet(fpi, errOut);
 174     fpi->peer_info = SOSPeerInfoCreateCopy(kCFAllocatorDefault, piToCopy, NULL);
 175     require_quiet(fpi->peer_info, errOut);
 176     fpi->key_ref = CFRetainSafe(toCopy->key_ref);
 177     CFTransferRetained(retval, fpi);
 178
 179 errOut:
 180     CFReleaseNull(fpi);
 181     return retval;
 182 }
 183
 184 bool SOSFullPeerInfoUpdateOctagonKeys(SOSFullPeerInfoRef peer, SecKeyRef octagonSigningKey, SecKeyRef octagonEncryptionKey, CFErrorRef* error){
 185     return SOSFullPeerInfoUpdate(peer, error, ^SOSPeerInfoRef(SOSPeerInfoRef peer, SecKeyRef key, CFErrorRef *error) {
 186         return SOSPeerInfoSetOctagonKeys(kCFAllocatorDefault, peer, octagonSigningKey, octagonEncryptionKey, key, error);
 187     });
 188 }
 189
 190 bool SOSFullPeerInfoUpdateOctagonSigningKey(SOSFullPeerInfoRef peer, SecKeyRef octagonSigningKey, CFErrorRef* error){
 191     return SOSFullPeerInfoUpdate(peer, error, ^SOSPeerInfoRef(SOSPeerInfoRef peer, SecKeyRef key, CFErrorRef *error) {
 192         return SOSPeerInfoSetOctagonSigningKey(kCFAllocatorDefault, peer, octagonSigningKey, key, error);
 193     });
 194 }
 195
 196 bool SOSFullPeerInfoUpdateOctagonEncryptionKey(SOSFullPeerInfoRef peer, SecKeyRef octagonEncryptionKey, CFErrorRef* error){
 197     return SOSFullPeerInfoUpdate(peer, error, ^SOSPeerInfoRef(SOSPeerInfoRef peer, SecKeyRef key, CFErrorRef *error) {
 198         return SOSPeerInfoSetOctagonEncryptionKey(kCFAllocatorDefault, peer, octagonEncryptionKey, key, error);
 199     });
 200 }
 201
 202
 203
 204 CFDataRef SOSPeerInfoCopyData(SOSPeerInfoRef pi, CFErrorRef *error)
 205 {
 206     CFTypeRef vData = NULL;
 207     SecKeyRef pubKey = SOSPeerInfoCopyPubKey(pi, error);
 208     CFDictionaryRef query = NULL;
 209     require_quiet(pubKey, exit);
 210
 211
 212     CFDataRef public_key_hash = SecKeyCopyPublicKeyHash(pubKey);
 213
 214     query = CFDictionaryCreateForCFTypes(kCFAllocatorDefault,
 215                                                          kSecClass,                 kSecClassKey,
 216                                                          kSecAttrKeyClass,          kSecAttrKeyClassPrivate,
 217                                                          kSecAttrSynchronizable,    kSecAttrSynchronizableAny,
 218                                                          kSecAttrApplicationLabel,  public_key_hash,
 219                                                          kSecReturnData,            kCFBooleanTrue,
 220                                                          NULL);
 221     CFReleaseNull(public_key_hash);
 222
 223     require_quiet(SecError(SecItemCopyMatching(query, &vData),error ,
 224                            CFSTR("Error finding persistent ref to key from public: %@"), pubKey), exit);
 225
 226 exit:
 227     CFReleaseNull(query);
 228     CFReleaseNull(pubKey);
 229     if (vData == NULL) {
 230         secnotice("fpi","no private key found");
 231     }
 232     return (CFDataRef)vData;
 233 }
 234
 235 SOSFullPeerInfoRef SOSFullPeerInfoCreateCloudIdentity(CFAllocatorRef allocator, SOSPeerInfoRef peer, CFErrorRef* error) {
 236     SOSFullPeerInfoRef fpi = CFTypeAllocate(SOSFullPeerInfo, struct __OpaqueSOSFullPeerInfo, allocator);
 237
 238     SecKeyRef pubKey = NULL;
 239
 240     fpi->peer_info = peer;
 241     CFRetainSafe(fpi->peer_info);
 242     if (fpi->peer_info == NULL) {
 243         CFReleaseNull(fpi);
 244         goto exit;
