keychain/ckks/CKKSViewManager.m

   1 /*
   2  * Copyright (c) 2016 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import "keychain/ckks/CKKSViewManager.h"
  25 #import "keychain/ckks/CKKSKeychainView.h"
  26 #import "keychain/ckks/CKKSSynchronizeOperation.h"
  27 #import "keychain/ckks/CKKSKey.h"
  28 #import "keychain/ckks/CKKSZoneStateEntry.h"
  29 #import "keychain/ckks/CKKSNearFutureScheduler.h"
  30 #import "keychain/ckks/CKKSNotifier.h"
  31 #import "keychain/ckks/CKKSCondition.h"
  32 #import "keychain/ckks/CloudKitCategories.h"
  33 #import "keychain/categories/NSError+UsefulConstructors.h"
  34
  35 #import "keychain/ot/OTDefines.h"
  36
  37 #import "SecEntitlements.h"
  38
  39 #include <securityd/SecDbItem.h>
  40 #include <securityd/SecDbKeychainItem.h>
  41 #include <securityd/SecItemSchema.h>
  42 #include <Security/SecureObjectSync/SOSViews.h>
  43
  44 #import <Foundation/NSXPCConnection.h>
  45 #import <Foundation/NSXPCConnection_Private.h>
  46
  47 #include <Security/SecureObjectSync/SOSAccount.h>
  48 #include <Security/SecItemBackup.h>
  49
  50 #if OCTAGON
  51 #import <CloudKit/CloudKit.h>
  52 #import <CloudKit/CloudKit_Private.h>
  53
  54 #import <SecurityFoundation/SFKey.h>
  55 #import <SecurityFoundation/SFKey_Private.h>
  56
  57 #import "CKKSAnalytics.h"
  58 #endif
  59
  60 @interface CKKSViewManager () <NSXPCListenerDelegate>
  61 #if OCTAGON
  62 @property NSXPCListener *listener;
  63
  64 // Once you set these, all CKKSKeychainViews created will use them
  65 @property (readonly) Class<CKKSFetchRecordZoneChangesOperation> fetchRecordZoneChangesOperationClass;
  66 @property (readonly) Class<CKKSFetchRecordsOperation> fetchRecordsOperationClass;
  67 @property (readonly) Class<CKKSQueryOperation> queryOperationClass;
  68 @property (readonly) Class<CKKSModifySubscriptionsOperation> modifySubscriptionsOperationClass;
  69 @property (readonly) Class<CKKSModifyRecordZonesOperation> modifyRecordZonesOperationClass;
  70 @property (readonly) Class<CKKSAPSConnection> apsConnectionClass;
  71 @property (readonly) Class<CKKSNotifier> notifierClass;
  72 @property (readonly) Class<CKKSNSNotificationCenter> nsnotificationCenterClass;
  73
  74 @property NSMutableDictionary<NSString*, CKKSKeychainView*>* views;
  75
  76 @property NSMutableDictionary<NSString*, SecBoolNSErrorCallback>* pendingSyncCallbacks;
  77 @property CKKSNearFutureScheduler* savedTLKNotifier;;
  78 @property NSOperationQueue* operationQueue;
  79
  80 @property NSMapTable<dispatch_queue_t, id<CKKSPeerUpdateListener>>* peerChangeListeners;
  81 #endif
  82 @end
  83
  84 #if OCTAGON
  85 @interface CKKSViewManager (lockstateTracker) <CKKSLockStateNotification>
  86 @end
  87 #endif
  88
  89 @implementation CKKSViewManager
  90 #if OCTAGON
  91
  92 - (instancetype)initCloudKitWithContainerName: (NSString*) containerName usePCS:(bool)usePCS {
  93     return [self initWithContainerName:containerName
  94                                 usePCS:usePCS
  95   fetchRecordZoneChangesOperationClass:[CKFetchRecordZoneChangesOperation class]
  96             fetchRecordsOperationClass:[CKFetchRecordsOperation class]
  97                    queryOperationClass:[CKQueryOperation class]
  98      modifySubscriptionsOperationClass:[CKModifySubscriptionsOperation class]
  99        modifyRecordZonesOperationClass:[CKModifyRecordZonesOperation class]
 100                     apsConnectionClass:[APSConnection class]
 101              nsnotificationCenterClass:[NSNotificationCenter class]
 102                          notifierClass:[CKKSNotifyPostNotifier class]];
 103 }
 104
 105 - (instancetype)initWithContainerName: (NSString*) containerName
 106                                usePCS: (bool)usePCS
 107  fetchRecordZoneChangesOperationClass: (Class<CKKSFetchRecordZoneChangesOperation>) fetchRecordZoneChangesOperationClass
 108            fetchRecordsOperationClass: (Class<CKKSFetchRecordsOperation>)fetchRecordsOperationClass
 109                   queryOperationClass: (Class<CKKSQueryOperation>)queryOperationClass
 110     modifySubscriptionsOperationClass: (Class<CKKSModifySubscriptionsOperation>) modifySubscriptionsOperationClass
 111       modifyRecordZonesOperationClass: (Class<CKKSModifyRecordZonesOperation>) modifyRecordZonesOperationClass
 112                    apsConnectionClass: (Class<CKKSAPSConnection>) apsConnectionClass
 113             nsnotificationCenterClass: (Class<CKKSNSNotificationCenter>) nsnotificationCenterClass
 114                         notifierClass: (Class<CKKSNotifier>) notifierClass
 115 {
 116     if(self = [super init]) {
 117         _fetchRecordZoneChangesOperationClass = fetchRecordZoneChangesOperationClass;
 118         _fetchRecordsOperationClass = fetchRecordsOperationClass;
 119         _queryOperationClass = queryOperationClass;
 120         _modifySubscriptionsOperationClass = modifySubscriptionsOperationClass;
 121         _modifyRecordZonesOperationClass = modifyRecordZonesOperationClass;
 122         _apsConnectionClass = apsConnectionClass;
 123         _nsnotificationCenterClass = nsnotificationCenterClass;
 124         _notifierClass = notifierClass;
 125
 126         _container = [self makeCKContainer: containerName usePCS:usePCS];
 127         _accountTracker = [[CKKSCKAccountStateTracker alloc] init:self.container nsnotificationCenterClass:nsnotificationCenterClass];
 128         _lockStateTracker = [[CKKSLockStateTracker alloc] init];
 129         [_lockStateTracker addLockStateObserver:self];
 130         _reachabilityTracker = [[CKKSReachabilityTracker alloc] init];
 131
 132         _zoneChangeFetcher = [[CKKSZoneChangeFetcher alloc] initWithContainer:_container
 133                                                                    fetchClass:fetchRecordZoneChangesOperationClass
 134                                                           reachabilityTracker:_reachabilityTracker];
 135
 136         _operationQueue = [[NSOperationQueue alloc] init];
 137
 138         // Backwards from how we'd like, but it's the best way to have weak pointers to CKKSPeerUpdateListener.
