]> git.saurik.com Git - apple/security.git/blob - keychain/ot/OTEstablishOperation.m
Security-59306.101.1.tar.gz
[apple/security.git] / keychain / ot / OTEstablishOperation.m
1 /*
2 * Copyright (c) 2018 Apple Inc. All Rights Reserved.
3 *
4 * @APPLE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
11 * file.
12 *
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
20 *
21 * @APPLE_LICENSE_HEADER_END@
22 */
23
24 #if OCTAGON
25
26 #import <utilities/debugging.h>
27
28 #import "keychain/ot/OTEstablishOperation.h"
29 #import "keychain/ot/OTCuttlefishAccountStateHolder.h"
30 #import "keychain/ot/OTFetchCKKSKeysOperation.h"
31 #import "keychain/ckks/CloudKitCategories.h"
32 #import "keychain/ckks/CKKSCurrentKeyPointer.h"
33 #import "keychain/ckks/CKKSKeychainView.h"
34 #import "keychain/SecureObjectSync/SOSAccount.h"
35
36 #import "keychain/TrustedPeersHelper/TrustedPeersHelperProtocol.h"
37 #import "keychain/ot/ObjCImprovements.h"
38
39 @interface OTEstablishOperation ()
40 @property OTOperationDependencies* operationDependencies;
41
42 @property OctagonState* ckksConflictState;
43
44 @property NSOperation* finishedOp;
45 @end
46
47 @implementation OTEstablishOperation
48 @synthesize intendedState = _intendedState;
49
50 - (instancetype)initWithDependencies:(OTOperationDependencies*)dependencies
51 intendedState:(OctagonState*)intendedState
52 ckksConflictState:(OctagonState*)ckksConflictState
53 errorState:(OctagonState*)errorState
54 {
55 if((self = [super init])) {
56 _operationDependencies = dependencies;
57
58 _intendedState = intendedState;
59 _nextState = errorState;
60 _ckksConflictState = ckksConflictState;
61 }
62 return self;
63 }
64
65 - (void)groupStart
66 {
67 secnotice("octagon", "Beginning an establish operation");
68
69 WEAKIFY(self);
70
71 self.finishedOp = [NSBlockOperation blockOperationWithBlock:^{
72 STRONGIFY(self);
73 secnotice("octagon", "Finishing an establish operation with %@", self.error ?: @"no error");
74 }];
75 [self dependOnBeforeGroupFinished:self.finishedOp];
76
77 // First, interrogate CKKS views, and see when they have a TLK proposal.
78 OTFetchCKKSKeysOperation* fetchKeysOp = [[OTFetchCKKSKeysOperation alloc] initWithDependencies:self.operationDependencies];
79 [self runBeforeGroupFinished:fetchKeysOp];
80
81 CKKSResultOperation* proceedWithKeys = [CKKSResultOperation named:@"establish-with-keys"
82 withBlock:^{
83 STRONGIFY(self);
84 [self proceedWithKeys:fetchKeysOp.viewKeySets
85 pendingTLKShares:fetchKeysOp.pendingTLKShares];
86 }];
87
88 [proceedWithKeys addDependency:fetchKeysOp];
89 [self runBeforeGroupFinished:proceedWithKeys];
90 }
91
92 - (void)proceedWithKeys:(NSArray<CKKSKeychainBackedKeySet*>*)viewKeySets pendingTLKShares:(NSArray<CKKSTLKShare*>*)pendingTLKShares
93 {
94 WEAKIFY(self);
95
96 NSArray<NSData*>* publicSigningSPKIs = nil;
97 if(self.operationDependencies.sosAdapter.sosEnabled) {
98 NSError* sosPreapprovalError = nil;
99 publicSigningSPKIs = [OTSOSAdapterHelpers peerPublicSigningKeySPKIsForCircle:self.operationDependencies.sosAdapter error:&sosPreapprovalError];
100
101 if(publicSigningSPKIs) {
102 secnotice("octagon-sos", "SOS preapproved keys are %@", publicSigningSPKIs);
103 } else {
104 secnotice("octagon-sos", "Unable to fetch SOS preapproved keys: %@", sosPreapprovalError);
105 }
106
107 } else {
108 secnotice("octagon-sos", "SOS not enabled; no preapproved keys");
109 }
110
111 NSError* persistError = nil;
112 BOOL persisted = [self.operationDependencies.stateHolder persistOctagonJoinAttempt:OTAccountMetadataClassC_AttemptedAJoinState_ATTEMPTED error:&persistError];
113 if(!persisted || persistError) {
114 secerror("octagon: failed to save 'attempted join' state: %@", persistError);
115 }
116
117 secnotice("octagon-ckks", "Beginning establish with keys: %@", viewKeySets);
118 [self.operationDependencies.cuttlefishXPCWrapper establishWithContainer:self.operationDependencies.containerName
119 context:self.operationDependencies.contextID
120 ckksKeys:viewKeySets
121 tlkShares:pendingTLKShares
122 preapprovedKeys:publicSigningSPKIs
123 reply:^(NSString * _Nullable peerID, NSArray<CKRecord*>* _Nullable keyHierarchyRecords, NSError * _Nullable error) {
124 STRONGIFY(self);
125
126 [[CKKSAnalytics logger] logResultForEvent:OctagonEventEstablishIdentity hardFailure:true result:error];
127 if(error) {
128 secerror("octagon: Error calling establish: %@", error);
129
130 if ([error isCuttlefishError:CuttlefishErrorKeyHierarchyAlreadyExists]) {
131 secnotice("octagon-ckks", "A CKKS key hierarchy is out of date; moving to '%@'", self.ckksConflictState);
132 self.nextState = self.ckksConflictState;
133 } else {
134 self.error = error;
135 }
136 [self runBeforeGroupFinished:self.finishedOp];
137 return;
138 }
139
140 self.peerID = peerID;
141
142 NSError* localError = nil;
143 BOOL persisted = [self.operationDependencies.stateHolder persistAccountChanges:^OTAccountMetadataClassC * _Nonnull(OTAccountMetadataClassC * _Nonnull metadata) {
144 metadata.trustState = OTAccountMetadataClassC_TrustState_TRUSTED;
145 metadata.peerID = peerID;
146 return metadata;
147 } error:&localError];
148 if(!persisted || localError) {
149 secnotice("octagon", "Couldn't persist results: %@", localError);
150 self.error = localError;
151 } else {
152 self.nextState = self.intendedState;
153 }
154
155 // Tell CKKS about our shiny new records!
156 for (id key in self.operationDependencies.viewManager.views) {
157 CKKSKeychainView* view = self.operationDependencies.viewManager.views[key];
158 secnotice("octagon-ckks", "Providing records to %@", view);
159 [view receiveTLKUploadRecords: keyHierarchyRecords];
160 }
161 [self runBeforeGroupFinished:self.finishedOp];
162 }];
163 }
164
165 @end
166
167 #endif // OCTAGON