1  //
  2  //  SOSRingConcordanceTrust.c
  3  //  sec
  4  //
  5  //  Created by Richard Murphy on 3/15/15.
  6  //
  7  //
  8  
  9  #include <AssertMacros.h>
 10  
 11  #include "keychain/SecureObjectSync/SOSInternal.h"
 12  #include "keychain/SecureObjectSync/SOSPeer.h"
 13  #include "keychain/SecureObjectSync/SOSPeerInfoInternal.h"
 14  #include "keychain/SecureObjectSync/SOSPeerInfoCollections.h"
 15  #include "keychain/SecureObjectSync/SOSCircle.h"
 16  #include <Security/SecFramework.h>
 17  
 18  #include <Security/SecKey.h>
 19  #include <Security/SecKeyPriv.h>
 20  #include <CoreFoundation/CoreFoundation.h>
 21  
 22  #include <utilities/SecCFWrappers.h>
 23  
 24  //#include "ckdUtilities.h"
 25  
 26  #include <corecrypto/ccder.h>
 27  #include <corecrypto/ccdigest.h>
 28  #include <corecrypto/ccsha2.h>
 29  
 30  
 31  #include <utilities/der_plist.h>
 32  #include <utilities/der_plist_internal.h>
 33  #include <corecrypto/ccder.h>
 34  #include <utilities/der_date.h>
 35  
 36  #include <stdlib.h>
 37  
 38  #include "SOSRing.h"
 39  #include "SOSRingUtils.h"
 40  
 41  static inline CFDictionaryRef SOSPeerInfoDictionaryCreate(CFSetRef peers) {
 42      size_t n = CFSetGetCount(peers);
 43      SOSPeerInfoRef  peerInfos[n];
 44      CFStringRef     peerIDs[n];
 45      CFSetGetValues(peers, (const void **) peerInfos);
 46      for(size_t i = 0; i < n; i++) peerIDs[i] = SOSPeerInfoGetPeerID(peerInfos[i]);
 47      return CFDictionaryCreate(NULL, (const void **)peerIDs, (const void **)peerInfos, n, &kCFTypeDictionaryKeyCallBacks, &kCFTypeDictionaryValueCallBacks);
 48  }
 49  
 50  static inline SOSConcordanceStatus CheckPeerStatus(CFStringRef peerID, SOSPeerInfoRef peer, SOSRingRef ring, SecKeyRef userPub, CFErrorRef *error) {
 51      SOSConcordanceStatus result = kSOSConcordanceNoPeer;
 52      SecKeyRef pubKey = NULL;
 53  
 54      require_action_quiet(peer, exit, result = kSOSConcordanceNoPeer);
 55      pubKey = SOSPeerInfoCopyPubKey(peer, error);
 56      require_quiet(pubKey, exit);
 57      require_action_quiet(SOSRingHasPeerID(ring, peerID), exit, result = kSOSConcordanceNoPeer);
 58      require_action_quiet(SOSPeerInfoApplicationVerify(peer, userPub, NULL), exit, result = kSOSConcordanceNoPeer);
 59      require_action_quiet(SOSRingVerifySignatureExists(ring, pubKey, error), exit, result = kSOSConcordanceNoPeerSig);
 60      require_action_quiet(SOSRingVerify(ring, pubKey, error), exit, result = kSOSConcordanceBadPeerSig);
 61  
 62      result = kSOSConcordanceTrusted;
 63  
 64  exit:
 65      CFReleaseNull(pubKey);
 66      return result;
 67  }
 68  
 69  static inline SOSConcordanceStatus CombineStatus(SOSConcordanceStatus status1, SOSConcordanceStatus status2)
 70  {
 71      if (status1 == kSOSConcordanceTrusted || status2 == kSOSConcordanceTrusted)
 72          return kSOSConcordanceTrusted;
 73  
 74      if (status1 == kSOSConcordanceBadPeerSig || status2 == kSOSConcordanceBadPeerSig)
 75          return kSOSConcordanceBadPeerSig;
 76  
 77      if (status1 == kSOSConcordanceNoPeerSig || status2 == kSOSConcordanceNoPeerSig)
 78          return kSOSConcordanceNoPeerSig;
 79  
 80      return status1;
 81  }
 82  
 83  SOSConcordanceStatus GetSignersStatus(CFSetRef peers, SOSRingRef signersRing, SOSRingRef statusRing,
 84                                                      SecKeyRef userPubkey, CFStringRef excludePeerID, CFErrorRef *error) {
 85      CFDictionaryRef ringPeerInfos = SOSPeerInfoDictionaryCreate(peers);
 86      __block SOSConcordanceStatus status = kSOSConcordanceNoPeer;
 87      SOSRingForEachPeerID(signersRing, ^(CFStringRef peerID) {
 88          SOSPeerInfoRef pi = (SOSPeerInfoRef) CFDictionaryGetValue(ringPeerInfos, peerID);
 89          SOSConcordanceStatus peerStatus = CheckPeerStatus(peerID, pi, statusRing, userPubkey, error);
 90  
 91          secnotice("ring", "concordance-signer-status: %@ -> %d", peerID, peerStatus);
 92  
 93          if (peerStatus == kSOSConcordanceNoPeerSig &&
 94              (CFEqualSafe(SOSPeerInfoGetPeerID(pi), excludePeerID) || SOSPeerInfoIsCloudIdentity(pi)))
 95              peerStatus = kSOSConcordanceNoPeer;
 96  
 97          status = CombineStatus(status, peerStatus);
 98      });
 99  
