]> git.saurik.com Git - apple/security.git/blob - OSX/sec/securityd/SecItemDataSource.c
Security-57740.1.18.tar.gz
[apple/security.git] / OSX / sec / securityd / SecItemDataSource.c
1 /*
2 * Copyright (c) 2006-2014 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24 /*
25 * SecItemDataSource.c - CoreFoundation-based constants and functions for
26 access to Security items (certificates, keys, identities, and
27 passwords.)
28 */
29
30 #include <securityd/SecItemDataSource.h>
31
32 #include <securityd/SecItemDb.h>
33 #include <securityd/SecItemSchema.h>
34 #include <securityd/SOSCloudCircleServer.h>
35 #include <Security/SecureObjectSync/SOSDigestVector.h>
36 #include <Security/SecureObjectSync/SOSViews.h>
37 #include <Security/SecBasePriv.h>
38 #include <Security/SecItem.h>
39 #include <Security/SecItemBackup.h>
40 #include <Security/SecItemPriv.h>
41 #include <utilities/array_size.h>
42
43 /*
44 *
45 *
46 * SecItemDataSource
47 *
48 *
49 */
50 typedef struct SecItemDataSource *SecItemDataSourceRef;
51
52 struct SecItemDataSource {
53 struct SOSDataSource ds;
54 SecDbRef db; // The database we operate on
55 CFStringRef name; // The name of the slice of the database we represent.
56 };
57
58 static const SecDbClass *dsSyncedClassesV0[] = {
59 &genp_class,
60 &inet_class,
61 &keys_class,
62 };
63
64 static const SecDbClass *dsSyncedClasses[] = {
65 &genp_class, // genp must be first!
66 &inet_class,
67 &keys_class,
68 &cert_class,
69 };
70
71 static bool SecErrorIsSqliteDuplicateItemError(CFErrorRef error) {
72 return error && CFErrorGetCode(error) == SQLITE_CONSTRAINT && CFEqual(kSecDbErrorDomain, CFErrorGetDomain(error));
73 }
74
75 static bool SecDbItemSelectSHA1(SecDbQueryRef query, SecDbConnectionRef dbconn, CFErrorRef *error,
76 bool (^use_attr_in_where)(const SecDbAttr *attr),
77 bool (^add_where_sql)(CFMutableStringRef sql, bool *needWhere),
78 bool (^bind_added_where)(sqlite3_stmt *stmt, int col),
79 void (^row)(sqlite3_stmt *stmt, bool *stop)) {
80 __block bool ok = true;
81 bool (^return_attr)(const SecDbAttr *attr) = ^bool (const SecDbAttr * attr) {
82 return attr->kind == kSecDbSHA1Attr;
83 };
84 CFStringRef sql = SecDbItemCopySelectSQL(query, return_attr, use_attr_in_where, add_where_sql);
85 if (sql) {
86 ok &= SecDbPrepare(dbconn, sql, error, ^(sqlite3_stmt *stmt) {
87 ok = (SecDbItemSelectBind(query, stmt, error, use_attr_in_where, bind_added_where) &&
88 SecDbStep(dbconn, stmt, error, ^(bool *stop){ row(stmt, stop); }));
89 });
90 CFRelease(sql);
91 } else {
92 ok = false;
93 }
94 return ok;
95 }
96
97 static SOSManifestRef SecItemDataSourceCopyManifestWithQueries(SecItemDataSourceRef ds, CFArrayRef queries, CFErrorRef *error) {
98 __block SOSManifestRef manifest = NULL;
99 __block CFErrorRef localError = NULL;
100 if (!SecDbPerformRead(ds->db, error, ^(SecDbConnectionRef dbconn) {
101 __block struct SOSDigestVector dv = SOSDigestVectorInit;
102 Query *q;
103 bool ok = true;
104 CFArrayForEachC(queries, q) {
105 if (!(ok &= SecDbItemSelectSHA1(q, dbconn, &localError, ^bool(const SecDbAttr *attr) {
106 return CFDictionaryContainsKey(q->q_item, attr->name);
107 }, NULL, NULL, ^(sqlite3_stmt *stmt, bool *stop) {
108 const uint8_t *digest = sqlite3_column_blob(stmt, 0);
109 size_t digestLen = sqlite3_column_bytes(stmt, 0);
110 if (digestLen != SOSDigestSize) {
111 secerror("digest %zu bytes", digestLen);
112 } else {
113 SOSDigestVectorAppend(&dv, digest);
114 }
115 }))) {
116 secerror("SecDbItemSelectSHA1 failed: %@", localError);
117 break;
118 }
119 }
120 if (ok) {
121 // TODO: This code assumes that the passed in queries do not overlap, otherwise we'd need something to eliminate dupes:
122 //SOSDigestVectorUniqueSorted(&dv);
123 manifest = SOSManifestCreateWithDigestVector(&dv, &localError);
124 }
125 SOSDigestVectorFree(&dv);
126 })) {
127 CFReleaseSafe(manifest);
128 }
129 CFErrorPropagate(localError, error);
130 return manifest;
131 }
132
133 static Query *SecItemDataSourceAppendQuery(CFMutableArrayRef queries, const SecDbClass *qclass, bool noTombstones, CFErrorRef *error) {
134 Query *q = query_create(qclass, NULL, NULL, error);
135 if (q) {
136 q->q_return_type = kSecReturnDataMask | kSecReturnAttributesMask;
137 q->q_limit = kSecMatchUnlimited;
138 q->q_keybag = KEYBAG_DEVICE;
139 query_add_attribute(kSecAttrSynchronizable, kCFBooleanTrue, q);
140 query_add_or_attribute(kSecAttrAccessible, kSecAttrAccessibleWhenUnlocked, q);
141 query_add_or_attribute(kSecAttrAccessible, kSecAttrAccessibleAfterFirstUnlock, q);
142 query_add_or_attribute(kSecAttrAccessible, kSecAttrAccessibleAlwaysPrivate, q);
143 query_add_or_attribute(kSecAttrAccessible, kSecAttrAccessibleWhenUnlockedThisDeviceOnly, q);
144 query_add_or_attribute(kSecAttrAccessible, kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly, q);
145 query_add_or_attribute(kSecAttrAccessible, kSecAttrAccessibleAlwaysThisDeviceOnlyPrivate, q);
146
147 if (noTombstones) {
148 query_add_attribute(kSecAttrTombstone, kCFBooleanFalse, q);
149 }
150
151 CFArrayAppendValue(queries, q);
152 }
153 return q;
154 }
155
156 static Query *SecItemDataSourceAppendQueryWithClassAndViewHint(CFMutableArrayRef queries, const SecDbClass *qclass, bool noTombstones, bool allowTkid, CFStringRef viewHint, CFErrorRef *error) {
157 Query *q = SecItemDataSourceAppendQuery(queries, qclass, noTombstones, error);
158 if (q) {
159 // For each attribute in current schema but not in v6, look for the
160 // default value of those attributes in the query, since old items
161 // will all have that as their values for these new attributes.
