keychain/ot/OTEstablishOperation.m

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #if OCTAGON
  25
  26 #import <utilities/debugging.h>
  27
  28 #import "keychain/ot/OTEstablishOperation.h"
  29 #import "keychain/ot/OTCuttlefishAccountStateHolder.h"
  30 #import "keychain/ot/OTFetchCKKSKeysOperation.h"
  31 #import "keychain/ckks/CloudKitCategories.h"
  32 #import "keychain/ckks/CKKSCurrentKeyPointer.h"
  33 #import "keychain/ckks/CKKSKeychainView.h"
  34 #import "keychain/SecureObjectSync/SOSAccount.h"
  35
  36 #import "keychain/TrustedPeersHelper/TrustedPeersHelperProtocol.h"
  37 #import "keychain/ot/ObjCImprovements.h"
  38
  39 @interface OTEstablishOperation ()
  40 @property OTOperationDependencies* operationDependencies;
  41
  42 @property OctagonState* ckksConflictState;
  43
  44 @property NSOperation* finishedOp;
  45 @end
  46
  47 @implementation OTEstablishOperation
  48 @synthesize intendedState = _intendedState;
  49
  50 - (instancetype)initWithDependencies:(OTOperationDependencies*)dependencies
  51                        intendedState:(OctagonState*)intendedState
  52                    ckksConflictState:(OctagonState*)ckksConflictState
  53                           errorState:(OctagonState*)errorState
  54 {
  55     if((self = [super init])) {
  56         _operationDependencies = dependencies;
  57
  58         _intendedState = intendedState;
  59         _nextState = errorState;
  60         _ckksConflictState = ckksConflictState;
  61     }
  62     return self;
  63 }
  64
  65 - (void)groupStart
  66 {
  67     secnotice("octagon", "Beginning an establish operation");
  68
  69     WEAKIFY(self);
  70
  71     self.finishedOp = [NSBlockOperation blockOperationWithBlock:^{
  72         STRONGIFY(self);
  73         secnotice("octagon", "Finishing an establish operation with %@", self.error ?: @"no error");
  74     }];
  75     [self dependOnBeforeGroupFinished:self.finishedOp];
  76
  77     // First, interrogate CKKS views, and see when they have a TLK proposal.
  78     OTFetchCKKSKeysOperation* fetchKeysOp = [[OTFetchCKKSKeysOperation alloc] initWithDependencies:self.operationDependencies];
  79     [self runBeforeGroupFinished:fetchKeysOp];
  80
  81     CKKSResultOperation* proceedWithKeys = [CKKSResultOperation named:@"establish-with-keys"
  82                                                             withBlock:^{
  83                                                                 STRONGIFY(self);
  84                                                                 [self proceedWithKeys:fetchKeysOp.viewKeySets
  85                                                                      pendingTLKShares:fetchKeysOp.pendingTLKShares];
  86                                                             }];
  87
  88     [proceedWithKeys addDependency:fetchKeysOp];
  89     [self runBeforeGroupFinished:proceedWithKeys];
  90 }
  91
  92 - (void)proceedWithKeys:(NSArray<CKKSKeychainBackedKeySet*>*)viewKeySets pendingTLKShares:(NSArray<CKKSTLKShare*>*)pendingTLKShares
  93 {
  94     WEAKIFY(self);
  95
  96     NSArray<NSData*>* publicSigningSPKIs = nil;
  97     if(self.operationDependencies.sosAdapter.sosEnabled) {
  98         NSError* sosPreapprovalError = nil;
  99         publicSigningSPKIs = [OTSOSAdapterHelpers peerPublicSigningKeySPKIsForCircle:self.operationDependencies.sosAdapter error:&sosPreapprovalError];
 100
 101         if(publicSigningSPKIs) {
 102             secnotice("octagon-sos", "SOS preapproved keys are %@", publicSigningSPKIs);
 103         } else {
 104             secnotice("octagon-sos", "Unable to fetch SOS preapproved keys: %@", sosPreapprovalError);
 105         }
 106
 107     } else {
 108         secnotice("octagon-sos", "SOS not enabled; no preapproved keys");
 109     }
 110
 111     NSError* persistError = nil;
 112     BOOL persisted = [self.operationDependencies.stateHolder persistOctagonJoinAttempt:OTAccountMetadataClassC_AttemptedAJoinState_ATTEMPTED error:&persistError];
 113     if(!persisted || persistError) {
 114         secerror("octagon: failed to save 'attempted join' state: %@", persistError);
 115     }
 116
 117     secnotice("octagon-ckks", "Beginning establish with keys: %@", viewKeySets);
 118     [self.operationDependencies.cuttlefishXPCWrapper establishWithContainer:self.operationDependencies.containerName
 119                                                                     context:self.operationDependencies.contextID
 120                                                                    ckksKeys:viewKeySets
 121                                                                   tlkShares:pendingTLKShares
 122                                                             preapprovedKeys:publicSigningSPKIs
 123                                                                       reply:^(NSString * _Nullable peerID, NSArray<CKRecord*>* _Nullable keyHierarchyRecords, NSError * _Nullable error) {
 124             STRONGIFY(self);
 125
 126             [[CKKSAnalytics logger] logResultForEvent:OctagonEventEstablishIdentity hardFailure:true result:error];
 127             if(error) {
 128                 secerror("octagon: Error calling establish: %@", error);
 129
 130                 if ([error isCuttlefishError:CuttlefishErrorKeyHierarchyAlreadyExists]) {
 131                     secnotice("octagon-ckks", "A CKKS key hierarchy is out of date; moving to '%@'", self.ckksConflictState);
 132                     self.nextState = self.ckksConflictState;
 133                 } else {
 134                     self.error = error;
 135                 }
 136                 [self runBeforeGroupFinished:self.finishedOp];
 137                 return;
 138             }
 139
 140             self.peerID = peerID;
 141
 142             NSError* localError = nil;
 143             BOOL persisted = [self.operationDependencies.stateHolder persistAccountChanges:^OTAccountMetadataClassC * _Nonnull(OTAccountMetadataClassC * _Nonnull metadata) {
 144                     metadata.trustState = OTAccountMetadataClassC_TrustState_TRUSTED;
 145                     metadata.peerID = peerID;
 146                     return metadata;
 147                 } error:&localError];
 148             if(!persisted || localError) {
 149                 secnotice("octagon", "Couldn't persist results: %@", localError);
 150                 self.error = localError;
 151             } else {
 152                 self.nextState = self.intendedState;
 153             }
 154
 155             // Tell CKKS about our shiny new records!
 156             for (id key in self.operationDependencies.viewManager.views) {
 157                 CKKSKeychainView* view = self.operationDependencies.viewManager.views[key];
 158                 secnotice("octagon-ckks", "Providing records to %@", view);
 159                 [view receiveTLKUploadRecords: keyHierarchyRecords];
 160             }
 161             [self runBeforeGroupFinished:self.finishedOp];
 162         }];
 163 }
 164
 165 @end
 166
 167 #endif // OCTAGON