]> git.saurik.com Git - apple/security.git/blob - OSX/sec/SOSCircle/SecureObjectSync/SOSEngine.c
projects / apple / security.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Security-58286.251.4.tar.gz
[apple/security.git] / OSX / sec / SOSCircle / SecureObjectSync / SOSEngine.c
1 /*
2 * Copyright (c) 2012-2017 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24
25 /*
26 * SOSEngine.c - Implementation of a secure object syncing engine
27 */
28
29 #include <Security/SecureObjectSync/SOSChangeTracker.h>
30 #include <Security/SecureObjectSync/SOSEnginePriv.h>
31 #include <Security/SecureObjectSync/SOSDigestVector.h>
32 #include <Security/SecureObjectSync/SOSInternal.h>
33 #include <Security/SecureObjectSync/SOSPeer.h>
34 #include <Security/SecureObjectSync/SOSViews.h>
35 #include <Security/SecureObjectSync/SOSBackupEvent.h>
36 #include <Security/SecureObjectSync/SOSPersist.h>
37 #include <Security/SecureObjectSync/SOSCloudCircleInternal.h>
38
39 #include <corecrypto/ccder.h>
40 #include <stdlib.h>
41 #include <stdbool.h>
42 #include <utilities/array_size.h>
43 #include <utilities/SecCFCCWrappers.h>
44 #include <utilities/SecCFError.h>
45 #include <utilities/SecCFRelease.h>
46 #include <utilities/SecCFWrappers.h>
47 #include <utilities/der_plist.h>
48 #include <utilities/der_plist_internal.h>
49 #include <utilities/debugging.h>
50 #include <utilities/iCloudKeychainTrace.h>
51 #include <utilities/SecCoreCrypto.h>
52 #include <utilities/SecFileLocations.h>
53 #include <utilities/SecADWrapper.h>
54 #include <utilities/SecTrace.h>
55
56
57 #include <AssertMacros.h>
58 #include <CoreFoundation/CoreFoundation.h>
59
60 #include <securityd/SecItemServer.h> // TODO: We can't leave this here.
61 #include <securityd/SOSCloudCircleServer.h> // TODO: We can't leave this here.
62 #include <Security/SecItem.h> // TODO: We can't leave this here.
63 #include <Security/SecItemPriv.h> // TODO: We can't leave this here.
64 #include <securityd/SecItemSchema.h>
65 #include <securityd/iCloudTrace.h>
66
67 #include <keychain/ckks/CKKS.h>
68
69 #include <CoreFoundation/CFURL.h>
70
71 #include <Security/SecureObjectSync/SOSEnsureBackup.h>
72
73 //
74 // MARK: SOSEngine The Keychain database with syncable keychain support.
75 //
76
77 //----------------------------------------------------------------------------------------
78 // MARK: Engine state v0
79 //----------------------------------------------------------------------------------------
80
81 // Key in dataSource for general engine state file.
82 // This file only has digest entries in it, no manifests.
83 static const CFStringRef kSOSEngineState = CFSTR("engine-state");
84
85 // Keys in state dictionary
86 static CFStringRef kSOSEngineManifestCacheKey = CFSTR("manifestCache");
87 static CFStringRef kSOSEnginePeerStateKey = CFSTR("peerState");
88 static CFStringRef kSOSEnginePeerIDsKey = CFSTR("peerIDs");
89 static CFStringRef kSOSEngineIDKey = CFSTR("id");
90 static CFStringRef kSOSEngineTraceDateKey = CFSTR("traceDate");
91
92 //----------------------------------------------------------------------------------------
93 // MARK: Engine state v2
94 //----------------------------------------------------------------------------------------
95
96 #if !TARGET_IPHONE_SIMULATOR
97 static const CFIndex kCurrentEngineVersion = 2;
98 #endif
99 // Keychain/datasource items
100 // Used for the kSecAttrAccount when saving in the datasource with dsSetStateWithKey
101 // Class D [kSecAttrAccessibleAlwaysPrivate/kSecAttrAccessibleAlwaysThisDeviceOnly]
102 CFStringRef kSOSEngineStatev2 = CFSTR("engine-state-v2");
103 CFStringRef kSOSEnginePeerStates = CFSTR("engine-peer-states");
104 CFStringRef kSOSEngineManifestCache = CFSTR("engine-manifest-cache");
105 CFStringRef kSOSEngineCoders = CFSTR("engine-coders");
106 #define kSOSEngineProtectionDomainClassA kSecAttrAccessibleWhenUnlockedThisDeviceOnly
107
108 // Keys for individual dictionaries
109 // engine-state-v2
110 CFStringRef kSOSEngineStateVersionKey = CFSTR("engine-stateVersion");
111
112 // Current save/load routines
113 // SOSEngineCreate/SOSEngineLoad/SOSEngineSetState
114 // SOSEngineSave/SOSEngineDoSave/SOSEngineCopyState
115 // no save/load functions external to this file
116
117 /*
118 Divide engine state into five pieces:
119
120 - General engine state
121 - My peer ID
122 - List of other (trusted) peer IDs
123
124 - Coder data (formerly in peer state)
125 - Backup Keybags (backup peers only)
126 - Peer state (including manifest hashes -- just keys into ManifestCache)
127 [__OpaqueSOSPeer/SOSPeerRef]
128 must-send
129 send-objects
130 sequence-number
131 Peer object states:
132 pending-objects
133 unwanted-manifest
134 confirmed-manifest
135 local-manifest
136 pending-manifest
137 Views
138
139 - Manifest Cache
140 - local manifest hashes (copy of local keychain)
141 - peer manifest hashes
142
143 These divisions are based on size, frequency of update, and protection domain
144
145 The Manifest Cache is a dictionary where each key is a hash over its entry,
146 which is a concatenation of 20 byte hashes of the keychain items. The local
147 keychain is present as one entry. The other entries are subsets of that, one
148 for each confirmed/pending/missing/unwanted shared with a peer. The local
149 keychain entry can be re-created by iterating over the databse, whereas the
150 others are built up through communicating with other peers.
151
152 83:d=2 hl=2 l= 13 prim: UTF8STRING :manifestCache
153 98:d=2 hl=4 l= 912 cons: SET
154 102:d=3 hl=2 l= 24 cons: SEQUENCE
155 104:d=4 hl=2 l= 20 prim: OCTET STRING [HEX DUMP]:DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
156 126:d=4 hl=2 l= 0 prim: OCTET STRING
157 128:d=3 hl=2 l= 124 cons: SEQUENCE
158 130:d=4 hl=2 l= 20 prim: OCTET STRING [HEX DUMP]:F9B59370A4733F0D174E8D220C5BE3AF062C775B
159 152:d=4 hl=2 l= 100 prim: OCTET STRING [HEX DUMP]:5A574BB4EC90C3BBCC69EE73CBFE039133AE807265D6A58003B8D205997EAB96390AAB207E63A2E270A476CAB5B2D9D2F7B0E55512AA957B58D5658E7EF907B069B83AA6BA941790A3C3C4A68292D59DABA3CA342966EFF82E1ACAEB691FD6E20772E17E
160 254:d=3 hl=4 l= 366 cons: SEQUENCE
161 258:d=4 hl=2 l= 20 prim: OCTET STRING [HEX DUMP]:2E69C2F7F3E014075B30004CE0EC6C1AD419EBF5
162 280:d=4 hl=4 l= 340 prim: OCTET STRING [HEX DUMP]:07571E9678FD7D68812E409CC96C1F54834A099A0C3A2D12CCE2EA95F4505EA52F2C982B2ADEE3DA14D4712C000309BF63D54A98B61AA1D963C40E0E2531C83B28CA5BE6DA0D26400C3C77A618F711DD3CC0BF86CCBAF8AA3332973268B30EEBF21CD8184D9C8427CA13DECCC7BB83C80009A2EF45CCC07F586315C80CEEEEF5D5352FD000AAE6D9CBB4294D5959FD00198225AF9ABD09B341A2FDC278E9FD1465D6A58003B8D205997EAB96390AAB207E63A2E270A476CAB5B2D9D2F7B0E55512AA957B58D5658E7EF907B069B83AA6BA941790A3C3C4A68292D59D95C9D4D8A8BCA2E8242AB0D409F671F298B6DCAE9BC4238C09E07548CEFB300098606F9E4F230C99ABA3CA342966EFF82E1ACAEB691FD6E20772E17EB4FEFB84F8CF75C0C69C59532C354D175A59F961BA4D4DFA017FD8192288F14278AE76712E127D65FE616C7E4FD0713644F7C9A7ABA1CE065694A968
163 624:d=3 hl=4 l= 386 cons: SEQUENCE
164 628:d=4 hl=2 l= 20 prim: OCTET STRING [HEX DUMP]:CCF179FF718C10F151E7409EDF1A06F0DF10DCAD
165 650:d=4 hl=4 l= 360 prim: OCTET STRING [HEX DUMP]:07571E9678FD7D68812E409CC96C1F54834A099A0C3A2D12CCE2EA95F4505EA52F2C982B2ADEE3DA14D4712C000309BF63D54A98B61AA1D963C40E0E2531C83B28CA5BE6DA0D26400C3C77A618F711DD3CC0BF86CCBAF8AA3332973268B30EEBF21CD8184D9C8427CA13DECCC7BB83C80009A2EF45CCC07F586315C80CEEEEF5D5352FD000AAE6D9CBB4294D5959FD00198225AF9ABD09B341A2FDC278E9FD145A574BB4EC90C3BBCC69EE73CBFE039133AE807265D6A58003B8D205997EAB96390AAB207E63A2E270A476CAB5B2D9D2F7B0E55512AA957B58D5658E7EF907B069B83AA6BA941790A3C3C4A68292D59D95C9D4D8A8BCA2E8242AB0D409F671F298B6DCAE9BC4238C09E07548CEFB300098606F9E4F230C99ABA3CA342966EFF82E1ACAEB691FD6E20772E17EB4FEFB84F8CF75C0C69C59532C354D175A59F961BA4D4DFA017FD8192288F14278AE76712E127D65FE616C7E4FD0713644F7C9A7ABA1CE065694A968
166
167 */
168
169
170
171 static bool SOSEngineLoad(SOSEngineRef engine, SOSTransactionRef txn, CFErrorRef *error);
172 static bool SOSEngineSetPeers_locked(SOSEngineRef engine, SOSPeerMetaRef myPeerMeta, CFArrayRef trustedPeerMetas, CFArrayRef untrustedPeerMetas);
173 static void SOSEngineApplyPeerState(SOSEngineRef engine, CFDictionaryRef peerStateMap);
174 static void SOSEngineSynthesizePeerMetas(SOSEngineRef engine, CFMutableArrayRef trustedPeersMetas, CFMutableArrayRef untrustedPeers);
175 static bool SOSEngineLoadCoders(SOSEngineRef engine, SOSTransactionRef txn, CFErrorRef *error);
176 #if !TARGET_IPHONE_SIMULATOR
177 static bool SOSEngineDeleteV0State(SOSEngineRef engine, SOSTransactionRef txn, CFErrorRef *error);
178 #endif
179
180 static CFStringRef SOSPeerIDArrayCreateString(CFArrayRef peerIDs) {
181 return peerIDs ? CFStringCreateByCombiningStrings(kCFAllocatorDefault, peerIDs, CFSTR(" ")) : CFSTR("");
182 }
183
184 static CFStringRef SOSEngineCopyFormattingDesc(CFTypeRef cf, CFDictionaryRef formatOptions) {
185 SOSEngineRef engine = (SOSEngineRef)cf;
186 CFStringRef tpDesc = SOSPeerIDArrayCreateString(engine->peerIDs);
187 CFStringRef desc = CFStringCreateWithFormat(kCFAllocatorDefault, formatOptions, CFSTR("<Engine %@ peers %@ MC[%d] PS[%d]>"), engine->myID, tpDesc, engine->manifestCache ? (int)CFDictionaryGetCount(engine->manifestCache) : 0, engine->peerMap ? (int)CFDictionaryGetCount(engine->peerMap) : 0);
188 CFReleaseSafe(tpDesc);
189 return desc;
190 }
191
192 static CFStringRef SOSEngineCopyDebugDesc(CFTypeRef cf) {
193 return SOSEngineCopyFormattingDesc(cf, NULL);
194 }
195
196 static dispatch_queue_t sEngineQueue;
197 static CFDictionaryRef sEngineMap;
198
199 CFGiblisWithFunctions(SOSEngine, NULL, NULL, NULL, NULL, NULL, SOSEngineCopyFormattingDesc, SOSEngineCopyDebugDesc, NULL, NULL, ^{
200 sEngineQueue = dispatch_queue_create("SOSEngine queue", DISPATCH_QUEUE_SERIAL);
201 sEngineMap = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
202 });
203
204 #define _LOG_RAW_MESSAGES 0
205 void logRawMessage(CFDataRef message, bool sending, uint64_t seqno)
206 {
207 #if _LOG_RAW_MESSAGES
208 CFStringRef hexMessage = NULL;
209 if (message) {
210 hexMessage = CFDataCopyHexString(message);
211 if (sending)
212 secnoticeq("engine", "%s RAW%1d %@", sending ? "send" : "recv", seqno?2:0, hexMessage);
213 else
214 secnoticeq("engine", "%s RAWx %@", sending ? "send" : "recv", hexMessage); // we don't know vers of received msg here
215 }
216 CFReleaseSafe(hexMessage);
217 #endif
218 }
219
220 //
221 // Peer state layout. WRONG! It's an array now
222 // The peer state is an array.
223 // The first element of the array is a dictionary with any number of keys and
224 // values in it (for future expansion) such as changing the digest size or type
225 // or remembering boolean flags for a peers sake.
226 // The next three are special in that they are manifest digests with special
227 // meaning and rules as to how they are treated (These are dynamically updated
228 // based on database activity so they have a fully history of all changes made
229 // to the local db. The first is the manifest representing the pendingObjects
230 // to send to the other peer. This is normally only ever appending to, and in
231 // particular with transactions originating from the Keychain API that affect
232 // syncable items will need to add the new objects digests to the pendingObjects list
233 // while adding the digests of any tombstones encountered to the extra list.
234
235 CFStringRef SOSEngineGetMyID(SOSEngineRef engine) {
236 // TODO: this should not be needed
237 return engine->myID;
238 }
239
240 // TEMPORARY: Get the list of IDs for cleanup, this shouldn't be used instead it should iterate KVS.
241 CFArrayRef SOSEngineGetPeerIDs(SOSEngineRef engine) {
242 if(!engine) return NULL;
243 return engine->peerIDs;
244 }
245
246 void SOSEngineClearCache(SOSEngineRef engine){
247 CFReleaseNull(engine->manifestCache);
248 CFReleaseNull(engine->localMinusUnreadableDigest);
249 if (engine->save_timer)
250 dispatch_source_cancel(engine->save_timer);
251 dispatch_release(engine->queue);
252 engine->queue = NULL;
253 }
254
255 static SOSPeerRef SOSEngineCopyPeerWithMapEntry_locked(SOSEngineRef engine, CFStringRef peerID, CFTypeRef mapEntry, CFErrorRef *error) {
256 SOSPeerRef peer = NULL;
257 if (mapEntry && CFGetTypeID(mapEntry) == SOSPeerGetTypeID()) {
258 // The mapEntry is an SOSPeer, so we're done.
259 peer = (SOSPeerRef)CFRetain(mapEntry);
260 } else {
261 // The mapEntry is a peerState, attempt to initialize a new
262 // peer iff peerID is in the set of trusted peerIDs
263 if (engine->peerIDs && CFArrayContainsValue(engine->peerIDs, CFRangeMake(0, CFArrayGetCount(engine->peerIDs)), peerID)) {
264 CFErrorRef localError = NULL;
265 peer = SOSPeerCreateWithState(engine, peerID, mapEntry, &localError);
266 if (!peer) {
267 secerror("error inflating peer: %@: %@ from state: %@", peerID, localError, mapEntry);
268 CFReleaseNull(localError);
269 peer = SOSPeerCreateWithState(engine, peerID, NULL, error);
270 }
271 if (peer) {
272 // Replace the map entry with the inflated peer.
273 CFDictionarySetValue(engine->peerMap, peerID, peer);
274 }
275 } else {
276 SOSErrorCreate(kSOSErrorPeerNotFound, error, NULL, CFSTR("peer: %@ is untrusted inflating not allowed"), peerID);
277 }
278 }
279 return peer;
280 }
281
282 static SOSPeerRef SOSEngineCopyPeerWithID_locked(SOSEngineRef engine, CFStringRef peerID, CFErrorRef *error) {
283 CFTypeRef mapEntry = CFDictionaryGetValue(engine->peerMap, peerID);
284 SOSPeerRef peer = NULL;
285 if (mapEntry) {
286 peer = SOSEngineCopyPeerWithMapEntry_locked(engine, peerID, mapEntry, error);
287 } else {
288 peer = NULL;
289 secerror("peer: %@ not found, peerMap: %@, engine: %@", peerID, engine->peerMap, engine);
290 SOSErrorCreate(kSOSErrorPeerNotFound, error, NULL, CFSTR("peer: %@ not found"), peerID);
291 }
292 return peer;
293 }
294
295 struct SOSEngineWithPeerContext {
296 SOSEngineRef engine;
297 void (^with)(SOSPeerRef peer);
298 };
299
300 static void SOSEngineWithPeerMapEntry_locked(const void *peerID, const void *mapEntry, void *context) {
301 struct SOSEngineWithPeerContext *ewp = context;
302 SOSPeerRef peer = SOSEngineCopyPeerWithMapEntry_locked(ewp->engine, peerID, mapEntry, NULL);
303 if (peer) {
304 ewp->with(peer);
305 CFRelease(peer);
306 }
307 }
308
309 static void SOSEngineForEachPeer_locked(SOSEngineRef engine, void (^with)(SOSPeerRef peer)) {
310 struct SOSEngineWithPeerContext ewp = { .engine = engine, .with = with };
311 CFDictionaryRef peerMapCopy = CFDictionaryCreateCopy(NULL, engine->peerMap);
312 CFDictionaryApplyFunction(peerMapCopy, SOSEngineWithPeerMapEntry_locked, &ewp);
313 CFRelease(peerMapCopy);
314 }
315
316 static void SOSEngineWithBackupPeerMapEntry_locked(const void *peerID, const void *mapEntry, void *context) {
317 struct SOSEngineWithPeerContext *ewp = context;
318 // v0 backup peer is always in map but we only consider it a backup peer if it has a keybag.
319 if (SOSPeerMapEntryIsBackup(mapEntry)) {
320 SOSPeerRef peer = SOSEngineCopyPeerWithMapEntry_locked(ewp->engine, peerID, mapEntry, NULL);
321 if (peer) {
322 ewp->with(peer);
323 CFRelease(peer);
324 }
325 }
326 }
327
328 static void SOSEngineForEachBackupPeer_locked(SOSEngineRef engine, void (^with)(SOSPeerRef peer)) {
329 struct SOSEngineWithPeerContext ewp = { .engine = engine, .with = with };
330 CFDictionaryRef peerMapCopy = CFDictionaryCreateCopy(NULL, engine->peerMap);
331 CFDictionaryApplyFunction(peerMapCopy, SOSEngineWithBackupPeerMapEntry_locked, &ewp);
332 CFRelease(peerMapCopy);
333 }
334
335 //
336 // Manifest cache
337 //
338 SOSManifestRef SOSEngineGetManifestForDigest(SOSEngineRef engine, CFDataRef digest) {
339 if (!engine->manifestCache || !digest) return NULL;
340 SOSManifestRef manifest = (SOSManifestRef)CFDictionaryGetValue(engine->manifestCache, digest);
341 if (!manifest) return NULL;
342 if (CFGetTypeID(manifest) != SOSManifestGetTypeID()) {
343 secerror("dropping corrupt manifest for %@ from cache", digest);
344 CFDictionaryRemoveValue(engine->manifestCache, digest);
345 return NULL;
346 }
347
348 return manifest;
349 }
350
351 void SOSEngineAddManifest(SOSEngineRef engine, SOSManifestRef manifest) {
352 CFDataRef digest = SOSManifestGetDigest(manifest, NULL);
353 if (digest) {
354 if (!engine->manifestCache)
355 engine->manifestCache = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
356 CFDictionaryAddValue(engine->manifestCache, digest, manifest);
357 }
358 }
359
360 CFDataRef SOSEnginePatchRecordAndCopyDigest(SOSEngineRef engine, SOSManifestRef base, SOSManifestRef removals, SOSManifestRef additions, CFErrorRef *error) {
361 CFDataRef digest = NULL;
362 SOSManifestRef manifest = SOSManifestCreateWithPatch(base, removals, additions, error);
363 if (manifest) {
364 SOSEngineAddManifest(engine, manifest);
365 digest = CFRetainSafe(SOSManifestGetDigest(manifest, NULL));
366 }
367 CFReleaseSafe(manifest);
368 return digest;
369 }
370
371 SOSManifestRef SOSEngineCopyPersistedManifest(SOSEngineRef engine, CFDictionaryRef persisted, CFStringRef key) {
372 return CFRetainSafe(SOSEngineGetManifestForDigest(engine, asData(CFDictionaryGetValue(persisted, key), NULL)));
373 }
374
375 CFMutableArrayRef SOSEngineCopyPersistedManifestArray(SOSEngineRef engine, CFDictionaryRef persisted, CFStringRef key, CFErrorRef *error) {
376 CFMutableArrayRef manifests = NULL;
377 CFArrayRef digests = NULL;
378 CFDataRef digest;
379 if (asArrayOptional(CFDictionaryGetValue(persisted, key), &digests, error))
380 manifests = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
381 if (digests) CFArrayForEachC(digests, digest) {
382 SOSManifestRef manifest = SOSEngineGetManifestForDigest(engine, digest);
383 if (manifest)
384 CFArrayAppendValue(manifests, manifest);
385 }
386 return manifests;
387 }
388
389 #if !TARGET_IPHONE_SIMULATOR
390 static CFDictionaryRef SOSEngineCopyEncodedManifestCache_locked(SOSEngineRef engine, CFErrorRef *error) {
391 CFMutableDictionaryRef mfc = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
392 SOSEngineForEachPeer_locked(engine, ^(SOSPeerRef peer) {
393 SOSPeerAddManifestsInUse(peer, mfc);
394 });
395 return mfc;
396 }
397 #endif
398
399 //
400 // End of Manifest cache
401 //
402
403 //----------------------------------------------------------------------------------------
404 // MARK: Coders
405 //----------------------------------------------------------------------------------------
406
407 /*
408 Each peer has an associated coder, whcih the engine keeps track of in a
409 CFDictionary indexed by peerID. The coders are read from disk when first needed,
410 then kept in memory as SOSCoders.