162 SecDbForEachAttr(qclass, attr) {
163 if (attr == &v7tkid || attr == &v7vwht) {
164 // attr is a primary key attribute added in schema version 7 or later
165 if (!allowTkid || attr != &v7tkid) {
166 if (attr == &v7vwht && viewHint) {
167 query_add_attribute_with_desc(attr, viewHint, q);
168 } else {
169 CFTypeRef value = SecDbAttrCopyDefaultValue(attr, &q->q_error);
170 if (value) {
171 query_add_attribute_with_desc(attr, value, q);
172 CFRelease(value);
173 }
174 }
175 }
176 }
177 }
178 }
179 return q;
180 }
181
182 static Query *SecItemDataSourceAppendQueryWithClass(CFMutableArrayRef queries, const SecDbClass *qclass, bool noTombstones, bool allowTkid, CFErrorRef *error) {
183 return SecItemDataSourceAppendQueryWithClassAndViewHint(queries, qclass, noTombstones, allowTkid, NULL, error);
184 }
185
186 static Query *SecItemDataSourceAppendQueryWithClassAndAgrp(CFMutableArrayRef queries, const SecDbClass *qclass, bool noTombstones, bool allowTkid, CFStringRef agrp, CFErrorRef *error) {
187 Query *q = SecItemDataSourceAppendQueryWithClass(queries, qclass, noTombstones, allowTkid, error);
188 if (q && agrp) {
189 query_add_attribute(kSecAttrAccessGroup, agrp, q);
190 }
191 return q;
192 }
193
194 static bool SecItemDataSourceAppendQueriesForViewName(SecItemDataSourceRef ds, CFMutableArrayRef queries, CFStringRef compositeViewName, CFErrorRef *error) {
195 bool ok = true;
196 CFStringRef viewName;
197 bool noTombstones = CFStringHasSuffix(compositeViewName, CFSTR("-tomb"));
198 if (noTombstones) {
199 viewName = CFStringCreateWithSubstring(kCFAllocatorDefault, compositeViewName, CFRangeMake(0, CFStringGetLength(compositeViewName) - 5));
200 } else {
201 viewName = CFRetain(compositeViewName);
202 }
203
204 const bool noTKID = false;
205 const bool allowTKID = true;
206 if (CFEqual(viewName, kSOSViewKeychainV0)) {
207 for (size_t class_ix = 0; class_ix < array_size(dsSyncedClassesV0); ++class_ix) {
208 SecItemDataSourceAppendQueryWithClass(queries, dsSyncedClassesV0[class_ix], noTombstones, noTKID, error);
209 }
210 } else if (CFEqual(viewName, kSOSViewWiFi)) {
211 Query *q = SecItemDataSourceAppendQueryWithClassAndAgrp(queries, &genp_class, noTombstones, allowTKID, CFSTR("apple"), error);
212 if (q) {
213 query_add_attribute(kSecAttrService, CFSTR("AirPort"), q);
214 }
215 } else if (CFEqual(viewName, kSOSViewAutofillPasswords)) {
216 SecItemDataSourceAppendQueryWithClassAndAgrp(queries, &inet_class, noTombstones, allowTKID, CFSTR("com.apple.cfnetwork"), error);
217 } else if (CFEqual(viewName, kSOSViewSafariCreditCards)) {
218 SecItemDataSourceAppendQueryWithClassAndAgrp(queries, &genp_class, noTombstones, allowTKID, CFSTR("com.apple.safari.credit-cards"), error);
219 } else if (CFEqual(viewName, kSOSViewiCloudIdentity)) {
220 SecItemDataSourceAppendQueryWithClassAndAgrp(queries, &keys_class, noTombstones, allowTKID, CFSTR("com.apple.security.sos"), error);
221 } else if (CFEqual(viewName, kSOSViewBackupBagV0)) {
222 SecItemDataSourceAppendQueryWithClassAndAgrp(queries, &genp_class, noTombstones, allowTKID, CFSTR("com.apple.sbd"), error);
223 } else if (CFEqual(viewName, kSOSViewOtherSyncable)) {
224 SecItemDataSourceAppendQueryWithClass(queries, &cert_class, noTombstones, allowTKID, error);
225
226 Query *q1_genp = SecItemDataSourceAppendQueryWithClassAndAgrp(queries, &genp_class, noTombstones, allowTKID, CFSTR("apple"), error);
227 query_add_not_attribute(kSecAttrService, CFSTR("AirPort"), q1_genp);
228
229 Query *q2_genp = SecItemDataSourceAppendQueryWithClass(queries, &genp_class, noTombstones, allowTKID, error);
230 query_add_not_attribute(kSecAttrAccessGroup, CFSTR("apple"), q2_genp);
231 query_add_not_attribute(kSecAttrAccessGroup, CFSTR("com.apple.safari.credit-cards"), q2_genp);
232 query_add_not_attribute(kSecAttrAccessGroup, CFSTR("com.apple.sbd"), q2_genp);
233
234 Query *q_inet = SecItemDataSourceAppendQueryWithClass(queries, &inet_class, noTombstones, allowTKID, error);
235 query_add_not_attribute(kSecAttrAccessGroup, CFSTR("com.apple.cfnetwork"), q_inet);
236
237 Query *q_keys = SecItemDataSourceAppendQueryWithClass(queries, &keys_class, noTombstones, allowTKID, error);
238 query_add_not_attribute(kSecAttrAccessGroup, CFSTR("com.apple.security.sos"), q_keys);
239 } else {
240 // All other viewNames should match on the ViewHint attribute.
