keychain/ckks/CKKSViewManager.h

   1 /*
   2  * Copyright (c) 2016 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24
  25 #import <Foundation/Foundation.h>
  26
  27 #if OCTAGON
  28
  29 #include "keychain/securityd/SecDbItem.h"
  30 #import "keychain/ckks/CKKS.h"
  31 #import "keychain/ckks/OctagonAPSReceiver.h"
  32 #import "keychain/ckks/CKKSAccountStateTracker.h"
  33 #import "keychain/ckks/CKKSCloudKitClassDependencies.h"
  34 #import "keychain/ckks/CKKSCondition.h"
  35 #import "keychain/ckks/CKKSControlProtocol.h"
  36 #import "keychain/ckks/CKKSLockStateTracker.h"
  37 #import "keychain/ckks/CKKSReachabilityTracker.h"
  38 #import "keychain/ckks/CKKSNotifier.h"
  39 #import "keychain/ckks/CKKSPeer.h"
  40 #import "keychain/ckks/CKKSRateLimiter.h"
  41 #import "keychain/ckks/CloudKitDependencies.h"
  42 #import "keychain/ckks/CKKSZoneChangeFetcher.h"
  43 #import "keychain/ckks/CKKSZoneModifier.h"
  44 #import "keychain/ckks/CKKSKeychainBackedKey.h"
  45
  46 #import "keychain/ot/OTSOSAdapter.h"
  47 #import "keychain/ot/OTDefines.h"
  48
  49 NS_ASSUME_NONNULL_BEGIN
  50
  51 @class CKKSKeychainView, CKKSRateLimiter, TPSyncingPolicy;
  52
  53 @interface CKKSViewManager : NSObject <CKKSControlProtocol>
  54
  55 @property CKContainer* container;
  56 @property CKKSAccountStateTracker* accountTracker;
  57 @property CKKSLockStateTracker* lockStateTracker;
  58 @property CKKSReachabilityTracker *reachabilityTracker;
  59 @property CKKSZoneChangeFetcher* zoneChangeFetcher;
  60 @property CKKSZoneModifier* zoneModifier;
  61
  62 // Signaled when SecCKKSInitialize is complete, as it's async and likes to fire after tests are complete
  63 @property CKKSCondition* completedSecCKKSInitialize;
  64
  65 @property CKKSRateLimiter* globalRateLimiter;
  66
  67 @property id<OTSOSAdapter> sosPeerAdapter;
  68
  69 @property (readonly, nullable) TPSyncingPolicy* policy;
  70
  71 @property (readonly) NSMutableDictionary<NSString*, CKKSKeychainView*>* views;
  72
  73 - (instancetype)initWithContainer:(CKContainer*)container
  74                        sosAdapter:(id<OTSOSAdapter> _Nullable)sosAdapter
  75               accountStateTracker:(CKKSAccountStateTracker*)accountTracker
  76                  lockStateTracker:(CKKSLockStateTracker*)lockStateTracker
  77         cloudKitClassDependencies:(CKKSCloudKitClassDependencies*)cloudKitClassDependencies;
  78
  79 // Note: findView will not wait for any views to be created. You must handle
  80 // states where the daemon has not entirely started up yourself
  81 - (CKKSKeychainView* _Nullable)findView:(NSString*)viewName;
  82
  83 // Similar to findView, but will create the view if it's not already present.
  84 - (CKKSKeychainView*)findOrCreateView:(NSString*)viewName;
  85
  86 // findViewOrError will wait for the Syncing Policy to be loaded, which
  87 // creates all views. Don't call this from any important queues.