411
412 N.B. Don't rollback coder in memory if a transaction is rolled back, since this
413 might lead to reuse of an IV.
414 */
415
416 static bool SOSEngineCopyCoderData(SOSEngineRef engine, CFStringRef peerID, CFDataRef *coderData, CFErrorRef *error) {
417 bool ok = true;
418 SOSCoderRef coder = (SOSCoderRef)CFDictionaryGetValue(engine->coders, peerID);
419 if (coder && (CFGetTypeID(coder) == SOSCoderGetTypeID())) {
420 CFErrorRef localError = NULL;
421 ok = *coderData = SOSCoderCopyDER(coder, &localError);
422 if (!ok) {
423 secerror("failed to der encode coder for peer %@, dropping it: %@", peerID, localError);
424 CFDictionaryRemoveValue(engine->coders, peerID);
425 CFErrorPropagate(localError, error);
426 }
427 } else {
428 *coderData = NULL;
429 }
430 return ok;
431 }
432
433 static SOSCoderRef SOSEngineGetCoderInTx_locked(SOSEngineRef engine, SOSTransactionRef txn, CFStringRef peerID, CFErrorRef *error) {
434 if (!engine->haveLoadedCoders) {
435 engine->haveLoadedCoders = SOSEngineLoadCoders(engine, txn, error);
436
437 if (!engine->haveLoadedCoders) {
438 return NULL;
439 }
440 }
441
442 SOSCoderRef coder = (SOSCoderRef)CFDictionaryGetValue(engine->coders, peerID);
443 if (!coder || (CFGetTypeID(coder) != SOSCoderGetTypeID())) {
444 SOSErrorCreate(kSOSErrorPeerNotFound, error, NULL, CFSTR("No coder for peer: %@"), peerID);
445 }
446 return coder;
447 }
448
449 static bool SOSEngineEnsureCoder_locked(SOSEngineRef engine, SOSTransactionRef txn, CFStringRef peerID, SOSFullPeerInfoRef myPeerInfo, SOSPeerInfoRef peerInfo, SOSCoderRef ourCoder, CFErrorRef *error) {
450 //have to have caused coder loading, transactions do this.
451 if (!ourCoder || !SOSCoderIsFor(ourCoder, peerInfo, myPeerInfo)) {
452 secinfo("coder", "New coder for id %@.", peerID);
453 CFErrorRef localError = NULL;
454 SOSCoderRef coder = SOSCoderCreate(peerInfo, myPeerInfo, kCFBooleanFalse, &localError);
455 if (!coder) {
456 secerror("Failed to create coder for %@: %@", peerID, localError);
457 CFErrorPropagate(localError, error);
458 return false;
459 }
460 CFDictionarySetValue(engine->coders, peerID, coder);
461 secdebug("coder", "setting coder for peerid: %@, coder: %@", peerID, coder);
462 CFReleaseNull(coder);
463 engine->codersNeedSaving = true;
464 }
465 return true;
466 }
467
468 bool SOSEngineInitializePeerCoder(SOSEngineRef engine, SOSFullPeerInfoRef myPeerInfo, SOSPeerInfoRef peerInfo, CFErrorRef *error) {
469 __block bool ok = true;
470 CFStringRef peerID = SOSPeerInfoGetPeerID(peerInfo);
471
472 ok &= SOSEngineWithPeerID(engine, peerID, error, ^(SOSPeerRef peer, SOSCoderRef coder, SOSDataSourceRef dataSource, SOSTransactionRef txn, bool *forceSaveState) {
473 ok = SOSEngineEnsureCoder_locked(engine, txn, peerID, myPeerInfo, peerInfo, coder, error);
474 // Only set if the codersNeedSaving state gets set.
475 *forceSaveState = engine->codersNeedSaving;
476 });
477
478 return ok;
479 }
480
481 static bool SOSEngineGCPeerState_locked(SOSEngineRef engine, CFErrorRef *error) {
482 bool ok = true;
483
484 //require_quiet(ok = SOSEngineGCManifests_locked(engine, error), exit);
485
486 //exit:
487 return ok;
488 }
489 #if !TARGET_IPHONE_SIMULATOR
490 static CFMutableDictionaryRef SOSEngineCopyPeerState_locked(SOSEngineRef engine, CFErrorRef *error) {
491 CFMutableDictionaryRef peerState = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
492 CFDictionaryForEach(engine->peerMap, ^(const void *key, const void *value) {
493 CFDictionaryRef state = NULL;
494 if (value && CFGetTypeID(value) == SOSPeerGetTypeID()) {
495 CFErrorRef localError = NULL;
496 // Inflated peer
497 state = SOSPeerCopyState((SOSPeerRef)value, &localError);
498 if (!state)
499 secnotice("engine", "%@ failed to encode peer: %@", key, localError);
500 CFReleaseNull(localError);
501 // TODO: Potentially replace inflated peer with deflated peer in peerMap
502 } else if (value) {
503 // We have a deflated peer.
504 state = CFRetainSafe(value);
505 }
506
507 if (state) {
508 CFDictionarySetValue(peerState, key, state);
509 CFReleaseSafe(state);
510 }
511 });
512 return peerState;
513 }
514 #endif
515 static CFMutableDictionaryRef SOSEngineCopyPeerCoders_locked(SOSEngineRef engine, CFErrorRef *error) {
516 CFMutableDictionaryRef coders = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
517 CFDictionaryForEach(engine->peerMap, ^(const void *key, const void *value) {
518 CFDataRef coderData = NULL;
519 CFErrorRef localError = NULL;
520 bool ok = SOSEngineCopyCoderData(engine, (CFStringRef)key, &coderData, &localError);
521
522 if (!ok) {
523 secnotice("engine", "%@ no coder for peer: %@", key, localError);
524 }
525 if (ok && coderData) {
526 CFDictionarySetValue(coders, key, coderData);
527 }
528 CFReleaseNull(coderData);
529 CFReleaseNull(localError);
530 });
531 return coders;
532 }
533
534 //----------------------------------------------------------------------------------------
535 // MARK: Engine state v2 Save
536 //----------------------------------------------------------------------------------------
537
538 // Coders and keybags
539
540 static CFDataRef SOSEngineCopyCoders(SOSEngineRef engine, CFErrorRef *error) {
541 // Copy the CFDataRef version of the coders into a dictionary, which is then DER-encoded for saving
542 CFDictionaryRef coders = SOSEngineCopyPeerCoders_locked(engine, error);
543 secdebug("coders", "copying coders! %@", coders);
544 CFDataRef der = CFPropertyListCreateDERData(kCFAllocatorDefault, coders, error);
545 CFReleaseSafe(coders);
546 return der;
547 }
548
549 #pragma clang diagnostic push
550 #pragma clang diagnostic fatal "-Wshadow"
551 static bool SOSEngineSaveCoders(SOSEngineRef engine, SOSTransactionRef txn, CFErrorRef *error) {
552 // MUST hold engine lock
553 // Device must be unlocked for this to succeed
554
555 if(!engine->haveLoadedCoders){
556 secdebug("coders", "attempting to save coders before we have loaded them!");
557 }
558
559 bool ok = true;
560 if (engine->codersNeedSaving) {
561 CFDataRef derCoders = SOSEngineCopyCoders(engine, error);
562 ok = derCoders && SOSDataSourceSetStateWithKey(engine->dataSource, txn, kSOSEngineCoders,
563 kSOSEngineProtectionDomainClassA, derCoders, error);
564 if (ok) {
565 engine->codersNeedSaving = false;
566 secnotice("coder", "saved coders: %@", engine->coders);
567 }
568 CFReleaseSafe(derCoders);
569 }
570 return ok;
571 }
572 #pragma clang diagnostic pop
573
574 bool SOSTestEngineSaveCoders(CFTypeRef engine, SOSTransactionRef txn, CFErrorRef *error){
575 return SOSEngineSaveCoders((SOSEngineRef)engine, txn, error);
576 }
577 #if !TARGET_IPHONE_SIMULATOR
578
579 static CFDictionaryRef SOSEngineCopyBasicState(SOSEngineRef engine, CFErrorRef *error) {
580 // Create a version of the in-memory engine state for saving to disk
581 CFMutableDictionaryRef state = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
582 if (engine->myID)
583 CFDictionarySetValue(state, kSOSEngineIDKey, engine->myID);
584 if (engine->peerIDs)
585 CFDictionarySetValue(state, kSOSEnginePeerIDsKey, engine->peerIDs);
586 if (engine->lastTraceDate)
587 CFDictionarySetValue(state, kSOSEngineTraceDateKey, engine->lastTraceDate);
588
589 SOSPersistCFIndex(state, kSOSEngineStateVersionKey, kCurrentEngineVersion);
590 return state;
591 }
592
593 static bool SOSEngineDoSaveOneState(SOSEngineRef engine, SOSTransactionRef txn, CFStringRef key, CFStringRef pdmn,
594 CFDictionaryRef state, CFErrorRef *error) {
595 CFDataRef derState = CFPropertyListCreateDERData(kCFAllocatorDefault, state, error);
596 bool ok = derState && SOSDataSourceSetStateWithKey(engine->dataSource, txn, key, pdmn, derState, error);
597 CFReleaseSafe(derState);
598 return ok;
599 }
600
601 static bool SOSEngineDoSave(SOSEngineRef engine, SOSTransactionRef txn, CFErrorRef *error) {
602 bool ok = true;
603
604 CFDictionaryRef state = SOSEngineCopyBasicState(engine, error);
605 ok &= state && SOSEngineDoSaveOneState(engine, txn, kSOSEngineStatev2, kSOSEngineProtectionDomainClassD, state, error);
606 CFReleaseNull(state);
607
608 state = SOSEngineCopyPeerState_locked(engine, error);
609 ok &= state && SOSEngineDoSaveOneState(engine, txn, kSOSEnginePeerStates, kSOSEngineProtectionDomainClassD, state, error);
610 CFReleaseNull(state);
611
612 state = SOSEngineCopyEncodedManifestCache_locked(engine, error);
613 ok &= state && SOSEngineDoSaveOneState(engine, txn, kSOSEngineManifestCache, kSOSEngineProtectionDomainClassD, state, error);
614 CFReleaseNull(state);
615
616 ok &= SOSEngineSaveCoders(engine, txn, error);
617
618 SOSEngineDeleteV0State(engine, txn, NULL);
619
620 return ok;
621 }
622 #endif
623
624 static bool SOSEngineSave(SOSEngineRef engine, SOSTransactionRef txn, CFErrorRef *error) {
625 // Don't save engine state from tests
626 if (!engine->dataSource)
627 return true;
628 #if !TARGET_IPHONE_SIMULATOR
629 return SOSEngineDoSave(engine, txn, error);
630 #endif
631 return true;
632 }
633
634 //----------------------------------------------------------------------------------------
635 // MARK: Engine state v2 Load/Restore
636 //----------------------------------------------------------------------------------------
637
638 // Restore the in-memory state of engine from saved state loaded from the db
639 static bool SOSEngineSetManifestCacheWithDictionary(SOSEngineRef engine, CFDictionaryRef manifestCache, CFErrorRef *error) {
640 __block bool ok = true;
641 CFReleaseNull(engine->manifestCache);
642 if (manifestCache) {
643 engine->manifestCache = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
644 CFDictionaryForEach(manifestCache, ^(const void *key, const void *value) {
645 CFDataRef data = (CFDataRef)value;
646 if (isData(data)) {
647 SOSManifestRef mf = SOSManifestCreateWithData(data, NULL);
648 if (mf)
649 CFDictionarySetValue(engine->manifestCache, key, mf);
650 CFReleaseSafe(mf);
651 }
652 });
653 }
654
655 return ok;
656 }
657
658 static bool SOSEngineUpdateStateWithDictionary(SOSEngineRef engine, CFDictionaryRef stateDict, CFErrorRef *error) {
659 bool ok = true;
660 #if 0
661 if (stateDict) {
662 // If kCurrentEngineVersion > 2, uncomment and fill in code below
663 CFIndex engineVersion = 0 ;
664 bool versionPresent = SOSPeerGetOptionalPersistedCFIndex(stateDict, kSOSEngineStateVersionKey, &engineVersion);
665 if (versionPresent && (engineVersion != kCurrentEngineVersion)) {
666 // need migration
667 }
668 }
669 #endif
670 return ok;
671 }
672
673 static bool SOSEngineSetStateWithDictionary(SOSEngineRef engine, CFDictionaryRef stateDict, CFErrorRef *error) {
674 bool ok = true;
675 if (stateDict) {
676 SOSEngineUpdateStateWithDictionary(engine, stateDict, error);
677 CFRetainAssign(engine->myID, asString(CFDictionaryGetValue(stateDict, kSOSEngineIDKey), NULL));
678 CFRetainAssign(engine->peerIDs, asArray(CFDictionaryGetValue(stateDict, kSOSEnginePeerIDsKey), NULL));
679 CFRetainAssign(engine->lastTraceDate, asDate(CFDictionaryGetValue(stateDict, kSOSEngineTraceDateKey), NULL));
680
681 }
682 secnotice("engine", "%@", engine);
683 return ok;
684 }
685
686 static bool SOSEngineSetPeerStateWithDictionary(SOSEngineRef engine, CFDictionaryRef peerStateDict, CFErrorRef *error) {
687 // Set the in-memory peer state using the dictionary version of the DER-encoded version from disk
688 CFMutableArrayRef untrustedPeers = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
689 CFMutableArrayRef trustedPeersMetas = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
690 SOSEngineApplyPeerState(engine, asDictionary(peerStateDict, NULL));
691 SOSEngineSynthesizePeerMetas(engine, trustedPeersMetas, untrustedPeers);
692 SOSEngineSetPeers_locked(engine, engine->myID, trustedPeersMetas, untrustedPeers);
693 CFReleaseNull(trustedPeersMetas);
694 CFReleaseNull(untrustedPeers);
695 return true;
696 }
697
698 CFMutableDictionaryRef derStateToDictionaryCopy(CFDataRef state, CFErrorRef *error) {
699 bool ok = true;
700 CFMutableDictionaryRef stateDict = NULL;
701 if (state) {
702 const uint8_t *der = CFDataGetBytePtr(state);
703 const uint8_t *der_end = der + CFDataGetLength(state);
704 ok = der = der_decode_dictionary(kCFAllocatorDefault, kCFPropertyListMutableContainers, (CFDictionaryRef *)&stateDict, error, der, der_end);
705 if (der && der != der_end) {
706 ok = SOSErrorCreate(kSOSErrorDecodeFailure, error, NULL, CFSTR("trailing %td bytes at end of state"), der_end - der);
707 }
708 if (!ok) {
709 CFReleaseNull(stateDict);
710 }
711 }
712 return stateDict;
713 }
714 bool TestSOSEngineLoadCoders(CFTypeRef engine, SOSTransactionRef txn, CFErrorRef *error)
715 {
716 return SOSEngineLoadCoders((SOSEngineRef)engine, txn, error);
717 }
718
719 static bool SOSEngineLoadCoders(SOSEngineRef engine, SOSTransactionRef txn, CFErrorRef *error) {
720 // Read the serialized engine state from the datasource (aka keychain) and populate the in-memory engine
721 __block bool needPeerRegistration = false;
722 bool ok = true;
723 CFDataRef derCoders = NULL;
724 CFMutableDictionaryRef codersDict = NULL;
725 derCoders = SOSDataSourceCopyStateWithKey(engine->dataSource, kSOSEngineCoders, kSOSEngineProtectionDomainClassA, txn, error);
726 require_quiet(derCoders, xit);
727 codersDict = derStateToDictionaryCopy(derCoders, error);
728 require_quiet(codersDict, xit);
729
730 /*
731 * Make sure all peer have coders
732 */
733 CFDictionaryForEach(engine->peerMap, ^(const void *peerID, const void *peerState) {
734 /*
735 * Skip backup peer since they will never have coders
736 */
737 if (isString(peerID) && CFStringHasSuffix(peerID, CFSTR("-tomb"))) {
738 secnotice("coder", "Skipping coder check for peer: %@", peerID);
739 return;
740 }
741
742 CFTypeRef coderRef = CFDictionaryGetValue(codersDict, peerID);
743 if (coderRef) {
744 CFDataRef coderData = asData(coderRef, NULL);
745 if (coderData) {
746 CFErrorRef createError = NULL;
747 SOSCoderRef coder = SOSCoderCreateFromData(coderData, &createError);
748 if (coder) {
749 CFDictionaryAddValue(engine->coders, peerID, coder);
750 secnotice("coder", "adding coder: %@ for peerid: %@", coder, peerID);
751 } else {
752 secnotice("coder", "Coder for '%@' failed to create: %@", peerID, createError);
753 }
754 CFReleaseNull(createError);
755 CFReleaseNull(coder);
756 } else {
757 // Needed a coder, didn't find one, notify the account to help us out.