241 for (size_t class_ix = 0; class_ix < array_size(dsSyncedClasses); ++class_ix) {
242 SecItemDataSourceAppendQueryWithClassAndViewHint(queries, dsSyncedClasses[class_ix], noTombstones, allowTKID, viewName, error);
243 }
244 }
245
246 CFReleaseSafe(viewName);
247 return ok;
248 }
249
250 static SOSManifestRef SecItemDataSourceCopyManifestWithViewNameSet(SecItemDataSourceRef ds, CFSetRef viewNames, CFErrorRef *error) {
251 CFMutableArrayRef queries = CFArrayCreateMutable(kCFAllocatorDefault, 0, NULL);
252 SOSManifestRef manifest = NULL;
253 __block bool ok = true;
254 CFSetForEach(viewNames, ^(const void *value) {
255 CFStringRef viewName = (CFStringRef)value;
256 ok &= SecItemDataSourceAppendQueriesForViewName(ds, queries, viewName, error);
257 });
258 if (ok)
259 manifest = SecItemDataSourceCopyManifestWithQueries(ds, queries, error);
260 Query *q;
261 CFArrayForEachC(queries, q) {
262 CFErrorRef localError = NULL;
263 if (!query_destroy(q, &localError)) {
264 secerror("query_destroy failed: %@", localError);
265 CFErrorPropagate(localError, error);
266 CFReleaseNull(manifest);
267 }
268 }
269 CFReleaseSafe(queries);
270 return manifest;
271 }
272
273 // Return the newest object (conflict resolver)
274 static SecDbItemRef SecItemDataSourceCopyMergedItem(SecDbItemRef item1, SecDbItemRef item2, CFErrorRef *error) {
275 CFErrorRef localError = NULL;
276 SecDbItemRef result = NULL;
277 CFDateRef m1, m2;
278 const SecDbAttr *desc = SecDbAttrWithKey(SecDbItemGetClass(item1), kSecAttrModificationDate, error);
279 m1 = SecDbItemGetValue(item1, desc, &localError);
280 m2 = SecDbItemGetValue(item2, desc, &localError);
281 if (m1 && m2) switch (CFDateCompare(m1, m2, NULL)) {
282 case kCFCompareGreaterThan:
283 result = item1;
284 break;
285 case kCFCompareLessThan:
286 result = item2;
287 break;
288 case kCFCompareEqualTo:
289 {
290 // Return the item with the smallest digest.
291 CFDataRef digest1 = SecDbItemGetSHA1(item1, &localError);
292 CFDataRef digest2 = SecDbItemGetSHA1(item2, &localError);
293 if (digest1 && digest2) switch (CFDataCompare(digest1, digest2)) {
294 case kCFCompareGreaterThan:
295 case kCFCompareEqualTo:
296 result = item2;
297 break;
298 case kCFCompareLessThan:
299 result = item1;
300 break;
301 } else if (SecErrorGetOSStatus(localError) == errSecDecode) {
302 if (digest1) result = item1;
303 if (digest2) result = item2;
304 }
305 break;
306 }
307 } else if (SecErrorGetOSStatus(localError) == errSecDecode) {
308 // If one of the two objects has an unparsable date,
309 // the object with the parsable date wins.
