IDSKeychainSyncingProxy/IDSProxy.m

   1 /*
   2  * Copyright (c) 2012-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 //
  25 //  IDSProxy.m
  26 //  ids-xpc
  27 //
  28
  29
  30 #import <Foundation/NSArray.h>
  31 #import <Foundation/Foundation.h>
  32
  33 #import <Security/SecBasePriv.h>
  34 #import <Security/SecItemPriv.h>
  35 #import <utilities/debugging.h>
  36 #import <notify.h>
  37
  38 #include <Security/CKBridge/SOSCloudKeychainConstants.h>
  39 #include <Security/SecureObjectSync/SOSARCDefines.h>
  40 #include <Security/SecureObjectSync/SOSCloudCircle.h>
  41 #include <Security/SecureObjectSync/SOSCloudCircleInternal.h>
  42
  43 #import <IDS/IDS.h>
  44 #import <os/activity.h>
  45
  46 #include <utilities/SecAKSWrappers.h>
  47 #include <utilities/SecCFRelease.h>
  48 #include <AssertMacros.h>
  49
  50 #import "IDSProxy.h"
  51 #import "IDSKeychainSyncingProxy+IDSProxyReceiveMessage.h"
  52 #import "IDSKeychainSyncingProxy+IDSProxySendMessage.h"
  53 #import "IDSKeychainSyncingProxy+IDSProxyThrottle.h"
  54 #import "IDSPersistentState.h"
  55
  56 #define kSecServerKeychainChangedNotification "com.apple.security.keychainchanged"
  57 #define kSecServerPeerInfoAvailable "com.apple.security.fpiAvailable"
  58
  59 #define IDSServiceNameKeychainSync "com.apple.private.alloy.keychainsync"
  60 static NSString *kMonitorState = @"MonitorState";
  61 static NSString *kExportUnhandledMessages = @"UnhandledMessages";
  62 static const char *kStreamName = "com.apple.notifyd.matching";
  63
  64 NSString *const IDSSendMessageOptionForceEncryptionOffKey = @"IDSSendMessageOptionForceEncryptionOff";
  65 static const int64_t kRetryTimerLeeway = (NSEC_PER_MSEC * 250);      // 250ms leeway for handling unhandled messages.
  66 static const int64_t kMinMessageRetryDelay = (NSEC_PER_SEC * 8);
  67
  68 CFStringRef kSOSErrorDomain = CFSTR("com.apple.security.sos.error");
  69
  70 CFIndex kSOSErrorPeerNotFound = 1032;
  71 CFIndex SECD_RUN_AS_ROOT_ERROR = 1041;
  72
  73 #define IDSPROXYSCOPE "IDSProxy"
  74
  75 @implementation IDSKeychainSyncingProxy
  76
  77 +   (IDSKeychainSyncingProxy *) idsProxy
  78 {
  79     static IDSKeychainSyncingProxy *idsProxy;
  80     if (!idsProxy) {
  81         static dispatch_once_t onceToken;
  82         dispatch_once(&onceToken, ^{
  83             idsProxy = [[self alloc] init];
  84         });
  85     }
  86     return idsProxy;
  87 }
  88
  89 -(NSDictionary*) exportState
  90 {
  91     return @{ kMonitorState:_monitor,
  92               kExportUnhandledMessages:_unhandledMessageBuffer
  93               };
  94
  95 }
  96 - (void)persistState
  97 {
  98     if([_unhandledMessageBuffer count] > 0){
  99         [IDSKeychainSyncingProxyPersistentState setUnhandledMessages:[self exportState]];
 100     }
 101 }
 102
 103 - (void) importIDSState: (NSMutableDictionary*) state
 104 {
 105     _unhandledMessageBuffer = state[kExportUnhandledMessages];
 106     if(!_unhandledMessageBuffer)
 107         _unhandledMessageBuffer = [NSMutableDictionary dictionary];
 108
 109     _monitor = state[kMonitorState];
 110     if(_monitor == nil)
 111         _monitor = [NSMutableDictionary dictionary];
 112 }
 113
 114 - (id)init
 115 {
 116     if (self = [super init])
 117     {
 118         secnotice("event", "%@ start", self);
 119
 120         _isIDSInitDone = false;
 121         _service = nil;
 122         _calloutQueue = dispatch_queue_create("IDSCallout", DISPATCH_QUEUE_SERIAL);
 123         _unhandledMessageBuffer = [ [NSMutableDictionary alloc] initWithCapacity: 0];
 124         _pingTimers = [ [NSMutableDictionary alloc] initWithCapacity: 0];
 125
 126         _isSecDRunningAsRoot = false;
 127         _doesSecDHavePeer = true;
 128
 129         secdebug(IDSPROXYSCOPE, "%@ done", self);
 130
 131         [self doIDSInitialization];
 132         if(_isIDSInitDone)
 133             [self doSetIDSDeviceID];
 134
 135
 136         // Register for lock state changes
 137         xpc_set_event_stream_handler(kStreamName, dispatch_get_main_queue(),