 245     }
 246
 247     pubKey = SOSPeerInfoCopyPubKey(peer, error);
 248     require_quiet(pubKey, exit);
 249
 250     fpi->key_ref = SecKeyCreatePersistentRefToMatchingPrivateKey(pubKey, error);
 251
 252     if (fpi->key_ref == NULL) {
 253         CFReleaseNull(fpi);
 254         goto exit;
 255     }
 256
 257 exit:
 258     CFReleaseNull(pubKey);
 259     return fpi;
 260 }
 261
 262
 263 SOSFullPeerInfoRef SOSFullPeerInfoCreateFromDER(CFAllocatorRef allocator, CFErrorRef* error,
 264                                         const uint8_t** der_p, const uint8_t *der_end) {
 265     SOSFullPeerInfoRef fpi = CFTypeAllocate(SOSFullPeerInfo, struct __OpaqueSOSFullPeerInfo, allocator);
 266
 267     const uint8_t *sequence_end;
 268
 269     *der_p = ccder_decode_constructed_tl(CCDER_CONSTRUCTED_SEQUENCE, &sequence_end, *der_p, der_end);
 270     CFReleaseNull(fpi->peer_info);
 271     fpi->peer_info = SOSPeerInfoCreateFromDER(allocator, error, der_p, der_end);
 272     require_quiet(fpi->peer_info != NULL, fail);
 273
 274     *der_p = der_decode_data(allocator, kCFPropertyListImmutable, &fpi->key_ref, error, *der_p, sequence_end);
 275     require_quiet(*der_p != NULL, fail);
 276
 277     return fpi;
 278
 279 fail:
 280     CFReleaseNull(fpi);
 281     return NULL;
 282 }
 283
 284 SOSFullPeerInfoRef SOSFullPeerInfoCreateFromData(CFAllocatorRef allocator, CFDataRef fullPeerData, CFErrorRef *error)
 285 {
 286     if(!fullPeerData) return NULL;
 287     size_t size = CFDataGetLength(fullPeerData);
 288     const uint8_t *der = CFDataGetBytePtr(fullPeerData);
 289     SOSFullPeerInfoRef inflated = SOSFullPeerInfoCreateFromDER(allocator, error, &der, der + size);
 290     return inflated;
 291 }
 292
 293 static void SOSFullPeerInfoDestroy(CFTypeRef aObj) {
 294     SOSFullPeerInfoRef fpi = (SOSFullPeerInfoRef) aObj;
 295
 296     CFReleaseNull(fpi->peer_info);
 297     CFReleaseNull(fpi->key_ref);
 298     CFReleaseNull(fpi->octagon_peer_signing_key_ref);
 299     CFReleaseNull(fpi->octagon_peer_encryption_key_ref);
 300 }
 301
 302 static Boolean SOSFullPeerInfoCompare(CFTypeRef lhs, CFTypeRef rhs) {
 303     SOSFullPeerInfoRef lpeer = (SOSFullPeerInfoRef) lhs;
 304     SOSFullPeerInfoRef rpeer = (SOSFullPeerInfoRef) rhs;
 305
 306     if (!CFEqual(lpeer->peer_info, rpeer->peer_info))
 307         return false;
 308
 309     if (CFEqual(lpeer->key_ref, rpeer->key_ref))
 310         return true;
 311
 312     SecKeyRef lpk = SOSFullPeerInfoCopyDeviceKey(lpeer, NULL);
 313     SecKeyRef rpk = SOSFullPeerInfoCopyDeviceKey(rpeer, NULL);
 314
 315     bool match = lpk && rpk && CFEqual(lpk, rpk);
 316
 317     CFReleaseNull(lpk);
 318     CFReleaseNull(rpk);
 319
 320     return match;
 321 }
 322
 323 static CFHashCode   SOSFullPeerInfoHash(CFTypeRef cf) {
 324     SOSFullPeerInfoRef peer = (SOSFullPeerInfoRef) cf;
 325
 326     return CFHash(peer->peer_info);
 327 }
 328
 329 static CFStringRef SOSFullPeerInfoCopyFormatDescription(CFTypeRef aObj, CFDictionaryRef formatOptions) {
 330     SOSFullPeerInfoRef fpi = (SOSFullPeerInfoRef) aObj;
 331
 332     return CFStringCreateWithFormat(NULL, NULL, CFSTR("<SOSFullPeerInfo@%p: \"%@\">"), fpi, fpi->peer_info);
 333 }
 334
 335 bool SOSFullPeerInfoUpdateGestalt(SOSFullPeerInfoRef peer, CFDictionaryRef gestalt, CFErrorRef* error)
 336 {
 337     return SOSFullPeerInfoUpdate(peer, error, ^SOSPeerInfoRef(SOSPeerInfoRef peer, SecKeyRef key, CFErrorRef *error) {