310 if (m1) result = item1;
311 if (m2) result = item2;
312 }
313
314 if (localError) {
315 if (!result && error && !*error)
316 *error = localError;
317 else
318 CFRelease(localError);
319 }
320 return CFRetainSafe(result);
321 }
322
323 //
324 // MARK: DataSource protocol implementation
325 //
326
327 static CFStringRef dsGetName(SOSDataSourceRef data_source) {
328 SecItemDataSourceRef ds = (SecItemDataSourceRef)data_source;
329 return ds->name;
330 }
331
332 static void dsAddNotifyPhaseBlock(SOSDataSourceRef data_source, SOSDataSourceNotifyBlock notifyBlock) {
333 SecItemDataSourceRef ds = (SecItemDataSourceRef)data_source;
334 SecDbAddNotifyPhaseBlock(ds->db, ^(SecDbConnectionRef dbconn, SecDbTransactionPhase phase, SecDbTransactionSource source, CFArrayRef changes)
335 {
336 notifyBlock(&ds->ds, (SOSTransactionRef)dbconn, phase, source, changes);
337 });
338 }
339
340 static SOSManifestRef dsCopyManifestWithViewNameSet(SOSDataSourceRef data_source, CFSetRef viewNameSet, CFErrorRef *error) {
341 struct SecItemDataSource *ds = (struct SecItemDataSource *)data_source;
342 return SecItemDataSourceCopyManifestWithViewNameSet(ds, viewNameSet, error);
343 }
344
345 static bool dsForEachObject(SOSDataSourceRef data_source, SOSTransactionRef txn, SOSManifestRef manifest, CFErrorRef *error, void (^handle_object)(CFDataRef key, SOSObjectRef object, bool *stop)) {
346 struct SecItemDataSource *ds = (struct SecItemDataSource *)data_source;
347 __block bool result = true;
348 const SecDbAttr *sha1Attr = SecDbClassAttrWithKind(&genp_class, kSecDbSHA1Attr, error);
349 if (!sha1Attr) return false;
350 bool (^return_attr)(const SecDbAttr *attr) = ^bool (const SecDbAttr * attr) {
351 return attr->kind == kSecDbRowIdAttr || attr->kind == kSecDbEncryptedDataAttr;
352 };
353 bool (^use_attr_in_where)(const SecDbAttr *attr) = ^bool (const SecDbAttr * attr) {
354 return attr->kind == kSecDbSHA1Attr;
355 };
356 Query *select_queries[array_size(dsSyncedClasses)] = {};
357 CFStringRef select_sql[array_size(dsSyncedClasses)] = {};
358 sqlite3_stmt *select_stmts[array_size(dsSyncedClasses)] = {};
359
360 __block Query **queries = select_queries;
361 __block CFStringRef *sqls = select_sql;
362 __block sqlite3_stmt **stmts = select_stmts;
363
364 void (^readBlock)(SecDbConnectionRef dbconn) = ^(SecDbConnectionRef dbconn)
365 {
366 // Setup
367 for (size_t class_ix = 0; class_ix < array_size(dsSyncedClasses); ++class_ix) {
368 result = (result
369 && (queries[class_ix] = query_create(dsSyncedClasses[class_ix], NULL, NULL, error))
370 && (sqls[class_ix] = SecDbItemCopySelectSQL(queries[class_ix], return_attr, use_attr_in_where, NULL))
371 && (stmts[class_ix] = SecDbCopyStmt(dbconn, sqls[class_ix], NULL, error)));
372 }
373
374 if (result) SOSManifestForEach(manifest, ^(CFDataRef key, bool *stop) {
375 __block SecDbItemRef item = NULL;
376 for (size_t class_ix = 0; result && !item && class_ix < array_size(dsSyncedClasses); ++class_ix) {
377 CFDictionarySetValue(queries[class_ix]->q_item, sha1Attr->name, key);
378 result = SecDbItemSelectBind(queries[class_ix], stmts[class_ix], error, use_attr_in_where, NULL);
379 if (result) {
380 result &= SecDbStep(dbconn, stmts[class_ix], error, ^(bool *unused_stop) {
381 item = SecDbItemCreateWithStatement(kCFAllocatorDefault, queries[class_ix]->q_class, stmts[class_ix], KEYBAG_DEVICE, error, return_attr);
382 });
383 }
384 if (result)
385 result &= SecDbReset(stmts[class_ix], error);
386 }
387 handle_object(key, (SOSObjectRef)item, stop);
388 CFReleaseSafe(item);
389 });
390
391 // Cleanup
392 for (size_t class_ix = 0; class_ix < array_size(dsSyncedClasses); ++class_ix) {
393 result &= SecDbReleaseCachedStmt(dbconn, sqls[class_ix], stmts[class_ix], error);
394 CFReleaseSafe(sqls[class_ix]);
395 result &= query_destroy(queries[class_ix], error);
396 }
397 };
398
399 if (txn) {
400 readBlock((SecDbConnectionRef)txn);
401 } else {
402 result &= SecDbPerformRead(ds->db, error, readBlock);
403 }
404
405 return result;
406 }
407
408 static bool dsRelease(SOSDataSourceRef data_source, CFErrorRef *error) {
409 // We never release our dataSource since it's tracking changes
410 // to the keychain for the engine and its peers.
411 return true;
412 }
413
414 static SOSObjectRef objectCreateWithPropertyList(CFDictionaryRef plist, CFErrorRef *error) {
415 SecDbItemRef item = NULL;
416 const SecDbClass *class = NULL;
417 CFTypeRef cname = CFDictionaryGetValue(plist, kSecClass);
418 if (cname) {
419 class = kc_class_with_name(cname);
420 if (class) {
421 item = SecDbItemCreateWithAttributes(kCFAllocatorDefault, class, plist, KEYBAG_DEVICE, error);
422 } else {
423 SecError(errSecNoSuchClass, error, CFSTR("can find class named: %@"), cname);
424 }
425 } else {
426 SecError(errSecItemClassMissing, error, CFSTR("query missing %@ attribute"), kSecClass);
427 }
428 return (SOSObjectRef)item;
429 }
430