100      return status;
101  }
102  
103  
104  SOSConcordanceStatus GetSignersStatus_Transitive(CFSetRef peers, SOSRingRef signersRing, SOSRingRef statusRing,
105                                                   SecKeyRef userPubkey, CFStringRef excludePeerID, CFErrorRef *error) {
106      __block SOSConcordanceStatus status = kSOSConcordanceNoPeer;
107      
108      CFSetForEach(peers, ^(const void *value) {
109          SOSPeerInfoRef pi = (SOSPeerInfoRef) value;
110          CFStringRef peerID = SOSPeerInfoGetPeerID(pi);
111          if(SOSRingHasPeerWithID(statusRing, peerID, NULL)) {
112              SOSConcordanceStatus peerStatus = CheckPeerStatus(peerID, pi, statusRing, userPubkey, error);
113              
114              if (peerStatus == kSOSConcordanceNoPeerSig &&
115                  (CFEqualSafe(SOSPeerInfoGetPeerID(pi), excludePeerID) || SOSPeerInfoIsCloudIdentity(pi)))
116                  peerStatus = kSOSConcordanceNoPeer;
117              
118              status = CombineStatus(status, peerStatus);
119          }
120      });
121      
122      return status;
123  }
124  
125  
126  SOSConcordanceStatus SOSRingUserKeyConcordanceTrust(SOSFullPeerInfoRef me, CFSetRef peers, SOSRingRef knownRing, SOSRingRef proposedRing,
127                                                      SecKeyRef knownPubkey, SecKeyRef userPubkey,
128                                                      CFStringRef excludePeerID, CFErrorRef *error) {
129      if(userPubkey == NULL) {
130          SOSCreateError(kSOSErrorPublicKeyAbsent, CFSTR("Concordance with no public key"), NULL, error);
131          return kSOSConcordanceNoUserKey;
132      }
133  
134      if (SOSRingIsEmpty_Internal(proposedRing)) {
135          return kSOSConcordanceTrusted;
136      }
137  
138      if(!SOSRingVerifySignatureExists(proposedRing, userPubkey, error)) {
139          SOSCreateError(kSOSErrorBadSignature, CFSTR("No public signature"), (error != NULL) ? *error : NULL, error);
140          return kSOSConcordanceNoUserSig;
141      }
142  
143      if(!SOSRingVerify(proposedRing, userPubkey, error)) {
144          SOSCreateError(kSOSErrorBadSignature, CFSTR("Bad public signature"), (error != NULL) ? *error : NULL, error);
145          return kSOSConcordanceBadUserSig;
146      }
147  
148      if (SOSRingIsEmpty_Internal(knownRing) || SOSRingIsOffering_Internal(proposedRing)) {
149          return GetSignersStatus(peers, proposedRing, proposedRing, userPubkey, NULL, error);
150      }
151  
152      if(SOSRingIsOlderGeneration(proposedRing, knownRing)) {
153          SOSCreateError(kSOSErrorReplay, CFSTR("Bad generation"), NULL, error);
154          return kSOSConcordanceGenOld;
155      }
156  
157      if(knownPubkey == NULL) knownPubkey = userPubkey;
158      if(!SOSRingVerify(knownRing, knownPubkey, error)) knownPubkey = userPubkey;
159      return GetSignersStatus(peers, knownRing, proposedRing, knownPubkey, CFSTR("novalue"), error);
160  }
161  
162  
163  SOSConcordanceStatus SOSRingPeerKeyConcordanceTrust(SOSFullPeerInfoRef me, CFSetRef peers, SOSRingRef knownRing, SOSRingRef proposedRing,
164                                                      __unused SecKeyRef knownPubkey, SecKeyRef userPubkey,
165                                                      CFStringRef excludePeerID, CFErrorRef *error) {
166      if(userPubkey == NULL) {
167          SOSCreateError(kSOSErrorPublicKeyAbsent, CFSTR("Concordance with no public key - need to validate application"), NULL, error);
168          return kSOSConcordanceNoUserKey;
169      }
170  
171      if (SOSRingIsEmpty_Internal(proposedRing)) {
172          secnotice("ring", "ring empty -> trusted");
173          return kSOSConcordanceTrusted;
174      }
175  
176      if (SOSRingIsEmpty_Internal(knownRing) || SOSRingIsOffering_Internal(proposedRing)) {
177          return GetSignersStatus(peers, proposedRing, proposedRing, userPubkey, NULL, error);
178      }
179  
180      if(SOSRingIsOlderGeneration(proposedRing, knownRing)) {
181          SOSCreateError(kSOSErrorReplay, CFSTR("Bad generation"), NULL, error);
182          return kSOSConcordanceGenOld;
183      }
184      return GetSignersStatus(peers, knownRing, proposedRing, userPubkey, excludePeerID, error);
185  }