 139         _peerChangeListeners = [NSMapTable strongToWeakObjectsMapTable];
 140
 141         _views = [[NSMutableDictionary alloc] init];
 142         _pendingSyncCallbacks = [[NSMutableDictionary alloc] init];
 143
 144         _initializeNewZones = false;
 145
 146         _completedSecCKKSInitialize = [[CKKSCondition alloc] init];
 147
 148         __weak __typeof(self) weakSelf = self;
 149         _savedTLKNotifier = [[CKKSNearFutureScheduler alloc] initWithName:@"newtlks"
 150                                                                     delay:5*NSEC_PER_SEC
 151                                                          keepProcessAlive:true
 152                                                 dependencyDescriptionCode:CKKSResultDescriptionNone
 153                                                                     block:^{
 154             [weakSelf notifyNewTLKsInKeychain];
 155         }];
 156
 157         _listener = [NSXPCListener anonymousListener];
 158         _listener.delegate = self;
 159         [_listener resume];
 160
 161         // If this is a live server, register with notify
 162         if(!SecCKKSTestsEnabled()) {
 163             int token = 0;
 164             notify_register_dispatch(kSOSCCCircleOctagonKeysChangedNotification, &token, dispatch_get_global_queue(QOS_CLASS_UTILITY, 0), ^(int t) {
 165                 // Since SOS doesn't change the self peer, we can reliably just send "trusted peers changed"; it'll be mostly right
 166                 secnotice("ckksshare", "Received a notification that the SOS Octagon peer set changed");
 167                 [weakSelf sendTrustedPeerSetChangedUpdate];
 168             });
 169         }
 170     }
 171     return self;
 172 }
 173
 174 -(CKContainer*)makeCKContainer:(NSString*)containerName usePCS:(bool)usePCS {
 175     CKContainer* container = [CKContainer containerWithIdentifier:containerName];
 176     if(!usePCS) {
 177         CKContainerOptions* containerOptions = [[CKContainerOptions alloc] init];
 178         containerOptions.bypassPCSEncryption = YES;
 179
 180         // We don't have a great way to set these, so replace the entire container object
 181         container = [[CKContainer alloc] initWithContainerID: container.containerID options:containerOptions];
 182     }
 183     return container;
 184 }
 185
 186 - (void)setupAnalytics
 187 {
 188     __weak __typeof(self) weakSelf = self;
 189
 190     // Tests shouldn't continue here; it leads to entitlement crashes with CloudKit if the mocks aren't enabled when this function runs
 191     if(SecCKKSTestsEnabled()) {
 192         return;
 193     }
 194
 195     [[CKKSAnalytics logger] AddMultiSamplerForName:@"CKKS-healthSummary" withTimeInterval:SFAnalyticsSamplerIntervalOncePerReport block:^NSDictionary<NSString *,NSNumber *> *{
 196         __strong __typeof(self) strongSelf = weakSelf;
 197         if(!strongSelf) {
 198             return nil;
 199         }
 200
 201         NSMutableDictionary* values = [NSMutableDictionary dictionary];
 202         BOOL inCircle = (strongSelf.accountTracker.currentCircleStatus == kSOSCCInCircle);
 203         if (inCircle) {
 204             [[CKKSAnalytics logger] setDateProperty:[NSDate date] forKey:CKKSAnalyticsLastInCircle];
 205         }
 206         values[CKKSAnalyticsInCircle] = @(inCircle);
 207
 208         BOOL validCredentials = strongSelf.accountTracker.currentCKAccountInfo.hasValidCredentials;
 209         if (!validCredentials) {
 210             values[CKKSAnalyticsValidCredentials] = @(validCredentials);
 211         }
 212
 213         NSArray<NSString *>* keys = @[ CKKSAnalyticsLastUnlock, CKKSAnalyticsLastInCircle];
 214         for (NSString * key in keys) {
 215             NSDate *date = [[CKKSAnalytics logger] datePropertyForKey:key];
 216             values[key] = @([CKKSAnalytics fuzzyDaysSinceDate:date]);
 217         }
 218         return values;
 219     }];
 220
 221     for (NSString* viewName in [self viewList]) {
 222         [[CKKSAnalytics logger] AddMultiSamplerForName:[NSString stringWithFormat:@"CKKS-%@-healthSummary", viewName] withTimeInterval:SFAnalyticsSamplerIntervalOncePerReport block:^NSDictionary<NSString *,NSNumber *> *{
 223             __strong __typeof(self) strongSelf = weakSelf;
 224             if(!strongSelf) {
 225                 return nil;
 226             }
 227             BOOL inCircle = strongSelf.accountTracker && strongSelf.accountTracker.currentCircleStatus == kSOSCCInCircle;
 228             NSMutableDictionary* values = [NSMutableDictionary dictionary];
 229             CKKSKeychainView* view = [strongSelf findOrCreateView:viewName];
 230             NSDate* dateOfLastSyncClassA = [[CKKSAnalytics logger] dateOfLastSuccessForEvent:CKKSEventProcessIncomingQueueClassA inView:view];
 231             NSDate* dateOfLastSyncClassC = [[CKKSAnalytics logger] dateOfLastSuccessForEvent:CKKSEventProcessIncomingQueueClassC inView:view];
 232             NSDate* dateOfLastKSR = [[CKKSAnalytics logger] datePropertyForKey:CKKSAnalyticsLastKeystateReady inView:view];
 233
 234             NSInteger fuzzyDaysSinceClassASync = [CKKSAnalytics fuzzyDaysSinceDate:dateOfLastSyncClassA];
 235             NSInteger fuzzyDaysSinceClassCSync = [CKKSAnalytics fuzzyDaysSinceDate:dateOfLastSyncClassC];
 236             NSInteger fuzzyDaysSinceKSR = [CKKSAnalytics fuzzyDaysSinceDate:dateOfLastKSR];
 237             [values setValue:@(fuzzyDaysSinceClassASync) forKey:[NSString stringWithFormat:@"%@-daysSinceClassASync", viewName]];
 238             [values setValue:@(fuzzyDaysSinceClassCSync) forKey:[NSString stringWithFormat:@"%@-daysSinceClassCSync", viewName]];
 239             [values setValue:@(fuzzyDaysSinceKSR) forKey:[NSString stringWithFormat:@"%@-daysSinceLastKeystateReady", viewName]];
 240
 241             BOOL hasTLKs = [view.keyHierarchyState isEqualToString:SecCKKSZoneKeyStateReady] || [view.keyHierarchyState isEqualToString:SecCKKSZoneKeyStateReadyPendingUnlock];
 242             /* only synced recently if between [0...7, ie withing 7 days */
 243             BOOL syncedClassARecently = fuzzyDaysSinceClassASync >= 0 && fuzzyDaysSinceClassASync < 7;
 244             BOOL syncedClassCRecently = fuzzyDaysSinceClassCSync >= 0 && fuzzyDaysSinceClassCSync < 7;
 245             BOOL incomingQueueIsErrorFree = view.lastIncomingQueueOperation.error == nil;
 246             BOOL outgoingQueueIsErrorFree = view.lastOutgoingQueueOperation.error == nil;
 247
 248             NSString* hasTLKsKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsHasTLKs];
 249             NSString* syncedClassARecentlyKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsSyncedClassARecently];
 250             NSString* syncedClassCRecentlyKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsSyncedClassCRecently];
 251             NSString* incomingQueueIsErrorFreeKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsIncomingQueueIsErrorFree];
 252             NSString* outgoingQueueIsErrorFreeKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsOutgoingQueueIsErrorFree];
 253
 254             values[hasTLKsKey] = @(hasTLKs);
 255             values[syncedClassARecentlyKey] = @(syncedClassARecently);
 256             values[syncedClassCRecentlyKey] = @(syncedClassCRecently);
 257             values[incomingQueueIsErrorFreeKey] = @(incomingQueueIsErrorFree);
 258             values[outgoingQueueIsErrorFreeKey] = @(outgoingQueueIsErrorFree);
 259
 260             BOOL weThinkWeAreInSync = inCircle && hasTLKs && syncedClassARecently && syncedClassCRecently && incomingQueueIsErrorFree && outgoingQueueIsErrorFree;
 261             NSString* inSyncKey = [NSString stringWithFormat:@"%@-%@", viewName, CKKSAnalyticsInSync];
 262             values[inSyncKey] = @(weThinkWeAreInSync);
 263
 264             return values;
 265         }];
 266     }
 267 }
 268
 269 -(void)dealloc {
 270     [self clearAllViews];
 271 }
 272
 273 dispatch_queue_t globalZoneStateQueue = NULL;
 274 dispatch_once_t globalZoneStateQueueOnce;
 275
 276 // We can't load the rate limiter in an init method, as the method might end up calling itself (if the database layer isn't yet initialized).