758 // Next attempt to sync will fix this
759 secnotice("coder", "coder for %@ was not cf data: %@", peerID, coderData);
760 needPeerRegistration = true;
761 }
762 } else{
763 secnotice("coder", "didn't find coder for peer: %@ engine dictionary: %@", peerID, codersDict);
764 needPeerRegistration = true;
765 }
766 });
767
768 secnotice("coder", "Will force peer registration: %s",needPeerRegistration ? "yes" : "no");
769
770 if (needPeerRegistration) {
771 dispatch_queue_t queue = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0);
772
773 dispatch_async(queue, ^{
774 CFErrorRef eprError = NULL;
775 if (!SOSCCProcessEnsurePeerRegistration_Server(&eprError)) {
776 secnotice("coder", "SOSCCProcessEnsurePeerRegistration failed with: %@", eprError);
777 }
778 CFReleaseNull(eprError);
779 });
780 }
781
782 engine->haveLoadedCoders = true;
783
784 xit:
785 CFReleaseNull(derCoders);
786 CFReleaseNull(codersDict);
787 return ok;
788 }
789 #if !TARGET_IPHONE_SIMULATOR
790 static bool SOSEngineDeleteV0State(SOSEngineRef engine, SOSTransactionRef txn, CFErrorRef *error) {
791 // SOSDataSourceDeleteStateWithKey(engine->dataSource, kSOSEngineState, kSOSEngineProtectionDomainClassD, txn, error);
792
793 // Create effectively empty state until delete is working
794 CFMutableDictionaryRef state = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
795 if (engine->myID)
796 CFDictionarySetValue(state, kSOSEngineIDKey, engine->myID);
797 CFDataRef derState = CFPropertyListCreateDERData(kCFAllocatorDefault, state, error);
798 CFReleaseNull(state);
799
800 bool ok = derState && SOSDataSourceSetStateWithKey(engine->dataSource, txn, kSOSEngineState, kSOSEngineProtectionDomainClassD, derState, error);
801 CFReleaseSafe(derState);
802 return ok;
803 }
804 #endif
805 static bool SOSEngineLoad(SOSEngineRef engine, SOSTransactionRef txn, CFErrorRef *error) {
806 // Read the serialized engine state from the datasource (aka keychain) and populate the in-memory engine
807 bool ok = true;
808 CFDataRef basicEngineState = NULL;
809 CFMutableDictionaryRef engineState = NULL;
810 CFDictionaryRef manifestCache = NULL;
811 CFDictionaryRef peerStateDict = NULL;
812 CFMutableDictionaryRef codersDict = NULL;
813 // Look for the v2 engine state first
814 basicEngineState = SOSDataSourceCopyStateWithKey(engine->dataSource, kSOSEngineStatev2, kSOSEngineProtectionDomainClassD, txn, error);
815 if (basicEngineState) {
816 CFDataRef data = NULL;
817 engineState = derStateToDictionaryCopy(basicEngineState, error);
818
819 data = SOSDataSourceCopyStateWithKey(engine->dataSource, kSOSEngineManifestCache, kSOSEngineProtectionDomainClassD, txn, error);
820 manifestCache = derStateToDictionaryCopy(data, error);
821 CFReleaseNull(data);
822
823 data = SOSDataSourceCopyStateWithKey(engine->dataSource, kSOSEnginePeerStates, kSOSEngineProtectionDomainClassD, txn, error);
824 peerStateDict = derStateToDictionaryCopy(data, error);
825 CFReleaseNull(data);
826 } else {
827 // Look for original V0 engine state next
828 CFDataRef v0EngineStateData = SOSDataSourceCopyStateWithKey(engine->dataSource, kSOSEngineState, kSOSEngineProtectionDomainClassD, txn, error);
829 if (v0EngineStateData) {
830 engineState = derStateToDictionaryCopy(v0EngineStateData, error);
831 if (engineState) {
832 manifestCache = CFRetainSafe(asDictionary(CFDictionaryGetValue(engineState, kSOSEngineManifestCacheKey), NULL));
833 peerStateDict = CFRetainSafe(asDictionary(CFDictionaryGetValue(engineState, kSOSEnginePeerStateKey), NULL));
834 }
835 CFReleaseNull(v0EngineStateData);
836 }
837 secnotice("coder", "Migrating from v0 engine state; dropping coders and forcing re-negotiation");
838 SOSCCEnsurePeerRegistration();
839
840 if (engine->peerIDs) {
841 SOSCCRequestSyncWithPeersList(engine->peerIDs);
842 }
843 }
844
845 ok = engineState && SOSEngineSetStateWithDictionary(engine, engineState, error);
846
847 ok &= SOSEngineSetManifestCacheWithDictionary(engine, manifestCache, error);
848
849 ok &= peerStateDict && SOSEngineSetPeerStateWithDictionary(engine, peerStateDict, error);
850
851 CFReleaseSafe(basicEngineState);
852 CFReleaseSafe(engineState);
853 CFReleaseSafe(manifestCache);
854 CFReleaseSafe(peerStateDict);
855 CFReleaseSafe(codersDict);
856 return ok;
857 }
858
859 bool SOSTestEngineSaveWithDER(SOSEngineRef engine, CFDataRef derState, CFErrorRef *error) {
860 assert(true);
861 return true;
862 }
863
864 bool SOSTestEngineSave(SOSEngineRef engine, SOSTransactionRef txn, CFErrorRef *error) {
865 bool bx = SOSEngineSave(engine, txn, error);
866 secnotice("test", "saved engine: %@", engine);
867 return bx;
868 }
869
870 bool SOSTestEngineLoad(SOSEngineRef engine, SOSTransactionRef txn, CFErrorRef *error) {
871 bool bx = SOSEngineLoad(engine, txn, error);
872 secnotice("test", "loaded engine: %@", engine);
873 return bx;
874 }
875
876 //----------------------------------------------------------------------------------------
877 // MARK: Change Trackers and Peer Manifests
878 //----------------------------------------------------------------------------------------
879
880 static SOSManifestRef SOSEngineCreateManifestWithViewNameSet_locked(SOSEngineRef engine, CFSetRef viewNameSet, CFErrorRef *error) {
881 // TODO: Potentially tell all changeTrackers to track manifests ( //forall ct do SOSChangeTrackerSetConcrete(ct, true);
882 // and read the entire dataSource and pass all objects though the filter here, instead of
883 // forcing the datasource to be able to do "smart" queries
884 return SOSDataSourceCopyManifestWithViewNameSet(engine->dataSource, viewNameSet, error);
885 }
886
887 static SOSChangeTrackerRef SOSEngineCopyChangeTrackerWithViewNameSet_locked(SOSEngineRef engine, CFSetRef viewNameSet, CFErrorRef *error) {
888 SOSChangeTrackerRef ct = (SOSChangeTrackerRef)CFDictionaryGetValue(engine->viewNameSet2ChangeTracker, viewNameSet);
889 if (!ct)
890 SOSErrorCreate(kSOSErrorPeerNotFound, error, NULL, CFSTR("no change tracker for view set %@"), viewNameSet);
891 return CFRetainSafe(ct);
892 }
893
894 static SOSManifestRef SOSEngineCopyManifestWithViewNameSet_locked(SOSEngineRef engine, CFSetRef viewNameSet, CFErrorRef *error) {
895 SOSChangeTrackerRef ct = SOSEngineCopyChangeTrackerWithViewNameSet_locked(engine, viewNameSet, error);
896 if (!ct)
897 return NULL;
898
899 SOSManifestRef manifest = SOSChangeTrackerCopyManifest(ct, NULL);
900 if (!manifest) {
901 manifest = SOSEngineCreateManifestWithViewNameSet_locked(engine, viewNameSet, error); // Do the SQL query
902 SOSChangeTrackerSetManifest(ct, manifest);
903 }
904 CFReleaseSafe(ct);
905 return manifest;
906 }
907
908 SOSManifestRef SOSEngineCopyLocalPeerManifest_locked(SOSEngineRef engine, SOSPeerRef peer, CFErrorRef *error) {
909 return SOSEngineCopyManifestWithViewNameSet_locked(engine, SOSPeerGetViewNameSet(peer), error);
910 }
911
912 #define withViewAndBackup(VIEW) do { with(VIEW); if (!isTomb) with(VIEW ## _tomb); } while(0)
913
914
915 // Invoke with once for each view an object is in.
916 // TODO: Move this function into the DataSource
917 static void SOSEngineObjectWithView(SOSEngineRef engine, SOSObjectRef object, void (^with)(CFStringRef view)) {
918 // Filter items into v0 only view here
919 SecDbItemRef item = (SecDbItemRef)object; // TODO: Layer violation, breaks tests
920 if (isDictionary(object)) {
921 CFTypeRef isTombValue = CFDictionaryGetValue((CFDictionaryRef)object, kSecAttrTombstone);
922 bool isTomb = isTombValue && CFBooleanGetValue(isTombValue);
923 // We are in the test just assume v0 and v2 views.
924 withViewAndBackup(kSOSViewKeychainV0);
925 } else if (SecDbItemIsSyncableOrCorrupted(item)) {
926 const SecDbClass *iclass = SecDbItemGetClass(item);
927 CFTypeRef pdmn = SecDbItemGetCachedValueWithName(item, kSecAttrAccessible);
928 if ((iclass == genp_class() || iclass == inet_class() || iclass == keys_class() || iclass == cert_class())
929 && isString(pdmn)
930 && (CFEqual(pdmn, kSecAttrAccessibleWhenUnlocked)
931 || CFEqual(pdmn, kSecAttrAccessibleAfterFirstUnlock)
932 || CFEqual(pdmn, kSecAttrAccessibleAlwaysPrivate)
933 || CFEqual(pdmn, kSecAttrAccessibleWhenUnlockedThisDeviceOnly)
934 || CFEqual(pdmn, kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly)
935 || CFEqual(pdmn, kSecAttrAccessibleAlwaysThisDeviceOnlyPrivate)))
936 {
937 CFTypeRef tomb = SecDbItemGetCachedValueWithName(item, kSecAttrTombstone);
938 char cvalue = 0;
939 bool isTomb = (isNumber(tomb) && CFNumberGetValue(tomb, kCFNumberCharType, &cvalue) && cvalue == 1);
940 CFStringRef viewHint = SecDbItemGetCachedValueWithName(item, kSecAttrSyncViewHint);
941
942 // check that view hint is a string, if its unset it will be kCFNull
943 if (!isString(viewHint)) {
944 viewHint = NULL;
945 }
946
947 // Intecept CKKS-handled items here and short-circuit function
948 if(SOSViewHintInCKKSSystem(viewHint)) {
949 return;
950 }
951
952 if (viewHint == NULL) {
953 if (iclass == cert_class()) {
954 withViewAndBackup(kSOSViewOtherSyncable);
955 } else {
956 if (!SecDbItemGetCachedValueWithName(item, kSecAttrTokenID)) {
957 withViewAndBackup(kSOSViewKeychainV0);
958 }
959 CFTypeRef agrp = SecDbItemGetCachedValueWithName(item, kSecAttrAccessGroup);
960 if (iclass == keys_class() && CFEqualSafe(agrp, CFSTR("com.apple.security.sos"))) {
961 withViewAndBackup(kSOSViewiCloudIdentity);
962 } else if (CFEqualSafe(agrp, CFSTR("com.apple.cfnetwork"))) {
963 withViewAndBackup(kSOSViewAutofillPasswords);
964 } else if (CFEqualSafe(agrp, CFSTR("com.apple.safari.credit-cards"))) {
965 withViewAndBackup(kSOSViewSafariCreditCards);
966 } else if (iclass == genp_class()) {
967 if (CFEqualSafe(agrp, CFSTR("apple")) &&
968 CFEqualSafe(SecDbItemGetCachedValueWithName(item, kSecAttrService), CFSTR("AirPort"))) {
969 withViewAndBackup(kSOSViewWiFi);
970 } else if (CFEqualSafe(agrp, CFSTR("com.apple.sbd"))) {
971 withViewAndBackup(kSOSViewBackupBagV0);
972 } else {
973 withViewAndBackup(kSOSViewOtherSyncable); // (genp)
974 }
975 } else {
976 withViewAndBackup(kSOSViewOtherSyncable); // (inet || keys)
977 }
978 }
979 } else {
980 with(viewHint);
981 if (!isTomb) {
982 CFStringRef viewHintTomb = CFStringCreateWithFormat(kCFAllocatorDefault, NULL, CFSTR("%@-tomb"), viewHint);
983 if (viewHintTomb) {
984 with(viewHintTomb);
985 CFRelease(viewHintTomb);
986 }
987 }
988 }
989 }
990 } else {
991 // TODO: general queries
992 #if 0
993 SOSViewRef view;
994 CFArrayForEachC(engine->views, view) {
995 bool inView = SOSViewQueryMatchItem(view, item);
996 if (inView) {
997 CFStringRef viewName = SOSViewCopyName(view);
998 with(viewName);
999 CFReleaseSafe(viewName);
1000 }
1001 }
1002 #endif
1003 }
1004 }
1005
1006 //
1007 // Deliver delayed notifiations of changes in keychain
1008 //
1009
1010 static void
1011 SOSSendViewNotification(CFSetRef viewNotifications)
1012 {
1013 CFNotificationCenterRef center = CFNotificationCenterGetDarwinNotifyCenter();
1014
1015 CFSetForEach(viewNotifications, ^(const void *value) {
1016 secinfo("view", "Sending view notification for view %@", value);
1017
1018 CFStringRef str = CFStringCreateWithFormat(NULL, NULL, CFSTR("com.apple.security.view-change.%@"), value);
1019 if (str == NULL)
1020 return;
1021
1022 CFNotificationCenterPostNotificationWithOptions(center, str, NULL, NULL, 0);
1023 CFRelease(str);
1024
1025 });
1026 }
1027
1028 static void
1029 SOSArmViewNotificationEvents(CFSetRef viewNotifications)
1030 {
1031 static CFMutableSetRef pendingViewNotifications;
1032 static dispatch_once_t onceToken;
1033 static dispatch_queue_t queue;
1034
1035 dispatch_once(&onceToken, ^{
1036 queue = dispatch_queue_create("ViewNotificationQueue", NULL);
1037 });
1038 if (queue == NULL || CFSetGetCount(viewNotifications) == 0)
1039 return;
1040
1041 /*
1042 * PendingViewNotifications is only modified on queue.
1043 * PendingViewNotifications is used as a signal if a timer is running.
1044 *
1045 * If a timer is running, new events are just added to the existing
1046 * pendingViewNotifications.
1047 */
1048
1049 #define DELAY_OF_NOTIFICATION_IN_NS (NSEC_PER_SEC)
1050
1051 CFRetain(viewNotifications);
1052
1053 dispatch_async(queue, ^{
1054 if (pendingViewNotifications == NULL) {
1055 pendingViewNotifications = CFSetCreateMutableCopy(NULL, 0, viewNotifications);
1056
1057 dispatch_after(dispatch_time(DISPATCH_TIME_NOW, (int64_t)DELAY_OF_NOTIFICATION_IN_NS), queue, ^{
1058 SOSSendViewNotification(pendingViewNotifications);
1059
1060 // when timer hits, clear out set of modified views
1061 CFRelease(pendingViewNotifications);
1062 pendingViewNotifications = NULL;
1063 });
1064 } else {
1065 CFSetUnion(pendingViewNotifications, viewNotifications);
1066 }
1067 CFRelease(viewNotifications);
1068 });
1069 }
1070
1071
1072 //
1073 // SOSChangeMapper - Helper for SOSEngineUpdateChanges_locked
1074 //
1075 struct SOSChangeMapper {
1076 SOSEngineRef engine;
1077 SOSTransactionRef txn;
1078 SOSDataSourceTransactionPhase phase;
1079 SOSDataSourceTransactionSource source;
1080 CFMutableDictionaryRef ct2changes;
1081 CFMutableSetRef viewNotifications;
1082 };
1083
1084 static void SOSChangeMapperInit(struct SOSChangeMapper *cm, SOSEngineRef engine, SOSTransactionRef txn, SOSDataSourceTransactionPhase phase, SOSDataSourceTransactionSource source) {
1085 cm->engine = engine;
1086 cm->txn = txn;
1087 cm->phase = phase;
1088 cm->source = source;
1089 cm->ct2changes = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
1090 cm->viewNotifications = CFSetCreateMutableForCFTypes(kCFAllocatorDefault);
1091 }
1092
1093 static void SOSChangeMapperSendNotifications(struct SOSChangeMapper *cm)
1094 {
1095 SOSArmViewNotificationEvents(cm->viewNotifications);
1096 }
1097
1098 static void SOSChangeMapperFree(struct SOSChangeMapper *cm) {
1099 CFReleaseSafe(cm->ct2changes);
1100 CFReleaseSafe(cm->viewNotifications);
1101 }
1102
1103 static void SOSChangeMapperAddViewNotification(struct SOSChangeMapper *cm, CFStringRef view)
1104 {
1105 assert(isString(view));
1106
1107 // aggregate the PCS view into one notification
1108 if (CFStringHasPrefix(view, CFSTR("PCS-"))) {
1109 view = CFSTR("PCS");
1110 }
1111 CFSetSetValue(cm->viewNotifications, view);
1112 }
1113
1114 static void SOSChangeMapperAppendObject(struct SOSChangeMapper *cm, SOSChangeTrackerRef ct, bool isAdd, CFTypeRef object) {
1115 CFMutableArrayRef changes = (CFMutableArrayRef)CFDictionaryGetValue(cm->ct2changes, ct);
1116 if (!changes) {
1117 changes = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
1118 CFDictionarySetValue(cm->ct2changes, ct, changes);
1119 CFReleaseSafe(changes);
1120 }
1121 isAdd ? SOSChangesAppendAdd(changes, object) : SOSChangesAppendDelete(changes, object);
1122 }
1123
1124 static bool SOSChangeMapperIngestChange(struct SOSChangeMapper *cm, bool isAdd, CFTypeRef change) {
1125 bool someoneCares = false;
1126 if (isData(change)) {
1127 // TODO: Reenable assertion once the tests have been updated
1128 //assert(!isAdd);
1129 // We got a digest for a deleted object. Our dataSource probably couldn't find
1130 // an object with this digest, probably because it went missing, or it was
1131 // discovered to be corrupted.
1132 // Tell all our changeTrackers about this digest since we don't know who might need it.
1133 CFDictionaryForEach(cm->engine->viewNameSet2ChangeTracker, ^(const void *viewNameSet, const void *ct) {
1134 SOSChangeMapperAppendObject(cm, (SOSChangeTrackerRef)ct, isAdd, change);
1135 });
1136 someoneCares = CFDictionaryGetCount(cm->engine->viewNameSet2ChangeTracker);
1137 } else {
1138 // We got an object let's figure out which views it's in and schedule it for
1139 // delivery to all changeTrackers interested in any of those views.
1140 SOSObjectRef object = (SOSObjectRef)change;
1141 CFMutableSetRef changeTrackerSet = CFSetCreateMutableForCFTypes(kCFAllocatorDefault);
1142 // First gather all the changeTrackers interested in this object (eliminating dupes by collecting them in a set)
1143 SOSEngineObjectWithView(cm->engine, object, ^(CFStringRef viewName) {
1144 const void *ctorset = CFDictionaryGetValue(cm->engine->viewName2ChangeTracker, viewName);
1145 if (isSet(ctorset)) {
1146 CFSetForEach((CFSetRef)ctorset, ^(const void *ct) { CFSetAddValue(changeTrackerSet, ct); });
1147 } else if (ctorset) {
1148 CFSetAddValue(changeTrackerSet, ctorset);
1149 }
1150
1151
1152 SOSChangeMapperAddViewNotification(cm, viewName);
1153 });
1154 // Then append the object to the changes array in the ct2changes dictionary keyed by viewSet
1155 CFSetForEach(changeTrackerSet, ^(const void *ct) {
1156 SOSChangeMapperAppendObject(cm, (SOSChangeTrackerRef)ct, isAdd, object);
1157 });
1158 someoneCares = CFSetGetCount(changeTrackerSet);
1159 CFReleaseSafe(changeTrackerSet);
1160 }
1161 return someoneCares;
1162 }
1163
1164 static bool SOSChangeMapperSend(struct SOSChangeMapper *cm, CFErrorRef *error) {
1165 __block bool ok = true;
1166 CFDictionaryForEach(cm->ct2changes, ^(const void *ct, const void *changes) {
1167 ok &= SOSChangeTrackerTrackChanges((SOSChangeTrackerRef)ct, cm->engine, cm->txn, cm->source, cm->phase, (CFArrayRef)changes, error);
1168 });
1169 return ok;
1170 }
1171
1172 static bool SOSEngineUpdateChanges_locked(SOSEngineRef engine, SOSTransactionRef txn, SOSDataSourceTransactionPhase phase, SOSDataSourceTransactionSource source, CFArrayRef changes, CFErrorRef *error)
1173 {
1174 secnoticeq("engine", "%@: %s %s %ld changes, txn=%@, %p", engine->myID, phase == kSOSDataSourceTransactionWillCommit ? "will-commit" : phase == kSOSDataSourceTransactionDidCommit ? "did-commit" : "did-rollback",
1175 source == kSOSDataSourceSOSTransaction ? "sos" :
1176 source == kSOSDataSourceCKKSTransaction ? "ckks" :
1177 source == kSOSDataSourceAPITransaction ? "api" :
1178 "unknown",
1179 CFArrayGetCount(changes), txn, txn);
1180 bool ok = true;
1181 switch (phase) {
1182 case kSOSDataSourceTransactionDidRollback:
1183 ok &= SOSEngineLoad(engine, txn, error);
1184 break;
1185 case kSOSDataSourceTransactionDidCommit: // Corruption causes us to process items at DidCommit
1186 case kSOSDataSourceTransactionWillCommit:
1187 {
1188 bool mappedItemChanged = false;
1189
1190 struct SOSChangeMapper cm;
1191 SOSChangeMapperInit(&cm, engine, txn, phase, source);
1192 SecDbEventRef event;
1193 CFArrayForEachC(changes, event) {
1194 CFTypeRef deleted = NULL;
1195 CFTypeRef inserted = NULL;
1196 SecDbEventGetComponents(event, &deleted, &inserted, error);
1197 if (deleted) {
1198 bool someoneCares = SOSChangeMapperIngestChange(&cm, false, deleted);
1199 if (someoneCares) {
1200 #if TARGET_OS_EMBEDDED
1201 SecADAddValueForScalarKey(CFSTR("com.apple.security.sos.delete"), 1);
1202 #endif
1203 mappedItemChanged = true;
1204 }
1205 }
1206 if (inserted) {
1207 bool someoneCares = SOSChangeMapperIngestChange(&cm, true, inserted);
1208 if (someoneCares) {
1209 #if TARGET_OS_EMBEDDED
1210 if (deleted == NULL) {
1211 SecADAddValueForScalarKey(CFSTR("com.apple.security.sos.add"), 1);
1212 } else {
1213 SecADAddValueForScalarKey(CFSTR("com.apple.security.sos.update"), 1);
1214 }
1215 #endif
1216 mappedItemChanged = true;
1217 }
1218 if (!someoneCares && !isData(inserted) && SecDbItemIsTombstone((SecDbItemRef)inserted) && !CFEqualSafe(SecDbItemGetValue((SecDbItemRef)inserted, &v7utomb, NULL), kCFBooleanTrue)) {
1219 CFErrorRef localError = NULL;
1220 // A tombstone was inserted but there is no changetracker that
1221 // cares about it.
1222 if (!SecDbItemDoDeleteSilently((SecDbItemRef)inserted, (SecDbConnectionRef)txn, &localError)) {
1223 secerror("failed to delete tombstone %@ that no one cares about: %@", inserted, localError);
1224 CFReleaseNull(localError);
1225 }
1226 }
1227 }
1228 }
1229
1230 ok &= SOSChangeMapperSend(&cm, error);
1231 SOSChangeMapperSendNotifications(&cm); // Trigger notifications for view that changes changed
1232 SOSChangeMapperFree(&cm);
1233
1234 if (ok && phase == kSOSDataSourceTransactionWillCommit) {
1235 // Only consider writing if we're in the WillCommit phase.
1236 // DidCommit phases happen outside the database lock and
1237 // writing to the DBConn will cause deadlocks.
