keychain/ckks/CKKSZoneChangeFetcher.m

   1 /*
   2  * Copyright (c) 2017 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #import <Foundation/Foundation.h>
  25
  26 #if OCTAGON
  27
  28 #import <dispatch/dispatch.h>
  29
  30 #import "keychain/ckks/CKKSZoneChangeFetcher.h"
  31 #import "keychain/ckks/CKKSFetchAllRecordZoneChangesOperation.h"
  32 #import "keychain/ckks/CKKSKeychainView.h"
  33 #import "keychain/ckks/CKKSNearFutureScheduler.h"
  34 #import "keychain/ckks/CloudKitCategories.h"
  35 #import "keychain/ckks/CKKSReachabilityTracker.h"
  36 #import "keychain/categories/NSError+UsefulConstructors.h"
  37 #import "keychain/analytics/SecEventMetric.h"
  38 #import "keychain/analytics/SecMetrics.h"
  39 #import "keychain/ot/ObjCImprovements.h"
  40
  41 CKKSFetchBecause* const CKKSFetchBecauseAPNS = (CKKSFetchBecause*) @"apns";
  42 CKKSFetchBecause* const CKKSFetchBecauseAPIFetchRequest = (CKKSFetchBecause*) @"api";
  43 CKKSFetchBecause* const CKKSFetchBecauseCurrentItemFetchRequest = (CKKSFetchBecause*) @"currentitemcheck";
  44 CKKSFetchBecause* const CKKSFetchBecauseInitialStart = (CKKSFetchBecause*) @"initialfetch";
  45 CKKSFetchBecause* const CKKSFetchBecauseSecuritydRestart = (CKKSFetchBecause*) @"restart";
  46 CKKSFetchBecause* const CKKSFetchBecausePreviousFetchFailed = (CKKSFetchBecause*) @"fetchfailed";
  47 CKKSFetchBecause* const CKKSFetchBecauseNetwork = (CKKSFetchBecause*) @"network";
  48 CKKSFetchBecause* const CKKSFetchBecauseKeyHierarchy = (CKKSFetchBecause*) @"keyhierarchy";
  49 CKKSFetchBecause* const CKKSFetchBecauseTesting = (CKKSFetchBecause*) @"testing";
  50 CKKSFetchBecause* const CKKSFetchBecauseResync = (CKKSFetchBecause*) @"resync";
  51 CKKSFetchBecause* const CKKSFetchBecauseMoreComing = (CKKSFetchBecause*) @"more-coming";
  52
  53 #pragma mark - CKKSZoneChangeFetchDependencyOperation
  54 @interface CKKSZoneChangeFetchDependencyOperation : CKKSResultOperation
  55 @property (weak) CKKSZoneChangeFetcher* owner;
  56 @property NSMutableArray<CKKSZoneChangeFetchDependencyOperation*>* chainDependents;
  57 - (void)chainDependency:(CKKSZoneChangeFetchDependencyOperation*)newDependency;
  58 @end
  59
  60 @implementation CKKSZoneChangeFetchDependencyOperation
  61 - (instancetype)init {
  62     if((self = [super init])) {
  63         _chainDependents = [NSMutableArray array];
  64     }
  65     return self;
  66 }
  67
  68 - (NSError* _Nullable)descriptionError {
  69     return [NSError errorWithDomain:CKKSResultDescriptionErrorDomain
  70                                code:CKKSResultDescriptionPendingSuccessfulFetch
  71                         description:@"Fetch failed"
  72                          underlying:self.owner.lastCKFetchError];
  73 }
  74
  75 - (void)chainDependency:(CKKSZoneChangeFetchDependencyOperation*)newDependency {
  76     [self addSuccessDependency:newDependency];
  77
  78     // There's no need to build a chain more than two links long. Move all our children up to depend on the new dependency.