 138                                      ^(xpc_object_t notification){
 139                                          [self streamEvent:notification];
 140                                      });
 141
 142         _retryTimer = dispatch_source_create(DISPATCH_SOURCE_TYPE_TIMER, 0, 0, dispatch_get_main_queue());
 143         dispatch_source_set_timer(_retryTimer, DISPATCH_TIME_FOREVER, DISPATCH_TIME_FOREVER, kRetryTimerLeeway);
 144         dispatch_source_set_event_handler(_retryTimer, ^{
 145             [self timerFired];
 146         });
 147         dispatch_resume(_retryTimer);
 148         [self importIDSState: [IDSKeychainSyncingProxyPersistentState idsState]];
 149
 150         int notificationToken;
 151         notify_register_dispatch(kSecServerKeychainChangedNotification, &notificationToken, dispatch_get_main_queue(),
 152                                  ^ (int token __unused)
 153                                  {
 154                                      secinfo("backoff", "keychain changed, wiping backoff monitor state");
 155                                      _monitor = [NSMutableDictionary dictionary];
 156                                  });
 157         int peerInfo;
 158         notify_register_dispatch(kSecServerPeerInfoAvailable, &peerInfo, dispatch_get_main_queue(),
 159                                  ^ (int token __unused)
 160                                  {
 161                                      secinfo("IDS Transport", "secd has a peer info");
 162                                      if(_doesSecDHavePeer == false){
 163                                          _doesSecDHavePeer = true;
 164                                          [self doSetIDSDeviceID];
 165                                      }
 166                                  });
 167
 168         [self updateUnlockedSinceBoot];
 169         [self updateIsLocked];
 170         if (!_isLocked)
 171             [self keybagDidUnlock];
 172
 173
 174     }
 175     return self;
 176 }
 177
 178 - (void)streamEvent:(xpc_object_t)notification
 179 {
 180 #if (!TARGET_IPHONE_SIMULATOR)
 181     const char *notificationName = xpc_dictionary_get_string(notification, "Notification");
 182     if (!notificationName) {
 183     } else if (strcmp(notificationName, kUserKeybagStateChangeNotification)==0) {
 184         return [self keybagStateChange];
 185     }
 186     const char *eventName = xpc_dictionary_get_string(notification, "XPCEventName");
 187     char *desc = xpc_copy_description(notification);
 188     secnotice("event", "%@ event: %s name: %s desc: %s", self, eventName, notificationName, desc);
 189     if (desc)
 190         free((void *)desc);
 191 #endif
 192 }
 193
 194 - (void) keybagDidLock
 195 {
 196     secnotice("IDS Transport", "%@ locking!", self);
 197 }
 198
 199 - (void) keybagDidUnlock
 200 {
 201     secnotice("IDS Transport", "%@ unlocking!", self);
 202     [self handleAllPendingMessage];
 203 }
 204
 205 - (BOOL) updateUnlockedSinceBoot
 206 {
 207     CFErrorRef aksError = NULL;
 208     if (!SecAKSGetHasBeenUnlocked(&_unlockedSinceBoot, &aksError)) {
 209         secerror("%@ Got error from SecAKSGetHasBeenUnlocked: %@", self, aksError);
 210         CFReleaseSafe(aksError);
 211         return NO;
 212     }
 213     return YES;
 214 }
 215
 216 - (BOOL) updateIsLocked
 217 {
 218     CFErrorRef aksError = NULL;
 219     if (!SecAKSGetIsLocked(&_isLocked, &aksError)) {
 220         secerror("%@ Got error querying lock state: %@", self, aksError);
 221         CFReleaseSafe(aksError);
 222         return NO;
 223     }
 224     secerror("updateIsLocked: %d", _isLocked);
 225     if (!_isLocked)
 226         _unlockedSinceBoot = YES;
 227     return YES;
 228 }
 229
 230 - (void) keybagStateChange
 231 {
 232     os_activity_initiate("keybagStateChanged", OS_ACTIVITY_FLAG_DEFAULT, ^{
 233         secerror("keybagStateChange! was locked: %d", _isLocked);
 234         BOOL wasLocked = _isLocked;
 235         if ([self updateIsLocked]) {