1238 if (mappedItemChanged || source == kSOSDataSourceSOSTransaction) {
1239 // Write SOSEngine and SOSPeer state to disk
1240 #if OCTAGON
1241 if(!SecCKKSTestDisableSOS()) {
1242 #endif
1243 secnotice("engine", "saving engine state");
1244 ok &= SOSEngineSave(engine, txn, error);
1245
1246 if (kSOSDataSourceAPITransaction == source || kSOSDataSourceCKKSTransaction == source)
1247 SOSCCRequestSyncWithPeersList(engine->peerIDs);
1248 #if OCTAGON
1249 }
1250 #endif
1251 } else {
1252 secinfo("engine", "Not saving engine state, nothing changed.");
1253 }
1254 }
1255
1256 break;
1257 }
1258 }
1259 return ok;
1260 }
1261
1262 static void SOSEngineSetNotifyPhaseBlock(SOSEngineRef engine) {
1263 SOSDataSourceAddNotifyPhaseBlock(engine->dataSource, ^(SOSDataSourceRef ds, SOSTransactionRef txn, SOSDataSourceTransactionPhase phase, SOSDataSourceTransactionSource source, CFArrayRef changes) {
1264 dispatch_sync(engine->queue, ^{
1265 CFErrorRef localError = NULL;
1266 if (!SOSEngineUpdateChanges_locked(engine, txn, phase, source, changes, &localError)) {
1267 secerror("updateChanged failed: %@", localError);
1268 }
1269 CFReleaseSafe(localError);
1270 });
1271 });
1272 }
1273
1274 #if 0 // TODO: update these checks
1275 static void SOSEngineCircleChanged_sanitycheck(SOSEngineRef engine, CFStringRef myPeerID, CFArrayRef trustedPeers, CFArrayRef untrustedPeers) {
1276 // Logging code
1277 CFMutableArrayRef addedPeers = CFArrayCreateDifference(kCFAllocatorDefault, trustedPeers, engine->peerIDs);
1278 CFMutableArrayRef deletedPeers = CFArrayCreateDifference(kCFAllocatorDefault, engine->peerIDs, trustedPeers);
1279 CFMutableArrayRef addedUntrustedPeers = CFArrayCreateDifference(kCFAllocatorDefault, untrustedPeers, engine->peerIDs);
1280 CFMutableArrayRef deletedUntrustedPeers = CFArrayCreateDifference(kCFAllocatorDefault, engine->peerIDs, untrustedPeers);
1281
1282 CFStringRef tpDesc = SOSPeerIDArrayCreateString(trustedPeers);
1283 CFStringRef apDesc = SOSPeerIDArrayCreateString(addedPeers);
1284 CFStringRef dpDesc = SOSPeerIDArrayCreateString(deletedPeers);
1285 CFStringRef aupDesc = SOSPeerIDArrayCreateString(addedUntrustedPeers);
1286 CFStringRef dupDesc = SOSPeerIDArrayCreateString(deletedUntrustedPeers);
1287 secnotice("engine", "trusted %@ added %@ removed %@ add ut: %@ rem ut: %@", tpDesc, apDesc, dpDesc, aupDesc, dupDesc);
1288 CFReleaseSafe(dupDesc);
1289 CFReleaseSafe(aupDesc);
1290 CFReleaseSafe(dpDesc);
1291 CFReleaseSafe(apDesc);
1292 CFReleaseSafe(tpDesc);
1293
1294 // Assertions:
1295 // Ensure SOSAccount isn't giving us the runaround.
1296 // Assert that trustedPeers, untrustedPeers and myPeerId are disjoint sets
1297 if (trustedPeers) {
1298 CFMutableArrayRef allTrustedPeers = CFArrayCreateDifference(kCFAllocatorDefault, trustedPeers, untrustedPeers);
1299 assert(CFEqual(trustedPeers, allTrustedPeers));
1300 CFReleaseSafe(allTrustedPeers);
1301 assert(!CFArrayContainsValue(trustedPeers, CFRangeMake(0, CFArrayGetCount(trustedPeers)), myPeerID));
1302 }
1303 if (untrustedPeers) {
1304 CFMutableArrayRef allUntrustedPeers = CFArrayCreateDifference(kCFAllocatorDefault, untrustedPeers, trustedPeers);
1305 assert(CFEqual(untrustedPeers, allUntrustedPeers));
1306 CFReleaseSafe(allUntrustedPeers);
1307 assert(!CFArrayContainsValue(untrustedPeers, CFRangeMake(0, CFArrayGetCount(trustedPeers)), myPeerID));
1308 }
1309
1310 CFReleaseNull(deletedUntrustedPeers);
1311 CFReleaseNull(addedUntrustedPeers);
1312 CFReleaseNull(deletedPeers);
1313 CFReleaseNull(addedPeers);
1314
1315 // End of logging and asertions, actual code here.
1316 }
1317 #endif
1318
1319 static SOSChangeTrackerRef SOSReferenceAndGetChangeTracker(CFDictionaryRef lookup, CFMutableDictionaryRef referenced, CFSetRef viewNameSet) {
1320 SOSChangeTrackerRef ct = (SOSChangeTrackerRef)CFDictionaryGetValue(referenced, viewNameSet);
1321 if (!ct) {
1322 ct = (SOSChangeTrackerRef)CFDictionaryGetValue(lookup, viewNameSet);
1323 if (ct) {
1324 SOSChangeTrackerResetRegistration(ct);
1325 CFDictionarySetValue(referenced, viewNameSet, ct);
1326 } else {
1327 ct = SOSChangeTrackerCreate(kCFAllocatorDefault, false, NULL, NULL);
1328 CFDictionarySetValue(referenced, viewNameSet, ct);
1329 CFReleaseSafe(ct);
1330 }
1331 }
1332 return ct;
1333 }
1334
1335 static void CFStringAppendPeerIDAndViews(CFMutableStringRef desc, CFStringRef peerID, CFSetRef vns) {
1336 CFStringSetPerformWithDescription(vns, ^(CFStringRef description) {
1337 CFStringAppendFormat(desc, NULL, CFSTR(" %@ (%@)"), peerID, description);
1338 });
1339 }
1340
1341 // Must be called after updating viewNameSet2ChangeTracker
1342 static void SOSEngineUpdateViewName2ChangeTracker(SOSEngineRef engine) {
1343 // Create the mapping from viewName -> ChangeTracker used for lookup during change notification
1344 CFMutableDictionaryRef newViewName2ChangeTracker = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
1345 CFDictionaryForEach(engine->viewNameSet2ChangeTracker, ^(const void *viewNameSet, const void *ct) {
1346 CFSetForEach(viewNameSet, ^(const void *viewName) {
1347 const void *ctorset = NULL;
1348 if (CFDictionaryGetValueIfPresent(newViewName2ChangeTracker, viewName, &ctorset)) {
1349 if (isSet(ctorset)) {
1350 CFSetAddValue((CFMutableSetRef)ctorset, ct);
1351 } else if (!CFEqual(ct, ctorset)) {
1352 CFMutableSetRef set = CFSetCreateMutableForCFTypes(kCFAllocatorDefault);
1353 CFSetAddValue(set, ctorset);
1354 CFSetAddValue(set, ct);
1355 CFDictionaryReplaceValue(newViewName2ChangeTracker, viewName, set);
1356 CFRelease(set);
1357 }
1358 } else {
1359 CFDictionarySetValue(newViewName2ChangeTracker, viewName, ct);
1360 }
1361 });
1362 });
1363 CFAssignRetained(engine->viewName2ChangeTracker, newViewName2ChangeTracker);
1364 }
1365
1366 static void SOSEngineSetBackupBag(SOSEngineRef engine, SOSObjectRef bagItem);
1367
1368 // This is called only if we are in a circle and we should listen for keybag changes
1369 static void SOSEngineRegisterBackupBagV0Tracker(SOSEngineRef engine, CFMutableDictionaryRef newViewNameSet2ChangeTracker, CFMutableStringRef desc) {
1370 SOSChangeTrackerRef bbct = SOSReferenceAndGetChangeTracker(engine->viewNameSet2ChangeTracker, newViewNameSet2ChangeTracker, SOSViewsGetV0BackupBagViewSet());
1371 SOSChangeTrackerRegisterChangeUpdate(bbct, ^bool(SOSChangeTrackerRef ct, SOSEngineRef engine, SOSTransactionRef txn, SOSDataSourceTransactionSource source, SOSDataSourceTransactionPhase phase, CFArrayRef changes, CFErrorRef *error) {
1372 SOSChangeRef change;
1373 CFArrayForEachC(changes, change) {
1374 CFTypeRef object = NULL;
1375 bool isAdd = SOSChangeGetObject(change, &object);
1376 SecDbItemRef dbi = (SecDbItemRef)object;
1377 if (!isData(object) &&
1378 CFEqualSafe(SecDbItemGetCachedValueWithName(dbi, kSecAttrService), CFSTR("SecureBackupService")) &&
1379 CFEqualSafe(SecDbItemGetCachedValueWithName(dbi, kSecAttrAccessible), kSecAttrAccessibleWhenUnlocked) &&
1380 CFEqualSafe(SecDbItemGetCachedValueWithName(dbi, kSecAttrAccount), CFSTR("SecureBackupPublicKeybag"))) {
1381 SOSEngineSetBackupBag(engine, isAdd ? (SOSObjectRef)object : NULL);
1382 }
1383 }
1384 return true;
1385 });
1386 }
1387
1388 static void SOSEngineReferenceBackupPeer(SOSEngineRef engine, CFStringRef peerID, CFSetRef viewNameSet, CFDataRef keyBag, CFMutableDictionaryRef newViewNameSet2ChangeTracker, CFMutableDictionaryRef newPeerMap) {
1389 CFTypeRef oldEntry = CFDictionaryGetValue(engine->peerMap, peerID);
1390 CFTypeRef newEntry = SOSPeerOrStateSetViewsKeyBagAndCreateCopy(oldEntry, viewNameSet, keyBag);
1391 if (newEntry) {
1392 if (isDictionary(newEntry)) {
1393 // Backup peers, are always inflated
1394 CFAssignRetained(newEntry, SOSPeerCreateWithState(engine, peerID, newEntry, NULL));
1395 // If !oldEntry this is an edge (first creation of a peer).
1396 if (!oldEntry) {
1397 SOSPeerKeyBagDidChange((SOSPeerRef)newEntry);
1398 }
1399 }
1400 CFDictionarySetValue(newPeerMap, peerID, newEntry);
1401 CFRelease(newEntry);
1402
1403 if (keyBag) {
1404 SOSChangeTrackerRef ct = SOSReferenceAndGetChangeTracker(engine->viewNameSet2ChangeTracker, newViewNameSet2ChangeTracker, viewNameSet);
1405
1406 SOSChangeTrackerUpdatesChanges child = Block_copy(^bool(SOSChangeTrackerRef ct, SOSEngineRef engine, SOSTransactionRef txn, SOSDataSourceTransactionSource source, SOSDataSourceTransactionPhase phase, CFArrayRef changes, CFErrorRef *error) {
1407 return SOSPeerDataSourceWillChange((SOSPeerRef)newEntry, SOSEngineGetDataSource(engine), source, changes, error);
1408 });
1409
1410 SOSChangeTrackerRegisterChangeUpdate(ct, child);
1411 Block_release(child);
1412 }
1413 }
1414 }
1415
1416 static void SOSEngineReferenceSyncPeer(SOSEngineRef engine, CFStringRef peerID, CFSetRef viewNameSet, CFMutableDictionaryRef newViewNameSet2ChangeTracker, CFMutableDictionaryRef newPeerMap) {
1417 CFTypeRef newEntry = SOSPeerOrStateSetViewsKeyBagAndCreateCopy(CFDictionaryGetValue(engine->peerMap, peerID), viewNameSet, NULL);
1418 if (newEntry) {
1419 SOSChangeTrackerRef ct = SOSReferenceAndGetChangeTracker(engine->viewNameSet2ChangeTracker, newViewNameSet2ChangeTracker, viewNameSet);
1420 // Standard peer, inflated on demand
1421 SOSChangeTrackerUpdatesManifests trackManifest;
1422 if (isDictionary(newEntry)) {
1423 // Uninflated peer, inflate on first notification.
1424 trackManifest = ^bool(SOSChangeTrackerRef ct, SOSEngineRef engine, SOSTransactionRef txn, SOSDataSourceTransactionSource source, SOSDataSourceTransactionPhase phase, SOSManifestRef removals, SOSManifestRef additions, CFErrorRef *error) {
1425 CFErrorRef localError = NULL;
1426 SOSPeerRef peer = SOSEngineCopyPeerWithID_locked(engine, peerID, &localError);
1427 bool ok;
1428 if (!peer) {
1429 secerror("%@: peer failed to inflate: %@", peerID, localError);
1430 CFReleaseSafe(localError);
1431 ok = false;
1432 } else {
1433 ok = SOSPeerDataSourceWillCommit(peer, source, removals, additions, error);
1434 }
1435 CFReleaseSafe(peer);
1436 return ok;
1437 };
1438 } else {
1439 // Inflated peer, just forward the changes to the peer
1440 trackManifest = ^bool(SOSChangeTrackerRef ct, SOSEngineRef engine, SOSTransactionRef txn, SOSDataSourceTransactionSource source, SOSDataSourceTransactionPhase phase, SOSManifestRef removals, SOSManifestRef additions, CFErrorRef *error) {
1441 return SOSPeerDataSourceWillCommit((SOSPeerRef)newEntry, source, removals, additions, error);
1442 };
1443 }
1444 SOSChangeTrackerUpdatesManifests trackManifestCopy = Block_copy(trackManifest);
1445 SOSChangeTrackerRegisterManifestUpdate(ct, trackManifestCopy);
1446 Block_release(trackManifestCopy);
1447
1448 CFDictionarySetValue(newPeerMap, peerID, newEntry);
1449 CFRelease(newEntry);
1450 }
1451 }
1452
1453
1454 static void SOSEngineReferenceTrustedPeer(SOSEngineRef engine, SOSPeerMetaRef peerMeta, CFMutableDictionaryRef newViewNameSet2ChangeTracker, CFMutableDictionaryRef newPeerMap, CFMutableArrayRef peerIDs, CFMutableStringRef desc) {
1455 CFSetRef viewNameSet = NULL;
1456 CFDataRef keyBag = NULL;
1457 CFStringRef peerID = SOSPeerMetaGetComponents(peerMeta, &viewNameSet, &keyBag, NULL);
1458 // We trust peerID so append it to peerIDs
1459 CFArrayAppendValue(peerIDs, peerID);
1460 if (desc) CFStringAppendPeerIDAndViews(desc, peerID, viewNameSet);
1461 // Update the viewNameSet for this peer, to appease tests, default to a viewset of the V0 view.
1462 if (!viewNameSet)
1463 viewNameSet = SOSViewsGetV0ViewSet();
1464
1465 // Always inflate backup peers, since they need to register with their changeTrackers right away.
1466 if (keyBag) {
1467 SOSEngineReferenceBackupPeer(engine, peerID, viewNameSet, keyBag, newViewNameSet2ChangeTracker, newPeerMap);
1468 } else {
1469 SOSEngineReferenceSyncPeer(engine, peerID, viewNameSet, newViewNameSet2ChangeTracker, newPeerMap);
1470 }
1471 }
1472
1473 static CFDataRef SOSEngineCopyV0KeyBag(SOSEngineRef engine, CFErrorRef *error) {
1474 // Return the keybag for the given peerID.
1475 /*
1476 Values for V0 are:
1477 kSecAttrAccessGroup ==> CFSTR("com.apple.sbd")
1478 kSecAttrAccessible ==> kSecAttrAccessibleWhenUnlocked
1479 kSecAttrAccount ==> CFSTR("SecureBackupPublicKeybag")
1480 kSecAttrService ==> CFSTR("SecureBackupService")
1481 */
1482
1483 CFMutableDictionaryRef keys = CFDictionaryCreateMutableForCFTypesWith(kCFAllocatorDefault,
1484 kSecAttrAccessGroup, CFSTR("com.apple.sbd"),
1485 kSecAttrAccount, CFSTR("SecureBackupPublicKeybag"),
1486 kSecAttrService, CFSTR("SecureBackupService"),
1487 kSecAttrAccessible, kSecAttrAccessibleWhenUnlocked,
1488 kSecAttrSynchronizable, kCFBooleanTrue,
1489 NULL);
1490
1491 CFDataRef keybag = engine->dataSource->dsCopyItemDataWithKeys(engine->dataSource, keys, error);
1492 CFReleaseSafe(keys);
1493
1494 return keybag;
1495 }
1496
1497 static void SOSEngineReferenceBackupV0Peer(SOSEngineRef engine, CFMutableDictionaryRef newViewNameSet2ChangeTracker, CFMutableDictionaryRef newPeerMap, CFMutableArrayRef newPeerIDs, CFMutableStringRef desc) {
1498 SOSPeerRef backupPeer = (SOSPeerRef)CFDictionaryGetValue(engine->peerMap, kSOSViewKeychainV0_tomb);
1499 CFDataRef bag = NULL;
1500 if (backupPeer && CFGetTypeID(backupPeer) == SOSPeerGetTypeID()) {
1501 bag = CFRetainSafe(SOSPeerGetKeyBag(backupPeer));
1502 } else {
1503 CFErrorRef localError = NULL;
1504 bag = SOSEngineCopyV0KeyBag(engine, &localError);
1505 if (!bag) {
1506 secnotice("engine", "No keybag found for v0 backup peer: %@", localError);
1507 CFReleaseSafe(localError);
1508 }
1509 }
1510 SOSEngineReferenceBackupPeer(engine, kSOSViewKeychainV0_tomb, SOSViewsGetV0BackupViewSet(), bag, newViewNameSet2ChangeTracker, newPeerMap);
1511 CFReleaseNull(bag);
1512 }
1513
1514 static void SOSEngineReferenceTrustedPeers(SOSEngineRef engine, CFMutableDictionaryRef newViewNameSet2ChangeTracker, CFMutableDictionaryRef newPeerMap, CFMutableArrayRef newPeerIDs, CFArrayRef trustedPeerMetas, CFMutableStringRef desc) {
1515 // Then update the views for all trusted peers and add them to newPeerMap.
1516 if (trustedPeerMetas != NULL && CFArrayGetCount(trustedPeerMetas) != 0) {
1517 if (desc) CFStringAppend(desc, CFSTR(" trusted"));
1518 // Remake engine->peerIDs
1519 SOSPeerMetaRef peerMeta;
1520 CFArrayForEachC(trustedPeerMetas, peerMeta) {
1521 SOSEngineReferenceTrustedPeer(engine, peerMeta, newViewNameSet2ChangeTracker, newPeerMap, newPeerIDs, desc);
1522 }
1523 }
1524 }
1525
1526 static void SOSEngineReferenceUntrustedPeers(SOSEngineRef engine, CFMutableDictionaryRef newPeerMap, CFArrayRef untrustedPeerMetas, CFMutableStringRef description) {
1527 // Copy any untrustedPeers to newPeerMap as well if we have a state
1528 // for them, if not no big deal. We also serialize all the untrustedPeers
1529 // since they don't need to be deserializable
1530 if (untrustedPeerMetas != NULL && CFArrayGetCount(untrustedPeerMetas) != 0) {
1531 if (description) CFStringAppend(description, CFSTR(" untrusted"));
1532 SOSPeerMetaRef peerMeta;
1533 CFArrayForEachC(untrustedPeerMetas, peerMeta) {
1534 CFSetRef views = NULL;
1535 CFStringRef peerID = SOSPeerMetaGetComponents(peerMeta, &views, NULL, NULL);
1536 if (description) CFStringAppendPeerIDAndViews(description, peerID, views);
1537 CFSetRef nviews = NULL;
1538 if (!views)
1539 views = nviews = CFSetCreate(kCFAllocatorDefault, NULL, 0, &kCFTypeSetCallBacks);
1540 CFTypeRef newEntry = SOSPeerOrStateSetViewsAndCopyState(CFDictionaryGetValue(engine->peerMap, peerID), views);
1541 CFReleaseSafe(nviews);
1542 if (newEntry) {
1543 CFDictionarySetValue(newPeerMap, peerID, newEntry);
1544 CFReleaseSafe(newEntry);
1545 }
1546 }
1547 }
1548 }
1549
1550 static void SOSEngineReferenceChangeTrackers(SOSEngineRef engine, CFArrayRef trustedPeerMetas, CFArrayRef untrustedPeerMetas, CFMutableStringRef desc) {
1551 CFMutableArrayRef newPeerIDs = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
1552 CFMutableDictionaryRef newPeerMap = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
1553 CFMutableDictionaryRef newViewNameSet2ChangeTracker = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
1554
1555 if (engine->myID) {
1556 // We have an engineID => in a circle (with 0 or more peers)
1557 // Ensure we have a v0 backup peer and it's listening for backup bag changes
1558 SOSEngineReferenceBackupV0Peer(engine, newViewNameSet2ChangeTracker, newPeerMap, newPeerIDs, desc);
1559 SOSEngineRegisterBackupBagV0Tracker(engine, newViewNameSet2ChangeTracker, desc);
1560 }
1561 SOSEngineReferenceTrustedPeers(engine, newViewNameSet2ChangeTracker, newPeerMap, newPeerIDs, trustedPeerMetas, desc);
1562 SOSEngineReferenceUntrustedPeers(engine, newPeerMap, untrustedPeerMetas, desc);
1563
1564 CFAssignRetained(engine->peerIDs, newPeerIDs);
1565 CFAssignRetained(engine->peerMap, newPeerMap);
1566 CFAssignRetained(engine->viewNameSet2ChangeTracker, newViewNameSet2ChangeTracker);
1567 SOSEngineUpdateViewName2ChangeTracker(engine);
1568 }
1569
1570 // Return true iff peers or views changed
1571 static bool SOSEngineSetPeers_locked(SOSEngineRef engine, SOSPeerMetaRef myPeerMeta, CFArrayRef trustedPeerMetas, CFArrayRef untrustedPeerMetas) {
1572 CFErrorRef error = NULL;
1573 CFSetRef myViews = NULL;
1574 CFDataRef myKeyBag = NULL;
1575 CFMutableStringRef desc = CFStringCreateMutableCopy(kCFAllocatorDefault, 0, CFSTR("me"));
1576 CFStringRef myPeerID = myPeerMeta ? SOSPeerMetaGetComponents(myPeerMeta, &myViews, &myKeyBag, &error) : NULL;
1577 if (desc) CFStringAppendPeerIDAndViews(desc, myPeerID, myViews);
1578
1579 // Start with no coders
1580 CFMutableDictionaryRef codersToKeep = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
1581
1582 if(engine->haveLoadedCoders){
1583 // If we're the same peerID we keep known peers (both trusted and untrusted)
1584 if (CFEqualSafe(myPeerID, engine->myID)) {
1585 void (^copyPeerMetasCoder)(const void *value) = ^(const void*element) {
1586 SOSPeerMetaRef peerMeta = (SOSPeerMetaRef) element;
1587
1588 CFStringRef currentID = SOSPeerMetaGetComponents(peerMeta, NULL, NULL, NULL);
1589 if (currentID) {
1590 SOSCoderRef coder = (SOSCoderRef) CFDictionaryGetValue(engine->coders, currentID);
1591 if (coder) {
1592 CFDictionarySetValue(codersToKeep, currentID, coder);
1593 }
1594 }
1595 };
1596
1597 if (trustedPeerMetas) {
1598 CFArrayForEach(trustedPeerMetas, copyPeerMetasCoder);
1599 }
1600 if (untrustedPeerMetas) {
1601 CFArrayForEach(untrustedPeerMetas, copyPeerMetasCoder);
1602 }
1603 }
1604
1605 engine->codersNeedSaving = true;
1606 }
1607 CFRetainAssign(engine->myID, myPeerID);
1608 CFTransferRetained(engine->coders, codersToKeep);
1609
1610 // Remake engine->peerMap from both trusted and untrusted peers
1611 SOSEngineReferenceChangeTrackers(engine, trustedPeerMetas, untrustedPeerMetas, desc);
1612
1613 secnotice("engine", "%@", desc);
1614 CFReleaseSafe(desc);
1615 return true;
1616 }
1617
1618 static void SOSEngineApplyPeerState(SOSEngineRef engine, CFDictionaryRef peerStateMap) {
1619 if (peerStateMap) CFDictionaryForEach(peerStateMap, ^(const void *peerID, const void *peerState) {
1620 CFTypeRef mapEntry = CFDictionaryGetValue(engine->peerMap, peerID);
1621 if (mapEntry && CFGetTypeID(mapEntry) == SOSPeerGetTypeID()) {
1622 // Update the state of any already inflated peers
1623 SOSPeerRef peer = (SOSPeerRef)mapEntry;
1624 CFErrorRef localError = NULL;
1625 if (!SOSPeerSetState(peer, engine, peerState, &localError)) {
1626 CFStringRef stateHex = NULL;
1627 stateHex = CFDataCopyHexString(peerState);
1628 secerror("peer: %@: bad state: %@ in engine state: %@", peerID, localError, stateHex);
1629 CFReleaseSafe(stateHex);
1630 CFReleaseNull(localError);
1631 // Possibly ask for an ensurePeerRegistration so we have a good list of peers again.
