keychain/ot/OTVouchWithBottleOperation.m

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #if OCTAGON
  25
  26 #import <utilities/debugging.h>
  27
  28 #import "keychain/ot/OTVouchWithBottleOperation.h"
  29 #import "keychain/ot/OTClientStateMachine.h"
  30 #import "keychain/ot/OTCuttlefishContext.h"
  31 #import "keychain/ot/OTFetchCKKSKeysOperation.h"
  32
  33 #import "keychain/TrustedPeersHelper/TrustedPeersHelperProtocol.h"
  34 #import "keychain/ot/ObjCImprovements.h"
  35
  36 @interface OTVouchWithBottleOperation ()
  37 @property OTOperationDependencies* deps;
  38
  39 @property NSOperation* finishedOp;
  40 @end
  41
  42 @implementation OTVouchWithBottleOperation
  43 @synthesize intendedState = _intendedState;
  44
  45 - (instancetype)initWithDependencies:(OTOperationDependencies*)dependencies
  46                        intendedState:(OctagonState*)intendedState
  47                           errorState:(OctagonState*)errorState
  48                             bottleID:(NSString*)bottleID
  49                              entropy:(NSData*)entropy
  50                           bottleSalt:(NSString*)bottleSalt
  51 {
  52     if((self = [super init])) {
  53         _deps = dependencies;
  54         _intendedState = intendedState;
  55         _nextState = errorState;
  56
  57         _bottleID = bottleID;
  58         _entropy = entropy;
  59         _bottleSalt = bottleSalt;
  60     }
  61     return self;
  62 }
  63
  64 - (void)groupStart
  65 {
  66     secnotice("octagon", "creating voucher using a bottle with escrow record id: %@", self.bottleID);
  67
  68     self.finishedOp = [[NSOperation alloc] init];
  69     [self dependOnBeforeGroupFinished:self.finishedOp];
  70
  71     if(self.bottleSalt != nil) {
  72         secnotice("octagon", "using passed in altdsid, altdsid is: %@", self.bottleSalt);
  73     } else{
  74         NSError *error = nil;
  75
  76         NSString* altDSID = [self.deps.authKitAdapter primaryiCloudAccountAltDSID:&error];
  77         if(altDSID){
  78             secnotice("octagon", "fetched altdsid is: %@", altDSID);
  79             self.bottleSalt = altDSID;
  80         }
  81         else {
  82             secnotice("octagon", "authkit doesn't know about the altdsid, using stored value: %@", error);
  83
  84             NSError* accountError = nil;
  85             OTAccountMetadataClassC* account = [self.deps.stateHolder loadOrCreateAccountMetadata:&accountError];
  86
  87             if(account && !accountError) {
  88                 secnotice("octagon", "retrieved account, altdsid is: %@", account.altDSID);
  89                 self.bottleSalt = account.altDSID;
  90             }
  91             if(accountError || !account){
  92                 secerror("failed to rerieve account object: %@", accountError);
  93             }
  94         }
  95     }
  96
  97     // Preflight the vouch: this will tell us the peerID of the recovering peer.
  98     // Then, filter the tlkShares array to include only tlks sent to that peer.
  99     WEAKIFY(self);
 100     [self.deps.cuttlefishXPCWrapper preflightVouchWithBottleWithContainer:self.deps.containerName
 101                                                                   context:self.deps.contextID
 102                                                                  bottleID:self.bottleID
 103                                                                     reply:^(NSString * _Nullable peerID,
 104                                                                             NSSet<NSString*>* peerSyncingViews,
 105                                                                             TPPolicy* peerSyncingPolicy,
 106                                                                             NSError * _Nullable error) {
 107         STRONGIFY(self);
 108         [[CKKSAnalytics logger] logResultForEvent:OctagonEventPreflightVouchWithBottle hardFailure:true result:error];
 109
 110         if(error || !peerID) {
 111             secerror("octagon: Error preflighting voucher using bottle: %@", error);
 112             self.error = error;
 113             [self runBeforeGroupFinished:self.finishedOp];
 114             return;
 115         }
 116
 117         secnotice("octagon", "Bottle %@ is for peerID %@", self.bottleID, peerID);
 118
 119         // Tell CKKS to spin up the new views and policy
 120         // But, do not persist this view set! We'll do that when we actually manager to join
 121         [self.deps.viewManager setSyncingViews:peerSyncingViews sortingPolicy:peerSyncingPolicy];
 122
 123         [self proceedWithPeerID:peerID];
 124     }];
 125 }
 126
 127 - (void)proceedWithPeerID:(NSString*)peerID