 277 // Lazy-load it here.
 278 - (CKKSRateLimiter*)getGlobalRateLimiter {
 279     dispatch_once(&globalZoneStateQueueOnce, ^{
 280         globalZoneStateQueue = dispatch_queue_create("CKKS global zone state", DISPATCH_QUEUE_SERIAL);
 281     });
 282
 283     if(_globalRateLimiter != nil) {
 284         return _globalRateLimiter;
 285     }
 286
 287     __block CKKSRateLimiter* blocklimit = nil;
 288
 289     dispatch_sync(globalZoneStateQueue, ^{
 290         NSError* error = nil;
 291
 292         // Special object containing state for all zones. Currently, just the rate limiter.
 293         CKKSZoneStateEntry* allEntry = [CKKSZoneStateEntry tryFromDatabase: @"all" error:&error];
 294
 295         if(error) {
 296             secerror("CKKSViewManager: couldn't load global zone state: %@", error);
 297         }
 298
 299         if(!error && allEntry.rateLimiter) {
 300             blocklimit = allEntry.rateLimiter;
 301         } else {
 302             blocklimit = [[CKKSRateLimiter alloc] init];
 303         }
 304     });
 305     _globalRateLimiter = blocklimit;
 306     return _globalRateLimiter;
 307 }
 308
 309 - (void)lockStateChangeNotification:(bool)unlocked
 310 {
 311     if (unlocked) {
 312         [[CKKSAnalytics logger] setDateProperty:[NSDate date] forKey:CKKSAnalyticsLastUnlock];
 313     }
 314 }
 315
 316 // Mostly exists to be mocked out.
 317 -(NSSet*)viewList {
 318     return CFBridgingRelease(SOSViewCopyViewSet(kViewSetCKKS));
 319 }
 320
 321 - (void)setView: (CKKSKeychainView*) obj {
 322     CKKSKeychainView* kcv = nil;
 323
 324     @synchronized(self.views) {
 325         kcv = self.views[obj.zoneName];
 326         self.views[obj.zoneName] = obj;
 327     }
 328
 329     if(kcv) {
 330         [kcv cancelAllOperations];
 331     }
 332 }
 333
 334 - (void)clearAllViews {
 335     NSArray<CKKSKeychainView*>* tempviews = nil;
 336     @synchronized(self.views) {
 337         tempviews = [self.views.allValues copy];
 338         [self.views removeAllObjects];
 339     }
 340
 341     for(CKKSKeychainView* view in tempviews) {
 342         [view cancelAllOperations];
 343     }
 344 }
 345
 346 - (void)clearView:(NSString*) viewName {
 347     CKKSKeychainView* kcv = nil;
 348     @synchronized(self.views) {
 349         kcv = self.views[viewName];
 350         self.views[viewName] = nil;
 351     }
 352
 353     if(kcv) {
 354         [kcv cancelAllOperations];
 355     }
 356 }
 357
 358 - (CKKSKeychainView*)findView:(NSString*)viewName {
 359     if(!viewName) {
 360         return nil;
 361     }
 362     @synchronized(self.views) {
 363         return self.views[viewName];
 364     }
 365 }
 366
 367 - (CKKSKeychainView*)findOrCreateView:(NSString*)viewName {
 368     @synchronized(self.views) {
 369         CKKSKeychainView* kcv = self.views[viewName];
 370         if(kcv) {
 371             return kcv;
 372         }
 373
 374         self.views[viewName] = [[CKKSKeychainView alloc] initWithContainer: self.container
 375                                                                   zoneName: viewName
 376                                                             accountTracker: self.accountTracker
 377                                                           lockStateTracker: self.lockStateTracker
 378                                                        reachabilityTracker: self.reachabilityTracker
 379                                                              changeFetcher:self.zoneChangeFetcher
 380                                                           savedTLKNotifier: self.savedTLKNotifier
 381                                                               peerProvider:self
 382                                       fetchRecordZoneChangesOperationClass: self.fetchRecordZoneChangesOperationClass
 383                                                 fetchRecordsOperationClass: self.fetchRecordsOperationClass
 384                                                        queryOperationClass:self.queryOperationClass
 385                                          modifySubscriptionsOperationClass: self.modifySubscriptionsOperationClass
 386                                            modifyRecordZonesOperationClass: self.modifyRecordZonesOperationClass
 387                                                         apsConnectionClass: self.apsConnectionClass
 388                                                              notifierClass: self.notifierClass];
 389
 390         if(self.initializeNewZones) {
 391             [self.views[viewName] initializeZone];
 392         }
 393
 394         return self.views[viewName];
 395     }
 396 }
 397
 398 - (NSDictionary<NSString *,NSString *> *)activeTLKs
 399 {
 400     NSMutableDictionary<NSString *,NSString *> *tlks = [NSMutableDictionary new];
 401     @synchronized(self.views) {
 402         for (NSString *name in self.views) {
 403             CKKSKeychainView *view = self.views[name];
 404             NSString *tlk = view.lastActiveTLKUUID;
 405             if (tlk) {
 406                 tlks[name] = tlk;
 407             }
 408         }
 409     }
 410     return tlks;
 411 }
 412
 413 - (CKKSKeychainView*)restartZone:(NSString*)viewName {
 414     @synchronized(self.views) {
 415         [self.views[viewName] halt];
 416         self.views[viewName] = nil;
 417     }
 418     return [self findOrCreateView: viewName];
 419 }
 420
 421 // Allows all views to begin initializing, and opens the floodgates so that new views will be initalized immediately
 422 - (void)initializeZones {
 423     if(!SecCKKSIsEnabled()) {
 424         secnotice("ckks", "Not initializing CKKS view set as CKKS is disabled");
 425         return;
 426     }
 427
 428     @synchronized(self.views) {
 429         self.initializeNewZones = true;
 430
 431         NSSet* viewSet = [self viewList];
 432         for(NSString* s in viewSet) {
 433             [self findOrCreateView:s]; // initializes any newly-created views
 434         }
 435     }
 436
 437     [self setupAnalytics];
 438 }
 439
 440 - (NSString*)viewNameForViewHint: (NSString*) viewHint {
 441     // For now, choose view based on viewhints.
 442     if(viewHint && ![viewHint isEqual: [NSNull null]]) {
 443         return viewHint;
 444     }
 445
 446     //  If there isn't a provided view hint, use the "keychain" view if we're testing. Otherwise, nil.
 447     if(SecCKKSTestsEnabled()) {
 448         return @"keychain";
 449     } else {
 450         return nil;
 451     }
 452 }
 453
 454 - (NSString*)viewNameForItem: (SecDbItemRef) item {
 455     CFErrorRef cferror = NULL;
 456     NSString* viewHint = (__bridge NSString*) SecDbItemGetValue(item, &v7vwht, &cferror);
 457
 458     if(cferror) {
 459         secerror("ckks: Couldn't fetch the viewhint for some reason: %@", cferror);
 460         CFReleaseNull(cferror);
 461         viewHint = nil;
 462     }
 463
 464     return [self viewNameForViewHint: viewHint];
 465 }
 466
 467 - (NSString*)viewNameForAttributes: (NSDictionary*) item {
 468     return [self viewNameForViewHint: item[(id)kSecAttrSyncViewHint]];
 469 }
 470
 471 - (void)registerSyncStatusCallback: (NSString*) uuid callback: (SecBoolNSErrorCallback) callback {
 472     // Someone is requesting future notification of this item.
 473     @synchronized(self.pendingSyncCallbacks) {
 474         self.pendingSyncCallbacks[uuid] = callback;
 475     }
 476 }
 477
 478 - (void) handleKeychainEventDbConnection: (SecDbConnectionRef) dbconn source:(SecDbTransactionSource)txionSource added: (SecDbItemRef) added deleted: (SecDbItemRef) deleted {
 479
 480     SecDbItemRef modified = added ? added : deleted;
 481
 482     NSString* viewName = [self viewNameForItem: modified];
 483     NSString* keyViewName = [CKKSKey isItemKeyForKeychainView: modified];
 484
 485     if(keyViewName) {
 486         // This might be some key material for this view! Poke it.