  79     for(CKKSZoneChangeFetchDependencyOperation* op in self.chainDependents) {
  80         [newDependency.chainDependents addObject:op];
  81         [op addSuccessDependency:newDependency];
  82         [op removeDependency:self];
  83     }
  84     [self.chainDependents removeAllObjects];
  85 }
  86 @end
  87
  88 #pragma mark - CKKSZoneChangeFetcher
  89
  90 @interface CKKSZoneChangeFetcher ()
  91 @property NSString* name;
  92 @property NSOperationQueue* operationQueue;
  93 @property dispatch_queue_t queue;
  94
  95 @property NSError* lastCKFetchError;
  96
  97 @property NSMapTable<CKRecordZoneID*, id<CKKSChangeFetcherClient>>* clientMap;
  98
  99 @property CKKSFetchAllRecordZoneChangesOperation* currentFetch;
 100 @property CKKSResultOperation* currentProcessResult;
 101
 102 @property NSMutableSet<CKKSFetchBecause*>* currentFetchReasons;
 103 @property NSMutableSet<CKRecordZoneNotification*>* apnsPushes;
 104 @property bool newRequests; // true if there's someone pending on successfulFetchDependency
 105 @property CKKSZoneChangeFetchDependencyOperation* successfulFetchDependency;
 106
 107 @property CKKSResultOperation* holdOperation;
 108 @end
 109
 110 @implementation CKKSZoneChangeFetcher
 111
 112 - (instancetype)initWithContainer:(CKContainer*)container
 113                        fetchClass:(Class<CKKSFetchRecordZoneChangesOperation>)fetchRecordZoneChangesOperationClass
 114               reachabilityTracker:(CKKSReachabilityTracker *)reachabilityTracker
 115 {
 116     if((self = [super init])) {
 117         _container = container;
 118         _fetchRecordZoneChangesOperationClass = fetchRecordZoneChangesOperationClass;
 119         _reachabilityTracker = reachabilityTracker;
 120
 121         _currentFetchReasons = [[NSMutableSet alloc] init];
 122         _apnsPushes = [[NSMutableSet alloc] init];
 123
 124         _clientMap = [NSMapTable strongToWeakObjectsMapTable];
 125
 126         _name = @"zone-change-fetcher";
 127         _queue = dispatch_queue_create([_name UTF8String], DISPATCH_QUEUE_SERIAL_WITH_AUTORELEASE_POOL);
 128         _operationQueue = [[NSOperationQueue alloc] init];
 129         _successfulFetchDependency = [self createSuccesfulFetchDependency];
 130
 131         _newRequests = false;
 132
 133         // If we're testing, for the initial delay, use 0.25 second. Otherwise, 2s.
 134         dispatch_time_t initialDelay = (SecCKKSReduceRateLimiting() ? 250 * NSEC_PER_MSEC : 2 * NSEC_PER_SEC);
 135
 136         // If we're testing, for the maximum delay, use 6 second. Otherwise, 2m.
