keychain/ckks/CKKSLocalSynchronizeOperation.m

   1 /*
   2  * Copyright (c) 2016 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import "keychain/ckks/CKKSKeychainView.h"
  25 #import "keychain/ckks/CKKSGroupOperation.h"
  26 #import "keychain/ckks/CKKSLocalSynchronizeOperation.h"
  27 #import "keychain/ckks/CKKSFetchAllRecordZoneChangesOperation.h"
  28 #import "keychain/ckks/CKKSScanLocalItemsOperation.h"
  29 #import "keychain/ckks/CKKSMirrorEntry.h"
  30 #import "keychain/ckks/CKKSIncomingQueueEntry.h"
  31 #import "keychain/ckks/CloudKitCategories.h"
  32 #import "keychain/categories/NSError+UsefulConstructors.h"
  33
  34 #if OCTAGON
  35
  36 @interface CKKSLocalSynchronizeOperation ()
  37 @property int32_t restartCount;
  38 @end
  39
  40 @implementation CKKSLocalSynchronizeOperation
  41
  42 - (instancetype)init {
  43     return nil;
  44 }
  45 - (instancetype)initWithCKKSKeychainView:(CKKSKeychainView*)ckks
  46 {
  47     if(self = [super init]) {
  48         _ckks = ckks;
  49         _restartCount = 0;
  50
  51         [self addNullableDependency:ckks.holdLocalSynchronizeOperation];
  52     }
  53     return self;
  54 }
  55
  56 - (void)groupStart {
  57     __weak __typeof(self) weakSelf = self;
  58
  59     /*
  60      * A local synchronize is very similar to a CloudKit synchronize, but it won't cause any (non-essential)
  61      * CloudKit operations to occur.
  62      *
  63      *  1. Finish processing the outgoing queue. You can't be in-sync with cloudkit if you have an update that hasn't propagated.
  64      *  2. Process anything in the incoming queue as normal.
  65      *          (Note that this might require the keybag to be unlocked.)
  66      *
  67      *  3. Take every item in the CKMirror, and check for its existence in the local keychain. If not present, add to the incoming queue.
  68      *  4. Process the incoming queue again.
  69      *  5. Scan the local keychain for items which exist locally but are not in CloudKit. Upload them.
  70      *  6. If there are any such items in 4, restart the sync.
  71      */
  72
  73     CKKSKeychainView* ckks = self.ckks;
  74
  75     // Synchronous, on some thread. Get back on the CKKS queue for SQL thread-safety.
  76     [ckks dispatchSync: ^bool{
  77         if(self.cancelled) {
  78             ckksnotice("ckksresync", ckks, "CKKSSynchronizeOperation cancelled, quitting");
  79             return false;
  80         }
  81
  82         //ckks.lastLocalSynchronizeOperation = self;
  83
  84         uint32_t steps = 5;
  85
  86         ckksinfo("ckksresync", ckks, "Beginning local resynchronize (attempt %u)", self.restartCount);
  87
  88         CKOperationGroup* operationGroup = [CKOperationGroup CKKSGroupWithName:@"ckks-resync-local"];
  89
  90         // Step 1
  91         CKKSOutgoingQueueOperation* outgoingOp = [ckks processOutgoingQueue: operationGroup];
  92         outgoingOp.name = [NSString stringWithFormat: @"resync-step%u-outgoing", self.restartCount * steps + 1];
  93         [self dependOnBeforeGroupFinished:outgoingOp];
  94
  95         // Step 2
  96         CKKSIncomingQueueOperation* incomingOp = [[CKKSIncomingQueueOperation alloc] initWithCKKSKeychainView:ckks errorOnClassAFailure:true];
  97         incomingOp.name = [NSString stringWithFormat: @"resync-step%u-incoming", self.restartCount * steps + 2];
  98         [incomingOp addSuccessDependency:outgoingOp];
  99         [self runBeforeGroupFinished:incomingOp];
 100
 101         // Step 3:
 102         CKKSResultOperation* reloadOp = [[CKKSReloadAllItemsOperation alloc] initWithCKKSKeychainView:ckks];
 103         reloadOp.name = [NSString stringWithFormat: @"resync-step%u-reload", self.restartCount * steps + 3];
 104         [self runBeforeGroupFinished:reloadOp];
 105
 106         // Step 4
 107         CKKSIncomingQueueOperation* incomingResyncOp = [[CKKSIncomingQueueOperation alloc] initWithCKKSKeychainView:ckks errorOnClassAFailure:true];
 108         incomingResyncOp.name = [NSString stringWithFormat: @"resync-step%u-incoming-again", self.restartCount * steps + 4];