 236             if (wasLocked == _isLocked)
 237                 secdebug("IDS Transport", "%@ still %s ignoring", self, _isLocked ? "locked" : "unlocked");
 238             else if (_isLocked)
 239                 [self keybagDidLock];
 240             else
 241                 [self keybagDidUnlock];
 242         }
 243     });
 244 }
 245
 246
 247 - (void)timerFired
 248 {
 249     if(_unhandledMessageBuffer)
 250         secnotice("IDS Transport", "%@ attempting to hand unhandled messages to securityd, here is our message queue: %@", self, _unhandledMessageBuffer);
 251
 252     if(_isLocked)
 253         _retryTimerScheduled = NO;
 254     else if([_unhandledMessageBuffer count] == 0)
 255         _retryTimerScheduled = NO;
 256     else if (_retryTimerScheduled && !_isLocked)
 257         [self handleAllPendingMessage];
 258     else
 259         [[IDSKeychainSyncingProxy idsProxy] scheduleRetryRequestTimer];
 260
 261 }
 262
 263 - (void)scheduleRetryRequestTimer
 264 {
 265     secnotice("IDS Transport", "scheduling unhandled messages timer");
 266     dispatch_source_set_timer(_retryTimer, dispatch_time(DISPATCH_TIME_NOW, kMinMessageRetryDelay), DISPATCH_TIME_FOREVER, kRetryTimerLeeway);
 267     _retryTimerScheduled = YES;
 268 }
 269
 270 - (void)doIDSInitialization
 271 {
 272
 273     secnotice("IDS Transport", "doIDSInitialization!");
 274
 275     _service = [[IDSService alloc] initWithService: @IDSServiceNameKeychainSync];
 276
 277     if( _service == nil ){
 278         _isIDSInitDone = false;
 279         secerror("Could not create ids service");
 280     }
 281     else{
 282         secnotice("IDS Transport", "IDS Transport Successfully set up IDS!");
 283         [_service addDelegate:self queue: dispatch_get_main_queue()];
 284
 285         _isIDSInitDone = true;
 286         if(_isSecDRunningAsRoot == false)
 287             [self doSetIDSDeviceID];
 288     }
 289 }
 290
 291 - (void) doSetIDSDeviceID
 292 {
 293     NSInteger code = 0;
 294     NSString *errorMessage = nil;
 295     __block NSString* deviceID;
 296
 297     if(!_isIDSInitDone){
 298         [self doIDSInitialization];
 299     }
 300     require_action_quiet(_isSecDRunningAsRoot == false, fail, errorMessage = @"cannot set IDS device ID, secd is running as root"; code = SECD_RUN_AS_ROOT_ERROR;);
 301     require_action_quiet(_doesSecDHavePeer == true, fail, errorMessage = @"cannot set IDS deviceID, secd does not have a full peer info for account"; code = kSOSErrorPeerNotFound);
 302     require_action_quiet(_isIDSInitDone, fail, errorMessage = @"IDSKeychainSyncingProxy can't set up the IDS service"; code = kSecIDSErrorNotRegistered);
 303     require_action_quiet(!_isLocked, fail, errorMessage = @"IDSKeychainSyncingProxy can't set device ID, device is locked"; code = kSecIDSErrorDeviceIsLocked);
 304
 305     deviceID = IDSCopyLocalDeviceUniqueID();
 306     secdebug("IDS Transport", "This is our IDS device ID: %@", deviceID);
 307
 308     require_action_quiet(deviceID != nil, fail, errorMessage = @"IDSKeychainSyncingProxy could not retrieve device ID from keychain"; code = kSecIDSErrorNoDeviceID);
 309
 310     if(_inCallout && _isSecDRunningAsRoot == false){
 311         _shadowDoSetIDSDeviceID = YES;
 312     }
 313     else{
 314         _setIDSDeviceID = YES;
 315         [self calloutWith:^(NSMutableDictionary *pending, bool handlePendingMesssages, bool doSetDeviceID, dispatch_queue_t queue, void(^done)(NSMutableDictionary *, bool, bool)) {
 316             CFErrorRef localError = NULL;
 317             bool handledSettingID = false;
 318             handledSettingID = SOSCCSetDeviceID((__bridge CFStringRef) deviceID, &localError);
 319             if(!handledSettingID && localError != NULL){
 320
 321                 if(CFErrorGetCode(localError) == SECD_RUN_AS_ROOT_ERROR){
 322                     secerror("SETTING RUN AS ROOT ERROR: %@", localError);
 323                     _isSecDRunningAsRoot = true;
 324                 }