1632 }
1633 } else {
1634 // Just record the state for non inflated peers for now.
1635 CFDictionarySetValue(engine->peerMap, peerID, peerState);
1636 }
1637 });
1638 }
1639
1640 static void SOSEngineSynthesizePeerMetas(SOSEngineRef engine, CFMutableArrayRef trustedPeersMetas, CFMutableArrayRef untrustedPeers) {
1641 CFSetRef trustedPeerSet = engine->peerIDs ? CFSetCreateCopyOfArrayForCFTypes(engine->peerIDs) : NULL;
1642 CFDictionaryForEach(engine->peerMap, ^(const void *peerID, const void *peerState) {
1643 SOSPeerMetaRef meta = NULL;
1644 if (peerState && CFGetTypeID(peerState) == SOSPeerGetTypeID()) {
1645 SOSPeerRef peer = (SOSPeerRef)peerState;
1646 meta = SOSPeerMetaCreateWithComponents(peerID, SOSPeerGetViewNameSet(peer), SOSPeerGetKeyBag(peer));
1647 } else {
1648 // We don't need to add the meta for the backup case, since
1649 // SOSEngineReferenceBackupV0Peer will do the right thing
1650 if (!CFEqualSafe(peerID, kSOSViewKeychainV0_tomb)) {
1651 meta = SOSPeerMetaCreateWithState(peerID, peerState);
1652 }
1653 }
1654 // Any peer in peerStateMap that is not in trustedPeers is an untrustedPeer unless it's the v0 backup peer
1655 if ((trustedPeerSet && CFSetContainsValue(trustedPeerSet, peerID)) || CFEqualSafe(peerID, kSOSViewKeychainV0_tomb)) {
1656 if (meta) {
1657 CFArrayAppendValue(trustedPeersMetas, meta);
1658 }
1659 } else {
1660 CFArrayAppendValue(untrustedPeers, peerID);
1661 }
1662 CFReleaseNull(meta);
1663 });
1664 CFReleaseNull(trustedPeerSet);
1665 }
1666
1667 static void SOSEngineSetBackupBag(SOSEngineRef engine, SOSObjectRef bagItem) {
1668 CFMutableStringRef desc = NULL;
1669 SOSPeerRef backupPeer = SOSEngineCopyPeerWithID_locked(engine, kSOSViewKeychainV0_tomb, NULL);
1670 CFDataRef keybag = NULL;
1671 if (bagItem) {
1672 keybag = SecDbItemGetValue((SecDbItemRef)bagItem, &v6v_Data, NULL);
1673 }
1674
1675 // Since SOSPeerSetKeyBag() doesn't notify on the edge from NULL->initial keybag, since
1676 // that is the right behaviour for non v0 backup peers, we need to do it here for the v0 peer.
1677 bool hadBag = SOSPeerGetKeyBag(backupPeer);
1678 SOSPeerSetKeyBag(backupPeer, keybag);
1679 if (!hadBag)
1680 SOSPeerKeyBagDidChange(backupPeer);
1681
1682 CFReleaseSafe(backupPeer);
1683
1684 CFMutableArrayRef untrustedPeerMetas = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
1685 CFMutableArrayRef trustedPeersMetas = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
1686 SOSEngineSynthesizePeerMetas(engine, trustedPeersMetas, untrustedPeerMetas);
1687 SOSEngineReferenceChangeTrackers(engine, trustedPeersMetas, untrustedPeerMetas, desc);
1688 CFReleaseSafe(trustedPeersMetas);
1689 CFReleaseSafe(untrustedPeerMetas);
1690 }
1691
1692 #define SECONDS_PER_DAY (86400.0)
1693
1694 #if (TARGET_OS_MAC && !(TARGET_OS_EMBEDDED || TARGET_OS_IPHONE))
1695 #define TRACE_INTERVAL (7 * SECONDS_PER_DAY)
1696 #elif (TARGET_OS_IPHONE && !TARGET_IPHONE_SIMULATOR)
1697 #define TRACE_INTERVAL (1 * SECONDS_PER_DAY)
1698 #endif
1699
1700 #ifdef TRACE_INTERVAL
1701 static void SOSEngineCloudKeychainTrace(SOSEngineRef engine, CFAbsoluteTime now) {
1702 CFAssignRetained(engine->lastTraceDate, CFDateCreate(kCFAllocatorDefault, now));
1703 CFIndex num_peers = engine->peerIDs ? 1 + CFArrayGetCount(engine->peerIDs) : 1;
1704 SOSManifestRef manifest = SOSEngineCopyManifestWithViewNameSet_locked(engine, SOSViewsGetV0ViewSet(), NULL);
1705 if (!manifest)
1706 manifest = SOSDataSourceCopyManifestWithViewNameSet(engine->dataSource, SOSViewsGetV0ViewSet(), NULL);
1707 size_t num_items = SOSManifestGetCount(manifest);
1708 CFReleaseSafe(manifest);
1709
1710 struct _SecServerKeyStats genpStats = { };
1711 struct _SecServerKeyStats inetStats = { };
1712 struct _SecServerKeyStats keysStats = { };
1713
1714 _SecServerGetKeyStats(genp_class(), &genpStats);
1715 _SecServerGetKeyStats(inet_class(), &inetStats);
1716 _SecServerGetKeyStats(keys_class(), &keysStats);
1717
1718 dispatch_async(dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0), ^{
1719 CloudKeychainTrace(num_peers, num_items, &genpStats, &inetStats, &keysStats);
1720 });
1721 }
1722 #endif
1723
1724 static void SOSEngineCloudKeychainTraceIfNeeded(SOSEngineRef engine) {
1725 #ifdef TRACE_INTERVAL
1726 if (!engine->myID)
1727 return;
1728 CFAbsoluteTime now = CFAbsoluteTimeGetCurrent();
1729 if (engine->lastTraceDate) {
1730 CFAbsoluteTime lastTraceTime = CFDateGetAbsoluteTime(engine->lastTraceDate);
1731 if ((now - lastTraceTime) >= TRACE_INTERVAL) {
1732 SOSEngineCloudKeychainTrace(engine, now);
1733 }
1734 } else {
1735 SOSEngineCloudKeychainTrace(engine, now);
1736 }
1737 #endif
1738 }
1739
1740
1741 static bool SOSEngineCircleChanged_locked(SOSEngineRef engine, SOSPeerMetaRef myPeerMeta, CFArrayRef trustedPeers, CFArrayRef untrustedPeers) {
1742 // Sanity check params
1743 // SOSEngineCircleChanged_sanitycheck(engine, myPeerID, trustedPeers, untrustedPeers);
1744
1745 // Transform from SOSPeerInfoRefs to CFDictionaries with the info we want per peer.
1746 // Or, Tell the real SOSPeerRef what the SOSPeerInfoRef is and have it copy out the data it needs.
1747 bool peersOrViewsChanged = SOSEngineSetPeers_locked(engine, myPeerMeta, trustedPeers, untrustedPeers);
1748
1749 // Run though all peers and only cache manifests for peers we still have
1750 CFErrorRef localError = NULL;
1751 if (!SOSEngineGCPeerState_locked(engine, &localError)) {
1752 secerror("SOSEngineGCPeerState_locked failed: %@", localError);
1753 CFReleaseNull(localError);
1754 }
1755 return peersOrViewsChanged;
1756 }
1757
1758 // Initialize the engine if a load fails. Basically this is our first time setup
1759 static bool SOSEngineInit(SOSEngineRef engine, CFErrorRef *error) {
1760 bool ok = true;
1761 secnotice("engine", "new engine for datasource named %@", SOSDataSourceGetName(engine->dataSource));
1762 CFAssignRetained(engine->peerMap, CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault));
1763 CFAssignRetained(engine->viewNameSet2ChangeTracker, CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault));
1764 CFAssignRetained(engine->viewName2ChangeTracker, CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault));
1765 CFReleaseNull(engine->manifestCache);
1766 CFReleaseNull(engine->peerIDs);
1767 // TODO: We shouldn't need to load the backup bag if there was no engine
1768 // state (load failed), since that means there was no circle nor were we an applicant.
1769
1770 // Set up change trackers so we know when a backup peer needs to be created?
1771 // no, since myID is not set, we are not in a circle, so no need to back up
1772 SOSEngineSetPeers_locked(engine, NULL, NULL, NULL);
1773 return ok;
1774 }
1775
1776 // Called by our DataSource in its constructor
1777 SOSEngineRef SOSEngineCreate(SOSDataSourceRef dataSource, CFErrorRef *error) {
1778 SOSEngineRef engine = NULL;
1779 engine = CFTypeAllocate(SOSEngine, struct __OpaqueSOSEngine, kCFAllocatorDefault);
1780 engine->dataSource = dataSource;
1781 engine->queue = dispatch_queue_create("engine", DISPATCH_QUEUE_SERIAL);
1782
1783 engine->peerMap = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
1784 engine->viewNameSet2ChangeTracker = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
1785 engine->viewName2ChangeTracker = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
1786 //engine->syncCompleteQueue = NULL;
1787 engine->syncCompleteListener = NULL;
1788 engine->coders = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
1789 engine->haveLoadedCoders = false;
1790 engine->codersNeedSaving = false;
1791
1792 CFErrorRef engineError = NULL;
1793 if (!SOSEngineLoad(engine, NULL, &engineError)) {
1794 secwarning("engine failed load state starting with nothing %@", engineError);
1795 CFReleaseNull(engineError);
1796 if (!SOSEngineInit(engine, error)) {
1797 secerror("engine failed to initialze %@ giving up", error ? *error : NULL);
1798 }
1799 } else {
1800 // Successfully loaded engine state, let's trace if we haven't in a while
1801 SOSEngineCloudKeychainTraceIfNeeded(engine);
1802 }
1803 SOSEngineSetNotifyPhaseBlock(engine);
1804 return engine;
1805 }
1806
1807 // --- Called from off the queue, need to move to on the queue
1808
1809 static void SOSEngineDoOnQueue(SOSEngineRef engine, dispatch_block_t action)
1810 {
1811 dispatch_sync(engine->queue, action);
1812 }
1813
1814 static bool SOSEngineDoTxnOnQueue(SOSEngineRef engine, CFErrorRef *error, void(^transaction)(SOSTransactionRef txn, bool *commit))
1815 {
1816 return SOSDataSourceWithCommitQueue(engine->dataSource, error, ^(SOSTransactionRef txn, bool *commit) {
1817 SOSEngineDoOnQueue(engine, ^{ transaction(txn, commit); });
1818 });
1819 }
1820
1821 //
1822 // MARK: SOSEngine API
1823 //
1824
1825 void SOSEngineDispose(SOSEngineRef engine) {
1826 // NOOP Engines stick around forever to monitor dataSource changes.
1827 engine->dataSource = NULL;
1828 CFReleaseNull(engine->coders);
1829 }
1830
1831 void SOSEngineForEachPeer(SOSEngineRef engine, void (^with)(SOSPeerRef peer)) {
1832 SOSEngineDoOnQueue(engine, ^{
1833 SOSEngineForEachPeer_locked(engine, with);
1834 });
1835 }
1836
1837 static void SOSEngineForEachBackupPeer(SOSEngineRef engine, void (^with)(SOSPeerRef peer)) {
1838 SOSEngineDoOnQueue(engine, ^{
1839 SOSEngineForEachBackupPeer_locked(engine, with);
1840 });
1841 }
1842
1843 static const CFStringRef kSecADSecurityNewItemSyncTimeKey = CFSTR("com.apple.security.secureobjectsync.itemtime.new");
1844 static const CFStringRef kSecADSecurityKnownItemSyncTimeKey = CFSTR("com.apple.security.secureobjectsync.itemtime.known");
1845
1846
1847 static void ReportItemSyncTime(SOSDataSourceRef ds, bool known, SOSObjectRef object)
1848 {
1849 CFDateRef itemModDate = SOSObjectCopyModificationDate(ds, object, NULL);
1850 if (itemModDate) {
1851 CFAbsoluteTime syncTime = 0;
1852 CFAbsoluteTime now = CFAbsoluteTimeGetCurrent();
1853
1854 CFAbsoluteTime peerModificationAbsoluteTime = CFDateGetAbsoluteTime(itemModDate);
1855 if (peerModificationAbsoluteTime > now) {
1856 syncTime = now - peerModificationAbsoluteTime;
1857 }
1858
1859 SecADClientPushValueForDistributionKey(known ? kSecADSecurityKnownItemSyncTimeKey : kSecADSecurityNewItemSyncTimeKey,
1860 SecBucket2Significant(syncTime));
1861 }
1862 CFReleaseNull(itemModDate);
1863 }
1864
1865 /* Handle incoming message from peer p. Return false if there was an error, true otherwise. */
1866 bool SOSEngineHandleMessage_locked(SOSEngineRef engine, CFStringRef peerID, SOSMessageRef message,
1867 SOSTransactionRef txn, bool *commit, bool *somethingChanged, CFErrorRef *error) {
1868 SOSPeerRef peer = SOSEngineCopyPeerWithID_locked(engine, peerID, error);
1869 if (!peer) return false;
1870
1871 CFStringRef peerDesc = NULL;
1872 SOSManifestRef localManifest = NULL;
1873 SOSManifestRef allAdditions = NULL;
1874 SOSManifestRef unwanted = NULL;
1875 SOSManifestRef confirmed = NULL;
1876 SOSManifestRef base = NULL;
1877 SOSManifestRef confirmedRemovals = NULL, confirmedAdditions = NULL;
1878 __block struct SOSDigestVector receivedObjects = SOSDigestVectorInit;
1879 __block struct SOSDigestVector unwantedObjects = SOSDigestVectorInit;
1880
1881 // Check for unknown criticial extensions in the message, and handle
1882 // any other extensions we support
1883 __block bool ok = true;
1884 CFMutableArrayRef changes = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
1885
1886 require_action_quiet(peer, exit, ok = SOSErrorCreate(errSecParam, error, NULL, CFSTR("Couldn't create peer with Engine for %@"), peerID));
1887 peerDesc = CFCopyDescription(peer);
1888
1889 bool hadBeenInSyncAtStart = SOSPeerHasBeenInSync(peer);
1890
1891 SOSMessageWithExtensions(message, true, ^(CFDataRef oid, bool isCritical, CFDataRef extension, bool *stop) {
1892 // OMFG a Critical extension what shall I do!
1893 ok = SOSErrorCreate(kSOSErrorNotReady, error, NULL, CFSTR("Unknown criticial extension in peer message"));
1894 *stop = true;
1895 });
1896 require_quiet(ok, exit);
1897
1898 // Merge Objects from the message into our DataSource.
1899 // Should we move the transaction to the SOSAccount level?
1900 // TODO: Filter incoming objects
1901 //if (!SOSDataSourceForEachObjectInViewSet(engine->dataSource, pendingObjects, SOSPeerGetViewNameSet(peer), error, ^void(CFDataRef key, SOSObjectRef object, bool *stop) {
1902 require_quiet(ok &= SOSMessageWithSOSObjects(message, engine->dataSource, error, ^(SOSObjectRef peersObject, bool *stop) {
1903 CFDataRef digest = SOSObjectCopyDigest(engine->dataSource, peersObject, error);
1904 if (!digest) {
1905 *stop = true;
1906 *commit = false;
1907 secerror("%@ peer sent bad object: %@, rolling back changes", SOSPeerGetID(peer), error ? *error : NULL);
1908 return;
1909 }
1910 SOSDigestVectorAppend(&receivedObjects, CFDataGetBytePtr(digest));
1911 SOSObjectRef mergedObject = NULL;
1912 SOSMergeResult mr = SOSDataSourceMergeObject(engine->dataSource, txn, peersObject, &mergedObject, error);
1913 // TODO: If the mr is kSOSMergeLocalObject most of the time (or all of the time),
1914 // consider asking the peer to stop sending us objects, and send it objects instead.
1915 ok &= (mr != kSOSMergeFailure);
1916 if (!ok) {
1917 *stop = true;
1918 *commit = false;
1919 // TODO: Might want to change to warning since the race of us locking after ckd sends us a message could cause db locked errors here.
1920 secerror("%@ SOSDataSourceMergeObject failed %@ rolling back changes", SOSPeerGetID(peer), error ? *error : NULL);
1921 } else if (mr==kSOSMergePeersObject || mr==kSOSMergeCreatedObject) {
1922 *somethingChanged = true;
1923 } else {
1924 // mr == kSOSMergeLocalObject
1925 if (!CFEqual(mergedObject, peersObject)) {
1926 // Record this object as something we don't want peer to ever send us again. By adding it to
1927 // unwantedObjects we'll falsely claim to peer we have it until they tell us they don't have it anymore.
1928 SOSDigestVectorAppend(&unwantedObjects, CFDataGetBytePtr(digest));
1929 }
1930 // Ensure localObject is in local manifest (possible corruption) by posting an update when we are done.
1931 SOSChangesAppendAdd(changes, mergedObject);
1932 }
1933
1934 if (ok && hadBeenInSyncAtStart) {
1935 ReportItemSyncTime(engine->dataSource,
1936 mr == kSOSMergeLocalObject,
1937 peersObject);
1938 }
1939
1940 CFReleaseSafe(mergedObject);
1941 CFReleaseSafe(digest);
1942 }), exit);
1943 struct SOSDigestVector dvunion = SOSDigestVectorInit;
1944 SOSDigestVectorSort(&receivedObjects);
1945 SOSDigestVectorUnionSorted(SOSManifestGetDigestVector(SOSMessageGetAdditions(message)), &receivedObjects, &dvunion);
1946 allAdditions = SOSManifestCreateWithDigestVector(&dvunion, error);
1947 SOSDigestVectorFree(&receivedObjects);
1948 SOSDigestVectorFree(&dvunion);
1949
1950 unwanted = SOSManifestCreateWithDigestVector(&unwantedObjects, error);
1951 SOSDigestVectorFree(&unwantedObjects);
1952
1953 if (CFArrayGetCount(changes)) {
1954 // NOTE: This is always notifiying of all additions that end up choosing local, which should be rare, since we shouldn't
1955 // be receiving objects we already have. When we do we tell ourselves to add them all again so our views will properly
1956 // reflect that we actually have these objects if we didn't already.