 137         dispatch_time_t maximumDelay = (SecCKKSReduceRateLimiting() ? 6 * NSEC_PER_SEC : 120 * NSEC_PER_SEC);
 138
 139         WEAKIFY(self);
 140         _fetchScheduler = [[CKKSNearFutureScheduler alloc] initWithName:@"zone-change-fetch-scheduler"
 141                                                            initialDelay:initialDelay
 142                                                        expontialBackoff:2
 143                                                            maximumDelay:maximumDelay
 144                                                        keepProcessAlive:false
 145                                               dependencyDescriptionCode:CKKSResultDescriptionPendingZoneChangeFetchScheduling
 146                                                                   block:^{
 147                                                                       STRONGIFY(self);
 148                                                                       [self maybeCreateNewFetch];
 149                                                                   }];
 150     }
 151     return self;
 152 }
 153
 154 - (NSString*)description {
 155     NSDate* nextFetchAt = self.fetchScheduler.nextFireTime;
 156     if(nextFetchAt) {
 157         NSDateFormatter* dateFormatter = [[NSDateFormatter alloc] init];
 158         [dateFormatter setDateFormat:@"yyyy-MM-dd HH:mm:ss"];
 159         return [NSString stringWithFormat: @"<CKKSZoneChangeFetcher(%@): next fetch at %@", self.name, [dateFormatter stringFromDate: nextFetchAt]];
 160     } else {
 161         return [NSString stringWithFormat: @"<CKKSZoneChangeFetcher(%@): no pending fetches", self.name];
 162     }
 163 }
 164
 165 - (void)registerClient:(id<CKKSChangeFetcherClient>)client
 166 {
 167     @synchronized(self.clientMap) {
 168         [self.clientMap setObject:client forKey:client.zoneID];
 169     }
 170 }
 171
 172 - (NSArray<id<CKKSChangeFetcherClient>>*)clients {
 173     NSMutableArray<id<CKKSChangeFetcherClient>> *clients = [NSMutableArray array];
 174     @synchronized (self.clientMap) {
 175         for(id<CKKSChangeFetcherClient> client in [self.clientMap objectEnumerator]) {
 176             if (client) {
 177                 [clients addObject:client];
 178             }
 179         }
 180     }
 181     return clients;
 182 }
 183
 184 - (CKKSResultOperation*)requestSuccessfulFetch:(CKKSFetchBecause*)why {
 185     return [self requestSuccessfulFetchForManyReasons:[NSSet setWithObject:why]];
 186 }
 187
 188 - (CKKSResultOperation*)requestFetchDueToAPNS:(CKRecordZoneNotification*)notification
 189 {
 190     __block BOOL notReady = YES;
 191
 192     // make sure we don't hold the self.queue when we call out to clients since that will lead
 193     // to lock inversions
 194
 195     NSArray<id<CKKSChangeFetcherClient>> *clients = [self clients];
 196
 197     for(id<CKKSChangeFetcherClient> client in clients) {
 198         if([client zoneIsReadyForFetching]) {
 199             notReady = NO;
 200         }
 201     }
 202
 203     dispatch_sync(self.queue, ^{
 204
 205         if(notification) {
 206             [self.apnsPushes addObject:notification];
 207             if(notification.ckksPushTracingEnabled) {
 208                 // Report that we saw this notification before doing anything else
 209                 secnotice("ckksfetch", "Submitting initial CKEventMetric due to notification %@", notification);
 210
 211                 CKEventMetric *metric = [[CKEventMetric alloc] initWithEventName:@"APNSPushMetrics"];
 212                 metric.isPushTriggerFired = true;
 213                 metric[@"push_token_uuid"] = notification.ckksPushTracingUUID;
 214                 metric[@"push_received_date"] = notification.ckksPushReceivedDate;
 215                 metric[@"push_event_name"] = @"CKKS APNS Push Received";
 216                 metric[@"zones_status"] = notReady ? @"not-ready" : @"ready";
 217
 218                 [self.container submitEventMetric:metric];
 219
 220                 SecEventMetric *metric2 = [[SecEventMetric alloc] initWithEventName:@"APNSPushMetrics"];
 221                 metric2[@"push_token_uuid"] = notification.ckksPushTracingUUID;
 222                 metric2[@"push_received_date"] = notification.ckksPushReceivedDate;
 223                 metric2[@"push_event_name"] = @"CKKS APNS Push Received-webtunnel";
 224                 metric[@"zones_status"] = notReady ? @"not-ready" : @"ready";