431 static CFDataRef copyObjectDigest(SOSObjectRef object, CFErrorRef *error) {
432 SecDbItemRef item = (SecDbItemRef) object;
433 CFDataRef digest = SecDbItemGetSHA1(item, error);
434 CFRetainSafe(digest);
435 return digest;
436 }
437
438 static CFDictionaryRef objectCopyPropertyList(SOSObjectRef object, CFErrorRef *error) {
439 SecDbItemRef item = (SecDbItemRef) object;
440 CFMutableDictionaryRef cryptoDataDict = SecDbItemCopyPListWithMask(item, kSecDbInCryptoDataFlag, error);
441 CFMutableDictionaryRef authDataDict = SecDbItemCopyPListWithMask(item, kSecDbInAuthenticatedDataFlag, error);
442
443 if (cryptoDataDict) {
444 if (authDataDict) {
445 CFDictionaryForEach(authDataDict, ^(const void *key, const void *value) {
446 CFDictionarySetValue(cryptoDataDict, key, value);
447 });
448 }
449 CFDictionaryAddValue(cryptoDataDict, kSecClass, SecDbItemGetClass(item)->name);
450 }
451
452 CFReleaseSafe(authDataDict);
453 return cryptoDataDict;
454 }
455
456 static bool dsWith(SOSDataSourceRef data_source, CFErrorRef *error, SOSDataSourceTransactionSource source, bool onCommitQueue, void(^transaction)(SOSTransactionRef txn, bool *commit)) {
457 SecItemDataSourceRef ds = (SecItemDataSourceRef)data_source;
458 __block bool ok = true;
459 ok &= SecDbPerformWrite(ds->db, error, ^(SecDbConnectionRef dbconn) {
460 ok &= SecDbTransaction(dbconn,
461 source == kSOSDataSourceAPITransaction ? kSecDbExclusiveTransactionType : kSecDbExclusiveRemoteTransactionType,
462 error, ^(bool *commit) {
463 if (onCommitQueue) {
464 SecDbPerformOnCommitQueue(dbconn, false, ^{
465 transaction((SOSTransactionRef)dbconn, commit);
466 });
467 } else {
468 transaction((SOSTransactionRef)dbconn, commit);
469 }
470 });
471 });
472 return ok;
473 }
474
475 static bool dsReadWith(SOSDataSourceRef data_source, CFErrorRef *error, SOSDataSourceTransactionSource source, void(^perform)(SOSTransactionRef txn)) {
476 SecItemDataSourceRef ds = (SecItemDataSourceRef)data_source;
477 __block bool ok = true;
478 ok &= SecDbPerformRead(ds->db, error, ^(SecDbConnectionRef dbconn) {
479 SecDbPerformOnCommitQueue(dbconn, false, ^{
480 perform((SOSTransactionRef)dbconn);
481 });
482 });
483 return ok;
484 }
485
486 static SOSMergeResult dsMergeObject(SOSTransactionRef txn, SOSObjectRef peersObject, SOSObjectRef *mergedObject, CFErrorRef *error) {
487 SecDbConnectionRef dbconn = (SecDbConnectionRef)txn;
488 SecDbItemRef peersItem = (SecDbItemRef)peersObject;
489 __block SOSMergeResult mr = kSOSMergeFailure;
490 __block SecDbItemRef mergedItem = NULL;
491 __block SecDbItemRef replacedItem = NULL;
492 __block CFErrorRef localError = NULL;
493
494 if (!peersItem || !dbconn)
495 return kSOSMergeFailure;
496 if (!SecDbItemSetKeybag(peersItem, KEYBAG_DEVICE, &localError)) {
497 secnotice("ds", "kSOSMergeFailure => SecDbItemSetKeybag: %@", localError);
498 CFErrorPropagate(localError, error);
499 return kSOSMergeFailure;
500 }
501
502 if (SecDbItemInsertOrReplace(peersItem, dbconn, &localError, ^(SecDbItemRef myItem, SecDbItemRef *replace) {
503 // An item with the same primary key as dbItem already exists in the the database. That item is old_item.
504 // Let the conflict resolver choose which item to keep.
505 mergedItem = SecItemDataSourceCopyMergedItem(peersItem, myItem, &localError);
506 if (!mergedItem)
507 return; // from block
508 if (mergedObject)
509 *mergedObject = (SOSObjectRef)CFRetain(mergedItem);
510 if (CFEqual(mergedItem, myItem)) {
511 // Conflict resolver choose my (local) item
512 secnotice("ds", "Conflict resolver chose my (local) item: %@", myItem);
513 mr = kSOSMergeLocalObject;
514 } else {
515 CFRetainAssign(replacedItem, myItem);
516 *replace = CFRetainSafe(mergedItem);
517 if (CFEqual(mergedItem, peersItem)) {
518 // Conflict resolver chose peer's item
519 secnotice("ds", "Conflict resolver chose peers item: %@", peersItem);
520 mr = kSOSMergePeersObject;
521 } else {
522 // Conflict resolver created a new item; return it to our caller
523 secnotice("ds", "Conflict resolver created a new item; return it to our caller: %@", mergedItem);
524 mr = kSOSMergeCreatedObject;
525 }
526 }
527 })) {
528 // either SecDbItemInsertOrReplace or SecItemDataSourceCopyMergedItem failed
529 if (mr == kSOSMergeFailure)
530 {
531 secnotice("ds", "kSOSMergeFailure => kSOSMergePeersObject, %@", localError);
532 CFReleaseSafe(localError);
533 mr = kSOSMergePeersObject;
534 }
535 }
536
537 if (localError && !SecErrorIsSqliteDuplicateItemError(localError)) {
538 secnotice("ds", "dsMergeObject failed: mr=%ld, %@", mr, localError);
539 // We should probably always propogate this, but for now we are only logging
540 // See rdar://problem/26451072 for case where we might need to propogate
541 if (mr == kSOSMergeFailure) {
542 CFErrorPropagate(localError, error);
543 localError = NULL;
544 }
545 }
546
547 CFReleaseSafe(mergedItem);
548 CFReleaseSafe(replacedItem);
549 CFReleaseSafe(localError);
550 return mr;