 325                 else if (CFErrorGetCode(localError) == -536870174 && CFErrorGetDomain(localError) == kSecKernDomain) {
 326                     secnotice("IDS Transport", "system is locked, cannot set device ID, error: %@", localError);
 327                     _isLocked = true;
 328                 }
 329                 else if (CFErrorGetCode(localError) == kSOSErrorPeerNotFound && CFStringCompare(CFErrorGetDomain(localError), kSOSErrorDomain, 0) == 0){
 330                     secnotice("IDS Transport","securityd does not have a peer yet , error: %@", localError);
 331                     _doesSecDHavePeer = false;
 332                 }
 333             }
 334             CFReleaseNull(localError);
 335             dispatch_async(queue, ^{
 336                 done(nil, NO, handledSettingID);
 337             });
 338         }];
 339     }
 340 fail:
 341     if(errorMessage != nil){
 342         secerror("Setting device ID error: %@, code: %ld", errorMessage, (long)code);
 343     }
 344 }
 345
 346 - (void) calloutWith: (void(^)(NSMutableDictionary *pending, bool handlePendingMesssages, bool doSetDeviceID, dispatch_queue_t queue, void(^done)(NSMutableDictionary *handledMessages, bool handledPendingMessage, bool handledSettingDeviceID))) callout
 347 {
 348     // In IDSKeychainSyncingProxy serial queue
 349     dispatch_queue_t idsproxy_queue = dispatch_get_main_queue();
 350
 351     // dispatch_get_global_queue - well-known global concurrent queue
 352     // dispatch_get_main_queue   - default queue that is bound to the main thread
 353     xpc_transaction_begin();
 354     dispatch_async(_calloutQueue, ^{
 355         __block NSMutableDictionary *myPending;
 356         __block bool myHandlePendingMessage;
 357         __block bool myDoSetDeviceID;
 358         __block bool wasLocked;
 359         dispatch_sync(idsproxy_queue, ^{
 360             myPending = [_unhandledMessageBuffer copy];
 361             myHandlePendingMessage = _handleAllPendingMessages;
 362             myDoSetDeviceID = _setIDSDeviceID;
 363             wasLocked = _isLocked;
 364
 365             _inCallout = YES;
 366
 367             _shadowHandleAllPendingMessages = NO;
 368         });
 369
 370         callout(myPending, myHandlePendingMessage, myDoSetDeviceID, idsproxy_queue, ^(NSMutableDictionary *handledMessages, bool handledPendingMessage, bool handledSetDeviceID) {
 371             secdebug("event", "%@ %s%s before callout handled: %s%s", self, myHandlePendingMessage ? "P" : "p", myDoSetDeviceID ? "D" : "d", handledPendingMessage ? "H" : "h", handledSetDeviceID ? "I" : "i");
 372
 373             // In IDSKeychainSyncingProxy's serial queue
 374             _inCallout = NO;
 375
 376             // Update setting device id
 377             _setIDSDeviceID = ((myDoSetDeviceID && !handledSetDeviceID));
 378
 379             _shadowDoSetIDSDeviceID = NO;
 380
 381             if(_setIDSDeviceID && !_isLocked && _isSecDRunningAsRoot == false && _doesSecDHavePeer)
 382                 [self doSetIDSDeviceID];
 383
 384             xpc_transaction_end();
 385         });
 386     });
 387 }
 388
 389 - (void) sendKeysCallout: (NSMutableDictionary*(^)(NSMutableDictionary* pending, NSError** error)) handleMessages {
 390     [self calloutWith: ^(NSMutableDictionary *pending, bool handlePendingMesssages, bool doSetDeviceID, dispatch_queue_t queue, void(^done)(NSMutableDictionary *, bool, bool)) {
 391         NSError* error = NULL;
 392
 393         NSMutableDictionary* handled = handleMessages(pending, &error);
 394
 395         dispatch_async(queue, ^{
 396             if (!handled && error) {
 397                 secerror("%@ did not handle message: %@", self, error);
 398             }
 399
 400             done(handled, NO, NO);
 401         });
 402     }];
 403 }
 404
 405 NSString* createErrorString(NSString* format, ...)
 406 {
 407     va_list va;
 408     va_start(va, format);
 409     NSString* errorString = ([[NSString alloc] initWithFormat:format arguments:va]);
 410     va_end(va);
 411     return errorString;
 412
 413 }
 414
 415 @end