keychain/ot/OTStates.h

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #if OCTAGON
  25
  26 #import <Foundation/Foundation.h>
  27 #import "keychain/ckks/CKKSResultOperation.h"
  28 #import "keychain/ot/OctagonStateMachineHelpers.h"
  29
  30 NS_ASSUME_NONNULL_BEGIN
  31
  32 // Two 'bad states':
  33 //   No iCloud Account (the state machine won't help at all)
  34 //   Untrusted (user interaction is required to resolve)
  35 //   WaitForHSA2 (there's some primary icloud account, but it's not HSA2 (yet))
  36 //   WaitForCDP (there's some HSA2 primary icloud account, but it's not CDP-enabled (yet)
  37 extern OctagonState* const OctagonStateNoAccount;
  38 extern OctagonState* const OctagonStateUntrusted;
  39 extern OctagonState* const OctagonStateWaitForHSA2;
  40 extern OctagonState* const OctagonStateWaitForCDP;
  41
  42 // Entering this state will mark down that the device is untrusted, then go to OctagonStateUntrusted
  43 extern OctagonState* const OctagonStateBecomeUntrusted;
  44
  45 // WaitForUnlock indicates that Octagon is waiting for the device to unlock before attempting the pended operation
  46 extern OctagonState* const OctagonStateWaitForUnlock;
  47
  48 // 'ready' indicates that this machine believes it is trusted by its peers
  49 // and has no pending things to do.
  50 extern OctagonState* const OctagonStateReady;
  51
  52 // This state runs any final preparation to enter the Ready state
  53 extern OctagonState* const OctagonStateBecomeReady;
  54
  55 // BecomeReady might go here, if it's not actually ready
  56 extern OctagonState* const OctagonStateRefetchCKKSPolicy;
  57
  58 // Enter this state if you'd like the state machine to double-check everything
  59 extern OctagonState* const OctagonStateEnsureConsistency;
  60 extern OctagonState* const OctagonStateEnsureOctagonKeysAreConsistent;
  61 extern OctagonState* const OctagonStateEnsureUpdatePreapprovals;
  62
  63 // The boot-up sequence looks as follows:
  64 extern OctagonState* const OctagonStateInitializing;
  65 extern OctagonState* const OctagonStateWaitingForCloudKitAccount;
  66 extern OctagonState* const OctagonStateCloudKitNewlyAvailable;
  67 extern OctagonState* const OctagonStateDetermineCDPState;
  68 extern OctagonState* const OctagonStateCheckTrustState;
  69
  70 /*Piggybacking and ProximitySetup as Initiator, Octagon only*/
  71 extern OctagonState* const OctagonStateInitiatorAwaitingVoucher;
  72
  73 extern OctagonState* const OctagonStateInitiatorSetCDPBit;
  74 extern OctagonState* const OctagonStateInitiatorUpdateDeviceList;
  75 extern OctagonState* const OctagonStateInitiatorJoin;
  76 extern OctagonState* const OctagonStateInitiatorJoinCKKSReset;
  77 extern OctagonState* const OctagonStateInitiatorJoinAfterCKKSReset;
  78
  79 extern OctagonState* const OctagonStateBottleJoinVouchWithBottle;
  80 extern OctagonState* const OctagonStateIdentityPrepared;
  81 // OctagonStateIdentityPrepared leads directly to
  82 extern OctagonState* const OctagonStateDeviceListUpdated;
  83
  84 /* used for join with bottle */
  85 extern OctagonState* const OctagonStateBottleJoinCreateIdentity;
  86
  87 /* used for join with recovery key */
  88 extern OctagonState* const OctagonStateCreateIdentityForRecoveryKey;
  89
  90 /* used for join with recovery key*/
  91 extern OctagonState* const OctagonStateVouchWithRecoveryKey;
  92
  93 // State flow when performing a full account reset
  94 extern OctagonState* const OctagonStateResetBecomeUntrusted;
  95 extern OctagonState* const OctagonStateResetAndEstablish;
  96 extern OctagonState* const OctagonStateResetAnyMissingTLKCKKSViews;
  97 extern OctagonState* const OctagonStateEstablishEnableCDPBit;
  98 extern OctagonState* const OctagonStateReEnactDeviceList;
  99 extern OctagonState* const OctagonStateReEnactPrepare;
 100 extern OctagonState* const OctagonStateReEnactReadyToEstablish;
 101 // this last state might loop through:
 102 extern OctagonState* const OctagonStateEstablishCKKSReset;
 103 extern OctagonState* const OctagonStateEstablishAfterCKKSReset;
 104
 105 /* used for trust health checks */
 106 extern OctagonState* const OctagonStateHSA2HealthCheck;
 107 extern OctagonState* const OctagonStateCDPHealthCheck;
 108 extern OctagonState* const OctagonStateSecurityTrustCheck;
 109 extern OctagonState* const OctagonStateTPHTrustCheck;
 110 extern OctagonState* const OctagonStateCuttlefishTrustCheck;
 111 extern OctagonState* const OctagonStatePostRepairCFU;
 112 extern OctagonState* const OctagonStateHealthCheckReset;
 113
 114 // End of account reset state flow
 115
 116 //Leave Clique
 117 extern OctagonState* const OctagonStateHealthCheckLeaveClique;
 118
 119 // Part of the signout flow
 120 extern OctagonState* const OctagonStateNoAccountDoReset;
 121 //
 122
 123 // escrow
 124 extern OctagonState* const OctagonStateEscrowTriggerUpdate;
 125
 126 // Enter this state to perform an SOS peer update, and return to ready.