551 }
552
553 /*
554 Truthy backup format is a dictionary from sha1 => item.
555 Each item has class, hash and item data.
556
557 TODO: sha1 is included as binary blob to avoid parsing key.
558 */
559 enum {
560 kSecBackupIndexHash = 0,
561 kSecBackupIndexClass,
562 kSecBackupIndexData,
563 };
564
565 static const void *kSecBackupKeys[] = {
566 [kSecBackupIndexHash] = kSecItemBackupHashKey,
567 [kSecBackupIndexClass] = kSecItemBackupClassKey,
568 [kSecBackupIndexData] = kSecItemBackupDataKey
569 };
570
571 static CFDictionaryRef objectCopyBackup(SOSObjectRef object, uint64_t handle, CFErrorRef *error) {
572 const void *values[array_size(kSecBackupKeys)];
573 SecDbItemRef item = (SecDbItemRef)object;
574 CFDictionaryRef backup_item = NULL;
575
576 if ((values[kSecBackupIndexHash] = SecDbItemGetSHA1(item, error))) {
577 if ((values[kSecBackupIndexData] = SecDbItemCopyEncryptedDataToBackup(item, handle, error))) {
578 values[kSecBackupIndexClass] = SecDbItemGetClass(item)->name;
579 backup_item = CFDictionaryCreate(kCFAllocatorDefault, kSecBackupKeys, values, array_size(kSecBackupKeys), &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
580 CFRelease(values[kSecBackupIndexData]);
581 }
582 }
583
584 return backup_item;
585 }
586
587 static CFDataRef dsCopyStateWithKey(SOSDataSourceRef data_source, CFStringRef key, CFStringRef pdmn, SOSTransactionRef txn, CFErrorRef *error) {
588 SecItemDataSourceRef ds = (SecItemDataSourceRef)data_source;
589 CFStringRef dataSourceID = CFStringCreateWithFormat(kCFAllocatorDefault, NULL, CFSTR("SOSDataSource-%@"), ds->name);
590 CFMutableDictionaryRef dict = CFDictionaryCreateMutableForCFTypesWith(kCFAllocatorDefault,
591 kSecAttrAccessGroup, kSOSInternalAccessGroup,
592 kSecAttrAccount, key,
593 kSecAttrService, dataSourceID,
594 kSecAttrAccessible, pdmn,
595 kSecAttrSynchronizable, kCFBooleanFalse,
596 NULL);
597 CFReleaseSafe(dataSourceID);
598 __block CFDataRef data = NULL;
599 SecDbQueryRef query = query_create(&genp_class, NULL, dict, error);
600 if (query) {
601 if (query->q_item) CFReleaseSafe(query->q_item);
602 query->q_item = dict;
603 void (^read_it)(SecDbConnectionRef dbconn) = ^(SecDbConnectionRef dbconn) {
604 SecDbItemSelect(query, dbconn, error, NULL, ^bool(const SecDbAttr *attr) {
605 return CFDictionaryContainsKey(dict, attr->name);
606 }, NULL, NULL, ^(SecDbItemRef item, bool *stop) {
607 secnotice("ds", "found item for key %@@%@", key, pdmn);
608 data = CFRetainSafe(SecDbItemGetValue(item, &v6v_Data, error));
609 });
610 };
611 if (txn) {
612 read_it((SecDbConnectionRef) txn);
613 } else {
614 SecDbPerformRead(ds->db, error, read_it);
615 }
616 query_destroy(query, error);
617 } else {
618 CFReleaseSafe(dict);
619 }
620 if (!data) secnotice("ds", "failed to load %@@%@ state: %@", key, pdmn, error ? *error : NULL);
621 return data;
622 }
623
624 static CFDataRef dsCopyItemDataWithKeys(SOSDataSourceRef data_source, CFDictionaryRef keys, CFErrorRef *error) {
625 /*
626 Values for V0 are:
627 kSecAttrAccessGroup ==> CFSTR("com.apple.sbd")
628 kSecAttrAccessible ==> kSecAttrAccessibleWhenUnlocked
629 kSecAttrAccount ==> CFSTR("SecureBackupPublicKeybag")
630 kSecAttrService ==> CFSTR("SecureBackupService")
631
632 CFMutableDictionaryRef dict = CFDictionaryCreateMutableForCFTypesWith(kCFAllocatorDefault,
633 kSecAttrAccessGroup, CFSTR("com.apple.sbd"),
634 kSecAttrAccount, account,
635 kSecAttrService, service,
636 kSecAttrAccessible, pdmn,
637 kSecAttrSynchronizable, kCFBooleanTrue,
638 NULL);
639 */
640
641 SecItemDataSourceRef ds = (SecItemDataSourceRef)data_source;
642 CFMutableDictionaryRef dict = CFDictionaryCreateMutableCopy(kCFAllocatorDefault, 0, keys);
643 __block CFDataRef data = NULL;
644 SecDbQueryRef query = query_create(&genp_class, NULL, dict, error);
645 if (query) {
646 if (query->q_item) CFReleaseSafe(query->q_item);
647 query->q_item = dict;
648 SecDbPerformRead(ds->db, error, ^(SecDbConnectionRef dbconn) {
649 SecDbItemSelect(query, dbconn, error, NULL, ^bool(const SecDbAttr *attr) {
650 return CFDictionaryContainsKey(dict, attr->name);
651 }, NULL, NULL, ^(SecDbItemRef item, bool *stop) {
652 secnotice("ds", "found item for keys %@", keys);
653 data = CFRetainSafe(SecDbItemGetValue(item, &v6v_Data, error));
654 });
655 });
656 query_destroy(query, error);
657 } else {
658 CFReleaseSafe(dict);
659 }
660 if (!data) secnotice("ds", "failed to load item %@: %@", keys, error ? *error : NULL);
661 return data;
662 }
663
664 static bool dsSetStateWithKey(SOSDataSourceRef data_source, SOSTransactionRef txn, CFStringRef key, CFStringRef pdmn, CFDataRef state, CFErrorRef *error) {
665 SecItemDataSourceRef ds = (SecItemDataSourceRef)data_source;
666 CFStringRef dataSourceID = CFStringCreateWithFormat(kCFAllocatorDefault, NULL, CFSTR("SOSDataSource-%@"), ds->name);
667 CFMutableDictionaryRef dict = CFDictionaryCreateMutableForCFTypesWith(kCFAllocatorDefault,
668 kSecAttrAccessGroup, kSOSInternalAccessGroup,
