keychain/securityd/SecDbQuery.h

   1 /*
   2  * Copyright (c) 2013-2014 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 /*!
  25  @header SecDbQuery.h - The thing that does the stuff with the gibli.
  26  */
  27
  28 #ifndef _SECURITYD_SECDBQUERY_H_
  29 #define _SECURITYD_SECDBQUERY_H_
  30
  31 #include "keychain/securityd/SecKeybagSupport.h"
  32 #include "keychain/securityd/SecDbItem.h"
  33 #include "ipc/securityd_client.h"   // be able to create queries which restrict API
  34
  35 __BEGIN_DECLS
  36
  37 typedef struct Pair *SecDbPairRef;
  38 typedef struct Query *SecDbQueryRef;
  39
  40 /* Return types. */
  41 typedef uint32_t ReturnTypeMask;
  42 enum
  43 {
  44     kSecReturnDataMask = 1 << 0,
  45     kSecReturnAttributesMask = 1 << 1,
  46     kSecReturnRefMask = 1 << 2,
  47     kSecReturnPersistentRefMask = 1 << 3,
  48 };
  49
  50 /* Constant indicating there is no limit to the number of results to return. */
  51 enum
  52 {
  53     kSecMatchUnlimited = kCFNotFound
  54 };
  55
  56 typedef struct Pair
  57 {
  58     const void *key;
  59     const void *value;
  60 } Pair;
  61
  62 /* Nothing in this struct is retained since all the
  63  values below are extracted from the dictionary passed in by the
  64  caller. */
  65 typedef struct Query
  66 {
  67     /* Class of this query. */
  68     const SecDbClass *q_class;
  69
  70     /* Dictionary with all attributes and values in clear (to be encrypted). */
  71     CFMutableDictionaryRef q_item;
  72
  73     /* q_pairs is an array of Pair structs.  Elements with indices
  74      [0, q_attr_end) contain attribute key value pairs.  Elements with
  75      indices [q_match_begin, q_match_end) contain match key value pairs.
  76      Thus q_attr_end is the number of attrs in q_pairs and
  77      q_match_begin - q_match_end is the number of matches in q_pairs.  */
  78     CFIndex q_match_begin;
  79     CFIndex q_match_end;
  80     CFIndex q_attr_end;
  81
  82     CFErrorRef q_error;
  83     ReturnTypeMask q_return_type;
  84
  85     CFDataRef q_data;
  86     CFTypeRef q_ref;
  87     sqlite_int64 q_row_id;
  88
  89     CFArrayRef q_use_item_list;
  90     CFBooleanRef q_use_tomb;
  91
  92     /* Value of kSecMatchLimit key if present. */
  93     CFIndex q_limit;
  94
  95     /* True if query contained a kSecAttrSynchronizable attribute,
  96      * regardless of its actual value. If this is false, then we
  97      * will add an explicit sync=0 to the query. */
  98     bool q_sync;
  99
 100     // Set to true if we modified any item as part of executing this query
 101     bool q_changed;
 102
 103     // Set to true if we modified any synchronizable item as part of executing this query
 104     bool q_sync_changed;
 105
 106     /* Keybag handle to use for this item. */
 107     keybag_handle_t q_keybag;
 108
 109     /* musr view to use when modifying the database */
 110     CFDataRef q_musrView;
 111
 112     /* ACL and credHandle passed to the query. q_cred_handle contain LA context object. */
 113     SecAccessControlRef q_access_control;
 114     CFDataRef q_use_cred_handle;
 115
 116     // Flag indicating that ui-protected items should be simply skipped
 117     // instead of reporting them to the client as an error.
 118     bool q_skip_acl_items;
 119
 120     // Some queries (e.g. backups) explicitly do not want to deal with clip-created items
 121     bool q_skip_app_clip_items;
 122
 123     // Set to true if any UUIDs generated by this query should be generated from the SHA2 digest of the item in question
 124     bool q_uuid_from_primary_key;
 125
 126     // Set to true if you'd like any Tombstones created by this query to have an mdat that is one second after the non-tombstone's mdat.
 127     // This is used if you're deleting an item, but are unsure when the item deletion occurred (e.g., you receive an item delete via CloudKit).