1957
1958 // Ensure any objects that we received and have locally already are actually in our local manifest
1959 SOSEngineUpdateChanges_locked(engine, txn, kSOSDataSourceTransactionDidCommit, kSOSDataSourceSOSTransaction, changes, error);
1960 }
1961 CFReleaseSafe(changes);
1962
1963 // ---- Don't use local or peer manifests from above this line,
1964 // ---- since commiting the SOSDataSourceWith transaction might change them ---
1965
1966 // Take a snapshot of our dataSource's local manifest.
1967 require_quiet(ok = localManifest = SOSEngineCopyLocalPeerManifest_locked(engine, peer, error), exit);
1968
1969 CFDataRef baseDigest = SOSMessageGetBaseDigest(message);
1970 CFDataRef proposedDigest = SOSMessageGetProposedDigest(message);
1971
1972 #if 0
1973 // I believe this is no longer needed now that we have eliminated extra,
1974 // since this is handled below once we get a confirmed manifest from our
1975 // peer.
1976
1977 // If we just received a L00 reset pendingObjects to localManifest
1978 if (!baseDigest && !proposedDigest) {
1979 // TODO: This is definitely busted for v0 peers since v0 peers always send a
1980 // L00 (ManifestDigestMessage as an ack) whereas in v2 this is a protocol restart
1981 // However if we can still find a confirmed manifest below we probably
1982 // don't want to do this even for v2.
1983 // Also I don't think we will ever send a ManifestMessage right now in
1984 // response to a ManifestDigest
1985 SOSPeerSetPendingObjects(peer, localManifest);
1986 secnoticeq("engine", "%@:%@ SOSPeerSetPendingObjects: %@", engine->myID, peerID, localManifest);
1987 }
1988 #endif
1989
1990 base = SOSPeerCopyManifestForDigest(peer, baseDigest);
1991
1992 // Note that the sender digest will only exist if we receive a SOSManifestDigestMessageType (since we never receive v2 messages)
1993 confirmed = SOSPeerCopyManifestForDigest(peer, SOSMessageGetSenderDigest(message));
1994 if (!confirmed) {
1995 if (SOSManifestGetCount(SOSMessageGetRemovals(message)) || SOSManifestGetCount(allAdditions)) {
1996 if (base || !baseDigest) {
1997
1998 secnotice("engine", "SOSEngineHandleMessage_locked (%@): creating a confirmed manifest via a patch (base %zu %@, +%zu, -%zu)", SOSPeerGetID(peer),
1999 SOSManifestGetCount(base), SOSManifestGetDigest(base, NULL),
2000 SOSManifestGetCount(allAdditions), SOSManifestGetCount(SOSMessageGetRemovals(message)));
2001
2002 confirmed = SOSManifestCreateWithPatch(base, SOSMessageGetRemovals(message), allAdditions, error);
2003 }
2004 if (!confirmed) {
2005 confirmedRemovals = CFRetainSafe(SOSMessageGetRemovals(message));
2006 confirmedAdditions = CFRetainSafe(allAdditions);
2007 }
2008 } else if (baseDigest) {
2009 confirmed = CFRetainSafe(base);
2010 secerror("%@:%@ Protocol error send L00 - figure out later base: %@", engine->myID, peerID, base);
2011 }
2012
2013 } else {
2014 secnotice("engine", "SOSEngineHandleMessage_locked (%@): got a confirmed manifest by digest: (%zu, %@)", SOSPeerGetID(peer), SOSManifestGetCount(confirmed), SOSMessageGetSenderDigest(message));
2015 }
2016 secnoticeq("engine", "%@:%@ confirmed: %@ base: %@", engine->myID, peerID, confirmed, base);
2017 if (confirmed) {
2018 ok &= SOSManifestDiff(SOSPeerGetConfirmedManifest(peer), confirmed, &confirmedRemovals, &confirmedAdditions, error);
2019 if (SOSManifestGetCount(SOSMessageGetRemovals(message)))
2020 CFAssignRetained(confirmedRemovals, SOSManifestCreateUnion(confirmedRemovals, SOSMessageGetRemovals(message), error));
2021 }
2022 if (SOSManifestGetCount(confirmedRemovals) || SOSManifestGetCount(confirmedAdditions) || SOSManifestGetCount(unwanted)) {
2023 ok &= SOSPeerDidReceiveRemovalsAndAdditions(peer, confirmedRemovals, confirmedAdditions, unwanted, localManifest, error);
2024 }
2025
2026
2027 // TODO: We should probably remove the if below and always call SOSPeerSetConfirmedManifest,
2028 // since having a NULL confirmed will force us to send a manifest message to get in sync again.
2029 if (confirmed) {
2030
2031 SOSManifestRef previousConfirmedManifest = SOSPeerGetConfirmedManifest(peer);
2032 if(previousConfirmedManifest) {
2033 secnotice("engine", "SOSEngineHandleMessage_locked (%@): new confirmed manifest (%zu, %@) will replace existing confirmed manifest (%zu, %@)", SOSPeerGetID(peer),
2034 SOSManifestGetCount(confirmed), SOSManifestGetDigest(confirmed, NULL),
2035 SOSManifestGetCount(previousConfirmedManifest), SOSManifestGetDigest(previousConfirmedManifest, NULL));
2036 } else {
2037 secnotice("engine", "SOSEngineHandleMessage_locked (%@): new confirmed manifest (%zu, %@) is first manifest for peer", SOSPeerGetID(peer),
2038 SOSManifestGetCount(confirmed), SOSManifestGetDigest(confirmed, NULL));
2039 }
2040
2041 SOSPeerSetConfirmedManifest(peer, confirmed);
2042 } else if (SOSPeerGetConfirmedManifest(peer)) {
2043 secnoticeq("engine", "%@:%@ unable to find confirmed in %@, sync protocol reset", engine->myID, peer, message);
2044
2045 SOSPeerSetConfirmedManifest(peer, NULL);
2046 //SOSPeerSetSendObjects(peer, true);
2047 }
2048
2049 // ---- SendObjects and extra->pendingObjects promotion dance ----
2050
2051 // The first block of code below sets peer.sendObjects to true when we receive a L00 and the second block
2052 // moves extra to pendingObjects once we receive a confirmed manifest in or after the L00.
2053 if (!baseDigest && !proposedDigest) {
2054 SOSPeerSetSendObjects(peer, true);
2055 }
2056
2057 if (0 /* confirmed && SOSPeerSendObjects(peer) */) {
2058 SOSManifestRef allExtra = NULL;
2059 ok &= SOSManifestDiff(confirmed, localManifest, NULL, &allExtra, error);
2060 secnoticeq("engine", "%@:%@ confirmed %@ (re)setting O:%@", engine->myID, SOSPeerGetID(peer), confirmed, allExtra);
2061 SOSPeerSetPendingObjects(peer, allExtra);
2062 CFReleaseSafe(allExtra);
2063 }
2064
2065 exit:
2066 secnotice("engine", "recv %@:%@ %@", engine->myID, SOSPeerGetID(peer), message);
2067 secnotice("peer", "recv %@ -> %@", peerDesc, peer);
2068
2069 CFReleaseNull(base);
2070 CFReleaseSafe(confirmed);
2071 CFReleaseSafe(localManifest);
2072 CFReleaseSafe(peerDesc);
2073 CFReleaseSafe(allAdditions);
2074 CFReleaseSafe(unwanted);
2075 CFReleaseSafe(confirmedRemovals);
2076 CFReleaseSafe(confirmedAdditions);
2077 CFReleaseSafe(peer);
2078 return ok;
2079 }
2080
2081 static CFDataRef SOSEngineCopyObjectDER(SOSEngineRef engine, SOSObjectRef object, CFErrorRef *error) {
2082 CFDataRef der = NULL;
2083 CFDictionaryRef plist = SOSObjectCopyPropertyList(engine->dataSource, object, error);
2084 if (plist) {
2085 der = CFPropertyListCreateDERData(kCFAllocatorDefault, plist, error);
2086 CFRelease(plist);
2087 }
2088 return der;
2089 }
2090
2091
2092 /*
2093
2094 +-----------------------------+_
2095 | | | \
2096 | A | T | \
2097 | | | \
2098 _+=============================+ } L
2099 / | | /
2100 / | S | /
2101 / | |_/
2102 / +==============================
2103 / | |
2104 C { | |
2105 \ | M +------------|
2106 \ | | |
2107 \ | | U |
2108 \ | | |
2109 \_+-------------+---------------+
2110
2111 A assumed
2112 T to be sent
2113 S shared
2114 M missing
2115 U unwanted
2116 L local
2117 C confirmed
2118
2119 */
2120 #if 0
2121 static bool SOSAppendRemoveToPatch(CFTypeRef remove, CFMutableDictionaryRef patch, CFErrorRef *error) {
2122 }
2123
2124 static bool SOSAppendAddToPatch(CFTypeRef add, CFMutableDictionaryRef patch, CFErrorRef *error) {
2125 }
2126
2127 static bool SOSAppendDiffToPatch(CFTypeRef left, CFTypeRef right, CFMutableDictionaryRef patch, CFErrorRef *error) {
2128 bool ok = true;
2129 if (!left && right) {
2130 SOSAppendAddToPatch(right, patch, error);
2131 } else if (left && !right) {
2132 SOSAppendRemoveToPatch(left, patch, error);
2133 } else if (left && right) {
2134 CFTypeID ltype = CFGetTypeID(left);
2135 CFTypeID rtype = CFGetTypeID(right);
2136 if (ltype == rtype) {
2137 if (CFArrayGetTypeID() == ltype) {
2138 ok = SecError(errSecParam, error, CFSTR("unsupported type array"), ltype);
2139 } else if (CFBooleanGetTypeID == ltype) {
2140 ok = SecError(errSecParam, error, CFSTR("unsupported type boolean"), ltype);
2141 } else if (CFDataGetTypeID == ltype) {
2142 ok = SecError(errSecParam, error, CFSTR("unsupported type data"), ltype);
2143 } else if (CFDictionaryGetTypeID == ltype) {
2144 __block CFMutableDictionaryRef leftnotright = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
2145 __block CFMutableDictionaryRef rightnotleft = CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 0, right);
2146
2147 CFDictionaryForEach(left, ^(const void *key, const void *lvalue) {
2148 const void *rvalue = NULL;
2149 if (CFDictionaryGetValueIfPresent(right, key, &rvalue)) {
2150 CFDictionaryRemoveValue(rightnotleft, key);
2151
2152 CFMutableDictionaryRef subpatch = CFDictionaryCreateForCFTypes(kCFAllocatorDefault);
2153 CFDictionaryAddValue(patch, key, subpatch);
2154 SOSAppendDiffToPatch(lvalue, rvalue, subpatch, error);
2155 CFReleaseSafe(subpatch);
2156 } else {
2157 CFDictionaryAddValue(leftnotright, key, lvalue);
2158 }
2159 });
2160 // Proccess leftnotright and rightnotleft
2161 CFReleaseSafe(leftnotright);
2162 CFReleaseSafe(rightnotleft);
2163 } else if (SOSManifestGetTypeID == ltype) {
2164 SOSManifestRef removed = NULL, added = NULL;
2165 ok &= SOSManifestDiff(left, right, &removed, &added, error);
2166 if (SOSManifestGetCount(removed) || SOSManifestGetCount(added)) {
2167 SOSAppendDiffToPatch(lvalue, rvalue, subpatch, error);
2168 CFStringAppend(, <#CFStringRef appendedString#>)
2169 }
2170 CFReleaseSafe(removed);
2171 CFReleaseSafe(added);
2172 } else if (CFNumberGetTypeID == ltype) {
2173 ok = SecError(errSecParam, error, CFSTR("unsupported type number"), ltype);
2174 } else if (CFSetGetTypeID == ltype) {
2175 ok = SecError(errSecParam, error, CFSTR("unsupported type set"), ltype);
2176 } else if (CFStringGetTypeID == ltype) {
2177 ok = SecError(errSecParam, error, CFSTR("unsupported type string"), ltype);
2178 } else {
2179 ok = SecError(errSecParam, error, CFSTR("unknown type %lu"), ltype);
2180 }
2181 }
2182 } else if (!left && !right) {
2183 // NOOP
2184 }
2185 }
2186 #endif
2187
2188 static __unused bool SOSEngineCheckPeerIntegrity(SOSEngineRef engine, SOSPeerRef peer, CFErrorRef *error) {
2189 #if 0
2190 //static CFMutableDictionaryRef p2amtu;
2191 if (!engine->p2amtu)
2192 engine->p2amtu = CFDictionaryCreateMutableForCFTypes(kCFAllocatorDefault);
2193 CFDictionaryRef amtu = CFDictionaryGetValue(engine->p2amtu, SOSPeerGetID(peer));
2194 #endif
2195
2196 // Inputs
2197 SOSManifestRef L = SOSEngineCopyLocalPeerManifest_locked(engine, peer, error);
2198 SOSManifestRef T = SOSPeerGetPendingObjects(peer);
2199 SOSManifestRef C = SOSPeerGetConfirmedManifest(peer);
2200 SOSManifestRef U = SOSPeerGetUnwantedManifest(peer);
2201
2202 // Computed
2203 SOSManifestRef CunionU = SOSManifestCreateUnion(C, U, error);
2204 SOSManifestRef S = SOSManifestCreateIntersection(L, CunionU, error);
2205
2206 SOSManifestRef AunionT = NULL, MunionU = NULL;
2207 SOSManifestDiff(L, C, &AunionT, &MunionU, error);
2208
2209 SOSManifestRef A = SOSManifestCreateComplement(T, AunionT, error);
2210 SOSManifestRef M = SOSManifestCreateComplement(U, MunionU, error);
2211
2212 SOSManifestRef SunionAunionT = SOSManifestCreateUnion(S, AunionT, error);
2213 SOSManifestRef SunionMunionU = SOSManifestCreateUnion(S, MunionU, error);
2214
2215 SOSManifestRef AintersectM = SOSManifestCreateIntersection(A, M, error);
2216 SOSManifestRef AintersectS = SOSManifestCreateIntersection(A, S, error);
2217 SOSManifestRef AintersectT = SOSManifestCreateIntersection(A, T, error);
2218 SOSManifestRef AintersectU = SOSManifestCreateIntersection(A, U, error);
2219 SOSManifestRef MintersectS = SOSManifestCreateIntersection(M, S, error);
2220 SOSManifestRef MintersectT = SOSManifestCreateIntersection(M, T, error);
2221 SOSManifestRef MintersectU = SOSManifestCreateIntersection(M, U, error);
2222 SOSManifestRef SintersectT = SOSManifestCreateIntersection(S, T, error);
2223 SOSManifestRef SintersectU = SOSManifestCreateIntersection(S, U, error);
2224 SOSManifestRef TintersectU = SOSManifestCreateIntersection(T, U, error);
2225
2226 #if 0
2227 CFDictionaryRef newAmtu = CFDictionaryCreateForCFTypes(kCFAllocatorDefault, CFSTR("A"), A, CFSTR("M"), M, CFSTR("T"), T, CFSTR("U") U, NULL);
2228 CFDictionarySetValue(engine->p2amtu, SOSPeerGetID(peer), newAmtu);
2229 CFMutableStringRef amtuChanges = CFStringCreateMutable(kCFAllocatorDefault, 0);
2230 SOSAppendDiffToString(amtu, newAmtu, amtuChanges);
2231 secnotice("engine", "%@: %@", SOSPeerGetID(peer), amtuChanges);
2232 #endif
2233
2234 #define SOSASSERT(e) (__builtin_expect(!(e), 0) ? secnotice("engine", "state-assertion %s", #e), assert(e) : (void)0)
2235
2236 SOSASSERT(L ? CFEqual(L, SunionAunionT) : SOSManifestGetCount(SunionAunionT) == 0);
2237 SOSASSERT(C ? CFEqual(C, SunionMunionU) : SOSManifestGetCount(SunionMunionU) == 0);
2238
2239 SOSASSERT(SOSManifestGetCount(AintersectM) == 0);
2240 SOSASSERT(SOSManifestGetCount(AintersectS) == 0);
2241 SOSASSERT(SOSManifestGetCount(AintersectT) == 0);
2242 SOSASSERT(SOSManifestGetCount(AintersectU) == 0);
2243 SOSASSERT(SOSManifestGetCount(MintersectS) == 0);
2244 SOSASSERT(SOSManifestGetCount(MintersectT) == 0);
2245 SOSASSERT(SOSManifestGetCount(MintersectU) == 0);
2246 SOSASSERT(SOSManifestGetCount(SintersectT) == 0);
2247 SOSASSERT(SOSManifestGetCount(SintersectU) == 0);
2248 SOSASSERT(SOSManifestGetCount(TintersectU) == 0);
2249
2250 CFReleaseSafe(AintersectM);
2251 CFReleaseSafe(AintersectS);
2252 CFReleaseSafe(AintersectT);
2253 CFReleaseSafe(AintersectU);
2254 CFReleaseSafe(MintersectS);
2255 CFReleaseSafe(MintersectT);
2256 CFReleaseSafe(MintersectU);
2257 CFReleaseSafe(SintersectT);
2258 CFReleaseSafe(SintersectU);
2259 CFReleaseSafe(TintersectU);
2260
2261 CFReleaseSafe(AunionT);
2262 CFReleaseSafe(MunionU);
2263 CFReleaseSafe(CunionU);
2264
2265 CFReleaseNull(SunionAunionT);
2266 CFReleaseNull(SunionMunionU);
2267
2268 CFReleaseSafe(A);
2269 CFReleaseSafe(M);
2270 CFReleaseSafe(S);
2271 //CFReleaseSafe(T); // Get
2272 //CFReleaseSafe(U); // Get
2273 //CFReleaseSafe(C); // Get
2274 CFReleaseSafe(L);
2275 return true;
2276 }
2277
2278 void SOSEngineSetSyncCompleteListener(SOSEngineRef engine, SOSEnginePeerInSyncBlock notify_block) {
2279 SOSEngineDoOnQueue(engine, ^{
2280 CFAssignRetained(engine->syncCompleteListener, Block_copy(notify_block));
2281 });
2282 }
2283
2284 void SOSEngineSetSyncCompleteListenerQueue(SOSEngineRef engine, dispatch_queue_t notify_queue) {
2285 SOSEngineDoOnQueue(engine, ^{
2286 CFRetainAssign(engine->syncCompleteQueue, notify_queue);
2287 });
2288 }
2289
2290 static void SOSEngineCompletedSyncWithPeer(SOSEngineRef engine, SOSPeerRef peer) {
2291 SOSEnginePeerInSyncBlock block_to_call = engine->syncCompleteListener;
2292
2293 if (block_to_call && engine->syncCompleteQueue) {
2294 CFStringRef ID = CFRetainSafe(SOSPeerGetID(peer));
2295 CFSetRef views = CFRetainSafe(SOSPeerGetViewNameSet(peer));
2296 CFRetainSafe(block_to_call);
2297
2298 dispatch_async(engine->syncCompleteQueue, ^{
2299 block_to_call(ID, views);
2300 CFReleaseSafe(ID);
2301 CFReleaseSafe(views);
2302 CFReleaseSafe(block_to_call);
2303 });
2304 }
2305
2306 SOSPeerSetHasBeenInSync(peer, true);
2307 }
2308
2309
2310 CFDataRef SOSEngineCreateMessage_locked(SOSEngineRef engine, SOSTransactionRef txn, SOSPeerRef peer,
2311 CFMutableArrayRef *attributeList, CFErrorRef *error, SOSEnginePeerMessageSentCallback **sent) {
2312 SOSManifestRef local = SOSEngineCopyLocalPeerManifest_locked(engine, peer, error);
2313 __block SOSMessageRef message = SOSMessageCreate(kCFAllocatorDefault, SOSPeerGetMessageVersion(peer), error);
2314 SOSManifestRef confirmed = SOSPeerGetConfirmedManifest(peer);
2315 SOSManifestRef pendingObjects = SOSPeerGetPendingObjects(peer);
2316 SOSManifestRef objectsSent = NULL;
2317 SOSManifestRef proposed = NULL;
2318 SOSManifestRef allMissing = NULL;
2319 SOSManifestRef allExtra = NULL;
2320 SOSManifestRef extra = NULL;
2321 SOSManifestRef excessPending = NULL;
2322 SOSManifestRef missing = NULL;
2323 SOSManifestRef unwanted = SOSPeerGetUnwantedManifest(peer);
2324 SOSManifestRef excessUnwanted = NULL;
2325 CFDataRef result = NULL;
2326
2327 // Given (C, L, T, U) compute (T, U, M, A)
2328 // (C \ L) \ U => M
2329 // (L \ C) \ T => A
2330 // we also compute
2331 // U \ (C \ L) => EU
2332 // T \ (L \ C) => ET
2333 // And assert that both EU and ET are empty and if not remove them from U and T respectively
2334 SOSManifestDiff(confirmed, local, &allMissing, &allExtra, error);
2335 SOSManifestDiff(allExtra, pendingObjects, &extra, &excessPending, error);
2336 if (SOSManifestGetCount(excessPending)) {
2337 // T \ (L \ C) => excessPending (items both in L and C or in neither that are still pending)
2338 // Can only happen if a member of T was removed from L without us having a chance to update T
2339 secerror("%@ ASSERTION FAILURE purging excess pendingObjects: %@", peer, excessPending);
2340 SOSManifestRef newPendingObjects = SOSManifestCreateComplement(excessPending, pendingObjects, error);
2341 SOSPeerSetPendingObjects(peer, newPendingObjects);
2342 CFReleaseSafe(newPendingObjects);
2343 pendingObjects = SOSPeerGetPendingObjects(peer);
2344 }
2345 SOSManifestDiff(allMissing, unwanted, &missing, &excessUnwanted, error);
2346 if (SOSManifestGetCount(excessUnwanted)) {
2347 // U \ (C \ L) => excessUnwanted (items both in L and C or in neither that are still unwanted)
2348 // Can only happen if a member of U was added to L without us having a chance to update U.