 487         CKKSKeychainView* view = [self findView: keyViewName];
 488
 489         if(!SecCKKSTestDisableKeyNotifications()) {
 490             ckksnotice("ckks", view, "Potential new key material from %@ (source %lu)",
 491                        keyViewName, (unsigned long)txionSource);
 492             [view keyStateMachineRequestProcess];
 493         } else {
 494             ckksnotice("ckks", view, "Ignoring potential new key material from %@ (source %lu)",
 495                        keyViewName, (unsigned long)txionSource);
 496         }
 497         return;
 498     }
 499
 500     // When SOS is in charge of a view, CKKS is not.
 501     // Since this isn't a CKKS key item, we don't care about it.
 502     if(txionSource == kSecDbSOSTransaction) {
 503         secinfo("ckks", "Ignoring new non-CKKS item in kSecDbSOSTransaction notification");
 504     }
 505
 506     // Looks like a normal item. Proceed!
 507     CKKSKeychainView* view = [self findView:viewName];
 508
 509     NSString* uuid = (__bridge NSString*) SecDbItemGetValue(modified, &v10itemuuid, NULL);
 510     SecBoolNSErrorCallback syncCallback = nil;
 511     if(uuid) {
 512         @synchronized(self.pendingSyncCallbacks) {
 513             syncCallback = self.pendingSyncCallbacks[uuid];
 514             self.pendingSyncCallbacks[uuid] = nil;
 515
 516             if(syncCallback) {
 517                 secinfo("ckks", "Have a pending callback for %@; passing along", uuid);
 518             }
 519         }
 520     }
 521
 522     if(!view) {
 523         secinfo("ckks", "No CKKS view for %@, skipping: %@", viewName, modified);
 524         if(syncCallback) {
 525             syncCallback(false, [NSError errorWithDomain:@"securityd"
 526                                                     code:kSOSCCNoSuchView
 527                                                 userInfo:@{NSLocalizedDescriptionKey: [NSString stringWithFormat: @"No syncing view for '%@'", viewName]}]);
 528         }
 529         return;
 530     }
 531
 532     ckksnotice("ckks", view, "Routing item to zone %@: %@", viewName, modified);
 533     [view handleKeychainEventDbConnection: dbconn added:added deleted:deleted rateLimiter:self.globalRateLimiter syncCallback: syncCallback];
 534 }
 535
 536 -(void)setCurrentItemForAccessGroup:(NSData* _Nonnull)newItemPersistentRef
 537                                hash:(NSData*)newItemSHA1
 538                         accessGroup:(NSString*)accessGroup
 539                          identifier:(NSString*)identifier
 540                            viewHint:(NSString*)viewHint
 541                           replacing:(NSData* _Nullable)oldCurrentItemPersistentRef
 542                                hash:(NSData*)oldItemSHA1
 543                            complete:(void (^) (NSError* operror)) complete
 544 {
 545     CKKSKeychainView* view = [self findView:viewHint];
 546
 547     if(!view) {
 548         secnotice("ckks", "No CKKS view for %@, skipping current request", viewHint);
 549         complete([NSError errorWithDomain:CKKSErrorDomain
 550                                      code:CKKSNoSuchView
 551                               description:[NSString stringWithFormat: @"No syncing view for view hint '%@'", viewHint]]);
 552         return;
 553     }
 554
 555     [view setCurrentItemForAccessGroup:newItemPersistentRef
 556                                   hash:newItemSHA1
 557                            accessGroup:accessGroup
 558                             identifier:identifier
 559                              replacing:oldCurrentItemPersistentRef
 560                                   hash:oldItemSHA1
 561                               complete:complete];
 562 }
 563
 564 -(void)getCurrentItemForAccessGroup:(NSString*)accessGroup
 565                          identifier:(NSString*)identifier
 566                            viewHint:(NSString*)viewHint
 567                     fetchCloudValue:(bool)fetchCloudValue
 568                            complete:(void (^) (NSString* uuid, NSError* operror)) complete
 569 {
 570     CKKSKeychainView* view = [self findView:viewHint];
 571     if(!view) {
 572         secnotice("ckks", "No CKKS view for %@, skipping current fetch request", viewHint);
 573         complete(NULL, [NSError errorWithDomain:CKKSErrorDomain
 574                                            code:CKKSNoSuchView
 575                                     description:[NSString stringWithFormat: @"No view for '%@'", viewHint]]);
 576         return;
 577     }
 578
 579     [view getCurrentItemForAccessGroup:accessGroup
 580                             identifier:identifier
 581                        fetchCloudValue:fetchCloudValue
 582                               complete:complete];
 583 }
 584
 585
 586 + (instancetype) manager {
 587     return [self resetManager: false setTo: nil];
 588 }
 589
 590 + (instancetype) resetManager: (bool) reset setTo: (CKKSViewManager*) obj {
 591     static CKKSViewManager* manager = nil;
 592
 593     if([CKDatabase class] == nil) {
 594         secerror("CKKS: CloudKit.framework appears to not be linked. Can't create CKKS objects.");
 595         return nil;
 596     }
 597
 598     if(!manager || reset || obj) {
 599         @synchronized([self class]) {
 600             if(obj != nil) {
 601                 [manager clearAllViews];
 602                 manager = obj;
 603             } else {
 604                 if(reset) {
 605                     [manager clearAllViews];
 606                     manager = nil;
 607                 } else if (manager == nil && SecCKKSIsEnabled()) {
 608                     manager = [[CKKSViewManager alloc] initCloudKitWithContainerName:SecCKKSContainerName usePCS:SecCKKSContainerUsePCS];
 609                 }
 610             }
 611         }
 612     }
 613
 614     return manager;
 615 }
 616
 617 - (void)cancelPendingOperations {
 618     [self.savedTLKNotifier cancel];
 619 }
 620
 621 -(void)notifyNewTLKsInKeychain {
 622     // Why two functions here? Limitation of OCMock, unfortunately: can't stub and expect the same method
 623     secnotice("ckksbackup", "New TLKs have arrived");
 624     [self syncBackupAndNotifyAboutSync];
 625 }
 626
 627 - (void)syncBackupAndNotifyAboutSync {
 628     SOSAccount* account = (__bridge SOSAccount*)SOSKeychainAccountGetSharedAccount();
 629
 630     [account performTransaction:^(SOSAccountTransaction * _Nonnull txn) {
 631         CFErrorRef error = NULL;
 632         NSSet* ignore = CFBridgingRelease(SOSAccountCopyBackupPeersAndForceSync(txn, &error));
 633         (void)ignore;
 634
 635         if(error) {
 636             secerror("ckksbackup: Couldn't process sync with backup peers: %@", error);
 637         } else {
 638             secnotice("ckksbackup", "telling CloudServices about TLK arrival");
 639             notify_post(kSecItemBackupNotification);
 640         };
 641     }];
 642 }
 643
 644 #pragma mark - RPCs to manage and report state
 645
 646 - (void)performanceCounters:(void(^)(NSDictionary <NSString *, NSNumber *> *counter))reply {
 647     reply(@{});
 648 }
 649
 650 - (NSArray<CKKSKeychainView*>*)views:(NSString*)viewName operation:(NSString*)opName error:(NSError**)error
 651 {
 652     NSArray* actualViews = nil;
 653
 654     // Ensure we've actually set up, but don't wait too long. Clients get impatient.