 128     bool q_tombstone_use_mdat_from_item;
 129
 130     // Set this to a callback that, on an add query, will get passed along with the CKKS subsystem and called when the item makes it off-device (or doesn't)
 131     __unsafe_unretained SecBoolCFErrorCallback q_add_sync_callback;
 132
 133     // SHA1 digest of DER encoded primary key
 134     CFDataRef q_primary_key_digest;
 135
 136     CFArrayRef q_match_issuer;
 137
 138     /* Caller acces groups for AKS */
 139     CFArrayRef q_caller_access_groups;
 140     bool q_system_keychain;
 141     int32_t q_sync_bubble;
 142     bool q_spindump_on_failure;
 143
 144     //policy for filtering certs and identities
 145     SecPolicyRef q_match_policy;
 146     //date for filtering certs and identities
 147     CFDateRef q_match_valid_on_date;
 148     //trusted only certs and identities
 149     CFBooleanRef q_match_trusted_only;
 150     //token persistent reference for filtering items is represented by token ID (in attrs) and token object ID
 151     CFDataRef q_token_object_id;
 152
 153     CFIndex q_pairs_count;
 154     Pair q_pairs[];
 155 } Query;
 156
 157 Query *query_create(const SecDbClass *qclass, CFDataRef musr, CFDictionaryRef query, SecurityClient* client, CFErrorRef *error);
 158 bool query_destroy(Query *q, CFErrorRef *error);
 159 bool query_error(Query *q, CFErrorRef *error);
 160 Query *query_create_with_limit(CFDictionaryRef query, CFDataRef musr, CFIndex limit, SecurityClient* client, CFErrorRef *error);
 161 void query_add_attribute(const void *key, const void *value, Query *q);
 162 void query_add_or_attribute(const void *key, const void *value, Query *q);
 163 void query_add_not_attribute(const void *key, const void *value, Query *q);
 164 void query_add_attribute_with_desc(const SecDbAttr *desc, const void *value, Query *q);
 165 void query_ensure_access_control(Query *q, CFStringRef agrp);
 166 void query_pre_add(Query *q, bool force_date);
 167 bool query_notify_and_destroy(Query *q, bool ok, CFErrorRef *error);
 168 CFIndex query_match_count(const Query *q);
 169 CFIndex query_attr_count(const Query *q);
 170 Pair query_attr_at(const Query *q, CFIndex ix);
 171 bool query_update_parse(Query *q, CFDictionaryRef update, CFErrorRef *error);
 172 const SecDbClass *kc_class_with_name(CFStringRef name);
 173 void query_set_caller_access_groups(Query *q, CFArrayRef caller_access_groups);
 174 void query_set_policy(Query *q, SecPolicyRef policy);
 175 void query_set_valid_on_date(Query *q, CFDateRef policy);
 176 void query_set_trusted_only(Query *q, CFBooleanRef trusted_only);
 177
 178 CFDataRef
 179 SecMUSRCopySystemKeychainUUID(void);
 180
 181 CFDataRef
 182 SecMUSRGetSystemKeychainUUID(void);
 183
 184 CFDataRef
 185 SecMUSRGetSingleUserKeychainUUID(void);
 186
 187 bool
 188 SecMUSRIsSingleUserView(CFDataRef uuid);
 189
 190 CFDataRef
 191 SecMUSRGetAllViews(void);
 192
 193 bool
 194 SecMUSRIsViewAllViews(CFDataRef musr);
 195
 196 #if TARGET_OS_IPHONE
 197 CFDataRef
 198 SecMUSRCreateActiveUserUUID(uid_t uid);
 199
 200 CFDataRef
 201 SecMUSRCreateSyncBubbleUserUUID(uid_t uid);
 202
 203 CFDataRef
 204 SecMUSRCreateBothUserAndSystemUUID(uid_t uid);
 205
 206 bool
 207 SecMUSRGetBothUserAndSystemUUID(CFDataRef musr, uid_t *uid);
 208
 209 #endif
 210
 211
 212 __END_DECLS
 213
 214 #endif /* _SECURITYD_SECDBQUERY_H_ */