 338         return SOSPeerInfoCopyWithGestaltUpdate(kCFAllocatorDefault, peer, gestalt, key, error);
 339     });
 340 }
 341
 342 bool SOSFullPeerInfoUpdateV2Dictionary(SOSFullPeerInfoRef peer, CFDictionaryRef newv2dict, CFErrorRef* error)
 343 {
 344     return SOSFullPeerInfoUpdate(peer, error, ^SOSPeerInfoRef(SOSPeerInfoRef peer, SecKeyRef key, CFErrorRef *error) {
 345         return SOSPeerInfoCopyWithV2DictionaryUpdate(kCFAllocatorDefault, peer,
 346                                                 newv2dict, key, error);
 347     });
 348 }
 349
 350 bool SOSFullPeerInfoUpdateBackupKey(SOSFullPeerInfoRef peer, CFDataRef backupKey, CFErrorRef* error)
 351 {
 352     return SOSFullPeerInfoUpdate(peer, error, ^SOSPeerInfoRef(SOSPeerInfoRef peer, SecKeyRef key, CFErrorRef *error) {
 353         return SOSPeerInfoCopyWithBackupKeyUpdate(kCFAllocatorDefault, peer, backupKey, key, error);
 354     });
 355 }
 356
 357 bool SOSFullPeerInfoReplaceEscrowRecords(SOSFullPeerInfoRef peer, CFDictionaryRef escrowRecords, CFErrorRef* error)
 358 {
 359     return SOSFullPeerInfoUpdate(peer, error, ^SOSPeerInfoRef(SOSPeerInfoRef peer, SecKeyRef key, CFErrorRef *error) {
 360         return SOSPeerInfoCopyWithReplacedEscrowRecords(kCFAllocatorDefault, peer, escrowRecords, key, error);
 361     });
 362 }
 363
 364 SOSViewResultCode SOSFullPeerInfoUpdateViews(SOSFullPeerInfoRef peer, SOSViewActionCode action, CFStringRef viewname, CFErrorRef* error)
 365 {
 366     __block SOSViewResultCode retval = kSOSCCGeneralViewError;
 367
 368     secnotice("viewChange", "%s view %@", SOSViewsXlateAction(action), viewname);
 369
 370     return SOSFullPeerInfoUpdate(peer, error, ^SOSPeerInfoRef(SOSPeerInfoRef peer, SecKeyRef key, CFErrorRef *error) {
 371         return SOSPeerInfoCopyWithViewsChange(kCFAllocatorDefault, peer, action, viewname, &retval, key, error);
 372     }) ? retval : kSOSCCGeneralViewError;
 373 }
 374
 375 static CFMutableSetRef SOSFullPeerInfoCopyViewUpdate(SOSFullPeerInfoRef peer, CFSetRef minimumViews, CFSetRef excludedViews) {
 376     CFSetRef enabledViews = SOSPeerInfoCopyEnabledViews(peer->peer_info);
 377     CFMutableSetRef newViews = SOSPeerInfoCopyEnabledViews(peer->peer_info);
 378
 379     if (isSet(minimumViews)) {
 380         CFSetUnion(newViews, minimumViews);
 381     }
 382     if (isSet(excludedViews)) {
 383         CFSetSubtract(newViews, excludedViews);
 384     }
 385
 386     if (CFEqualSafe(newViews, enabledViews)) {
 387         CFReleaseNull(newViews);
 388     }
 389
 390     CFReleaseNull(enabledViews);
 391     return newViews;
 392 }
 393
 394 static bool SOSFullPeerInfoNeedsViewUpdate(SOSFullPeerInfoRef peer, CFSetRef minimumViews, CFSetRef excludedViews) {
 395     CFSetRef updatedViews = SOSFullPeerInfoCopyViewUpdate(peer, minimumViews, excludedViews);
 396     bool needsUpdate = (updatedViews != NULL);
 397     CFReleaseNull(updatedViews);
 398     return needsUpdate;
 399 }
 400
 401 static bool sosFullPeerInfoRequiresUpdate(SOSFullPeerInfoRef peer, CFSetRef minimumViews, CFSetRef excludedViews) {
 402
 403     if(!SOSPeerInfoVersionIsCurrent(peer->peer_info)) return true;
 404     if(!SOSPeerInfoSerialNumberIsSet(peer->peer_info)) return true;
 405     if(SOSFullPeerInfoNeedsViewUpdate(peer, minimumViews, excludedViews)) return true;
 406
 407     return false;
 408 }
 409
 410 // Returning false indicates we don't need to upgrade.
