keychain/ot/OTEstablishOperation.m

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #if OCTAGON
  25
  26 #import <utilities/debugging.h>
  27
  28 #import "keychain/ot/OTEstablishOperation.h"
  29 #import "keychain/ot/OTCuttlefishAccountStateHolder.h"
  30 #import "keychain/ot/OTFetchCKKSKeysOperation.h"
  31 #import "keychain/ckks/CloudKitCategories.h"
  32 #import "keychain/ckks/CKKSCurrentKeyPointer.h"
  33 #import "keychain/ckks/CKKSKeychainView.h"
  34 #import "keychain/SecureObjectSync/SOSAccount.h"
  35
  36 #import "keychain/TrustedPeersHelper/TrustedPeersHelperProtocol.h"
  37 #import "keychain/ot/ObjCImprovements.h"
  38
  39 @interface OTEstablishOperation ()
  40 @property OTOperationDependencies* operationDependencies;
  41
  42 @property OctagonState* ckksConflictState;
  43
  44 @property NSOperation* finishedOp;
  45 @end
  46
  47 @implementation OTEstablishOperation
  48 @synthesize intendedState = _intendedState;
  49
  50 - (instancetype)initWithDependencies:(OTOperationDependencies*)dependencies
  51                        intendedState:(OctagonState*)intendedState
  52                    ckksConflictState:(OctagonState*)ckksConflictState
  53                           errorState:(OctagonState*)errorState
  54 {
  55     if((self = [super init])) {
  56         _operationDependencies = dependencies;
  57
  58         _intendedState = intendedState;
  59         _nextState = errorState;
  60         _ckksConflictState = ckksConflictState;
  61     }
  62     return self;
  63 }
  64
  65 - (void)groupStart
  66 {
  67     secnotice("octagon", "Beginning an establish operation");
  68
  69     WEAKIFY(self);
  70
  71     self.finishedOp = [NSBlockOperation blockOperationWithBlock:^{
  72         STRONGIFY(self);
  73         secnotice("octagon", "Finishing an establish operation with %@", self.error ?: @"no error");
  74     }];
  75     [self dependOnBeforeGroupFinished:self.finishedOp];
  76
  77     // First, interrogate CKKS views, and see when they have a TLK proposal.
  78     OTFetchCKKSKeysOperation* fetchKeysOp = [[OTFetchCKKSKeysOperation alloc] initWithDependencies:self.operationDependencies
  79                                                                                      refetchNeeded:NO];
  80     [self runBeforeGroupFinished:fetchKeysOp];
  81
  82     CKKSResultOperation* proceedWithKeys = [CKKSResultOperation named:@"establish-with-keys"
  83                                                             withBlock:^{
  84                                                                 STRONGIFY(self);
  85                                                                 [self proceedWithKeys:fetchKeysOp.viewKeySets
  86                                                                      pendingTLKShares:fetchKeysOp.pendingTLKShares];
  87                                                             }];
  88
  89     [proceedWithKeys addDependency:fetchKeysOp];
  90     [self runBeforeGroupFinished:proceedWithKeys];
  91 }
  92
  93 - (void)proceedWithKeys:(NSArray<CKKSKeychainBackedKeySet*>*)viewKeySets pendingTLKShares:(NSArray<CKKSTLKShare*>*)pendingTLKShares
  94 {
  95     WEAKIFY(self);
  96
  97     NSArray<NSData*>* publicSigningSPKIs = nil;
  98     if(self.operationDependencies.sosAdapter.sosEnabled) {
  99         NSError* sosPreapprovalError = nil;
 100         publicSigningSPKIs = [OTSOSAdapterHelpers peerPublicSigningKeySPKIsForCircle:self.operationDependencies.sosAdapter error:&sosPreapprovalError];
 101
 102         if(publicSigningSPKIs) {
 103             secnotice("octagon-sos", "SOS preapproved keys are %@", publicSigningSPKIs);
 104         } else {
 105             secnotice("octagon-sos", "Unable to fetch SOS preapproved keys: %@", sosPreapprovalError);
 106         }
 107
 108     } else {
 109         secnotice("octagon-sos", "SOS not enabled; no preapproved keys");
 110     }
 111
 112     NSError* persistError = nil;
 113     BOOL persisted = [self.operationDependencies.stateHolder persistOctagonJoinAttempt:OTAccountMetadataClassC_AttemptedAJoinState_ATTEMPTED error:&persistError];
 114     if(!persisted || persistError) {
 115         secerror("octagon: failed to save 'attempted join' state: %@", persistError);
 116     }
 117
 118     secnotice("octagon-ckks", "Beginning establish with keys: %@", viewKeySets);
 119     [self.operationDependencies.cuttlefishXPCWrapper establishWithContainer:self.operationDependencies.containerName
 120                                                                     context:self.operationDependencies.contextID
 121                                                                    ckksKeys:viewKeySets
 122                                                                   tlkShares:pendingTLKShares
 123                                                             preapprovedKeys:publicSigningSPKIs
 124                                                                       reply:^(NSString * _Nullable peerID,
 125                                                                               NSArray<CKRecord*>* _Nullable keyHierarchyRecords,
 126                                                                               TPSyncingPolicy* _Nullable syncingPolicy,
 127                                                                               NSError * _Nullable error) {
 128             STRONGIFY(self);
 129
 130             [[CKKSAnalytics logger] logResultForEvent:OctagonEventEstablishIdentity hardFailure:true result:error];
 131             if(error) {
 132                 secerror("octagon: Error calling establish: %@", error);
 133
 134                 if ([error isCuttlefishError:CuttlefishErrorKeyHierarchyAlreadyExists]) {
 135                     secnotice("octagon-ckks", "A CKKS key hierarchy is out of date; moving to '%@'", self.ckksConflictState);
 136                     self.nextState = self.ckksConflictState;
 137                 } else {
 138                     self.error = error;
 139                 }
 140                 [self runBeforeGroupFinished:self.finishedOp];
 141                 return;
 142             }
 143
 144             self.peerID = peerID;
 145
 146             NSError* localError = nil;
 147             BOOL persisted = [self.operationDependencies.stateHolder persistAccountChanges:^OTAccountMetadataClassC * _Nonnull(OTAccountMetadataClassC * _Nonnull metadata) {
 148                 metadata.trustState = OTAccountMetadataClassC_TrustState_TRUSTED;
 149                 metadata.peerID = peerID;
 150                 [metadata setTPSyncingPolicy:syncingPolicy];
 151                 return metadata;
 152             } error:&localError];
 153
 154             if(!persisted || localError) {
 155                 secnotice("octagon", "Couldn't persist results: %@", localError);
 156                 self.error = localError;
 157             } else {
 158                 self.nextState = self.intendedState;
 159             }
 160
 161             [self.operationDependencies.viewManager setCurrentSyncingPolicy:syncingPolicy];
 162
 163             // Tell CKKS about our shiny new records!
 164             for (id key in self.operationDependencies.viewManager.views) {
 165                 CKKSKeychainView* view = self.operationDependencies.viewManager.views[key];
 166                 secnotice("octagon-ckks", "Providing records to %@", view);
 167                 [view receiveTLKUploadRecords: keyHierarchyRecords];
 168             }
 169             [self runBeforeGroupFinished:self.finishedOp];
 170         }];
 171 }
 172
 173 @end
 174
 175 #endif // OCTAGON