 127 extern OctagonState* const OctagonStateUpdateSOSPreapprovals;
 128
 129 extern OctagonState* const OctagonStateError;
 130 extern OctagonState* const OctagonStateDisabled;
 131
 132 extern OctagonState* const OctagonStateAttemptSOSUpgrade;
 133 extern OctagonState* const OctagonStateSOSUpgradeCKKSReset;
 134 extern OctagonState* const OctagonStateSOSUpgradeAfterCKKSReset;
 135
 136 extern OctagonState* const OctagonStateDetermineiCloudAccountState;
 137
 138 // CKKS sometimes needs an assist. These states are supposed to handle those cases
 139 extern OctagonState* const OctagonStateAssistCKKSTLKUpload;
 140 extern OctagonState* const OctagonStateAssistCKKSTLKUploadCKKSReset;
 141 extern OctagonState* const OctagonStateAssistCKKSTLKUploadAfterCKKSReset;
 142
 143 // Call out to otpaird (KCPairing via IDS), then proceed to BecomeUntrusted
 144 extern OctagonState* const OctagonStateStartCompanionPairing;
 145
 146 // Cuttlefish notification while waiting for CDP
 147 extern OctagonState* const OctagonStateWaitForCDPUpdated;
 148
 149 // Untrusted cuttlefish notification.
 150 extern OctagonState* const OctagonStateUntrustedUpdated;
 151
 152 // Cuttlefish notifiation while ready.
 153 extern OctagonState* const OctagonStateReadyUpdated;
 154
 155 extern OctagonState* const OctagonStateUnimplemented;
 156
 157 NSDictionary<OctagonState*, NSNumber*>* OctagonStateMap(void);
 158 NSDictionary<NSNumber*, OctagonState*>* OctagonStateInverseMap(void);
 159
 160 // Unfortunately, this set contains the 'wait for hsa2' state, which means that many
 161 // of our state machine RPCs will work in the SA case.
 162 // <rdar://problem/54094162> Octagon: ensure Octagon operations can't occur on SA accounts
 163 NSSet<OctagonState*>* OctagonInAccountStates(void);
 164 NSSet<OctagonState *>* OctagonHealthSourceStates(void);
 165 NSSet<OctagonFlag *>* AllOctagonFlags(void);
 166
 167 ////// State machine flags
 168 extern OctagonFlag* const OctagonFlagIDMSLevelChanged;
 169
 170 extern OctagonFlag* const OctagonFlagEgoPeerPreapproved;
 171
 172 extern OctagonFlag* const OctagonFlagCKKSRequestsTLKUpload;
 173
 174 // We've received a change notification from cuttlefish; we should probably see what's new
 175 extern OctagonFlag* const OctagonFlagCuttlefishNotification NS_SWIFT_NAME(OctagonFlagCuttlefishNotification);
 176
 177
 178 extern OctagonFlag* const OctagonFlagFetchAuthKitMachineIDList;
 179
 180 extern OctagonFlag* const OctagonFlagAccountIsAvailable;
 181 extern OctagonFlag* const OctagonFlagCDPEnabled;
 182
 183 extern OctagonFlag* const OctagonFlagAttemptSOSUpgrade;
 184 extern OctagonFlag* const OctagonFlagUnlocked;
 185
 186 extern OctagonFlag* const OctagonFlagAttemptSOSUpdatePreapprovals;
 187 extern OctagonFlag* const OctagonFlagAttemptSOSConsistency;
 188
 189 extern OctagonFlag* const OctagonFlagEscrowRequestInformCloudServicesOperation;
 190
 191
 192 NS_ASSUME_NONNULL_END
 193
 194 #endif // OCTAGON