 655     if([self.completedSecCKKSInitialize wait:5*NSEC_PER_SEC]) {
 656         secerror("ckks: Haven't yet initialized zones; expect failure fetching views");
 657     }
 658
 659     @synchronized(self.views) {
 660         if(viewName) {
 661             CKKSKeychainView* view = self.views[viewName];
 662             secnotice("ckks", "Received a %@ request for zone %@ (%@)", opName, viewName, view);
 663
 664             if(!view) {
 665                 if(error) {
 666                     *error = [NSError errorWithDomain:CKKSErrorDomain
 667                                                  code:CKKSNoSuchView
 668                                              userInfo:@{NSLocalizedDescriptionKey: [NSString stringWithFormat: @"No view for '%@'", viewName]}];
 669                 }
 670                 return nil;
 671             }
 672
 673             actualViews = @[view];
 674         } else {
 675             actualViews = [self.views.allValues copy];
 676             secnotice("ckks", "Received a %@ request for all zones: %@", opName, actualViews);
 677         }
 678     }
 679     actualViews = [actualViews sortedArrayUsingDescriptors:@[[NSSortDescriptor sortDescriptorWithKey:@"zoneName" ascending:YES]]];
 680     return actualViews;
 681 }
 682
 683 - (void)rpcResetLocal:(NSString*)viewName reply: (void(^)(NSError* result)) reply {
 684     NSError* localError = nil;
 685     NSArray* actualViews = [self views:viewName operation:@"local reset" error:&localError];
 686     if(localError) {
 687         secerror("ckks: Error getting view %@: %@", viewName, localError);
 688         reply(localError);
 689         return;
 690     }
 691
 692     CKKSResultOperation* op = [CKKSResultOperation named:@"local-reset-zones-waiter" withBlockTakingSelf:^(CKKSResultOperation * _Nonnull strongOp) {
 693         if(!strongOp.error) {
 694             secnotice("ckksreset", "Completed rpcResetLocal");
 695         } else {
 696             secnotice("ckks", "Completed rpcResetLocal with error: %@", strongOp.error);
 697         }
 698         reply(CKXPCSuitableError(strongOp.error));
 699     }];
 700
 701     for(CKKSKeychainView* view in actualViews) {
 702         ckksnotice("ckksreset", view, "Beginning local reset for %@", view);
 703         [op addSuccessDependency:[view resetLocalData]];
 704     }
 705
 706     [op timeout:120*NSEC_PER_SEC];
 707     [self.operationQueue addOperation: op];
 708 }
 709
 710 #pragma clang diagnostic push
 711 #pragma clang diagnostic ignored "-Wdeprecated-implementations"
 712 - (void)rpcResetCloudKit:(NSString*)viewName reply: (void(^)(NSError* result)) reply {
 713     [self rpcResetCloudKit:viewName reason:@"unknown" reply:reply];
 714 }
 715 #pragma clang diagnostic pop
 716
 717 - (void)rpcResetCloudKit:(NSString*)viewName reason:(NSString *)reason reply:(void(^)(NSError* result)) reply {
 718     NSError* localError = nil;
 719     NSArray* actualViews = [self views:viewName operation:@"CloudKit reset" error:&localError];
 720     if(localError) {
 721         secerror("ckks: Error getting view %@: %@", viewName, localError);
 722         reply(localError);
 723         return;
 724     }
 725
 726     CKKSResultOperation* op = [CKKSResultOperation named:@"cloudkit-reset-zones-waiter" withBlockTakingSelf:^(CKKSResultOperation * _Nonnull strongOp) {
 727         if(!strongOp.error) {
 728             secnotice("ckksreset", "Completed rpcResetCloudKit");
 729         } else {
 730             secnotice("ckksreset", "Completed rpcResetCloudKit with error: %@", strongOp.error);
 731         }
 732         reply(CKXPCSuitableError(strongOp.error));
 733     }];
 734
 735     for(CKKSKeychainView* view in actualViews) {
 736         NSString *operationGroupName = [NSString stringWithFormat:@"api-reset-%@", reason];
 737         ckksnotice("ckksreset", view, "Beginning CloudKit reset for %@: %@", view, reason);
 738         [op addSuccessDependency:[view resetCloudKitZone:[CKOperationGroup CKKSGroupWithName:operationGroupName]]];
 739     }
 740
 741     [op timeout:120*NSEC_PER_SEC];
 742     [self.operationQueue addOperation: op];
 743 }
 744
 745 - (void)rpcResync:(NSString*)viewName reply: (void(^)(NSError* result)) reply {
 746     NSError* localError = nil;
 747     NSArray* actualViews = [self views:viewName operation:@"CloudKit resync" error:&localError];
 748     if(localError) {
 749         secerror("ckks: Error getting view %@: %@", viewName, localError);
 750         reply(localError);
 751         return;
 752     }
 753
 754     CKKSResultOperation* op = [[CKKSResultOperation alloc] init];
 755     op.name = @"rpc-resync-cloudkit";
 756     __weak __typeof(op) weakOp = op;
 757     [op addExecutionBlock:^{
 758         __strong __typeof(op) strongOp = weakOp;
 759         secnotice("ckks", "Ending rsync-CloudKit rpc with %@", strongOp.error);
 760     }];
 761
 762     for(CKKSKeychainView* view in actualViews) {
 763         ckksnotice("ckksresync", view, "Beginning resync (CloudKit) for %@", view);
 764
 765         CKKSSynchronizeOperation* resyncOp = [view resyncWithCloud];
 766         [op addSuccessDependency:resyncOp];
 767     }
 768
 769     [op timeout:120*NSEC_PER_SEC];
 770     [self.operationQueue addOperation:op];
 771     [op waitUntilFinished];
 772     reply(CKXPCSuitableError(op.error));
 773 }
 774
 775 - (void)rpcResyncLocal:(NSString*)viewName reply:(void(^)(NSError* result))reply {
 776     NSError* localError = nil;
 777     NSArray* actualViews = [self views:viewName operation:@"local resync" error:&localError];
 778     if(localError) {
 779         secerror("ckks: Error getting view %@: %@", viewName, localError);
 780         reply(localError);
 781         return;
 782     }
 783
 784     CKKSResultOperation* op = [[CKKSResultOperation alloc] init];
 785     op.name = @"rpc-resync-local";
 786     __weak __typeof(op) weakOp = op;
 787     [op addExecutionBlock:^{
 788         __strong __typeof(op) strongOp = weakOp;
 789         secnotice("ckks", "Ending rsync-local rpc with %@", strongOp.error);
 790         reply(CKXPCSuitableError(strongOp.error));
 791     }];
 792
 793     for(CKKSKeychainView* view in actualViews) {
 794         ckksnotice("ckksresync", view, "Beginning resync (local) for %@", view);
 795
 796         CKKSLocalSynchronizeOperation* resyncOp = [view resyncLocal];
 797         [op addSuccessDependency:resyncOp];
 798     }
 799
 800     [op timeout:120*NSEC_PER_SEC];
 801 }
 802
 803 - (void)rpcStatus: (NSString*)viewName reply: (void(^)(NSArray<NSDictionary*>* result, NSError* error)) reply {
 804     NSMutableArray* a = [[NSMutableArray alloc] init];
 805
 806     // Now, query the views about their status
 807     NSError* error = nil;
 808     NSArray* actualViews = [self views:viewName operation:@"status" error:&error];
 809     if(!actualViews || error) {
 810         reply(nil, error);
 811         return;
 812     }
 813
