#include <securityd/spi.h>
#include <ipc/SecdWatchdog.h>
#include <ipc/server_security_helpers.h>
#include <ipc/securityd_client.h>
#include <securityd/SecPolicyServer.h>
#include <securityd/SecItemBackupServer.h>
#include <securityd/SecItemServer.h>
#include <securityd/SecTrustStoreServer.h>
#include <Security/SecureObjectSync/SOSPeerInfo.h>
#include <CoreFoundation/CFString.h>
#include <CoreFoundation/CFError.h>
#include <securityd/SOSCloudCircleServer.h>
#include <securityd/SecOCSPCache.h>
#include <securityd/SecOTRRemote.h>
#include <securityd/SecLogSettingsServer.h>
#include <securityd/personalization.h>
#include <securityd/SecTrustLoggingServer.h>
#include <CoreFoundation/CFXPCBridge.h>
#include "utilities/iOSforOSX.h"
#include "utilities/SecFileLocations.h"
#include "OTATrustUtilities.h"
static struct securityd securityd_spi = {
.sec_item_add = _SecItemAdd,
.sec_item_copy_matching = _SecItemCopyMatching,
.sec_item_update = _SecItemUpdate,
.sec_item_delete = _SecItemDelete,
#if TARGET_OS_IOS && !TARGET_OS_BRIDGE
.sec_add_shared_web_credential = _SecAddSharedWebCredential,
.sec_copy_shared_web_credential = _SecCopySharedWebCredential,
#endif
.sec_item_delete_all = _SecItemDeleteAll,
.sec_keychain_backup = _SecServerKeychainCreateBackup,
.sec_keychain_restore = _SecServerKeychainRestore,
.sec_keychain_backup_syncable = _SecServerBackupSyncable,
.sec_keychain_restore_syncable = _SecServerRestoreSyncable,
.sec_item_backup_copy_names = SecServerItemBackupCopyNames,
.sec_item_backup_handoff_fd = SecServerItemBackupHandoffFD,
.sec_item_backup_set_confirmed_manifest = SecServerItemBackupSetConfirmedManifest,
.sec_item_backup_restore = SecServerItemBackupRestore,
.sec_otr_session_create_remote = _SecOTRSessionCreateRemote,
.sec_otr_session_process_packet_remote = _SecOTRSessionProcessPacketRemote,
.soscc_TryUserCredentials = SOSCCTryUserCredentials_Server,
.soscc_SetUserCredentials = SOSCCSetUserCredentials_Server,
.soscc_SetUserCredentialsAndDSID = SOSCCSetUserCredentialsAndDSID_Server,
.soscc_SetUserCredentialsAndDSIDWithAnalytics = SOSCCSetUserCredentialsAndDSIDWithAnalytics_Server,
.soscc_CanAuthenticate = SOSCCCanAuthenticate_Server,
.soscc_PurgeUserCredentials = SOSCCPurgeUserCredentials_Server,
.soscc_ThisDeviceIsInCircle = SOSCCThisDeviceIsInCircle_Server,
.soscc_RequestToJoinCircle = SOSCCRequestToJoinCircle_Server,
.soscc_RequestToJoinCircleAfterRestore = SOSCCRequestToJoinCircleAfterRestore_Server,
.soscc_RequestToJoinCircleAfterRestoreWithAnalytics = SOSCCRequestToJoinCircleAfterRestoreWithAnalytics_Server,
.soscc_RequestEnsureFreshParameters = SOSCCRequestEnsureFreshParameters_Server,
.soscc_GetAllTheRings = SOSCCGetAllTheRings_Server,
.soscc_ApplyToARing = SOSCCApplyToARing_Server,
.soscc_WithdrawlFromARing = SOSCCWithdrawlFromARing_Server,
.soscc_EnableRing = SOSCCEnableRing_Server,
.soscc_RingStatus = SOSCCRingStatus_Server,
.soscc_SetToNew = SOSCCAccountSetToNew_Server,