 225
 226                 [[SecMetrics managerObject] submitEvent:metric2];
 227             }
 228         }
 229
 230     });
 231
 232     if (notReady) {
 233         secnotice("ckksfetch", "Skipping fetching size no zone is ready");
 234         return NULL;
 235     }
 236
 237     return [self requestSuccessfulFetchForManyReasons:[NSSet setWithObject:CKKSFetchBecauseAPNS]];
 238 }
 239
 240 - (CKKSResultOperation*)requestSuccessfulFetchForManyReasons:(NSSet<CKKSFetchBecause*>*)why
 241 {
 242     __block CKKSResultOperation* dependency = nil;
 243     dispatch_sync(self.queue, ^{
 244         dependency = self.successfulFetchDependency;
 245         self.newRequests = true;
 246         [self.currentFetchReasons unionSet:why];
 247
 248         [self.fetchScheduler trigger];
 249     });
 250
 251     return dependency;
 252 }
 253
 254 -(void)maybeCreateNewFetchOnQueue {
 255     dispatch_assert_queue(self.queue);
 256     if(self.newRequests &&
 257        (self.currentFetch == nil || [self.currentFetch isFinished]) &&
 258        (self.currentProcessResult == nil || [self.currentProcessResult isFinished])) {
 259         [self _onqueueCreateNewFetch];
 260     }
 261 }
 262
 263 -(void)maybeCreateNewFetch {
 264     dispatch_sync(self.queue, ^{
 265         [self maybeCreateNewFetchOnQueue];
 266     });
 267 }
 268
 269 -(void)_onqueueCreateNewFetch {
 270     dispatch_assert_queue(self.queue);
 271
 272     WEAKIFY(self);
 273
 274     CKKSZoneChangeFetchDependencyOperation* dependency = self.successfulFetchDependency;
 275     NSMutableSet<CKKSFetchBecause*>* lastFetchReasons = self.currentFetchReasons;
 276     self.currentFetchReasons = [[NSMutableSet alloc] init];
 277
 278     NSString *reasonsString = [[lastFetchReasons sortedArrayUsingDescriptors:@[[NSSortDescriptor sortDescriptorWithKey:@"description" ascending:YES]]] componentsJoinedByString:@","];
 279
 280     secnotice("ckksfetcher", "Starting a new fetch, reasons: %@", reasonsString);
 281
 282     NSMutableSet<CKRecordZoneNotification*>* lastAPNSPushes = self.apnsPushes;
 283     self.apnsPushes = [[NSMutableSet alloc] init];
 284
 285     CKOperationGroup* operationGroup = [CKOperationGroup CKKSGroupWithName: reasonsString];
 286
 287     NSArray<id<CKKSChangeFetcherClient>> *clients = [self clients];
 288
 289     if(clients.count == 0u) {
 290         secnotice("ckksfetcher", "No clients");
 291         // Nothing to do, really.
 292     }
 293
 294     CKKSFetchAllRecordZoneChangesOperation* fetchAllChanges = [[CKKSFetchAllRecordZoneChangesOperation alloc] initWithContainer:self.container
 295                                                                                                                      fetchClass:self.fetchRecordZoneChangesOperationClass
 296                                                                                                                         clients:clients
 297                                                                                                                    fetchReasons:lastFetchReasons
 298                                                                                                                      apnsPushes:lastAPNSPushes
 299                                                                                                                     forceResync:false
 300                                                                                                                ckoperationGroup:operationGroup];
 301
 302     if ([lastFetchReasons containsObject:CKKSFetchBecauseNetwork]) {
 303         secnotice("ckksfetcher", "blocking fetch on network reachability");
 304         [fetchAllChanges addNullableDependency: self.reachabilityTracker.reachabilityDependency]; // wait on network, if its unavailable
 305     }
 306     [fetchAllChanges addNullableDependency: self.holdOperation];
 307
 308     self.currentProcessResult = [CKKSResultOperation operationWithBlock: ^{
 309         STRONGIFY(self);
 310         if(!self) {
 311             secerror("ckksfetcher: Received a null self pointer; strange.");
 312             return;
 313         }
 314
 315         bool attemptAnotherFetch = false;
 316         if(fetchAllChanges.error != nil) {
 317             secerror("ckksfetcher: Interrogating clients about fetch error: %@", fetchAllChanges.error);
 318
 319             // Check in with clients: should we keep fetching for them?
