keychain/ckks/CKKSLocalSynchronizeOperation.m

   1 /*
   2  * Copyright (c) 2016 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import "keychain/ckks/CKKSKeychainView.h"
  25 #import "keychain/ckks/CKKSGroupOperation.h"
  26 #import "keychain/ckks/CKKSLocalSynchronizeOperation.h"
  27 #import "keychain/ckks/CKKSFetchAllRecordZoneChangesOperation.h"
  28 #import "keychain/ckks/CKKSScanLocalItemsOperation.h"
  29 #import "keychain/ckks/CKKSMirrorEntry.h"
  30 #import "keychain/ckks/CKKSIncomingQueueEntry.h"
  31 #import "keychain/ckks/CloudKitCategories.h"
  32 #import "keychain/categories/NSError+UsefulConstructors.h"
  33 #import "keychain/ot/ObjCImprovements.h"
  34
  35 #if OCTAGON
  36
  37 @interface CKKSLocalSynchronizeOperation ()
  38 @property int32_t restartCount;
  39 @end
  40
  41 @implementation CKKSLocalSynchronizeOperation
  42
  43 - (instancetype)init {
  44     return nil;
  45 }
  46 - (instancetype)initWithCKKSKeychainView:(CKKSKeychainView*)ckks
  47 {
  48     if(self = [super init]) {
  49         _ckks = ckks;
  50         _restartCount = 0;
  51
  52         [self addNullableDependency:ckks.holdLocalSynchronizeOperation];
  53     }
  54     return self;
  55 }
  56
  57 - (void)groupStart {
  58     WEAKIFY(self);
  59
  60     /*
  61      * A local synchronize is very similar to a CloudKit synchronize, but it won't cause any (non-essential)
  62      * CloudKit operations to occur.
  63      *
  64      *  1. Finish processing the outgoing queue. You can't be in-sync with cloudkit if you have an update that hasn't propagated.
  65      *  2. Process anything in the incoming queue as normal.
  66      *          (Note that this might require the keybag to be unlocked.)
  67      *
  68      *  3. Take every item in the CKMirror, and check for its existence in the local keychain. If not present, add to the incoming queue.
  69      *  4. Process the incoming queue again.
  70      *  5. Scan the local keychain for items which exist locally but are not in CloudKit. Upload them.
  71      *  6. If there are any such items in 4, restart the sync.
  72      */
  73
  74     CKKSKeychainView* ckks = self.ckks;
  75
  76     // Synchronous, on some thread. Get back on the CKKS queue for SQL thread-safety.
  77     [ckks dispatchSync: ^bool{
  78         if(self.cancelled) {
  79             ckksnotice("ckksresync", ckks, "CKKSSynchronizeOperation cancelled, quitting");
  80             return false;
  81         }
  82
  83         //ckks.lastLocalSynchronizeOperation = self;
  84
  85         uint32_t steps = 5;
  86
  87         ckksinfo("ckksresync", ckks, "Beginning local resynchronize (attempt %u)", self.restartCount);
  88
  89         CKOperationGroup* operationGroup = [CKOperationGroup CKKSGroupWithName:@"ckks-resync-local"];
  90
  91         // Step 1
  92         CKKSOutgoingQueueOperation* outgoingOp = [ckks processOutgoingQueue: operationGroup];
  93         outgoingOp.name = [NSString stringWithFormat: @"resync-step%u-outgoing", self.restartCount * steps + 1];
  94         [self dependOnBeforeGroupFinished:outgoingOp];
  95
  96         // Step 2
  97         CKKSIncomingQueueOperation* incomingOp = [[CKKSIncomingQueueOperation alloc] initWithCKKSKeychainView:ckks errorOnClassAFailure:true];
  98         incomingOp.name = [NSString stringWithFormat: @"resync-step%u-incoming", self.restartCount * steps + 2];
  99         [incomingOp addSuccessDependency:outgoingOp];
 100         [self runBeforeGroupFinished:incomingOp];
 101
 102         // Step 3:
 103         CKKSResultOperation* reloadOp = [[CKKSReloadAllItemsOperation alloc] initWithCKKSKeychainView:ckks];
 104         reloadOp.name = [NSString stringWithFormat: @"resync-step%u-reload", self.restartCount * steps + 3];
 105         [self runBeforeGroupFinished:reloadOp];
 106
 107         // Step 4
 108         CKKSIncomingQueueOperation* incomingResyncOp = [[CKKSIncomingQueueOperation alloc] initWithCKKSKeychainView:ckks errorOnClassAFailure:true];
 109         incomingResyncOp.name = [NSString stringWithFormat: @"resync-step%u-incoming-again", self.restartCount * steps + 4];