.soscc_ResetToOffering = SOSCCResetToOffering_Server,
.soscc_ResetToEmpty = SOSCCResetToEmpty_Server,
.soscc_ResetToEmptyWithAnalytics = SOSCCResetToEmptyWithAnalytics_Server,
.soscc_View = SOSCCView_Server,
.soscc_ViewSet = SOSCCViewSet_Server,
.soscc_ViewSetWithAnalytics = SOSCCViewSetWithAnalytics_Server,
.soscc_RemoveThisDeviceFromCircle = SOSCCRemoveThisDeviceFromCircle_Server,
.soscc_RemoveThisDeviceFromCircleWithAnalytics = SOSCCRemoveThisDeviceFromCircleWithAnalytics_Server,
.soscc_RemovePeersFromCircle = SOSCCRemovePeersFromCircle_Server,
.soscc_RemovePeersFromCircleWithAnalytics = SOSCCRemovePeersFromCircleWithAnalytics_Server,
.soscc_LoggedOutOfAccount = SOSCCLoggedOutOfAccount_Server,
.soscc_BailFromCircle = SOSCCBailFromCircle_Server,
.soscc_AcceptApplicants = SOSCCAcceptApplicants_Server,
.soscc_RejectApplicants = SOSCCRejectApplicants_Server,
.soscc_CopyApplicantPeerInfo = SOSCCCopyApplicantPeerInfo_Server,
.soscc_CopyGenerationPeerInfo = SOSCCCopyGenerationPeerInfo_Server,
.soscc_CopyValidPeerPeerInfo = SOSCCCopyValidPeerPeerInfo_Server,
.soscc_ValidateUserPublic = SOSCCValidateUserPublic_Server,
.soscc_CopyNotValidPeerPeerInfo = SOSCCCopyNotValidPeerPeerInfo_Server,
.soscc_CopyRetirementPeerInfo = SOSCCCopyRetirementPeerInfo_Server,
.soscc_CopyViewUnawarePeerInfo = SOSCCCopyViewUnawarePeerInfo_Server,
.soscc_CopyEngineState = SOSCCCopyEngineState_Server,
.soscc_CopyPeerInfo = SOSCCCopyPeerPeerInfo_Server,
.soscc_CopyConcurringPeerInfo = SOSCCCopyConcurringPeerPeerInfo_Server,
.soscc_ProcessSyncWithPeers = SOSCCProcessSyncWithPeers_Server,
.soscc_ProcessSyncWithAllPeers = SOSCCProcessSyncWithAllPeers_Server,
.soscc_EnsurePeerRegistration = SOSCCProcessEnsurePeerRegistration_Server,
.sec_roll_keys = _SecServerRollKeysGlue,
.sec_keychain_sync_update_message = _SecServerKeychainSyncUpdateMessage,
.sec_get_log_settings = SecCopyLogSettings_Server,
.sec_set_xpc_log_settings = SecSetXPCLogSettings_Server,
.sec_set_circle_log_settings = SecSetCircleLogSettings_Server,
.soscc_CopyMyPeerInfo = SOSCCCopyMyPeerInfo_Server,
.soscc_SetLastDepartureReason = SOSCCSetLastDepartureReason_Server,
.soscc_SetNewPublicBackupKey = SOSCCSetNewPublicBackupKey_Server,
.soscc_RegisterSingleRecoverySecret = SOSCCRegisterSingleRecoverySecret_Server,
.soscc_WaitForInitialSync = SOSCCWaitForInitialSync_Server,
.soscc_WaitForInitialSyncWithAnalytics = SOSCCWaitForInitialSyncWithAnalytics_Server,
.soscc_CopyYetToSyncViewsList = SOSCCCopyYetToSyncViewsList_Server,
.soscc_SetEscrowRecords = SOSCCSetEscrowRecord_Server,
.soscc_CopyEscrowRecords = SOSCCCopyEscrowRecord_Server,
.sosbskb_WrapToBackupSliceKeyBagForView = SOSWrapToBackupSliceKeyBagForView_Server,
.soscc_CopyAccountState = SOSCCCopyAccountState_Server,
.soscc_DeleteAccountState = SOSCCDeleteAccountState_Server,
.soscc_CopyEngineData = SOSCCCopyEngineData_Server,
.soscc_DeleteEngineState = SOSCCDeleteEngineState_Server,
.soscc_AccountHasPublicKey = SOSCCAccountHasPublicKey_Server,
