keychain/ot/OTUpdateTPHOperation.m

   1
   2 #if OCTAGON
   3
   4 #import "keychain/TrustedPeersHelper/TrustedPeersHelperProtocol.h"
   5 #import "keychain/ot/categories/OTAccountMetadataClassC+KeychainSupport.h"
   6
   7 #import <CloudKit/CloudKit_Private.h>
   8
   9 #import "keychain/ckks/CloudKitCategories.h"
  10
  11 #import "keychain/ot/ObjCImprovements.h"
  12
  13 #import "keychain/ot/OTCuttlefishAccountStateHolder.h"
  14 #import "keychain/ot/OTOperationDependencies.h"
  15 #import "keychain/ot/OTStates.h"
  16 #import "keychain/ot/OTUpdateTPHOperation.h"
  17
  18 @interface OTUpdateTPHOperation ()
  19 @property OTOperationDependencies* deps;
  20
  21 @property OctagonState* peerUnknownState;
  22
  23 @property NSOperation* finishedOp;
  24
  25 @property (nullable) OctagonFlag* retryFlag;
  26 @end
  27
  28 @implementation OTUpdateTPHOperation
  29 @synthesize nextState = _nextState;
  30 @synthesize intendedState = _intendedState;
  31
  32 - (instancetype)initWithDependencies:(OTOperationDependencies*)dependencies
  33                        intendedState:(OctagonState*)intendedState
  34                     peerUnknownState:(OctagonState*)peerUnknownState
  35                           errorState:(OctagonState*)errorState
  36                            retryFlag:(OctagonFlag* _Nullable)retryFlag
  37 {
  38     if((self = [super init])) {
  39         _deps = dependencies;
  40
  41         _intendedState = intendedState;
  42         _nextState = errorState;
  43         _peerUnknownState = peerUnknownState;
  44
  45         _retryFlag = retryFlag;
  46     }
  47     return self;
  48 }
  49
  50 - (void)groupStart
  51 {
  52     WEAKIFY(self);
  53     self.finishedOp = [NSBlockOperation blockOperationWithBlock:^{
  54         // If we errored in some unknown way, ask to try again!
  55         STRONGIFY(self);
  56
  57         if(self.error) {
  58             if(self.retryFlag == nil) {
  59                 secerror("octagon: Received an error updating TPH, but no retry flag present.");
  60                 return;
  61             }
  62
  63             // Is this a very scary error?
  64             bool fatal = true;
  65
  66             OctagonPendingFlag* pendingFlag = nil;
  67
  68             if([self.deps.lockStateTracker isLockedError:self.error]) {
  69                 secnotice("octagon", "Updating trust state failed because locked, retry once unlocked: %@", self.error);
  70                 self.nextState = OctagonStateWaitForUnlock;
  71                 pendingFlag = [[OctagonPendingFlag alloc] initWithFlag:self.retryFlag
  72                                                             conditions:OctagonPendingConditionsDeviceUnlocked];
  73                 fatal = false;
  74             } else {
  75                 // more CloudKit errors should trigger a retry here
  76                 secnotice("octagon", "Error is currently unknown, aborting: %@", self.error);
  77             }
  78
  79             if(!fatal) {
  80                 if(!pendingFlag) {
  81                     NSTimeInterval baseDelay = SecCKKSTestsEnabled() ? 2 : 30;
  82                     NSTimeInterval ckDelay = CKRetryAfterSecondsForError(self.error);
  83                     NSTimeInterval cuttlefishDelay = [self.error cuttlefishRetryAfter];
  84                     NSTimeInterval delay = MAX(ckDelay, cuttlefishDelay);
  85                     if (delay == 0) {
  86                         delay = baseDelay;
  87                     }
  88
  89                     pendingFlag = [[OctagonPendingFlag alloc] initWithFlag:self.retryFlag
  90                                                             delayInSeconds:delay];
  91                 }
  92                 secnotice("octagon", "Updating trust state no fatal: requesting retry: %@",
  93                           pendingFlag);
  94                 [self.deps.flagHandler handlePendingFlag:pendingFlag];
  95             }
  96         }
  97     }];
  98     [self dependOnBeforeGroupFinished:self.finishedOp];
  99
 100
 101     [self.deps.cuttlefishXPCWrapper updateWithContainer:self.deps.containerName
 102                                                 context:self.deps.contextID
 103                                              deviceName:self.deps.deviceInformationAdapter.deviceName
 104                                            serialNumber:self.deps.deviceInformationAdapter.serialNumber
 105                                               osVersion:self.deps.deviceInformationAdapter.osVersion
 106                                           policyVersion:nil
 107                                           policySecrets:nil
 108                                                   reply:^(TrustedPeersHelperPeerState* peerState, NSError* error) {
 109             STRONGIFY(self);
 110             if(error || !peerState) {
 111                 secerror("octagon: update errored: %@", error);
 112                 self.error = error;
 113
 114                 // On an error, for now, go back to the intended state
 115                 // <rdar://problem/50190005> Octagon: handle lock state errors in update()
 116                 self.nextState = self.intendedState;
 117                 [self runBeforeGroupFinished:self.finishedOp];
 118                 return;
 119             }
 120
 121             secnotice("octagon", "update complete: %@", peerState);
 122
 123             if(peerState.identityIsPreapproved) {
 124                 secnotice("octagon-sos", "Self peer is now preapproved!");
 125                 [self.deps.flagHandler handleFlag:OctagonFlagEgoPeerPreapproved];
 126             }
 127             if (peerState.memberChanges) {
 128                 secnotice("octagon", "Member list changed");
 129                 [self.deps.octagonAdapter sendTrustedPeerSetChangedUpdate];
 130             }
 131
 132             if (peerState.unknownMachineIDsPresent) {
 133                 secnotice("octagon-authkit", "Unknown machine IDs are present; requesting fetch");
 134                 [self.deps.flagHandler handleFlag:OctagonFlagFetchAuthKitMachineIDList];
 135             }
 136
 137             if(peerState.peerStatus & TPPeerStatusExcluded) {
 138                 secnotice("octagon", "Self peer (%@) is excluded; moving to untrusted", peerState.peerID);
 139                 self.nextState = OctagonStateBecomeUntrusted;
 140
 141             } else if(peerState.peerStatus & TPPeerStatusUnknown) {
 142                 secnotice("octagon", "Self peer (%@) is unknown; moving to '%@''", peerState.peerID, self.peerUnknownState);
 143                 self.nextState = self.peerUnknownState;
 144
 145             } else {
 146                 self.nextState = self.intendedState;
 147             }
 148
 149             [self runBeforeGroupFinished:self.finishedOp];
 150         }];
 151 }
 152
 153 @end
 154
 155 #endif // OCTAGON