669 kSecAttrAccount, key,
670 kSecAttrService, dataSourceID,
671 kSecAttrAccessible, pdmn,
672 kSecAttrSynchronizable, kCFBooleanFalse,
673 kSecValueData, state,
674 NULL);
675 CFReleaseSafe(dataSourceID);
676 SecDbItemRef item = SecDbItemCreateWithAttributes(kCFAllocatorDefault, &genp_class, dict, KEYBAG_DEVICE, error);
677 SOSMergeResult mr = dsMergeObject(txn, (SOSObjectRef)item, NULL, error);
678 if (mr == kSOSMergeFailure) secerror("failed to save %@@%@ state: %@", key, pdmn, error ? *error : NULL);
679 CFReleaseSafe(item);
680 CFReleaseSafe(dict);
681 return mr != kSOSMergeFailure;
682 }
683
684 static bool dsDeleteStateWithKey(SOSDataSourceRef data_source, CFStringRef key, CFStringRef pdmn, SOSTransactionRef txn, CFErrorRef *error) {
685 SecItemDataSourceRef ds = (SecItemDataSourceRef)data_source;
686 CFStringRef dataSourceID = CFStringCreateWithFormat(kCFAllocatorDefault, NULL, CFSTR("SOSDataSource-%@"), ds->name);
687 CFMutableDictionaryRef dict = CFDictionaryCreateMutableForCFTypesWith(kCFAllocatorDefault,
688 kSecAttrAccessGroup, kSOSInternalAccessGroup,
689 kSecAttrAccount, key,
690 kSecAttrService, dataSourceID,
691 kSecAttrAccessible, pdmn,
692 kSecAttrSynchronizable, kCFBooleanFalse,
693 NULL);
694 CFReleaseSafe(dataSourceID);
695 SecDbItemRef item = SecDbItemCreateWithAttributes(kCFAllocatorDefault, &genp_class, dict, KEYBAG_DEVICE, error);
696 bool ok = SecDbItemDoDeleteSilently(item, (SecDbConnectionRef)txn, error);
697 CFReleaseNull(dict);
698 CFReleaseSafe(item);
699 return ok;
700 }
701
702 static bool dsRestoreObject(SOSTransactionRef txn, uint64_t handle, CFDictionaryRef item, CFErrorRef *error) {
703 CFStringRef item_class = CFDictionaryGetValue(item, kSecItemBackupClassKey);
704 CFDataRef data = CFDictionaryGetValue(item, kSecItemBackupDataKey);
705 const SecDbClass *dbclass = NULL;
706
707 if (!item_class || !data)
708 return SecError(errSecDecode, error, CFSTR("no class or data in object"));
709
710 dbclass = kc_class_with_name(item_class);
711 if (!dbclass)
712 return SecError(errSecDecode, error, CFSTR("no such class %@; update kc_class_with_name "), item_class);
713
714 SecDbItemRef dbitem = SecDbItemCreateWithEncryptedData(kCFAllocatorDefault, dbclass, data, (keybag_handle_t)handle, error);
715 bool ok = dbitem && (dsMergeObject(txn, (SOSObjectRef)dbitem, NULL, error) != kSOSMergeFailure);
716 CFReleaseSafe(dbitem);
717 return ok;
718 }
719
720 SOSDataSourceRef SecItemDataSourceCreate(SecDbRef db, CFStringRef name, CFErrorRef *error) {
721 SecItemDataSourceRef ds = calloc(1, sizeof(struct SecItemDataSource));
722 ds->ds.dsGetName = dsGetName;
723 ds->ds.dsAddNotifyPhaseBlock = dsAddNotifyPhaseBlock;
724 ds->ds.dsCopyManifestWithViewNameSet = dsCopyManifestWithViewNameSet;
725 ds->ds.dsCopyStateWithKey = dsCopyStateWithKey;
726 ds->ds.dsCopyItemDataWithKeys = dsCopyItemDataWithKeys;
727
728 ds->ds.dsForEachObject = dsForEachObject;
729 ds->ds.dsWith = dsWith;
730 ds->ds.dsReadWith = dsReadWith;
731 ds->ds.dsRelease = dsRelease;
732
733 ds->ds.dsMergeObject = dsMergeObject;
734 ds->ds.dsSetStateWithKey = dsSetStateWithKey;
735 ds->ds.dsDeleteStateWithKey = dsDeleteStateWithKey;
736 ds->ds.dsRestoreObject = dsRestoreObject;
737
738 // Object field accessors
739 ds->ds.objectCopyDigest = copyObjectDigest;
740
741 // Object encode and decode.
742 ds->ds.objectCreateWithPropertyList = objectCreateWithPropertyList;
743 ds->ds.objectCopyPropertyList = objectCopyPropertyList;
744 ds->ds.objectCopyBackup = objectCopyBackup;
745
746 ds->db = CFRetainSafe(db);
747 ds->name = CFRetainSafe(name);
748
749 // Do this after the ds is fully setup so the engine can query us right away.
750 ds->ds.engine = SOSEngineCreate(&ds->ds, error);
751 if (!ds->ds.engine) {
752 free(ds);
753 ds = NULL;
754 }
755 return &ds->ds;
756 }
757
758 static CFStringRef SecItemDataSourceFactoryCopyName(SOSDataSourceFactoryRef factory)
759 {
760 // This is the name of the v0 datasource, a.k.a. "ak"
761 return kSecAttrAccessibleWhenUnlocked;
762 }
763
764 struct SecItemDataSourceFactory {
765 struct SOSDataSourceFactory factory;
766 CFMutableDictionaryRef dsCache;
767 dispatch_queue_t queue;
768 SecDbRef db;
769 };
770
771 static SOSDataSourceRef SecItemDataSourceFactoryCopyDataSource(SOSDataSourceFactoryRef factory, CFStringRef dataSourceName, CFErrorRef *error)
772 {
773 struct SecItemDataSourceFactory *f = (struct SecItemDataSourceFactory *)factory;
774 __block SOSDataSourceRef dataSource = NULL;
775 dispatch_sync(f->queue, ^{
776 dataSource = (SOSDataSourceRef)CFDictionaryGetValue(f->dsCache, dataSourceName);
777 if (!dataSource) {
778 dataSource = (SOSDataSourceRef)SecItemDataSourceCreate(f->db, dataSourceName, error);
779 CFDictionarySetValue(f->dsCache, dataSourceName, dataSource);
780 }
781 });
782 return dataSource;
783 }
784
785 static void SecItemDataSourceFactoryDispose(SOSDataSourceFactoryRef factory)
786 {
787 // Nothing to do here.