 109         [incomingResyncOp addSuccessDependency: reloadOp];
 110         [self runBeforeGroupFinished:incomingResyncOp];
 111
 112         // Step 5
 113         CKKSScanLocalItemsOperation* scan = [[CKKSScanLocalItemsOperation alloc] initWithCKKSKeychainView:ckks ckoperationGroup:operationGroup];
 114         scan.name = [NSString stringWithFormat: @"resync-step%u-scan", self.restartCount * steps + 5];
 115         [scan addSuccessDependency: incomingResyncOp];
 116         [self runBeforeGroupFinished: scan];
 117
 118         // Step 6
 119         CKKSResultOperation* restart = [[CKKSResultOperation alloc] init];
 120         restart.name = [NSString stringWithFormat: @"resync-step%u-consider-restart", self.restartCount * steps + 6];
 121         [restart addExecutionBlock:^{
 122             __strong __typeof(weakSelf) strongSelf = weakSelf;
 123             if(!strongSelf) {
 124                 secerror("ckksresync: received callback for released object");
 125                 return;
 126             }
 127
 128             NSError* error = nil;
 129             NSArray<NSString*>* iqes = [CKKSIncomingQueueEntry allUUIDs:ckks.zoneID error:&error];
 130             if(error) {
 131                 ckkserror("ckksresync", ckks, "Couldn't fetch IQEs: %@", error);
 132             }
 133
 134             if(scan.recordsFound > 0 || iqes.count > 0) {
 135                 if(strongSelf.restartCount >= 3) {
 136                     // we've restarted too many times. Fail and stop.
 137                     ckkserror("ckksresync", ckks, "restarted synchronization too often; Failing");
 138                     strongSelf.error = [NSError errorWithDomain:@"securityd"
 139                                                            code:2
 140                                                        userInfo:@{NSLocalizedDescriptionKey: @"resynchronization restarted too many times; churn in database?"}];
 141                 } else {
 142                     // restart the sync operation.
 143                     strongSelf.restartCount += 1;
 144                     ckkserror("ckksresync", ckks, "restarting synchronization operation due to new local items");
 145                     [strongSelf groupStart];
 146                 }
 147             }
 148         }];
 149
 150         [restart addSuccessDependency: scan];
 151         [self runBeforeGroupFinished: restart];
 152
 153         return true;
 154     }];
 155 }
 156
 157 @end;
 158
 159 #pragma mark - CKKSReloadAllItemsOperation
 160
 161 @implementation CKKSReloadAllItemsOperation
 162
 163 - (instancetype)init {
 164     return nil;
 165 }
 166 - (instancetype)initWithCKKSKeychainView:(CKKSKeychainView*)ckks
 167 {
 168     if(self = [super init]) {
 169         _ckks = ckks;
 170     }
 171     return self;
 172 }
 173
 174 - (void)main {
 175     CKKSKeychainView* strongCKKS = self.ckks;
 176
 177     [strongCKKS dispatchSync: ^bool{
 178        NSError* error = nil;
 179        NSArray<CKKSMirrorEntry*>* mirrorItems = [CKKSMirrorEntry all:strongCKKS.zoneID error:&error];
 180
 181        if(error) {
 182            ckkserror("ckksresync", strongCKKS, "Couldn't fetch mirror items: %@", error);
 183            self.error = error;
 184            return false;
 185        }
 186
 187        // Reload all entries back into the local keychain
 188        // We _could_ scan for entries, but that'd be expensive
 189        // In 36044942, we used to store only the CKRecord system fields in the ckrecord. To work around this, make a whole new CKRecord from the item.
 190        for(CKKSMirrorEntry* ckme in mirrorItems) {
 191            CKRecord* ckmeRecord = [ckme.item CKRecordWithZoneID:strongCKKS.zoneID];
 192            if(!ckmeRecord) {
 193                ckkserror("ckksresync", strongCKKS, "Couldn't make CKRecord for item: %@", ckme);
 194                continue;
 195            }
 196
 197            [strongCKKS _onqueueCKRecordChanged:ckmeRecord resync:true];
 198        }
 199
 200        return true;
 201     }];
 202 }
 203 @end
 204 #endif
 205