2349 // Since U only contains items the conflict resolver rejected, this implies L somehow got rolled back
2350 // The other option (and more likely) is a member of U was removed from C and not from U.
2351 secerror("%@ ASSERTION FAILURE purging excess unwanted: %@", peer, excessUnwanted);
2352 SOSManifestRef newUnwanted = SOSManifestCreateComplement(excessUnwanted, unwanted, error);
2353 SOSPeerSetUnwantedManifest(peer, newUnwanted);
2354 CFReleaseSafe(newUnwanted);
2355 unwanted = SOSPeerGetUnwantedManifest(peer);
2356 }
2357
2358 CFReleaseNull(allExtra);
2359 CFReleaseNull(excessPending);
2360 CFReleaseNull(allMissing);
2361 CFReleaseNull(excessUnwanted);
2362
2363 secnoticeq("engine", "%@:%@: send state for peer [%s%s%s][%s%s] local:%zu confirmed:%zu pending:%zu, extra:%zu, missing:%zu unwanted:%zu", engine->myID, SOSPeerGetID(peer),
2364 local ? "L":"l",
2365 confirmed ? "C":"0",
2366 pendingObjects ? "P":"0",
2367 SOSPeerSendObjects(peer) ? "O":"o",
2368 SOSPeerMustSendMessage(peer) ? "S":"s",
2369 SOSManifestGetCount(local),
2370 SOSManifestGetCount(confirmed),
2371 SOSManifestGetCount(pendingObjects),
2372 SOSManifestGetCount(extra),
2373 SOSManifestGetCount(missing),
2374 SOSManifestGetCount(unwanted)
2375 );
2376
2377 if (confirmed) {
2378 // TODO: Because of not letting things terminate while we have extra left
2379 // we might send objects when we didn't need to, but there is always an
2380 // extra roundtrip required for objects that we assume the other peer
2381 // should have already.
2382 // TODO: If there are extra objects left, calling this function is not
2383 // idempotent we should check if pending is what we are about to send and not send anything in this case.
2384 if (SOSManifestGetCount(pendingObjects) == 0 && SOSManifestGetCount(extra) == 0)
2385 SOSPeerSetSendObjects(peer, false);
2386
2387 // If we aren't missing anything, we've gotten all their data, so we're sync even if they haven't seen ours.
2388 if (missing && SOSManifestGetCount(missing) == 0) {
2389 SOSEngineCompletedSyncWithPeer(engine, peer);
2390 }
2391
2392 if (CFEqualSafe(local, SOSPeerGetProposedManifest(peer)) && !SOSPeerMustSendMessage(peer)) {
2393 bool send = false;
2394 if (CFEqual(confirmed, local)) {
2395 secnoticeq("engine", "synced <No MSG> %@:%@", engine->myID, peer);
2396 } else if (SOSManifestGetCount(pendingObjects) == 0 /* TODO: No entries moved from extra to pendingObjects. */
2397 && SOSManifestGetCount(missing) == 0) {
2398 secnoticeq("engine", "waiting <MSG not resent> %@:%@ extra: %@", engine->myID, peer, extra);
2399 } else {
2400 send = true;
2401 }
2402 if (!send) {
2403 CFReleaseNull(local);
2404 CFReleaseNull(message);
2405 CFReleaseNull(extra);
2406 CFReleaseNull(missing);
2407 return CFDataCreate(kCFAllocatorDefault, NULL, 0);
2408 }
2409 }
2410
2411 if (SOSManifestGetCount(pendingObjects)) {
2412 // If we have additions and we need to send objects, do so.
2413 __block size_t objectsSize = 0;
2414 __block struct SOSDigestVector dv = SOSDigestVectorInit;
2415 CFMutableArrayRef changes = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
2416 __block CFErrorRef dsfeError = NULL;
2417
2418 if (!SOSDataSourceForEachObject(engine->dataSource, txn, pendingObjects, &dsfeError, ^void(CFDataRef key, SOSObjectRef object, bool *stop) {
2419 CFErrorRef localError = NULL;
2420 CFDataRef digest = NULL;
2421 CFDataRef der = NULL;
2422 #if !defined(NDEBUG)
2423 const uint8_t *d = CFDataGetBytePtr(key);
2424 #endif
2425 secdebug("engine", "%@:%@ object %02X%02X%02X%02X error from SOSDataSourceForEachObject: %@",
2426 engine->myID, SOSPeerGetID(peer), d[0], d[1], d[2], d[3], dsfeError);
2427 if (!object) {
2428 const uint8_t *d = CFDataGetBytePtr(key);
2429 secerror("%@:%@ object %02X%02X%02X%02X dropping from manifest: not found in datasource: %@",
2430 engine->myID, SOSPeerGetID(peer), d[0], d[1], d[2], d[3], dsfeError);
2431 SOSChangesAppendDelete(changes, key);
2432 } else if (!(der = SOSEngineCopyObjectDER(engine, object, &localError))
2433 || !(digest = SOSObjectCopyDigest(engine->dataSource, object, &localError))) {
2434 if (SecErrorGetOSStatus(localError) == errSecDecode) {
2435 // Decode error, we need to drop these objects from our manifests
2436 const uint8_t *d = CFDataGetBytePtr(key);
2437 secnoticeq("engine", "%@:%@ object %02X%02X%02X%02X dropping from manifest: %@",
2438 engine->myID, SOSPeerGetID(peer), d[0], d[1], d[2], d[3], localError);
2439 SOSChangesAppendDelete(changes, key);
2440 CFRelease(localError);
2441 } else {
2442 // Stop iterating and propagate out all other errors.
2443 const uint8_t *d = CFDataGetBytePtr(key);
2444 secnoticeq("engine", "%@:%@ object %02X%02X%02X%02X in SOSDataSourceForEachObject: %@",
2445 engine->myID, SOSPeerGetID(peer), d[0], d[1], d[2], d[3], localError);
2446 *stop = true;
2447 CFErrorPropagate(localError, error);
2448 CFReleaseNull(message);
2449 }
2450 } else {
2451 if (!CFEqual(key, digest)) {
2452 const uint8_t *d = CFDataGetBytePtr(key);
2453 const uint8_t *e = CFDataGetBytePtr(digest);
2454 secnoticeq("engine", "%@:%@ object %02X%02X%02X%02X is really %02X%02X%02X%02X dropping from local manifest",
2455 engine->myID, SOSPeerGetID(peer), d[0], d[1], d[2], d[3], e[0], e[1], e[2], e[3]);
2456 SOSChangesAppendDelete(changes, key);
2457 SOSChangesAppendAdd(changes, object); // This is new behaviour but we think it's more correct
2458 }
2459
2460 size_t objectLen = (size_t)CFDataGetLength(der);
2461 if (SOSMessageAppendObject(message, der, &localError)) {
2462 SOSDigestVectorAppend(&dv, CFDataGetBytePtr(digest));
2463 if(!*attributeList)
2464 *attributeList = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
2465 CFDictionaryRef itemPlist = SOSObjectCopyPropertyList(engine->dataSource, object, &localError);
2466 if(itemPlist && !CFArrayContainsValue(*attributeList, CFRangeMake(0, CFArrayGetCount(*attributeList)), (CFStringRef)CFDictionaryGetValue(itemPlist, kSecAttrAccessGroup))){
2467 CFArrayAppendValue(*attributeList, (CFStringRef)CFDictionaryGetValue(itemPlist, kSecAttrAccessGroup));
2468 }//copy access group to array
2469 CFReleaseNull(itemPlist);
2470 } else {
2471 const uint8_t *d = CFDataGetBytePtr(digest);
2472 CFStringRef hexder = CFDataCopyHexString(der);
2473 secnoticeq("engine", "%@:%@ object %02X%02X%02X%02X der: %@ dropping from manifest: %@",
2474 engine->myID, SOSPeerGetID(peer), d[0], d[1], d[2], d[3], hexder, localError);
2475 CFReleaseNull(hexder);
2476 CFReleaseNull(message);
2477 // Since we can't send these objects let's assume they are bad too?
2478 SOSChangesAppendDelete(changes, digest);
2479 }
2480
2481 objectsSize += objectLen;
2482 if (objectsSize > kSOSMessageMaxObjectsSize)
2483 *stop = true;
2484 }
2485 CFErrorPropagate(dsfeError, error); // this also releases dsfeError
2486 dsfeError = NULL;
2487 CFReleaseSafe(der);
2488 CFReleaseSafe(digest);
2489 })) {
2490 CFReleaseNull(message);
2491 }
2492 if (dv.count){
2493 objectsSent = SOSManifestCreateWithDigestVector(&dv, error);
2494 }
2495 if (CFArrayGetCount(changes)) {
2496 CFErrorRef localError = NULL;
2497 if (!SOSEngineUpdateChanges_locked(engine, NULL, kSOSDataSourceTransactionDidCommit, kSOSDataSourceSOSTransaction, changes, &localError))
2498 secerror("SOSEngineUpdateChanges_locked: %@ failed: %@", changes, localError);
2499 CFReleaseSafe(localError);
2500 CFAssignRetained(local, SOSEngineCopyLocalPeerManifest_locked(engine, peer, error));
2501 }
2502 CFReleaseSafe(changes);
2503 SOSDigestVectorFree(&dv);
2504 CFReleaseNull(dsfeError);
2505 }
2506 } else {
2507 // If we have no confirmed manifest, we want all pendedObjects going out as a manifest
2508 objectsSent = CFRetainSafe(pendingObjects);
2509 }
2510
2511 if (confirmed || SOSManifestGetCount(missing) || SOSManifestGetCount(extra) || objectsSent) {
2512 SOSManifestRef allExtra = SOSManifestCreateUnion(extra, objectsSent, error);
2513 proposed = SOSManifestCreateWithPatch(confirmed, missing, allExtra, error);
2514 CFReleaseNull(allExtra);
2515 }
2516
2517 SOSManifestRef sender = local;
2518 // We actually send the remote peer its own digest.
2519 // Note that both pendingObjects and unwanted may have been changed, so we get them again
2520 if (SOSManifestGetCount(SOSPeerGetPendingObjects(peer))==0 && SOSManifestGetCount(extra)==0 &&
2521 SOSManifestGetCount(missing)==0 && SOSManifestGetCount(SOSPeerGetUnwantedManifest(peer))!=0) {
2522 secnoticeq("engine", "%@:%@: only have differences in unwanted set; lying to peer to stop sync",engine->myID, SOSPeerGetID(peer));
2523 sender = confirmed;
2524 }
2525
2526 if (!SOSMessageSetManifests(message, sender, confirmed, proposed, proposed, confirmed ? objectsSent : NULL, error)) {
2527 secnoticeq("engine", "%@:%@: failed to set message manifests",engine->myID, SOSPeerGetID(peer));
2528 CFReleaseNull(message);
2529 }
2530
2531 CFReleaseNull(objectsSent);
2532
2533 if (message) {
2534 result = SOSMessageCreateData(message, SOSPeerNextSequenceNumber(peer), error);
2535 }
2536
2537 if (result) {
2538 SOSEnginePeerMessageSentCallback* pmsc = malloc(sizeof(SOSEnginePeerMessageSentCallback));
2539 memset(pmsc, 0, sizeof(SOSEnginePeerMessageSentCallback));
2540 pmsc->engine = engine; CFRetain(pmsc->engine);
2541 pmsc->peer = CFRetainSafe(peer);
2542 pmsc->local = CFRetainSafe(local);
2543 pmsc->proposed = CFRetainSafe(proposed);
2544 pmsc->message = CFRetainSafe(message);
2545 pmsc->confirmed = CFRetainSafe(confirmed);
2546
2547 SOSEngineMessageCallbackSetCallback(pmsc, ^(bool success) {
2548 // Have to copy pmsc so it'll still be around during the dispatch_async
2549 SOSEnginePeerMessageSentCallback* pmsc2 = malloc(sizeof(SOSEnginePeerMessageSentCallback));
2550 memset(pmsc2, 0, sizeof(SOSEnginePeerMessageSentCallback));
2551 pmsc2->engine = pmsc->engine; CFRetain(pmsc2->engine);
2552 pmsc2->peer = CFRetainSafe(pmsc->peer);
2553 pmsc2->local = CFRetainSafe(pmsc->local);
2554 pmsc2->proposed = CFRetainSafe(pmsc->proposed);
2555 pmsc2->message = CFRetainSafe(pmsc->message);
2556 pmsc2->confirmed = CFRetainSafe(pmsc->confirmed);
2557
2558 dispatch_async(pmsc->engine->queue, ^{
2559 if (success) {
2560 SOSPeerSetMustSendMessage(pmsc2->peer, false);
2561 if (!pmsc2->confirmed && !pmsc2->proposed) {
2562 SOSPeerSetSendObjects(pmsc2->peer, true);
2563 secnoticeq("engine", "%@:%@ sendObjects=true L:%@", pmsc2->engine->myID, SOSPeerGetID(pmsc2->peer), pmsc2->local);
2564 }
2565 SOSPeerAddLocalManifest(pmsc2->peer, pmsc2->local);
2566 SOSPeerAddProposedManifest(pmsc2->peer, pmsc2->proposed);
2567 secnoticeq("engine", "send %@:%@ %@", pmsc2->engine->myID, SOSPeerGetID(pmsc2->peer), pmsc2->message);
2568 //SOSEngineCheckPeerIntegrity(engine, peer, NULL);
2569 } else {
2570 secerror("%@:%@ failed to send %@", pmsc2->engine->myID, SOSPeerGetID(pmsc2->peer), pmsc2->message);
2571 }
2572 SOSEngineFreeMessageCallback(pmsc2);
2573 });
2574 });
2575
2576 *sent = pmsc;
2577 }
2578
2579 CFReleaseNull(local);
2580 CFReleaseNull(extra);
2581 CFReleaseNull(missing);
2582 CFReleaseNull(message);
2583 CFReleaseNull(proposed);
2584 if (error && *error)
2585 secerror("%@:%@ error in send: %@", engine->myID, SOSPeerGetID(peer), *error);
2586
2587 return result;
2588 }
2589
2590 void SOSEngineMessageCallbackSetCallback(SOSEnginePeerMessageSentCallback *sent, SOSEnginePeerMessageSentBlock block) {
2591 if(sent) {
2592 sent->block = Block_copy(block);
2593 }
2594 }
2595
2596
2597 void SOSEngineMessageCallCallback(SOSEnginePeerMessageSentCallback *sent, bool ok) {
2598 if (sent && sent->block) {
2599 (sent->block)(ok);
2600 }
2601 }
2602
2603 void SOSEngineFreeMessageCallback(SOSEnginePeerMessageSentCallback* psmc) {
2604 if(psmc) {
2605 CFReleaseNull(psmc->engine);
2606 CFReleaseNull(psmc->peer);
2607 CFReleaseNull(psmc->coder);
2608 CFReleaseNull(psmc->local);
2609 CFReleaseNull(psmc->proposed);
2610 CFReleaseNull(psmc->message);
2611 CFReleaseNull(psmc->confirmed);
2612
2613 if(psmc->block) {
2614 Block_release(psmc->block);
2615 }
2616
2617 free(psmc);
2618 }
2619 }
2620
2621 static void SOSEngineLogItemError(SOSEngineRef engine, CFStringRef peerID, CFDataRef key, CFDataRef optionalDigest, const char *where, CFErrorRef error) {
2622 if (!optionalDigest) {
2623 const uint8_t *d = CFDataGetBytePtr(key);
2624 secwarning("%@:%@ object %02X%02X%02X%02X %s: %@", engine->myID, peerID, d[0], d[1], d[2], d[3], where, error ? (CFTypeRef)error : CFSTR(""));
2625 } else {
2626 const uint8_t *d = CFDataGetBytePtr(key);
2627 const uint8_t *e = CFDataGetBytePtr(optionalDigest);
2628 secwarning("%@:%@ object %02X%02X%02X%02X is really %02X%02X%02X%02X dropping from local manifest", engine->myID, peerID, d[0], d[1], d[2], d[3], e[0], e[1], e[2], e[3]);
2629 }
2630 }
2631
2632 static bool SOSEngineWriteToBackup_locked(SOSEngineRef engine, SOSPeerRef peer, bool rewriteComplete, bool *didWrite, bool *incomplete, CFErrorRef *error) {
2633 __block bool ok = SOSPeerWritePendingReset(peer, error);
2634 if (!ok || !SOSPeerGetKeyBag(peer))
2635 return ok;
2636 __block SOSManifestRef local = SOSEngineCopyLocalPeerManifest_locked(engine, peer, error);
2637 __block SOSManifestRef proposed = SOSPeerGetProposedManifest(peer);
2638 __block bool notify = true;
2639 SOSManifestRef pendingObjects = NULL;
2640 SOSManifestRef missing = NULL;
2641 CFStringRef peerID = SOSPeerGetID(peer);
2642
2643 ok &= SOSManifestDiff(proposed, local, &missing, &pendingObjects, error);
2644
2645 secnoticeq("engine", "%@:%@: Send state for peer [%s%s%s] O: %zu, M: %zu", engine->myID, peerID,
2646 local ? "L":"l",
2647 proposed ? "P":"0",
2648 pendingObjects ? "O":"0",
2649 SOSManifestGetCount(pendingObjects),
2650 SOSManifestGetCount(missing));
2651
2652 if (SOSManifestGetCount(missing) == 0 && SOSManifestGetCount(pendingObjects) == 0) {
2653 // proposed == local (faster test than CFEqualSafe above), since we
2654 // already did the SOSManifestDiff
2655 if (rewriteComplete) {
2656 notify = false;
2657 } else {
2658 secnoticeq("engine", "%@:%@ backup still done", engine->myID, peer);
2659 goto done;
2660 }
2661 }
2662 ok &= SOSPeerAppendToJournal(peer, error, ^(FILE *journalFile, keybag_handle_t kbhandle) {
2663 SOSManifestRef objectsSent = NULL;
2664 __block struct SOSDigestVector dvdel = SOSDigestVectorInit;
2665 __block struct SOSDigestVector dvadd = SOSDigestVectorInit;
2666 SOSManifestForEach(missing, ^(CFDataRef key, bool *stop) {
2667 CFErrorRef localError = NULL;
2668 if (ftello(journalFile) > kSOSBackupMaxFileSize) {
2669 // Highwatermark hit on file.
2670 *stop = true;
2671 } else if (SOSBackupEventWriteDelete(journalFile, key, &localError)) {
2672 SOSDigestVectorAppend(&dvdel, CFDataGetBytePtr(key));
2673 } else {
2674 SOSEngineLogItemError(engine, peerID, key, NULL, "in SOSPeerWriteDelete", localError);
2675 CFErrorPropagate(localError, error);
2676 // TODO: Update of missing so proposed is updated properly
2677 *stop = true; // Disk full?
2678 ok = false;
2679 }
2680 });
2681 if (ok && SOSManifestGetCount(pendingObjects)) {
2682 CFMutableArrayRef changes = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
2683 ok &= SOSDataSourceForEachObject(engine->dataSource, NULL, pendingObjects, error, ^void(CFDataRef key, SOSObjectRef object, bool *stop) {
2684 CFErrorRef localError = NULL;
2685 CFDataRef digest = NULL;
2686 CFDictionaryRef backupItem = NULL;
2687 if (ftello(journalFile) > kSOSBackupMaxFileSize) {
2688 // Highwatermark hit on file.
2689 *stop = true;
2690 } else if (!object) {
2691 SOSEngineLogItemError(engine, peerID, key, NULL, "dropping from manifest: not found in datasource", localError);
2692 SOSChangesAppendDelete(changes, key);
2693 } else if (!(backupItem = SOSObjectCopyBackup(engine->dataSource, object, kbhandle, &localError))
2694 || !(digest = SOSObjectCopyDigest(engine->dataSource, object, &localError))) {
2695 if (SecErrorGetOSStatus(localError) == errSecDecode) {
2696 // Decode error, we need to drop these objects from our manifests
2697 SOSEngineLogItemError(engine, peerID, key, NULL, "dropping from manifest", localError);
2698 SOSChangesAppendDelete(changes, key);
2699 CFRelease(localError);
2700 } else {
2701 // Stop iterating and propagate out all other errors.
2702 SOSEngineLogItemError(engine, peerID, key, NULL, "in SOSDataSourceForEachObject", localError);
2703 *stop = true;
2704 CFErrorPropagate(localError, error);
2705 ok = false;
2706 }
2707 } else {
2708 if (!CFEqual(key, digest)) {
2709 SOSEngineLogItemError(engine, peerID, key, digest, "", NULL);
2710 SOSChangesAppendDelete(changes, key);
2711 SOSChangesAppendAdd(changes, object); // This is new behaviour but we think it's more correct
2712 }
2713
2714 if (SOSBackupEventWriteAdd(journalFile, backupItem, &localError)) {
2715 SOSDigestVectorAppend(&dvadd, CFDataGetBytePtr(digest));
2716 } else {
2717 SOSEngineLogItemError(engine, peerID, key, NULL, "in SOSPeerWriteAdd", localError);
2718 *stop = true; // Disk full?