 814     __weak __typeof(self) weakSelf = self;
 815     CKKSResultOperation* statusOp = [CKKSResultOperation named:@"status-rpc" withBlock:^{
 816         __strong __typeof(self) strongSelf = weakSelf;
 817
 818         // The first element is always the current global state (non-view-specific)
 819         NSError* selfPeersError = nil;
 820         CKKSSelves* selves = [strongSelf fetchSelfPeers:&selfPeersError];
 821         NSError* trustedPeersError = nil;
 822         NSSet<id<CKKSPeer>>* peers = [strongSelf fetchTrustedPeers:&trustedPeersError];
 823
 824         // Get account state, even wait for it a little
 825         [self.accountTracker.ckdeviceIDInitialized wait:1*NSEC_PER_SEC];
 826         NSString *deviceID = self.accountTracker.ckdeviceID;
 827         NSError *deviceIDError = self.accountTracker.ckdeviceIDError;
 828
 829         NSMutableArray<NSString*>* mutTrustedPeers = [[NSMutableArray alloc] init];
 830         [peers enumerateObjectsUsingBlock:^(id<CKKSPeer>  _Nonnull obj, BOOL * _Nonnull stop) {
 831             [mutTrustedPeers addObject: [obj description]];
 832         }];
 833
 834 #define stringify(obj) CKKSNilToNSNull([obj description])
 835         NSDictionary* global = @{
 836                                  @"view":                @"global",
 837                                  @"selfPeers":           stringify(selves),
 838                                  @"selfPeersError":      CKKSNilToNSNull(selfPeersError),
 839                                  @"trustedPeers":        CKKSNilToNSNull(mutTrustedPeers),
 840                                  @"trustedPeersError":   CKKSNilToNSNull(trustedPeersError),
 841                                  @"reachability":        strongSelf.reachabilityTracker.currentReachability ? @"network" : @"no-network",
 842                                  @"ckdeviceID":          CKKSNilToNSNull(deviceID),
 843                                  @"ckdeviceIDError":     CKKSNilToNSNull(deviceIDError),
 844         };
 845         [a addObject: global];
 846
 847         for(CKKSKeychainView* view in actualViews) {
 848             ckksnotice("ckks", view, "Fetching status for %@", view.zoneName);
 849             NSDictionary* status = [view status];
 850             ckksinfo("ckks", view, "Status is %@", status);
 851             if(status) {
 852                 [a addObject: status];
 853             }
 854         }
 855         reply(a, nil);
 856     }];
 857
 858     // If we're signed in, give the views a few seconds to enter what they consider to be a non-transient state (in case this daemon just launched)
 859     if([self.accountTracker.currentComputedAccountStatusValid wait:5*NSEC_PER_SEC]) {
 860         secerror("ckks status: Haven't yet figured out login state");
 861     }
 862
 863     if(self.accountTracker.currentComputedAccountStatus == CKKSAccountStatusAvailable) {
 864         CKKSResultOperation* blockOp = [CKKSResultOperation named:@"wait-for-status" withBlock:^{}];
 865         [blockOp timeout:8*NSEC_PER_SEC];
 866         for(CKKSKeychainView* view in actualViews) {
 867             [blockOp addNullableDependency:view.keyStateNonTransientDependency];
 868             [statusOp addDependency:blockOp];
 869         }
 870         [self.operationQueue addOperation:blockOp];
 871     }
 872     [self.operationQueue addOperation:statusOp];
 873
 874     return;
 875 }
 876
 877 - (void)rpcFetchAndProcessChanges:(NSString*)viewName reply: (void(^)(NSError* result))reply {
 878     [self rpcFetchAndProcessChanges:viewName classA:false reply: (void(^)(NSError* result))reply];
 879 }
 880
 881 - (void)rpcFetchAndProcessClassAChanges:(NSString*)viewName reply: (void(^)(NSError* result))reply {
 882     [self rpcFetchAndProcessChanges:viewName classA:true reply:(void(^)(NSError* result))reply];
 883 }
 884
 885 - (void)rpcFetchAndProcessChanges:(NSString*)viewName classA:(bool)classAError reply: (void(^)(NSError* result)) reply {
 886     NSError* error = nil;
 887     NSArray* actualViews = [self views:viewName operation:@"fetch" error:&error];
 888     if(!actualViews || error) {
 889         reply(error);
 890         return;
 891     }
 892
 893     CKKSResultOperation* blockOp = [[CKKSResultOperation alloc] init];
 894     blockOp.name = @"rpc-fetch-and-process-result";
 895     __weak __typeof(blockOp) weakBlockOp = blockOp;
 896     // Use the completion block instead of the operation block, so that it runs even if the cancel fires
 897     [blockOp setCompletionBlock:^{
 898         __strong __typeof(blockOp) strongBlockOp = weakBlockOp;
 899         [strongBlockOp allDependentsSuccessful];
 900         reply(CKXPCSuitableError(strongBlockOp.error));
 901     }];
 902
 903     for(CKKSKeychainView* view in actualViews) {
 904         ckksnotice("ckks", view, "Beginning fetch for %@", view);
 905
 906         CKKSResultOperation* op = [view processIncomingQueue:classAError after:[view.zoneChangeFetcher requestSuccessfulFetch: CKKSFetchBecauseAPIFetchRequest]];
 907         [blockOp addDependency:op];
 908     }
 909
 910     [self.operationQueue addOperation: [blockOp timeout:(SecCKKSTestsEnabled() ? NSEC_PER_SEC * 5 : NSEC_PER_SEC * 120)]];
 911 }
 912
 913 - (void)rpcPushOutgoingChanges:(NSString*)viewName reply: (void(^)(NSError* result))reply {
 914     NSError* error = nil;
 915     NSArray* actualViews = [self views:viewName operation:@"push" error:&error];
 916     if(!actualViews || error) {
 917         reply(error);
 918         return;
 919     }
 920
 921     CKKSResultOperation* blockOp = [[CKKSResultOperation alloc] init];
 922     blockOp.name = @"rpc-push";
 923     __weak __typeof(blockOp) weakBlockOp = blockOp;
 924     // Use the completion block instead of the operation block, so that it runs even if the cancel fires
 925     [blockOp setCompletionBlock:^{
 926         __strong __typeof(blockOp) strongBlockOp = weakBlockOp;
 927         [strongBlockOp allDependentsSuccessful];
 928         reply(CKXPCSuitableError(strongBlockOp.error));
 929     }];
 930
 931     for(CKKSKeychainView* view in actualViews) {
 932         ckksnotice("ckks-rpc", view, "Beginning push for %@", view);
 933
 934         CKKSResultOperation* op = [view processOutgoingQueue: [CKOperationGroup CKKSGroupWithName:@"rpc-push"]];
 935         [blockOp addDependency:op];
 936     }
 937
 938     [self.operationQueue addOperation: [blockOp timeout:(SecCKKSTestsEnabled() ? NSEC_PER_SEC * 2 : NSEC_PER_SEC * 120)]];
 939 }
 940
 941 - (void)rpcGetCKDeviceIDWithReply:(void (^)(NSString *))reply {
 942     reply(self.accountTracker.ckdeviceID);
 943 }
 944
 945 -(void)xpc24HrNotification {
 946     // XPC has poked us and said we should do some cleanup!
 947
 948     // For now, poke the views and tell them to update their device states if they'd like
 949     NSArray* actualViews = nil;
 950     @synchronized(self.views) {
 951         // Can't safely iterate a mutable collection, so copy it.