.soscc_AccountIsNew = SOSCCAccountIsNew_Server,
.sec_item_update_token_items = _SecItemUpdateTokenItems,
.sec_delete_items_with_access_groups = _SecItemServerDeleteAllWithAccessGroups,
.soscc_IsThisDeviceLastBackup = SOSCCkSecXPCOpIsThisDeviceLastBackup_Server,
.soscc_SOSCCPeersHaveViewsEnabled = SOSCCPeersHaveViewsEnabled_Server,
.soscc_RegisterRecoveryPublicKey = SOSCCRegisterRecoveryPublicKey_Server,
.soscc_CopyRecoveryPublicKey = SOSCCCopyRecoveryPublicKey_Server,
.soscc_CopyBackupInformation = SOSCCCopyBackupInformation_Server,
.soscc_SOSCCMessageFromPeerIsPending = SOSCCMessageFromPeerIsPending_Server,
.soscc_SOSCCSendToPeerIsPending = SOSCCSendToPeerIsPending_Server,
.sec_item_copy_parent_certificates = _SecItemCopyParentCertificates,
.sec_item_certificate_exists = _SecItemCertificateExists,
};
#ifdef LIBTRUSTD
static struct trustd trustd_spi = {
.sec_trust_store_for_domain = SecTrustStoreForDomainName,
.sec_trust_store_contains = SecTrustStoreContainsCertificateWithDigest,
.sec_trust_store_set_trust_settings = _SecTrustStoreSetTrustSettings,
.sec_trust_store_remove_certificate = SecTrustStoreRemoveCertificateWithDigest,
.sec_truststore_remove_all = _SecTrustStoreRemoveAll,
.sec_trust_evaluate = SecTrustServerEvaluate,
.sec_ota_pki_trust_store_version = SecOTAPKIGetCurrentTrustStoreVersion,
.sec_ota_pki_asset_version = SecOTAPKIGetCurrentAssetVersion,
.ota_CopyEscrowCertificates = SecOTAPKICopyCurrentEscrowCertificates,
.sec_ota_pki_get_new_asset = SecOTAPKISignalNewAsset,
.sec_trust_store_copy_all = _SecTrustStoreCopyAll,
.sec_trust_store_copy_usage_constraints = _SecTrustStoreCopyUsageConstraints,
.sec_ocsp_cache_flush = SecOCSPCacheFlush,
.sec_networking_analytics_report = SecNetworkingAnalyticsReport,
.sec_trust_store_set_ct_exceptions = _SecTrustStoreSetCTExceptions,
.sec_trust_store_copy_ct_exceptions = _SecTrustStoreCopyCTExceptions,
};
#endif
#if SECD_SERVER
static CFTypeRef
delayedSOSSharedObject(void)
{
static CFTypeRef soscc_status;
static dispatch_once_t onceToken;
dispatch_once(&onceToken, ^{
soscc_status = SOSKeychainAccountGetSharedAccount();
});
return soscc_status;
}
#endif
void securityd_init_local_spi(void) {
gSecurityd = &securityd_spi;
#if SECD_SERVER
securityd_spi.soscc_status = delayedSOSSharedObject;
#endif
securityd_spi.secd_xpc_server = SecCreateLocalCFSecuritydXPCServer();
}
void securityd_init_server(void) {
securityd_init_local_spi();
CFErrorRef cferror = nil;
bool keychainAlive = kc_with_dbt(false, &cferror, ^bool(SecDbConnectionRef dbt) {
secnotice("keychain", "Keychain initialized!");
return true;
});
if(!keychainAlive || cferror) {
secerror("Couldn't bring up keychain: %@", cferror);
}
CFReleaseNull(cferror);
SecdLoadWatchDog();
}
static void trustd_init_server(void) {
#ifdef LIBTRUSTD
gTrustd = &trustd_spi;
SecPolicyServerInitialize();
#endif
}
void securityd_init(CFURLRef home_path) {
if (home_path)
SetCustomHomeURL(home_path);
securityd_init_server();
trustd_init_server();
}