keychain/ot/OTJoinWithVoucherOperation.m

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #if OCTAGON
  25
  26 #import <utilities/debugging.h>
  27
  28 #import <CloudKit/CloudKit_Private.h>
  29
  30 #import "keychain/ot/OTJoinWithVoucherOperation.h"
  31 #import "keychain/ot/OTOperationDependencies.h"
  32 #import "keychain/ot/OTFetchCKKSKeysOperation.h"
  33 #import "keychain/ckks/CKKSNearFutureScheduler.h"
  34 #import "keychain/ckks/CloudKitCategories.h"
  35
  36 #import "keychain/TrustedPeersHelper/TrustedPeersHelperProtocol.h"
  37 #import "keychain/ot/ObjCImprovements.h"
  38 #import "keychain/ot/OTStates.h"
  39
  40 @interface OTJoinWithVoucherOperation ()
  41 @property OTOperationDependencies* deps;
  42
  43 @property OctagonState* ckksConflictState;
  44
  45 @property NSOperation* finishedOp;
  46 @end
  47
  48 @implementation OTJoinWithVoucherOperation
  49
  50 @synthesize intendedState = _intendedState;
  51
  52 - (instancetype)initWithDependencies:(OTOperationDependencies*)dependencies
  53                        intendedState:(OctagonState*)intendedState
  54                    ckksConflictState:(OctagonState*)ckksConflictState
  55                           errorState:(OctagonState*)errorState
  56                          voucherData:(NSData*)voucherData
  57                           voucherSig:(NSData*)voucherSig
  58 {
  59     if((self = [super init])) {
  60         _deps = dependencies;
  61
  62         _intendedState = intendedState;
  63         _nextState = errorState;
  64         _ckksConflictState = ckksConflictState;
  65
  66         _voucherData = voucherData;
  67         _voucherSig = voucherSig;
  68     }
  69     return self;
  70 }
  71
  72 - (void)groupStart
  73 {
  74     secnotice("octagon", "joining");
  75
  76     self.finishedOp = [[NSOperation alloc] init];
  77     [self dependOnBeforeGroupFinished:self.finishedOp];
  78
  79     WEAKIFY(self);
  80
  81     OTFetchCKKSKeysOperation* fetchKeysOp = [[OTFetchCKKSKeysOperation alloc] initWithDependencies:self.deps];
  82     [self runBeforeGroupFinished:fetchKeysOp];
  83
  84     CKKSResultOperation* proceedWithKeys = [CKKSResultOperation named:@"vouch-with-keys"
  85                                                             withBlock:^{
  86                                                                 STRONGIFY(self);
  87                                                                 [self proceedWithKeys:fetchKeysOp.viewKeySets
  88                                                                      pendingTLKShares:fetchKeysOp.pendingTLKShares];
  89                                                             }];
  90
  91     [proceedWithKeys addDependency:fetchKeysOp];
  92     [self runBeforeGroupFinished:proceedWithKeys];
  93 }
  94
  95 - (void)proceedWithKeys:(NSArray<CKKSKeychainBackedKeySet*>*)viewKeySets pendingTLKShares:(NSArray<CKKSTLKShare*>*)pendingTLKShares
  96 {
  97     WEAKIFY(self);
  98
  99     NSArray<NSData*>* publicSigningSPKIs = nil;
 100     if(self.deps.sosAdapter.sosEnabled) {
 101         NSError* sosPreapprovalError = nil;
 102         publicSigningSPKIs = [OTSOSAdapterHelpers peerPublicSigningKeySPKIsForCircle:self.deps.sosAdapter error:&sosPreapprovalError];
 103
 104         if(publicSigningSPKIs) {
 105             secnotice("octagon-sos", "SOS preapproved keys are %@", publicSigningSPKIs);
 106         } else {
 107             secnotice("octagon-sos", "Unable to fetch SOS preapproved keys: %@", sosPreapprovalError);
 108         }
 109
 110     } else {
 111         secnotice("octagon-sos", "SOS not enabled; no preapproved keys");
 112     }
 113
 114     [self.deps.cuttlefishXPCWrapper joinWithContainer:self.deps.containerName
 115                                               context:self.deps.contextID
 116                                           voucherData:self.voucherData
 117                                            voucherSig:self.voucherSig
 118                                              ckksKeys:viewKeySets
 119                                             tlkShares:pendingTLKShares
 120                                       preapprovedKeys:publicSigningSPKIs
 121                                                 reply:^(NSString * _Nullable peerID,
 122                                                         NSArray<CKRecord*>* keyHierarchyRecords,
 123                                                         NSSet<NSString*>* _Nullable syncingViews,
 124                                                         TPPolicy* _Nullable syncingPolicy,
 125                                                         NSError * _Nullable error) {
 126             STRONGIFY(self);
 127             if(error){
 128                 secerror("octagon: Error joining with voucher: %@", error);
 129                 [[CKKSAnalytics logger] logRecoverableError:error forEvent:OctagonEventJoinWithVoucher withAttributes:NULL];
 130
 131                 // IF this is a CKKS conflict error, don't retry
 132                 if ([error isCuttlefishError:CuttlefishErrorKeyHierarchyAlreadyExists]) {
 133                     secnotice("octagon-ckks", "A CKKS key hierarchy is out of date; going to state '%@'", self.ckksConflictState);
 134                     self.nextState = self.ckksConflictState;
 135                 } else if ([error isCuttlefishError:CuttlefishErrorResultGraphNotFullyReachable]) {
 136                     secnotice("octagon", "requesting cuttlefish health check");
 137                     self.nextState = OctagonStateCuttlefishTrustCheck;
 138                     self.error = error;
 139                 } else {
 140                     self.error = error;
 141                 }
 142             } else {
 143                 self.peerID = peerID;
 144
 145                 [[CKKSAnalytics logger] logSuccessForEventNamed:OctagonEventJoinWithVoucher];
 146
 147                 [self.deps.viewManager setSyncingViews:syncingViews sortingPolicy:syncingPolicy];
 148
 149                 NSError* localError = nil;
 150                 BOOL persisted = [self.deps.stateHolder persistAccountChanges:^OTAccountMetadataClassC * _Nonnull(OTAccountMetadataClassC * _Nonnull metadata) {
 151                     metadata.trustState = OTAccountMetadataClassC_TrustState_TRUSTED;
 152                     metadata.peerID = peerID;
 153                     metadata.syncingViews = [syncingViews mutableCopy];
 154                     [metadata setTPPolicy:syncingPolicy];
 155                     return metadata;
 156                 } error:&localError];
 157                 if(!persisted || localError) {
 158                     secnotice("octagon", "Couldn't persist results: %@", localError);
 159                     self.error = localError;
 160                 } else {
 161                     secerror("octagon: join successful");
 162                     self.nextState = self.intendedState;
 163                 }
 164
 165                 // Tell CKKS about our shiny new records!
 166                 for (id key in self.deps.viewManager.views) {
 167                     CKKSKeychainView* view = self.deps.viewManager.views[key];
 168                     secnotice("octagon-ckks", "Providing join() records to %@", view);
 169                     [view receiveTLKUploadRecords: keyHierarchyRecords];
 170                 }
 171             }
 172             [self runBeforeGroupFinished:self.finishedOp];
 173         }];
 174 }
 175
 176 @end
 177
 178 #endif // OCTAGON