 110         [incomingResyncOp addSuccessDependency: reloadOp];
 111         [self runBeforeGroupFinished:incomingResyncOp];
 112
 113         // Step 5
 114         CKKSScanLocalItemsOperation* scan = [[CKKSScanLocalItemsOperation alloc] initWithCKKSKeychainView:ckks ckoperationGroup:operationGroup];
 115         scan.name = [NSString stringWithFormat: @"resync-step%u-scan", self.restartCount * steps + 5];
 116         [scan addSuccessDependency: incomingResyncOp];
 117         [self runBeforeGroupFinished: scan];
 118
 119         // Step 6
 120         CKKSResultOperation* restart = [[CKKSResultOperation alloc] init];
 121         restart.name = [NSString stringWithFormat: @"resync-step%u-consider-restart", self.restartCount * steps + 6];
 122         [restart addExecutionBlock:^{
 123             STRONGIFY(self);
 124             if(!self) {
 125                 secerror("ckksresync: received callback for released object");
 126                 return;
 127             }
 128
 129             NSError* error = nil;
 130             NSArray<NSString*>* iqes = [CKKSIncomingQueueEntry allUUIDs:ckks.zoneID error:&error];
 131             if(error) {
 132                 ckkserror("ckksresync", ckks, "Couldn't fetch IQEs: %@", error);
 133             }
 134
 135             if(scan.recordsFound > 0 || iqes.count > 0) {
 136                 if(self.restartCount >= 3) {
 137                     // we've restarted too many times. Fail and stop.
 138                     ckkserror("ckksresync", ckks, "restarted synchronization too often; Failing");
 139                     self.error = [NSError errorWithDomain:@"securityd"
 140                                                            code:2
 141                                                        userInfo:@{NSLocalizedDescriptionKey: @"resynchronization restarted too many times; churn in database?"}];
 142                 } else {
 143                     // restart the sync operation.
 144                     self.restartCount += 1;
 145                     ckkserror("ckksresync", ckks, "restarting synchronization operation due to new local items");
 146                     [self groupStart];
 147                 }
 148             }
 149         }];
 150
 151         [restart addSuccessDependency: scan];
 152         [self runBeforeGroupFinished: restart];
 153
 154         return true;
 155     }];
 156 }
 157
 158 @end;
 159
 160 #pragma mark - CKKSReloadAllItemsOperation
 161
 162 @implementation CKKSReloadAllItemsOperation
 163
 164 - (instancetype)init {
 165     return nil;
 166 }
 167 - (instancetype)initWithCKKSKeychainView:(CKKSKeychainView*)ckks
 168 {
 169     if(self = [super init]) {
 170         _ckks = ckks;
 171     }
 172     return self;
 173 }
 174
 175 - (void)main {
 176     CKKSKeychainView* strongCKKS = self.ckks;
 177
 178     [strongCKKS dispatchSync: ^bool{
 179        NSError* error = nil;
 180        NSArray<CKKSMirrorEntry*>* mirrorItems = [CKKSMirrorEntry all:strongCKKS.zoneID error:&error];
 181
 182        if(error) {
 183            ckkserror("ckksresync", strongCKKS, "Couldn't fetch mirror items: %@", error);
 184            self.error = error;
 185            return false;
 186        }
 187
 188        // Reload all entries back into the local keychain
 189        // We _could_ scan for entries, but that'd be expensive
 190        // In 36044942, we used to store only the CKRecord system fields in the ckrecord. To work around this, make a whole new CKRecord from the item.
 191        for(CKKSMirrorEntry* ckme in mirrorItems) {
 192            CKRecord* ckmeRecord = [ckme.item CKRecordWithZoneID:strongCKKS.zoneID];
 193            if(!ckmeRecord) {
 194                ckkserror("ckksresync", strongCKKS, "Couldn't make CKRecord for item: %@", ckme);
 195                continue;
 196            }
 197
 198            [strongCKKS _onqueueCKRecordChanged:ckmeRecord resync:true];
 199        }
 200
 201        return true;
 202     }];
 203 }
 204 @end
 205 #endif
 206