 952         actualViews = self.views.allValues;
 953     }
 954
 955     secnotice("ckks", "Received a 24hr notification from XPC");
 956     CKOperationGroup* group = [CKOperationGroup CKKSGroupWithName:@"periodic-device-state-update"];
 957     for(CKKSKeychainView* view in actualViews) {
 958         ckksnotice("ckks", view, "Starting device state XPC update");
 959         // Let the update know it should rate-limit itself
 960         [view updateDeviceState:true waitForKeyHierarchyInitialization:30*NSEC_PER_SEC ckoperationGroup:group];
 961     }
 962 }
 963
 964 - (NSArray<NSDictionary *> * _Nullable)loadRestoredBottledKeysOfType:(OctagonKeyType)keyType error:(NSError**)error
 965 {
 966     CFTypeRef result = NULL;
 967     NSMutableArray* bottledPeerKeychainItems = nil;
 968
 969     NSDictionary* query = @{
 970                             (id)kSecClass : (id)kSecClassInternetPassword,
 971                             (id)kSecAttrAccessible: (id)kSecAttrAccessibleWhenUnlocked,
 972                             (id)kSecAttrNoLegacy : @YES,
 973                             (id)kSecAttrType : [[NSNumber alloc]initWithInt: keyType],
 974                             (id)kSecAttrServer : (keyType == 1) ? @"Octagon Signing Key" : @"Octagon Encryption Key",
 975                             (id)kSecAttrAccessGroup: @"com.apple.security.ckks",
 976                             (id)kSecMatchLimit : (id)kSecMatchLimitAll,
 977                             (id)kSecReturnAttributes: @YES,
 978                             (id)kSecReturnData: @YES,
 979                             };
 980     OSStatus status = SecItemCopyMatching((__bridge CFDictionaryRef)query, &result);
 981
 982     if(status == errSecSuccess && result && isArray(result)) {
 983         bottledPeerKeychainItems = CFBridgingRelease(result);
 984         result = NULL;
 985     } else {
 986         if(error) {
 987             *error = [NSError errorWithDomain:NSOSStatusErrorDomain
 988                                          code:status
 989                                   description:@"could not load bottled peer keys"];
 990         }
 991         CFReleaseNull(result);
 992     }
 993
 994     return bottledPeerKeychainItems;
 995 }
 996
 997 -(NSDictionary *) keychainItemForPeerID:(NSString*)neededPeerID
 998                           keychainItems:(NSArray<NSDictionary*> *)keychainItems
 999                 escrowSigningPubKeyHash:(NSString *)hashWeNeedToMatch
1000 {
1001     NSDictionary* peerItem = nil;
1002
1003     for(NSDictionary* item in keychainItems){
1004         if(item && [item count] > 0){
1005             NSString* peerIDFromItem = [item objectForKey:(id)kSecAttrAccount];
1006             NSString* hashToConsider = [item objectForKey:(id)kSecAttrLabel];
1007             if([peerIDFromItem isEqualToString:neededPeerID] &&
1008                [hashWeNeedToMatch isEqualToString:hashToConsider])
1009             {
1010                 peerItem = [item copy];
1011                 break;
1012             }
1013         }
1014     }
1015
1016     return peerItem;
1017 }
1018
1019 - (NSSet<id<CKKSSelfPeer>>*)pastSelves:(NSError**)error
1020 {
1021     NSError* localError = nil;
1022
1023     // get bottled peer identities from the keychain
1024     NSMutableSet<id<CKKSSelfPeer>>* allSelves = [NSMutableSet set];
1025     NSArray<NSDictionary*>* signingKeys = [self loadRestoredBottledKeysOfType:OctagonSigningKey error:&localError];
1026     if(!signingKeys) {
1027         // Item not found isn't actually an error here
1028         if(error && !(localError && [localError.domain isEqualToString: NSOSStatusErrorDomain] && localError.code == errSecItemNotFound)) {
1029             *error = localError;
1030         }
1031
1032         return allSelves;
1033     }
1034
1035     NSArray<NSDictionary*>* encryptionKeys = [self loadRestoredBottledKeysOfType:OctagonEncryptionKey error:&localError];
1036     if(!encryptionKeys) {
1037         if(error && !(localError && [localError.domain isEqualToString: NSOSStatusErrorDomain] && localError.code == errSecItemNotFound)) {
1038             *error = localError;
1039         }
1040         return allSelves;
1041     }
1042
1043     for(NSDictionary* signingKey in signingKeys) {
1044         NSError* peerError = nil;
1045         NSString* peerid = signingKey[(id)kSecAttrAccount];
1046         NSString* hash = signingKey[(id)kSecAttrLabel]; // escrow signing pub key hash
1047
1048         //use peer id AND escrow signing public key hash to look up the matching item in encryptionKeys list
1049         NSDictionary* encryptionKeyItem = [self keychainItemForPeerID:peerid keychainItems:encryptionKeys escrowSigningPubKeyHash:hash];
1050         if(!encryptionKeyItem) {
1051             secerror("octagon: no encryption key available to pair with signing key %@,%@", peerid, hash);
1052             continue;
1053         }
1054
1055         NSData* signingKeyData = signingKey[(id)kSecValueData];
1056         if(!signingKeyData) {
1057             secerror("octagon: no signing key data for %@,%@", peerid,hash);
1058             continue;
1059         }
1060
1061         SFECKeyPair* restoredSigningKey = [[SFECKeyPair alloc] initWithData:signingKeyData
1062                                                                   specifier:[[SFECKeySpecifier alloc] initWithCurve:SFEllipticCurveNistp384]
1063                                                                       error:&peerError];
1064         if(!restoredSigningKey) {
1065             secerror("octagon: couldn't make signing key for %@,%@: %@", peerid, hash, peerError);
1066             continue;
1067         }
1068
1069         NSData* encryptionKeyData = [encryptionKeyItem objectForKey:(id)kSecValueData];
1070         if(!encryptionKeyData) {
1071             secerror("octagon: no encryption key data for %@,%@", peerid,hash);
1072             continue;
1073         }
1074
1075         SFECKeyPair* restoredEncryptionKey = [[SFECKeyPair alloc] initWithData:encryptionKeyData
1076                                                                      specifier:[[SFECKeySpecifier alloc] initWithCurve:SFEllipticCurveNistp384]
1077                                                                          error:&peerError];
1078         if(!restoredEncryptionKey) {
1079             secerror("octagon: couldn't make encryption key for %@,%@: %@", peerid,hash, peerError);
1080             continue;
1081         }
1082
1083         //create the SOS self peer
1084         CKKSSOSSelfPeer* restoredIdentity = [[CKKSSOSSelfPeer alloc]initWithSOSPeerID:peerid encryptionKey:restoredEncryptionKey signingKey:restoredSigningKey];
1085
1086         if(restoredIdentity){
1087             secnotice("octagon","adding bottled peer identity: %@", restoredIdentity);
1088             [allSelves addObject:restoredIdentity];
1089         } else {
1090             secerror("octagon: could not create restored identity from: %@: %@", peerid, peerError);
1091         }
1092     }
1093     return allSelves;
1094 }
1095
1096 - (id<CKKSSelfPeer> _Nullable)currentSOSSelf:(NSError**)error
1097 {
1098     __block SFECKeyPair* signingPrivateKey = nil;
1099     __block SFECKeyPair* encryptionPrivateKey = nil;
1100
1101     __block NSError* localerror = nil;
1102
1103     // Wait for this to initialize, but don't worry if it isn't.