 411 bool SOSFullPeerInfoUpdateToCurrent(SOSFullPeerInfoRef peer, CFSetRef minimumViews, CFSetRef excludedViews) {
 412     bool success = false;
 413
 414     CFMutableSetRef newViews = NULL;
 415     CFErrorRef copyError = NULL;
 416     CFErrorRef createError = NULL;
 417     SecKeyRef device_key = NULL;
 418
 419     require_quiet(sosFullPeerInfoRequiresUpdate(peer, minimumViews, excludedViews), errOut);
 420
 421     newViews = SOSFullPeerInfoCopyViewUpdate(peer, minimumViews, excludedViews);
 422
 423     device_key = SOSFullPeerInfoCopyDeviceKey(peer, &copyError);
 424     require_action_quiet(device_key, errOut,
 425                          secnotice("upgrade", "SOSFullPeerInfoCopyDeviceKey failed: %@", copyError));
 426
 427     SOSPeerInfoRef newPeer = SOSPeerInfoCreateCurrentCopy(kCFAllocatorDefault, peer->peer_info,
 428                                                           NULL, NULL, kCFBooleanFalse, kCFBooleanTrue, kCFBooleanTrue, newViews,
 429                                                           device_key, &createError);
 430     require_action_quiet(newPeer, errOut,
 431                          secnotice("upgrade", "Peer info v2 create copy failed: %@", createError));
 432
 433     CFTransferRetained(peer->peer_info, newPeer);
 434
 435     success = true;
 436
 437 errOut:
 438     CFReleaseNull(newViews);
 439     CFReleaseNull(copyError);
 440     CFReleaseNull(createError);
 441     CFReleaseNull(device_key);
 442     return success;
 443 }
 444
 445 SOSViewResultCode SOSFullPeerInfoViewStatus(SOSFullPeerInfoRef peer, CFStringRef viewname, CFErrorRef *error)
 446 {
 447     SOSPeerInfoRef pi = SOSFullPeerInfoGetPeerInfo(peer);
 448     if(!pi) return kSOSCCGeneralViewError;
 449     return SOSPeerInfoViewStatus(pi, viewname, error);
 450 }
 451
 452 SOSPeerInfoRef SOSFullPeerInfoGetPeerInfo(SOSFullPeerInfoRef fullPeer) {
 453     return fullPeer?fullPeer->peer_info:NULL;
 454 }
 455
 456 // MARK: Private Key Retrieval and Existence
 457
 458 SecKeyRef SOSFullPeerInfoCopyPubKey(SOSFullPeerInfoRef fpi, CFErrorRef *error) {
 459     SecKeyRef retval = NULL;
 460     require_quiet(fpi, errOut);
 461     SOSPeerInfoRef pi = SOSFullPeerInfoGetPeerInfo(fpi);
 462     require_quiet(pi, errOut);
 463     retval = SOSPeerInfoCopyPubKey(pi, error);
 464
 465 errOut:
 466     return retval;
 467 }
 468
 469 SecKeyRef SOSFullPeerInfoCopyOctagonPublicSigningKey(SOSFullPeerInfoRef fpi, CFErrorRef* error)
 470 {
 471     SecKeyRef retval = NULL;
 472     require_quiet(fpi, errOut);
 473     SOSPeerInfoRef pi = SOSFullPeerInfoGetPeerInfo(fpi);
 474     require_quiet(pi, errOut);
 475     retval = SOSPeerInfoCopyOctagonSigningPublicKey(pi, error);
 476 errOut:
 477     return retval;
 478 }
 479
 480 SecKeyRef SOSFullPeerInfoCopyOctagonPublicEncryptionKey(SOSFullPeerInfoRef fpi, CFErrorRef* error)
 481 {
 482     SecKeyRef retval = NULL;
 483     require_quiet(fpi, errOut);
 484     SOSPeerInfoRef pi = SOSFullPeerInfoGetPeerInfo(fpi);