  88 - (CKKSKeychainView* _Nullable)findView:(NSString*)viewName error:(NSError**)error;
  89
  90 - (void)setView:(CKKSKeychainView*)obj;
  91 - (void)clearView:(NSString*)viewName;
  92
  93 - (NSSet<CKKSKeychainView*>*)currentViews;
  94
  95 - (void)setupAnalytics;
  96
  97 - (NSString* _Nullable)viewNameForItem:(SecDbItemRef)item;
  98
  99 - (void)handleKeychainEventDbConnection:(SecDbConnectionRef)dbconn
 100                                  source:(SecDbTransactionSource)txionSource
 101                                   added:(SecDbItemRef _Nullable)added
 102                                 deleted:(SecDbItemRef _Nullable)deleted;
 103
 104 - (void)setCurrentItemForAccessGroup:(NSData* _Nonnull)newItemPersistentRef
 105                                 hash:(NSData*)newItemSHA1
 106                          accessGroup:(NSString*)accessGroup
 107                           identifier:(NSString*)identifier
 108                             viewHint:(NSString*)viewHint
 109                            replacing:(NSData* _Nullable)oldCurrentItemPersistentRef
 110                                 hash:(NSData* _Nullable)oldItemSHA1
 111                             complete:(void (^)(NSError* operror))complete;
 112
 113 - (void)getCurrentItemForAccessGroup:(NSString*)accessGroup
 114                           identifier:(NSString*)identifier
 115                             viewHint:(NSString*)viewHint
 116                      fetchCloudValue:(bool)fetchCloudValue
 117                             complete:(void (^)(NSString* uuid, NSError* operror))complete;
 118
 119 - (void)registerSyncStatusCallback:(NSString*)uuid callback:(SecBoolNSErrorCallback)callback;
 120
 121 // Cancels pending operations owned by this view manager
 122 - (void)cancelPendingOperations;
 123
 124 + (instancetype)manager;
 125
 126 // Called by XPC every 24 hours
 127 - (void)xpc24HrNotification;
 128
 129 // Returns the current set of views
 130 - (NSSet<NSString*>*)viewList;
 131
 132 - (NSSet<NSString*>*)defaultViewList;
 133
 134 // Call this to set the syncing views+policy that this manager will use.
 135 // If beginCloudKitOperationOfAllViews has previously been called, then any new views created
 136 // as a result of this call will begin CK operation.
 137 - (BOOL)setCurrentSyncingPolicy:(TPSyncingPolicy* _Nullable)syncingPolicy;
 138
 139 // Similar to above, but please only pass policyIsFresh=YES if Octagon has contacted cuttlefish immediately previously
 140 // Returns YES if the view set has changed as part of this set
 141 - (BOOL)setCurrentSyncingPolicy:(TPSyncingPolicy* _Nullable)syncingPolicy policyIsFresh:(BOOL)policyIsFresh;
 142
 143 - (void)clearAllViews;
 144
 145 // Create all views, but don't begin CK/network operations
 146 // Remove as part of <rdar://problem/57768740> CKKS: ensure we collect keychain changes made before policy is loaded from disk
 147 - (void)createViews;
 148
 149 // Call this to begin CK operation of all views
 150 // This bit will be 'sticky', in that any new views created with also begin cloudkit operation immediately.
 151 // (clearAllViews will reset this bit.)
 152 - (void)beginCloudKitOperationOfAllViews;
 153
 154 // Notify sbd to re-backup.
 155 - (void)notifyNewTLKsInKeychain;
 156 - (void)syncBackupAndNotifyAboutSync;
 157
 158 // allow user blocking operation to block on trust status trying to sort it-self out the
 159 // first time after launch, only waits the the initial call
 160 - (BOOL)waitForTrustReady;
 161
 162 // Helper function to make CK containers
 163 + (CKContainer*)makeCKContainer:(NSString*)containerName
 164                          usePCS:(bool)usePCS;
 165
 166 // Checks featureflags to return whether we should use policy-based views, or use the hardcoded list
 167 - (BOOL)useCKKSViewsFromPolicy;
 168
 169 // Extract TLKs for sending to some peer. Pass restrictToPolicy=True if you want to restrict the returned TLKs
 170 // to what the current policy indicates (allowing to prioritize transferred TLKs)
 171 - (NSArray<CKKSKeychainBackedKey*>* _Nullable)currentTLKsFilteredByPolicy:(BOOL)restrictToPolicy error:(NSError**)error;
 172
 173 // Interfaces to examine sync callbacks
 174 - (SecBoolNSErrorCallback _Nullable)claimCallbackForUUID:(NSString* _Nullable)uuid;
 175 - (NSSet<NSString*>*)pendingCallbackUUIDs;
 176 + (void)callSyncCallbackWithErrorNoAccount:(SecBoolNSErrorCallback)syncCallback;
 177 @end
 178
 179 @interface CKKSViewManager (Testing)
 180 - (void)setOverrideCKKSViewsFromPolicy:(BOOL)value;
 181 - (void)resetSyncingPolicy;
 182
 183 - (void)haltAll;
 184 - (CKKSKeychainView*)restartZone:(NSString*)viewName;
 185 - (void)haltZone:(NSString*)viewName;
 186
 187 // If set, any set passed to setSyncingViews will be intersected with this set
 188 - (void)setSyncingViewsAllowList:(NSSet<NSString*>* _Nullable)viewNames;
 189 @end
 190 NS_ASSUME_NONNULL_END
 191
 192 #else
 193 @interface CKKSViewManager : NSObject
 194 @end
 195 #endif  // OCTAGON