1104     [self.accountTracker.accountCirclePeerIDInitialized wait:500*NSEC_PER_MSEC];
1105     NSString* peerID = self.accountTracker.accountCirclePeerID;
1106     if(!peerID || self.accountTracker.accountCirclePeerIDError) {
1107         secerror("ckkspeer: Error fetching self peer : %@", self.accountTracker.accountCirclePeerIDError);
1108         if(error) {
1109             *error = self.accountTracker.accountCirclePeerIDError;
1110         }
1111         return nil;
1112     }
1113
1114     SOSCCPerformWithAllOctagonKeys(^(SecKeyRef octagonEncryptionKey, SecKeyRef octagonSigningKey, CFErrorRef cferror) {
1115         if(cferror) {
1116             localerror = (__bridge NSError*)cferror;
1117             return;
1118         }
1119         if (!cferror && octagonEncryptionKey && octagonSigningKey) {
1120             signingPrivateKey = [[SFECKeyPair alloc] initWithSecKey:octagonSigningKey];
1121             encryptionPrivateKey = [[SFECKeyPair alloc] initWithSecKey:octagonEncryptionKey];
1122         } else {
1123             localerror = [NSError errorWithDomain:CKKSErrorDomain
1124                                              code:CKKSNoPeersAvailable
1125                                       description:@"Not all SOS peer keys available, but no error returned"];
1126         }
1127     });
1128
1129     if(localerror) {
1130         if(![self.lockStateTracker isLockedError:localerror]) {
1131             secerror("ckkspeer: Error fetching self encryption keys: %@", localerror);
1132         }
1133         if(error) {
1134             *error = localerror;
1135         }
1136         return nil;
1137     }
1138
1139     CKKSSOSSelfPeer* selfPeer = [[CKKSSOSSelfPeer alloc] initWithSOSPeerID:peerID
1140                                                              encryptionKey:encryptionPrivateKey
1141                                                                 signingKey:signingPrivateKey];
1142     return selfPeer;
1143 }
1144
1145 #pragma mark - CKKSPeerProvider implementation
1146
1147 - (CKKSSelves*)fetchSelfPeers:(NSError* __autoreleasing *)error {
1148     NSError* localError = nil;
1149
1150     id<CKKSSelfPeer> selfPeer = [self currentSOSSelf:&localError];
1151     if(!selfPeer || localError) {
1152         if(![self.lockStateTracker isLockedError:localError]) {
1153             secerror("ckks: Error fetching current SOS self: %@", localError);
1154         }
1155         if(error) {
1156             *error = localError;
1157         }
1158         return nil;
1159     }
1160
1161     NSSet<id<CKKSSelfPeer>>* allSelves = [self pastSelves:&localError];
1162     if(!allSelves || localError) {
1163         secerror("ckks: Error fetching past selves: %@", localError);
1164         if(error) {
1165             *error = localError;
1166         }
1167         return nil;
1168     }
1169
1170     CKKSSelves* selves = [[CKKSSelves alloc] initWithCurrent:selfPeer allSelves:allSelves];
1171     return selves;
1172 }
1173
1174 - (NSSet<id<CKKSPeer>>*)fetchTrustedPeers:(NSError* __autoreleasing *)error {
1175     __block NSMutableSet<id<CKKSPeer>>* peerSet = [NSMutableSet set];
1176
1177     SOSCCPerformWithTrustedPeers(^(CFSetRef sosPeerInfoRefs, CFErrorRef cfTrustedPeersError) {
1178         if(cfTrustedPeersError) {
1179             secerror("ckks: Error fetching trusted peers: %@", cfTrustedPeersError);
1180             if(error) {
1181                 *error = (__bridge NSError*)cfTrustedPeersError;
1182             }
1183         }
1184
1185         CFSetForEach(sosPeerInfoRefs, ^(const void* voidPeer) {
1186             CFErrorRef cfPeerError = NULL;
1187             SOSPeerInfoRef sosPeerInfoRef = (SOSPeerInfoRef)voidPeer;
1188
1189             if(!sosPeerInfoRef) {
1190                 return;
1191             }
1192
1193             CFStringRef cfpeerID = SOSPeerInfoGetPeerID(sosPeerInfoRef);
1194             SecKeyRef cfOctagonSigningKey = NULL, cfOctagonEncryptionKey = NULL;
1195
1196             cfOctagonSigningKey = SOSPeerInfoCopyOctagonSigningPublicKey(sosPeerInfoRef, &cfPeerError);
1197             if (cfOctagonSigningKey) {
1198                 cfOctagonEncryptionKey = SOSPeerInfoCopyOctagonEncryptionPublicKey(sosPeerInfoRef, &cfPeerError);
1199             }
1200
1201             if(cfOctagonSigningKey == NULL || cfOctagonEncryptionKey == NULL) {
1202                 // Don't log non-debug for -50; it almost always just means this peer didn't have octagon keys
1203                 if(cfPeerError == NULL
1204                    || !(CFEqualSafe(CFErrorGetDomain(cfPeerError), kCFErrorDomainOSStatus) && (CFErrorGetCode(cfPeerError) == errSecParam)))
1205                 {
1206                     secerror("ckkspeer: error fetching octagon keys for peer: %@ %@", sosPeerInfoRef, cfPeerError);
1207                 } else {
1208                     secinfo("ckkspeer", "Peer(%@) doesn't have Octagon keys, but this is expected: %@", cfpeerID, cfPeerError);
1209                 }
1210             }
1211
1212             // Add all peers to the trust set: old-style SOS peers will just have null keys
1213             SFECPublicKey* signingPublicKey = cfOctagonSigningKey ? [[SFECPublicKey alloc] initWithSecKey:cfOctagonSigningKey] : nil;
1214             SFECPublicKey* encryptionPublicKey = cfOctagonEncryptionKey ? [[SFECPublicKey alloc] initWithSecKey:cfOctagonEncryptionKey] : nil;
1215
1216             CKKSSOSPeer* peer = [[CKKSSOSPeer alloc] initWithSOSPeerID:(__bridge NSString*)cfpeerID
1217                                                    encryptionPublicKey:encryptionPublicKey
1218                                                       signingPublicKey:signingPublicKey];
1219             [peerSet addObject:peer];
1220
1221             CFReleaseNull(cfOctagonSigningKey);
1222             CFReleaseNull(cfOctagonEncryptionKey);
1223             CFReleaseNull(cfPeerError);
1224         });
1225     });
1226
1227     return peerSet;
1228 }
1229
1230 - (void)registerForPeerChangeUpdates:(id<CKKSPeerUpdateListener>)listener {
1231     @synchronized(self.peerChangeListeners) {
1232         bool alreadyRegisteredListener = false;
1233         NSEnumerator *enumerator = [self.peerChangeListeners objectEnumerator];
1234         id<CKKSPeerUpdateListener> value;
1235
1236         while ((value = [enumerator nextObject])) {
1237             // do pointer comparison
1238             alreadyRegisteredListener |= (value == listener);
1239         }
1240
1241         if(listener && !alreadyRegisteredListener) {
1242             NSString* queueName = [NSString stringWithFormat: @"ck-peer-change-%@", listener];
1243
1244             dispatch_queue_t objQueue = dispatch_queue_create([queueName UTF8String], DISPATCH_QUEUE_SERIAL);
1245             [self.peerChangeListeners setObject: listener forKey: objQueue];
1246         }
1247     }
1248 }
1249
1250 - (void)iteratePeerListenersOnTheirQueue:(void (^)(id<CKKSPeerUpdateListener>))block {
1251     @synchronized(self.peerChangeListeners) {
1252         NSEnumerator *enumerator = [self.peerChangeListeners keyEnumerator];
1253         dispatch_queue_t dq;
1254
1255         // Queue up the changes for each listener.
1256         while ((dq = [enumerator nextObject])) {
1257             id<CKKSPeerUpdateListener> listener = [self.peerChangeListeners objectForKey: dq];
1258             __weak id<CKKSPeerUpdateListener> weakListener = listener;
1259
1260             if(listener) {
1261                 dispatch_async(dq, ^{
1262                     __strong id<CKKSPeerUpdateListener> strongListener = weakListener;
1263                     block(strongListener);
1264                 });
1265             }
1266         }
1267     }
1268 }
1269
1270 - (void)sendSelfPeerChangedUpdate {
1271     [self.completedSecCKKSInitialize wait:5*NSEC_PER_SEC]; // Wait for bringup, but don't worry if this times out
1272
1273     [self iteratePeerListenersOnTheirQueue: ^(id<CKKSPeerUpdateListener> listener) {
1274         [listener selfPeerChanged];
1275     }];
1276 }
1277
1278 - (void)sendTrustedPeerSetChangedUpdate {
1279     [self.completedSecCKKSInitialize wait:5*NSEC_PER_SEC]; // Wait for bringup, but don't worry if this times out
1280
1281     [self iteratePeerListenersOnTheirQueue: ^(id<CKKSPeerUpdateListener> listener) {
1282         [listener trustedPeerSetChanged];
1283     }];
1284 }
1285 #endif // OCTAGON
1286 @end