 485     require_quiet(pi, errOut);
 486     retval = SOSPeerInfoCopyOctagonEncryptionPublicKey(pi, error);
 487
 488 errOut:
 489     return retval;
 490 }
 491
 492
 493 static SecKeyRef SOSFullPeerInfoCopyMatchingPrivateKey(SOSFullPeerInfoRef fpi, CFErrorRef *error) {
 494     SecKeyRef retval = NULL;
 495
 496     SecKeyRef pub = SOSFullPeerInfoCopyPubKey(fpi, error);
 497     require_quiet(pub, exit);
 498     retval = SecKeyCopyMatchingPrivateKey(pub, error);
 499 exit:
 500     CFReleaseNull(pub);
 501     return retval;
 502 }
 503
 504 static SecKeyRef SOSFullPeerInfoCopyMatchingOctagonSigningPrivateKey(SOSFullPeerInfoRef fpi, CFErrorRef* error)
 505 {
 506     SecKeyRef retval = NULL;
 507     SecKeyRef pub = SOSFullPeerInfoCopyOctagonPublicSigningKey(fpi, error);
 508     require_quiet(pub, exit);
 509     retval = SecKeyCopyMatchingPrivateKey(pub, error);
 510
 511 exit:
 512     CFReleaseNull(pub);
 513     return retval;
 514 }
 515 static SecKeyRef SOSFullPeerInfoCopyMatchingOctagonEncryptionPrivateKey(SOSFullPeerInfoRef fpi, CFErrorRef* error)
 516 {
 517     SecKeyRef retval = NULL;
 518     SecKeyRef pub = SOSFullPeerInfoCopyOctagonPublicEncryptionKey(fpi, error);
 519     require_quiet(pub, exit);
 520     retval = SecKeyCopyMatchingPrivateKey(pub, error);
 521
 522 exit:
 523     CFReleaseNull(pub);
 524     return retval;
 525 }
 526
 527
 528 static OSStatus SOSFullPeerInfoGetMatchingPrivateKeyStatus(SOSFullPeerInfoRef fpi, CFErrorRef *error) {
 529     OSStatus retval = errSecParam;
 530     SecKeyRef pub = SOSFullPeerInfoCopyPubKey(fpi, error);
 531     require_quiet(pub, exit);
 532     retval = SecKeyGetMatchingPrivateKeyStatus(pub, error);
 533
 534 exit:
 535     CFReleaseNull(pub);
 536     return retval;
 537 }
 538
 539 bool SOSFullPeerInfoValidate(SOSFullPeerInfoRef peer, CFErrorRef* error) {
 540     OSStatus result = SOSFullPeerInfoGetMatchingPrivateKeyStatus(peer, error);
 541     if(result == errSecSuccess) return true;
 542     return false;
 543 }
 544
 545 bool SOSFullPeerInfoPrivKeyExists(SOSFullPeerInfoRef peer) {
 546     OSStatus result = SOSFullPeerInfoGetMatchingPrivateKeyStatus(peer, NULL);
 547     if(result == errSecItemNotFound || result == errSecParam) return false;
 548     return true;
 549 }
 550
 551 bool SOSFullPeerInfoPurgePersistentKey(SOSFullPeerInfoRef fpi, CFErrorRef* error) {
 552     bool result = false;
 553     CFDictionaryRef privQuery = NULL;
 554     CFMutableDictionaryRef query = NULL;
 555     CFDictionaryRef octagonPrivQuery = NULL;
 556     CFMutableDictionaryRef octagonQuery = NULL;
 557
 558     SecKeyRef pub = SOSFullPeerInfoCopyPubKey(fpi, error);
 559     SecKeyRef octagonSigningPub = SOSFullPeerInfoCopyOctagonPublicSigningKey(fpi, error);
 560     SecKeyRef octagonEncryptionPub = SOSFullPeerInfoCopyOctagonPublicEncryptionKey(fpi, error);
 561     require_quiet(pub, fail);
 562     // iCloud Identities doesn't have either signing or encryption key here. Don't fail if they're not present.