 320             @synchronized(self.clientMap) {
 321                 for(CKRecordZoneID* zoneID in fetchAllChanges.fetchedZoneIDs) {
 322                     id<CKKSChangeFetcherClient> client = [self.clientMap objectForKey:zoneID];
 323                     if(client) {
 324                         attemptAnotherFetch |= [client shouldRetryAfterFetchError:fetchAllChanges.error];
 325                     }
 326                 }
 327             }
 328         }
 329
 330         dispatch_sync(self.queue, ^{
 331             self.lastCKFetchError = fetchAllChanges.error;
 332
 333             if(fetchAllChanges.error == nil) {
 334                 // success! notify the listeners.
 335                 [self.operationQueue addOperation: dependency];
 336                 self.currentFetch = nil;
 337
 338                 // Did new people show up and want another fetch?
 339                 if(self.newRequests) {
 340                     [self.fetchScheduler trigger];
 341                 }
 342             } else {
 343                 // The operation errored. Chain the dependency on the current one...
 344                 [dependency chainDependency:self.successfulFetchDependency];
 345                 [self.operationQueue addOperation: dependency];
 346
 347                 if(!attemptAnotherFetch) {
 348                     secerror("ckksfetcher: All clients thought %@ is a fatal error. Not restarting fetch.", fetchAllChanges.error);
 349                     return;
 350                 }
 351
 352                 // And in a bit, try the fetch again.
 353                 NSTimeInterval delay = CKRetryAfterSecondsForError(fetchAllChanges.error);
 354                 if (delay) {
 355                     secnotice("ckksfetcher", "Fetch failed with rate-limiting error, restarting in %.1f seconds: %@", delay, fetchAllChanges.error);
 356                     [self.fetchScheduler waitUntil:NSEC_PER_SEC * delay];
 357                 } else {
 358                     secnotice("ckksfetcher", "Fetch failed with error, restarting soon: %@", fetchAllChanges.error);
 359                 }
 360
 361                 // Add the failed fetch reasons to the new fetch reasons
 362                 [self.currentFetchReasons unionSet:lastFetchReasons];
 363                 [self.apnsPushes unionSet:lastAPNSPushes];
 364
 365                 // If its a network error, make next try depend on network availability
 366                 if ([self.reachabilityTracker isNetworkError:fetchAllChanges.error]) {
 367                     [self.currentFetchReasons addObject:CKKSFetchBecauseNetwork];
 368                 } else {
 369                     [self.currentFetchReasons addObject:CKKSFetchBecausePreviousFetchFailed];
 370                 }
 371                 self.newRequests = true;
 372                 [self.fetchScheduler trigger];
 373             }
 374         });
 375     }];
 376
 377     // creata a new fetch dependency, for all those who come in while this operation is executing
 378     self.newRequests = false;
 379     self.successfulFetchDependency = [self createSuccesfulFetchDependency];
 380
 381     // now let new new fetch go and process it's results
 382     self.currentProcessResult.name = @"zone-change-fetcher-worker";
 383     [self.currentProcessResult addDependency: fetchAllChanges];
 384
 385     [self.operationQueue addOperation:self.currentProcessResult];
 386
 387     self.currentFetch = fetchAllChanges;
 388     [self.operationQueue addOperation:self.currentFetch];
 389 }
 390
 391 -(CKKSZoneChangeFetchDependencyOperation*)createSuccesfulFetchDependency {
 392     CKKSZoneChangeFetchDependencyOperation* dep = [[CKKSZoneChangeFetchDependencyOperation alloc] init];
 393
 394     dep.name = @"successful-fetch-dependency";
 395     dep.descriptionErrorCode = CKKSResultDescriptionPendingSuccessfulFetch;
 396     dep.owner = self;
 397
 398     return dep;
 399 }
 400
 401 - (void)holdFetchesUntil:(CKKSResultOperation*)holdOperation {
 402     self.holdOperation = holdOperation;
 403 }
 404
 405 -(void)cancel {
 406     [self.fetchScheduler cancel];
 407 }
 408
 409 @end
 410
 411 #endif
 412
 413