keychain/ot/OTJoinWithVoucherOperation.m

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #if OCTAGON
  25
  26 #import <utilities/debugging.h>
  27
  28 #import <CloudKit/CloudKit_Private.h>
  29
  30 #import "keychain/ot/OTJoinWithVoucherOperation.h"
  31 #import "keychain/ot/OTOperationDependencies.h"
  32 #import "keychain/ot/OTFetchCKKSKeysOperation.h"
  33 #import "keychain/ckks/CKKSNearFutureScheduler.h"
  34 #import "keychain/ckks/CloudKitCategories.h"
  35
  36 #import "keychain/TrustedPeersHelper/TrustedPeersHelperProtocol.h"
  37 #import "keychain/ot/ObjCImprovements.h"
  38 #import "keychain/ot/OTStates.h"
  39
  40 @interface OTJoinWithVoucherOperation ()
  41 @property OTOperationDependencies* deps;
  42
  43 @property OctagonState* ckksConflictState;
  44
  45 @property NSOperation* finishedOp;
  46 @end
  47
  48 @implementation OTJoinWithVoucherOperation
  49
  50 @synthesize intendedState = _intendedState;
  51
  52 - (instancetype)initWithDependencies:(OTOperationDependencies*)dependencies
  53                        intendedState:(OctagonState*)intendedState
  54                    ckksConflictState:(OctagonState*)ckksConflictState
  55                           errorState:(OctagonState*)errorState
  56                          voucherData:(NSData*)voucherData
  57                           voucherSig:(NSData*)voucherSig
  58                      preapprovedKeys:(NSArray<NSData *>*)preapprovedKeys
  59 {
  60     if((self = [super init])) {
  61         _deps = dependencies;
  62
  63         _intendedState = intendedState;
  64         _nextState = errorState;
  65         _ckksConflictState = ckksConflictState;
  66
  67         _voucherData = voucherData;
  68         _voucherSig = voucherSig;
  69         _preapprovedKeys = preapprovedKeys;
  70     }
  71     return self;
  72 }
  73
  74 - (void)groupStart
  75 {
  76     secnotice("octagon", "joining");
  77
  78     self.finishedOp = [[NSOperation alloc] init];
  79     [self dependOnBeforeGroupFinished:self.finishedOp];
  80
  81     WEAKIFY(self);
  82
  83     OTFetchCKKSKeysOperation* fetchKeysOp = [[OTFetchCKKSKeysOperation alloc] initWithDependencies:self.deps];
  84     [self runBeforeGroupFinished:fetchKeysOp];
  85
  86     CKKSResultOperation* proceedWithKeys = [CKKSResultOperation named:@"vouch-with-keys"
  87                                                             withBlock:^{
  88                                                                 STRONGIFY(self);
  89                                                                 [self proceedWithKeys:fetchKeysOp.viewKeySets
  90                                                                      pendingTLKShares:fetchKeysOp.pendingTLKShares];
  91                                                             }];
  92
  93     [proceedWithKeys addDependency:fetchKeysOp];
  94     [self runBeforeGroupFinished:proceedWithKeys];
  95 }
  96
  97 - (void)proceedWithKeys:(NSArray<CKKSKeychainBackedKeySet*>*)viewKeySets pendingTLKShares:(NSArray<CKKSTLKShare*>*)pendingTLKShares
  98 {
  99     WEAKIFY(self);
 100
 101     [self.deps.cuttlefishXPCWrapper joinWithContainer:self.deps.containerName
 102                                               context:self.deps.contextID
 103                                           voucherData:self.voucherData
 104                                            voucherSig:self.voucherSig
 105                                              ckksKeys:viewKeySets
 106                                             tlkShares:pendingTLKShares
 107                                       preapprovedKeys:self.preapprovedKeys
 108                                                 reply:^(NSString * _Nullable peerID, NSArray<CKRecord*>* keyHierarchyRecords, NSError * _Nullable error) {
 109             STRONGIFY(self);
 110             if(error){
 111                 secerror("octagon: Error joining with voucher: %@", error);
 112                 [[CKKSAnalytics logger] logRecoverableError:error forEvent:OctagonEventJoinWithVoucher withAttributes:NULL];
 113
 114                 // IF this is a CKKS conflict error, don't retry
 115                 if ([error isCuttlefishError:CuttlefishErrorKeyHierarchyAlreadyExists]) {
 116                     secnotice("octagon-ckks", "A CKKS key hierarchy is out of date; going to state '%@'", self.ckksConflictState);
 117                     self.nextState = self.ckksConflictState;
 118                 } else if ([error isCuttlefishError:CuttlefishErrorResultGraphNotFullyReachable]) {
 119                     secnotice("octagon", "requesting cuttlefish health check");
 120                     self.nextState = OctagonStateCuttlefishTrustCheck;
 121                     self.error = error;
 122                 } else {
 123                     self.error = error;
 124                 }
 125             } else {
 126                 self.peerID = peerID;
 127
 128                 [[CKKSAnalytics logger] logSuccessForEventNamed:OctagonEventJoinWithVoucher];
 129
 130                 NSError* localError = nil;
 131                 BOOL persisted = [self.deps.stateHolder persistAccountChanges:^OTAccountMetadataClassC * _Nonnull(OTAccountMetadataClassC * _Nonnull metadata) {
 132                         metadata.trustState = OTAccountMetadataClassC_TrustState_TRUSTED;
 133                         metadata.peerID = peerID;
 134                         return metadata;
 135                     } error:&localError];
 136                 if(!persisted || localError) {
 137                     secnotice("octagon", "Couldn't persist results: %@", localError);
 138                     self.error = localError;
 139                 } else {
 140                     secerror("octagon: join successful");
 141                     self.nextState = self.intendedState;
 142                 }
 143
 144                 // Tell CKKS about our shiny new records!
 145                 for (id key in self.deps.viewManager.views) {
 146                     CKKSKeychainView* view = self.deps.viewManager.views[key];
 147                     secnotice("octagon-ckks", "Providing join() records to %@", view);
 148                     [view receiveTLKUploadRecords: keyHierarchyRecords];
 149                 }
 150             }
 151             [self runBeforeGroupFinished:self.finishedOp];
 152         }];
 153 }
 154
 155 @end
 156
 157 #endif // OCTAGON