 563
 564     privQuery = CreatePrivateKeyMatchingQuery(pub, false);
 565     query = CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 0, privQuery);
 566     CFDictionaryAddValue(query, kSecUseTombstones, kCFBooleanFalse);
 567
 568     result = SecError(SecItemDelete(query), error, CFSTR("Deleting while purging"));
 569
 570     // do the same thing to also purge the octagon sync signing key
 571     if(octagonSigningPub) {
 572         octagonPrivQuery = CreatePrivateKeyMatchingQuery(octagonSigningPub, false);
 573         octagonQuery = CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 0, octagonPrivQuery);
 574         CFDictionaryAddValue(octagonQuery, kSecUseTombstones, kCFBooleanFalse);
 575
 576         result &= SecError(SecItemDelete(octagonQuery), error, CFSTR("Deleting signing key while purging"));
 577     }
 578
 579     CFReleaseNull(octagonPrivQuery);
 580     CFReleaseNull(octagonQuery);
 581
 582     // do the same thing to also purge the octagon encryption key
 583     if(octagonEncryptionPub) {
 584         octagonPrivQuery = CreatePrivateKeyMatchingQuery(octagonEncryptionPub, false);
 585         octagonQuery = CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 0, octagonPrivQuery);
 586         CFDictionaryAddValue(octagonQuery, kSecUseTombstones, kCFBooleanFalse);
 587
 588         result &= SecError(SecItemDelete(octagonQuery), error, CFSTR("Deleting encryption key while purging"));
 589     }
 590
 591 fail:
 592     CFReleaseNull(privQuery);
 593     CFReleaseNull(query);
 594     CFReleaseNull(pub);
 595     CFReleaseNull(octagonPrivQuery);
 596     CFReleaseNull(octagonQuery);
 597     CFReleaseNull(octagonSigningPub);
 598     CFReleaseNull(octagonEncryptionPub);
 599     return result;
 600 }
 601
 602 SecKeyRef  SOSFullPeerInfoCopyDeviceKey(SOSFullPeerInfoRef fullPeer, CFErrorRef* error)
 603 {
 604     return SOSFullPeerInfoCopyMatchingPrivateKey(fullPeer, error);
 605 }
 606
 607 SecKeyRef SOSFullPeerInfoCopyOctagonSigningKey(SOSFullPeerInfoRef fullPeer, CFErrorRef* error)
 608 {
 609     return SOSFullPeerInfoCopyMatchingOctagonSigningPrivateKey(fullPeer, error);
 610 }
 611
 612 SecKeyRef SOSFullPeerInfoCopyOctagonEncryptionKey(SOSFullPeerInfoRef fullPeer, CFErrorRef* error)
 613 {
 614     return SOSFullPeerInfoCopyMatchingOctagonEncryptionPrivateKey(fullPeer, error);
 615 }
 616
 617
 618 //
 619 // MARK: Encode and decode
 620 //
 621 size_t      SOSFullPeerInfoGetDEREncodedSize(SOSFullPeerInfoRef peer, CFErrorRef *error)
 622 {
 623     size_t peer_size = SOSPeerInfoGetDEREncodedSize(peer->peer_info, error);
 624     if (peer_size == 0)
 625         return 0;
 626
 627     size_t ref_size = der_sizeof_data(peer->key_ref, error);
 628     if (ref_size == 0)
 629         return 0;
 630
 631     return ccder_sizeof(CCDER_CONSTRUCTED_SEQUENCE,
 632                         peer_size + ref_size);
 633 }
 634
 635 uint8_t* SOSFullPeerInfoEncodeToDER(SOSFullPeerInfoRef peer, CFErrorRef* error, const uint8_t* der, uint8_t* der_end)
 636 {
 637     return ccder_encode_constructed_tl(CCDER_CONSTRUCTED_SEQUENCE, der_end, der,
 638            SOSPeerInfoEncodeToDER(peer->peer_info, error, der,