 128 {
 129     WEAKIFY(self);
 130
 131     // After a vouch, we also want to acquire all TLKs that the bottled peer might have had
 132     OTFetchCKKSKeysOperation* fetchKeysOp = [[OTFetchCKKSKeysOperation alloc] initWithDependencies:self.deps];
 133     [self runBeforeGroupFinished:fetchKeysOp];
 134
 135     CKKSResultOperation* proceedWithKeys = [CKKSResultOperation named:@"bottle-tlks"
 136                                                             withBlock:^{
 137         STRONGIFY(self);
 138
 139         NSMutableArray<CKKSTLKShare*>* filteredTLKShares = [NSMutableArray array];
 140         for(CKKSTLKShare* share in fetchKeysOp.tlkShares) {
 141             // If we didn't get a peerID, just pass every tlkshare and hope for the best
 142             if(peerID == nil || [share.receiverPeerID isEqualToString:peerID]) {
 143                 [filteredTLKShares addObject:share];
 144             }
 145         }
 146
 147         [self proceedWithKeys:fetchKeysOp.viewKeySets filteredTLKShares:filteredTLKShares];
 148     }];
 149
 150     [proceedWithKeys addDependency:fetchKeysOp];
 151     [self runBeforeGroupFinished:proceedWithKeys];
 152 }
 153
 154
 155 - (void)noteMetric:(NSString*)metric count:(int64_t)count
 156 {
 157     NSString* metricName = [NSString stringWithFormat:@"%@%lld", metric, count];
 158
 159     [[CKKSAnalytics logger] logResultForEvent:metricName
 160                                   hardFailure:NO
 161                                        result:nil];
 162
 163     [[CKKSAnalytics logger] setDateProperty:[NSDate date] forKey:metricName];
 164     [[CKKSAnalytics logger] setNumberProperty:[[NSNumber alloc]initWithLong:count] forKey:metric];
 165 }
 166
 167 - (void)proceedWithKeys:(NSArray<CKKSKeychainBackedKeySet*>*)viewKeySets filteredTLKShares:(NSArray<CKKSTLKShare*>*)tlkShares
 168 {
 169     WEAKIFY(self);
 170
 171     [self.deps.cuttlefishXPCWrapper vouchWithBottleWithContainer:self.deps.containerName
 172                                                          context:self.deps.contextID
 173                                                         bottleID:self.bottleID
 174                                                          entropy:self.entropy
 175                                                       bottleSalt:self.bottleSalt
 176                                                        tlkShares:tlkShares
 177                                                            reply:^(NSData * _Nullable voucher,
 178                                                                    NSData * _Nullable voucherSig,
 179                                                                    int64_t uniqueTLKsRecovered,
 180                                                                    int64_t totalTLKSharesRecovered,
 181                                                                    NSError * _Nullable error) {
 182             STRONGIFY(self);
 183             [[CKKSAnalytics logger] logResultForEvent:OctagonEventVoucherWithBottle hardFailure:true result:error];
 184
 185             if(error){
 186                 secerror("octagon: Error preparing voucher using bottle: %@", error);
 187                 self.error = error;
 188                 [self runBeforeGroupFinished:self.finishedOp];
 189                 return;
 190             }
 191
 192             //collect TLK count metrics
 193             [self noteMetric:OctagonAnalyticsBottledUniqueTLKsRecovered count:uniqueTLKsRecovered];
 194             [self noteMetric:OctagonAnalyticsBottledTotalTLKSharesRecovered count:totalTLKSharesRecovered];
 195             [self noteMetric:OctagonAnalyticsBottledTotalTLKShares count:tlkShares.count];
 196
 197             NSMutableSet<NSString*>* uniqueTLKsWithShares = [NSMutableSet set];
 198             for (CKKSTLKShare* share in tlkShares) {
 199                 [uniqueTLKsWithShares addObject:share.tlkUUID];
 200             }
 201
 202             [self noteMetric:OctagonAnalyticsBottledUniqueTLKsWithSharesCount count:uniqueTLKsWithShares.count];
 203
 204             NSMutableDictionary *views = [NSMutableDictionary dictionary];
 205             for (CKKSTLKShare *share in tlkShares) {
 206                 views[share.zoneID] = share.zoneID;
 207             }
 208             [self noteMetric:OctagonAnalyticsBottledTLKUniqueViewCount count:views.count];
 209
 210             secnotice("octagon", "Received bottle voucher");
 211
 212             self.voucher = voucher;
 213             self.voucherSig = voucherSig;
 214             self.nextState = self.intendedState;
 215             [self runBeforeGroupFinished:self.finishedOp];
 216         }];
 217 }
 218
 219 @end
 220
 221 #endif // OCTAGON