2719 CFErrorPropagate(localError, error);
2720 ok = false;
2721 }
2722 }
2723 CFReleaseSafe(backupItem);
2724 CFReleaseSafe(digest);
2725 });
2726 if (CFArrayGetCount(changes)) {
2727 CFErrorRef localError = NULL;
2728 if (!SOSEngineUpdateChanges_locked(engine, NULL, kSOSDataSourceTransactionDidCommit, kSOSDataSourceSOSTransaction, changes, &localError))
2729 secerror("SOSEngineUpdateChanges_locked: %@ failed: %@", changes, localError);
2730 CFReleaseSafe(localError);
2731 // Since calling SOSEngineUpdateChanges_locked might cause local to change and might cause the backup peer to update proposed, refetch them here.
2732 CFAssignRetained(local, SOSEngineCopyLocalPeerManifest_locked(engine, peer, error));
2733 proposed = SOSPeerGetProposedManifest(peer);
2734 }
2735 CFReleaseSafe(changes);
2736 }
2737
2738 if (dvadd.count || (proposed && dvdel.count)) {
2739 *didWrite = true;
2740 SOSManifestRef deleted = SOSManifestCreateWithDigestVector(&dvdel, error);
2741 SOSManifestRef objectsSent = SOSManifestCreateWithDigestVector(&dvadd, error);
2742 SOSManifestRef newProposed = SOSManifestCreateWithPatch(proposed, deleted, objectsSent, error);
2743 CFReleaseSafe(deleted);
2744 CFReleaseSafe(objectsSent);
2745 SOSPeerSetProposedManifest(peer, newProposed);
2746 CFReleaseSafe(newProposed);
2747 proposed = SOSPeerGetProposedManifest(peer);
2748 }
2749 SOSDigestVectorFree(&dvdel);
2750 SOSDigestVectorFree(&dvadd);
2751
2752 // TODO: If proposed is NULL, and local is empty we should still consider ourselves done.
2753 // It so happens this can't happen in practice today since there is at least a backupbag
2754 // in the backup, but this is a bug waiting to rear its head in the future.
2755 if (ok && CFEqualSafe(local, proposed)) {
2756 CFErrorRef localError = NULL;
2757 if (SOSBackupEventWriteCompleteMarker(journalFile, 899, &localError)) {
2758 SOSPeerSetSendObjects(peer, true);
2759 *didWrite = true;
2760 secnoticeq("backup", "%@:%@ backup done%s", engine->myID, peerID, notify ? " notifying sbd" : "");
2761 // TODO: Now switch to changes based writing to backup sync.
2762 // Currently we leave changes enabled but we probably shouldn't
2763 } else {
2764 secwarning("%@:%@ in SOSBackupPeerWriteCompleteMarker: %@", engine->myID, peerID, localError);
2765 ok = false;
2766 *incomplete = true;
2767 CFErrorPropagate(localError, error);
2768 }
2769 } else {
2770 secnoticeq("backup", "%@:%@ backup incomplete [%zu/%zu]%s", engine->myID, peerID, SOSManifestGetCount(local), SOSManifestGetCount(proposed), notify ? " notifying sbd" : "");
2771 *incomplete = true;
2772 }
2773 CFReleaseNull(objectsSent);
2774 });
2775 if (notify)
2776 SOSBackupPeerPostNotification("writing changes to backup");
2777
2778 done:
2779 CFReleaseSafe(local);
2780 CFReleaseNull(pendingObjects);
2781 CFReleaseNull(missing);
2782
2783 return ok;
2784 }
2785
2786 CF_RETURNS_RETAINED CFSetRef SOSEngineSyncWithBackupPeers(SOSEngineRef engine, CFSetRef /* CFStringRef */ peers, bool forceReset, CFErrorRef *error)
2787 {
2788 __block bool incomplete = false;
2789 CFMutableSetRef handledSet = CFSetCreateMutableForCFTypes(kCFAllocatorDefault);
2790
2791 bool ok = SOSEngineDoTxnOnQueue(engine, error, ^(SOSTransactionRef txn, bool *commit) {
2792 __block bool dirty = false;
2793 CFSetForEach(peers, ^(const void *value) {
2794 bool report_handled = true;
2795 CFErrorRef localError = NULL;
2796 SOSPeerRef peer = NULL;
2797 CFStringRef peerID = asString(value, &localError);
2798 require_action_quiet(peerID, done, report_handled = false);
2799
2800 peer = SOSEngineCopyPeerWithID_locked(engine, peerID, &localError);
2801 require_quiet(peerID, done);
2802
2803 if (SOSPeerMapEntryIsBackup(peer)) {
2804 if(forceReset) {
2805 SOSPeerSetMustSendMessage(peer, true);
2806 }
2807
2808 report_handled = SOSEngineWriteToBackup_locked(engine, peer, false, &dirty, &incomplete, &localError);
2809 }
2810
2811 done:
2812 if (localError) {
2813 secnotice("engine-sync", "Failed to process sync for %@: %@", peerID, localError);
2814 }
2815 if (report_handled) {
2816 CFSetAddValue(handledSet, peerID);
2817 }
2818 CFReleaseNull(localError);
2819 CFReleaseNull(peer);
2820 });
2821
2822 if (dirty) {
2823 CFErrorRef saveError = NULL;
2824 if (!SOSEngineSave(engine, txn, &saveError)) {
2825 secnotice("engine-save", "Failed to save engine: %@", saveError);
2826 }
2827 }
2828 });
2829 if (incomplete) {
2830 // Ensure we get called again in a while (after a backup timeout)
2831 // sbd will do this since we never wrote a complete marker.
2832 // TODO: This relies on us not writing complete marker for update
2833 // event while we havn't finished a full backup, which we currently still do.
2834 }
2835 if (!ok)
2836 CFReleaseNull(handledSet);
2837
2838 return handledSet;
2839 }
2840
2841 bool SOSEngineHandleMessage(SOSEngineRef engine, CFStringRef peerID,
2842 CFDataRef raw_message, CFErrorRef *error)
2843 {
2844 __block bool result = true;
2845 __block bool somethingChanged = false;
2846 SOSMessageRef message = SOSMessageCreateWithData(kCFAllocatorDefault, raw_message, error);
2847 result &= message && SOSEngineDoTxnOnQueue(engine, error, ^(SOSTransactionRef txn, bool *commit) {
2848 result = SOSEngineHandleMessage_locked(engine, peerID, message, txn, commit, &somethingChanged, error);
2849 });
2850 CFReleaseSafe(message);
2851 if (somethingChanged)
2852 SecKeychainChanged();
2853 return result;
2854 }
2855
2856 void SOSEngineCircleChanged(SOSEngineRef engine, CFStringRef myPeerID, CFArrayRef trustedPeers, CFArrayRef untrustedPeers) {
2857 __block bool peersOrViewsChanged = false;
2858 SOSEngineDoOnQueue(engine, ^{
2859 peersOrViewsChanged = SOSEngineCircleChanged_locked(engine, myPeerID, trustedPeers, untrustedPeers);
2860
2861 // We should probably get a more precise list of peers that actually need talking to
2862 if (peersOrViewsChanged && engine->myID && CFArrayGetCount(engine->peerIDs) != 0)
2863 SOSCCRequestSyncWithPeersList(engine->peerIDs);
2864 });
2865
2866 __block bool ok = true;
2867 __block CFErrorRef localError = NULL;
2868 ok &= SOSEngineDoTxnOnQueue(engine, &localError, ^(SOSTransactionRef txn, bool *commit) {
2869 ok = *commit = SOSEngineSave(engine, txn, &localError);
2870 });
2871 if (!ok) {
2872 secerror("failed to save engine state: %@", localError);
2873 CFReleaseSafe(localError);
2874 }
2875
2876 }
2877
2878 SOSManifestRef SOSEngineCopyManifest(SOSEngineRef engine, CFErrorRef *error) {
2879 __block SOSManifestRef result = NULL;
2880 SOSEngineDoOnQueue(engine, ^{
2881 result = SOSEngineCopyManifestWithViewNameSet_locked(engine, SOSViewsGetV0ViewSet(), error);
2882 });
2883 return result;
2884 }
2885
2886 SOSManifestRef SOSEngineCopyLocalPeerManifest(SOSEngineRef engine, SOSPeerRef peer, CFErrorRef *error) {
2887 __block SOSManifestRef result = NULL;
2888 SOSEngineDoOnQueue(engine, ^{
2889 result = SOSEngineCopyLocalPeerManifest_locked(engine, peer, error);
2890 });
2891 return result;
2892 }
2893
2894 bool SOSEngineUpdateChanges(SOSEngineRef engine, SOSDataSourceTransactionSource source, CFArrayRef changes, CFErrorRef *error) {
2895 __block bool result = true;
2896 SOSEngineDoOnQueue(engine, ^{
2897 result = SOSEngineUpdateChanges_locked(engine, NULL, kSOSDataSourceTransactionDidCommit, source, changes, error);
2898 });
2899 return result;
2900 }
2901
2902 //
2903 // Peer state layout. WRONG! It's an array now
2904 // The peer state is an array.
2905 // The first element of the array is a dictionary with any number of keys and
2906 // values in it (for future expansion) such as changing the digest size or type
2907 // or remebering boolean flags for a peers sake.
2908 // The next three are special in that they are manifest digests with special
2909 // meaning and rules as to how they are treated (These are dynamically updated
2910 // based on database activity so they have a fully history of all changes made
2911 // to the local db. The first is the manifest representing the pendingObjects
2912 // to send to the other peer. This is normally only ever appending to, and in
2913 // particular with transactions originating from the Keychain API that affect
2914 // syncable items will need to add the new objects digests to the pendingObjects list
2915 // while adding the digests of any tombstones encountered to the extra list.
2916
2917 SOSPeerRef SOSEngineCopyPeerWithID(SOSEngineRef engine, CFStringRef peer_id, CFErrorRef *error) {
2918 __block SOSPeerRef peer = NULL;
2919 SOSEngineDoOnQueue(engine, ^{
2920 peer = SOSEngineCopyPeerWithID_locked(engine, peer_id, error);
2921 });
2922 return peer;
2923 }
2924
2925 bool SOSEngineForPeerID(SOSEngineRef engine, CFStringRef peerID, CFErrorRef *error, void (^forPeer)(SOSTransactionRef txn, SOSPeerRef peer)) {
2926 __block bool ok = true;
2927 SOSDataSourceReadWithCommitQueue(engine->dataSource, error, ^(SOSTransactionRef txn) {
2928 SOSEngineDoOnQueue(engine, ^{
2929 SOSPeerRef peer = SOSEngineCopyPeerWithID_locked(engine, peerID, error);
2930 if (peer) {
2931 forPeer(txn, peer);
2932 CFRelease(peer);
2933 } else {
2934 ok = false;
2935 }
2936 });
2937 });
2938
2939 return ok;
2940 }
2941
2942 bool SOSEngineWithPeerID(SOSEngineRef engine, CFStringRef peerID, CFErrorRef *error, void (^with)(SOSPeerRef peer, SOSCoderRef coder, SOSDataSourceRef dataSource, SOSTransactionRef txn, bool *forceSaveState)) {
2943 __block bool result = true;
2944 result &= SOSEngineDoTxnOnQueue(engine, error, ^(SOSTransactionRef txn, bool *commit) {
2945 SOSPeerRef peer = SOSEngineCopyPeerWithID_locked(engine, peerID, error);
2946 if (!peer) {
2947 result = SOSErrorCreate(kSOSErrorPeerNotFound, error, NULL, CFSTR("Engine has no peer for %@"), peerID);
2948 } else {
2949 bool saveState = false;
2950 SOSCoderRef coder = SOSEngineGetCoderInTx_locked(engine, txn, peerID, NULL);
2951 with(peer, coder, engine->dataSource, txn, &saveState);
2952 CFReleaseSafe(peer);
2953 if (saveState)
2954 result = SOSEngineSave(engine, txn, error);
2955 // TODO: Don't commit if engineSave fails?
2956 }
2957 });
2958
2959 return result;
2960 }
2961
2962 CFDataRef SOSEngineCreateMessageToSyncToPeer(SOSEngineRef engine, CFStringRef peerID, CFMutableArrayRef *attributeList, SOSEnginePeerMessageSentCallback **sentCallback, CFErrorRef *error){
2963 __block CFDataRef message = NULL;
2964 SOSEngineForPeerID(engine, peerID, error, ^(SOSTransactionRef txn, SOSPeerRef peer) {
2965 message = SOSEngineCreateMessage_locked(engine, txn, peer, attributeList, error, sentCallback);
2966 });
2967 return message;
2968 }
2969
2970 bool SOSEnginePeerDidConnect(SOSEngineRef engine, CFStringRef peerID, CFErrorRef *error) {
2971 return SOSEngineWithPeerID(engine, peerID, error, ^(SOSPeerRef peer, SOSCoderRef coder, SOSDataSourceRef dataSource, SOSTransactionRef txn, bool *saveState) {
2972 *saveState = SOSPeerDidConnect(peer);
2973 });
2974 }
2975
2976 bool SOSEngineSetPeerConfirmedManifest(SOSEngineRef engine, CFStringRef backupName,
2977 CFDataRef keybagDigest, CFDataRef manifestData, CFErrorRef *error) {
2978 __block bool ok = true;
2979
2980 ok &= SOSEngineForPeerID(engine, backupName, error, ^(SOSTransactionRef txn, SOSPeerRef peer) {
2981 bool dirty = false;
2982 bool incomplete = false;
2983 SOSManifestRef confirmed = NULL;
2984 CFDataRef keybag = SOSPeerGetKeyBag(peer);
2985 CFDataRef computedKeybagDigest = keybag ? CFDataCopySHA1Digest(keybag, NULL) : NULL;
2986 if (CFEqualSafe(keybagDigest, computedKeybagDigest)) {
2987 ok = confirmed = SOSManifestCreateWithData(manifestData, error);
2988 if (ok) {
2989 // Set both confirmed and proposed (confirmed is just
2990 // for debug status, proposed is actually what's used
2991 // by the backup peer).
2992 SOSPeerSetConfirmedManifest(peer, confirmed);
2993 SOSPeerSetProposedManifest(peer, confirmed);
2994 }
2995 } else {
2996 // sbd missed a reset event, send it again
2997 // Force SOSEngineWriteToBackup_locked to call SOSPeerWriteReset, which clears
2998 // confirmed and proposed manifests and writes the keybag to the journal.
2999 SOSPeerSetMustSendMessage(peer, true);
3000 }
3001
3002 // Stop changes from writing complete markers, unless SOSEngineWriteToBackup_locked() detects we are in sync
3003 SOSPeerSetSendObjects(peer, false);
3004 // Write data for this peer if we can, technically not needed for non legacy protocol support all the time.
3005 ok = SOSEngineWriteToBackup_locked(engine, peer, true, &dirty, &incomplete, error);
3006
3007 if (!ok && error && SecErrorGetOSStatus(*error) == errSecInteractionNotAllowed) {
3008 SOSEnsureBackupWhileUnlocked();
3009 }
3010
3011 CFReleaseSafe(confirmed);
3012 CFReleaseSafe(computedKeybagDigest);
3013 });
3014 return ok;
3015 }
3016
3017 CFArrayRef SOSEngineCopyBackupPeerNames(SOSEngineRef engine, CFErrorRef *error) {
3018 __block CFMutableArrayRef backupNames = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
3019 SOSEngineForEachBackupPeer(engine, ^(SOSPeerRef peer) {
3020 CFArrayAppendValue(backupNames, SOSPeerGetID(peer));
3021 });
3022 return backupNames;
3023 }
3024
3025 static CFMutableDictionaryRef SOSEngineCreateStateDictionary(CFStringRef peerID, SOSManifestRef manifest, CFSetRef vns, CFStringRef coderString) {
3026 CFNumberRef manifestCount = CFNumberCreateWithCFIndex(kCFAllocatorDefault, SOSManifestGetCount(manifest));
3027 CFDataRef manifestHash = SOSManifestGetDigest(manifest, NULL);
3028 CFMutableDictionaryRef result = CFDictionaryCreateMutableForCFTypesWithSafe(kCFAllocatorDefault,
3029 kSOSCCEngineStatePeerIDKey, peerID,
3030 kSOSCCEngineStateManifestCountKey, manifestCount,
3031 kSOSCCEngineStateManifestHashKey, manifestHash,
3032 kSOSCCEngineStateSyncSetKey, asSet(vns, NULL),
3033 kSOSCCEngineStateCoderKey, coderString,
3034 NULL);
3035 CFReleaseNull(manifestCount);
3036 return result;
3037 }
3038
3039 static void SOSEngineAppendStateDictionary(CFMutableArrayRef stateArray, CFStringRef peerID, SOSManifestRef manifest, CFSetRef vns, CFStringRef coderString) {
3040 CFMutableDictionaryRef newState = SOSEngineCreateStateDictionary(peerID, manifest, vns, coderString);
3041 CFArrayAppendValue(stateArray, newState);
3042 CFReleaseNull(newState);
3043 }
3044
3045 static CFArrayRef SOSEngineCopyPeerConfirmedDigests_locked(SOSEngineRef engine, CFErrorRef *error) {
3046 CFMutableArrayRef result = CFArrayCreateMutableForCFTypes(kCFAllocatorDefault);
3047 CFDictionaryForEach(engine->viewNameSet2ChangeTracker, ^(const void *vns, const void *ct) {
3048 SOSManifestRef manifest = SOSEngineCopyManifestWithViewNameSet_locked(engine, vns, error);
3049 SOSEngineAppendStateDictionary(result, NULL, manifest, vns, NULL);
3050 CFReleaseNull(manifest);
3051 });
3052
3053 // Copy other peers even if we aren't in the circle, since we're observing it.
3054 SOSEngineForEachPeer_locked(engine, ^(SOSPeerRef peer) {
3055 CFTypeRef coderObject = engine->coders ? CFDictionaryGetValue(engine->coders, SOSPeerGetID(peer)) : CFSTR("Coders not loaded.");
3056 CFStringRef coderState = coderObject ? CFCopyDescription(coderObject) : NULL;
3057 SOSEngineAppendStateDictionary(result, SOSPeerGetID(peer), SOSPeerGetConfirmedManifest(peer), SOSPeerGetViewNameSet(peer), coderState);
3058 CFReleaseNull(coderState);
3059 });
3060 return result;
3061 }
3062
3063 CFArrayRef SOSEngineCopyPeerConfirmedDigests(SOSEngineRef engine, CFErrorRef *error) {
3064 __block CFArrayRef result = NULL;
3065 SOSEngineDoOnQueue(engine, ^{
3066 result = SOSEngineCopyPeerConfirmedDigests_locked(engine, error);
3067 });
3068 return result;
3069 }
3070
3071 SOSDataSourceRef SOSEngineGetDataSource(SOSEngineRef engine) {
3072 return engine->dataSource;
3073 }
3074
3075 #define ENGINELOGSTATE "engineLogState"
3076 void SOSEngineLogState(SOSEngineRef engine) {
3077 CFErrorRef error = NULL;
3078 CFArrayRef confirmedDigests = NULL;
3079
3080 secnotice(ENGINELOGSTATE, "Start");
3081
3082 require_action_quiet(engine, retOut, secnotice(ENGINELOGSTATE, "No Engine Available"));
3083 confirmedDigests = SOSEngineCopyPeerConfirmedDigests(engine, &error);
3084 require_action_quiet(confirmedDigests, retOut, secnotice(ENGINELOGSTATE, "No engine peers: %@\n", error));
3085
3086 SOSCCForEachEngineStateAsStringFromArray(confirmedDigests, ^(CFStringRef onePeerDescription) {
3087 secnotice(ENGINELOGSTATE, "%@", onePeerDescription);
3088 });
3089
3090 retOut:
3091 CFReleaseNull(error);
3092 CFReleaseNull(confirmedDigests);
3093 secnotice(ENGINELOGSTATE, "Finish");
3094
3095 return;
3096 }
3097
3098 //For Testing
3099 void TestSOSEngineDoOnQueue(CFTypeRef engine, dispatch_block_t action)
3100 {
3101 dispatch_sync(((SOSEngineRef)engine)->queue, action);
3102 }
3103 CFMutableDictionaryRef TestSOSEngineGetCoders(CFTypeRef engine){
3104 return ((SOSEngineRef)engine)->coders;
3105 }
3106
3107 bool TestSOSEngineDoTxnOnQueue(CFTypeRef engine, CFErrorRef *error, void(^transaction)(SOSTransactionRef txn, bool *commit))
3108 {
3109 return SOSDataSourceWithCommitQueue(((SOSEngineRef)engine)->dataSource, error, ^(SOSTransactionRef txn, bool *commit) {
3110 TestSOSEngineDoOnQueue((SOSEngineRef)engine, ^{ transaction(txn, commit); });
3111 });
3112 }
3113 bool SOSEngineGetCodersNeedSaving(SOSEngineRef engine){
3114 return engine->codersNeedSaving;
3115 }
3116
3117 void SOSEngineSetCodersNeedSaving(SOSEngineRef engine, bool saved){
3118 engine->codersNeedSaving = saved;
3119 }
3120
mirror of Security