 639            der_encode_data(peer->key_ref, error, der, der_end)));
 640 }
 641
 642 CFDataRef SOSFullPeerInfoCopyEncodedData(SOSFullPeerInfoRef peer, CFAllocatorRef allocator, CFErrorRef *error)
 643 {
 644     return CFDataCreateWithDER(kCFAllocatorDefault, SOSFullPeerInfoGetDEREncodedSize(peer, error), ^uint8_t*(size_t size, uint8_t *buffer) {
 645         return SOSFullPeerInfoEncodeToDER(peer, error, buffer, (uint8_t *) buffer + size);
 646     });
 647 }
 648
 649 bool SOSFullPeerInfoPromoteToApplication(SOSFullPeerInfoRef fpi, SecKeyRef user_key, CFErrorRef *error)
 650 {
 651     bool success = false;
 652     SOSPeerInfoRef old_pi = NULL;
 653
 654     SecKeyRef device_key = SOSFullPeerInfoCopyDeviceKey(fpi, error);
 655     require_quiet(device_key, exit);
 656
 657     old_pi = fpi->peer_info;
 658     fpi->peer_info = SOSPeerInfoCopyAsApplication(old_pi, user_key, device_key, error);
 659
 660     require_action_quiet(fpi->peer_info, exit, fpi->peer_info = old_pi; old_pi = NULL);
 661
 662     success = true;
 663
 664 exit:
 665     CFReleaseSafe(old_pi);
 666     CFReleaseSafe(device_key);
 667     return success;
 668 }
 669
 670 bool SOSFullPeerInfoUpgradeSignatures(SOSFullPeerInfoRef fpi, SecKeyRef user_key, CFErrorRef *error)
 671 {
 672     bool success = false;
 673     SOSPeerInfoRef old_pi = NULL;
 674
 675     SecKeyRef device_key = SOSFullPeerInfoCopyDeviceKey(fpi, error);
 676     require_quiet(device_key, exit);
 677
 678     old_pi = fpi->peer_info;
 679     fpi->peer_info = SOSPeerInfoUpgradeSignatures(NULL, user_key, device_key, old_pi, error);
 680
 681     require_action_quiet(fpi->peer_info, exit, fpi->peer_info = old_pi; old_pi = NULL);
 682
 683     success = true;
 684
 685 exit:
 686     CFReleaseSafe(old_pi);
 687     CFReleaseSafe(device_key);
 688     return success;
 689 }
 690
 691 //
 692 //
 693 //
 694
 695 SOSPeerInfoRef SOSFullPeerInfoPromoteToRetiredAndCopy(SOSFullPeerInfoRef fpi, CFErrorRef *error)
 696 {
 697     SOSPeerInfoRef peer_to_free = NULL;
 698     SOSPeerInfoRef retired_peer = NULL;
 699     SecKeyRef key = SOSFullPeerInfoCopyDeviceKey(fpi, error);
 700     require_quiet(key, error_out);
 701
 702     retired_peer = SOSPeerInfoCreateRetirementTicket(NULL, key, fpi->peer_info, error);
 703
 704     require_quiet(retired_peer, error_out);
 705
 706     peer_to_free = fpi->peer_info;
 707     fpi->peer_info = retired_peer;
 708     CFRetainSafe(fpi->peer_info);
 709
 710 error_out:
 711     CFReleaseNull(key);
 712     CFReleaseNull(peer_to_free);
 713     return retired_peer;
 714 }
 715
 716
 717 bool SOSFullPeerInfoPing(SOSFullPeerInfoRef peer, CFErrorRef* error) {
 718     bool retval = false;
 719     SecKeyRef device_key = SOSFullPeerInfoCopyDeviceKey(peer, error);
 720     require_quiet(device_key, fail);
 721     SOSPeerInfoRef newPeer = SOSPeerInfoCopyWithPing(kCFAllocatorDefault, peer->peer_info, device_key, error);
 722     require_quiet(newPeer, fail);
 723
 724     CFReleaseNull(peer->peer_info);
 725     peer->peer_info = newPeer;
 726     newPeer = NULL;
 727     retval = true;
 728 fail:
 729     CFReleaseNull(device_key);
 730     return retval;
 731 }
 732
 733