788 }
789
790 static void SecItemDataSourceFactoryCircleChanged(SOSDataSourceFactoryRef factory, CFStringRef myPeerID, CFArrayRef trustedPeerIDs, CFArrayRef untrustedPeerIDs) {
791 CFStringRef dsName = SOSDataSourceFactoryCopyName(factory);
792 SOSEngineRef engine = SOSDataSourceFactoryGetEngineForDataSourceName(factory, dsName, NULL);
793 if (engine)
794 SOSEngineCircleChanged(engine, myPeerID, trustedPeerIDs, untrustedPeerIDs);
795 CFReleaseSafe(dsName);
796 }
797
798 // Fire up the SOSEngines so they can
799 static bool SOSDataSourceFactoryStartYourEngines(SOSDataSourceFactoryRef factory) {
800 bool ok = true;
801 CFStringRef dsName = SOSDataSourceFactoryCopyName(factory);
802 CFErrorRef localError = NULL;
803 SOSDataSourceRef ds = SOSDataSourceFactoryCreateDataSource(factory, dsName, &localError);
804 if (!ds)
805 secerror("create_datasource %@ failed %@", dsName, localError);
806 CFReleaseNull(localError);
807 SOSDataSourceRelease(ds, &localError);
808 CFReleaseNull(localError);
809 CFReleaseNull(dsName);
810 return ok;
811 }
812
813 static SOSDataSourceFactoryRef SecItemDataSourceFactoryCreate(SecDbRef db) {
814 struct SecItemDataSourceFactory *dsf = calloc(1, sizeof(struct SecItemDataSourceFactory));
815 dsf->factory.copy_name = SecItemDataSourceFactoryCopyName;
816 dsf->factory.create_datasource = SecItemDataSourceFactoryCopyDataSource;
817 dsf->factory.release = SecItemDataSourceFactoryDispose;
818 dsf->factory.circle_changed = SecItemDataSourceFactoryCircleChanged;
819
820 dsf->dsCache = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, NULL);
821 dsf->queue = dispatch_queue_create("dsf queue", DISPATCH_QUEUE_SERIAL);
822 dsf->db = CFRetainSafe(db);
823 if (!SOSDataSourceFactoryStartYourEngines(&dsf->factory))
824 secerror("Failed to start engines, gonna lose the race.");
825 return &dsf->factory;
826 }
827
828 SOSDataSourceFactoryRef SecItemDataSourceFactoryGetShared(SecDbRef db) {
829 static dispatch_once_t sDSFQueueOnce;
830 static dispatch_queue_t sDSFQueue;
831 static CFMutableDictionaryRef sDSTable = NULL;
832
833 dispatch_once(&sDSFQueueOnce, ^{
834 sDSFQueue = dispatch_queue_create("dataSourceFactory queue", DISPATCH_QUEUE_SERIAL);
835 });
836
837 __block SOSDataSourceFactoryRef result = NULL;
838 dispatch_sync(sDSFQueue, ^{
839 CFStringRef dbPath = SecDbGetPath(db);
840 if (sDSTable) {
841 result = (SOSDataSourceFactoryRef) CFDictionaryGetValue(sDSTable, dbPath);
842 } else {
843 sDSTable = CFDictionaryCreateMutable(kCFAllocatorDefault, 0, &kCFTypeDictionaryKeyCallBacks, NULL);
844 }
845
846 if (!result) {
847 result = SecItemDataSourceFactoryCreate(db);
848
849 CFDictionaryAddValue(sDSTable, dbPath, result);
850 }
851 });
852
853 return result;
854 }
855
856 // TODO: These should move to SecItemServer.c
857
858 void SecItemServerAppendItemDescription(CFMutableStringRef desc, CFDictionaryRef object) {
859 SOSObjectRef item = objectCreateWithPropertyList(object, NULL);
860 if (item) {
861 CFStringRef itemDesc = CFCopyDescription(item);
862 if (itemDesc) {
863 CFStringAppend(desc, itemDesc);
864 CFReleaseSafe(itemDesc);
865 }
866 CFRelease(item);
867 }
868 }
869
870 SOSManifestRef SOSCreateManifestWithBackup(CFDictionaryRef backup, CFErrorRef *error)
871 {
872 __block struct SOSDigestVector dv = SOSDigestVectorInit;
873 if (backup) {
874 CFDictionaryForEach(backup, ^void (const void * key, const void * value) {
875 if (isDictionary(value)) {
876 /* converting key back to binary blob is horrible */
877 CFDataRef sha1 = CFDictionaryGetValue(value, kSecItemBackupHashKey);
878 if (isData(sha1) && CFDataGetLength(sha1) == CCSHA1_OUTPUT_SIZE)
879 SOSDigestVectorAppend(&dv, CFDataGetBytePtr(sha1));
880 }
881 });
882 }
883 SOSManifestRef manifest = SOSManifestCreateWithDigestVector(&dv, error);
884 SOSDigestVectorFree(&dv);
885 return manifest;
886 }