keychain/ot/OTJoinWithVoucherOperation.m

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #if OCTAGON
  25
  26 #import <utilities/debugging.h>
  27
  28 #import <CloudKit/CloudKit_Private.h>
  29
  30 #import "keychain/ot/OTJoinWithVoucherOperation.h"
  31 #import "keychain/ot/OTOperationDependencies.h"
  32 #import "keychain/ot/OTFetchCKKSKeysOperation.h"
  33 #import "keychain/ckks/CKKSNearFutureScheduler.h"
  34 #import "keychain/ckks/CloudKitCategories.h"
  35
  36 #import "keychain/TrustedPeersHelper/TrustedPeersHelperProtocol.h"
  37 #import "keychain/ot/ObjCImprovements.h"
  38 #import "keychain/ot/OTStates.h"
  39
  40 @interface OTJoinWithVoucherOperation ()
  41 @property OTOperationDependencies* deps;
  42
  43 @property OctagonState* ckksConflictState;
  44
  45 @property NSOperation* finishedOp;
  46 @property int retries;
  47 @property int maxRetries;
  48 @property int delay;
  49 @property CKKSNearFutureScheduler* retrySched;
  50 @end
  51
  52 @implementation OTJoinWithVoucherOperation
  53
  54 @synthesize intendedState = _intendedState;
  55
  56 - (instancetype)initWithDependencies:(OTOperationDependencies*)dependencies
  57                        intendedState:(OctagonState*)intendedState
  58                    ckksConflictState:(OctagonState*)ckksConflictState
  59                           errorState:(OctagonState*)errorState
  60                          voucherData:(NSData*)voucherData
  61                           voucherSig:(NSData*)voucherSig
  62                      preapprovedKeys:(NSArray<NSData *>*)preapprovedKeys
  63 {
  64     if((self = [super init])) {
  65         _deps = dependencies;
  66
  67         _retries = 0;
  68         _maxRetries = 5;
  69         _delay = 1;
  70
  71         _intendedState = intendedState;
  72         _nextState = errorState;
  73         _ckksConflictState = ckksConflictState;
  74
  75         _voucherData = voucherData;
  76         _voucherSig = voucherSig;
  77         _preapprovedKeys = preapprovedKeys;
  78     }
  79     return self;
  80 }
  81
  82 - (void)groupStart
  83 {
  84     secnotice("octagon", "joining");
  85
  86     self.finishedOp = [[NSOperation alloc] init];
  87     [self dependOnBeforeGroupFinished:self.finishedOp];
  88
  89     WEAKIFY(self);
  90
  91     OTFetchCKKSKeysOperation* fetchKeysOp = [[OTFetchCKKSKeysOperation alloc] initWithDependencies:self.deps];
  92     [self runBeforeGroupFinished:fetchKeysOp];
  93
  94     CKKSResultOperation* proceedWithKeys = [CKKSResultOperation named:@"vouch-with-keys"
  95                                                             withBlock:^{
  96                                                                 STRONGIFY(self);
  97                                                                 [self proceedWithKeys:fetchKeysOp.viewKeySets
  98                                                                      pendingTLKShares:fetchKeysOp.pendingTLKShares];
  99                                                             }];
 100
 101     [proceedWithKeys addDependency:fetchKeysOp];
 102     [self runBeforeGroupFinished:proceedWithKeys];
 103 }
 104
 105 - (BOOL)isRetryable:(NSError* _Nonnull)error {
 106     return [error isCuttlefishError:CuttlefishErrorTransactionalFailure];
 107 }
 108
 109 - (int)retryDelay:(NSError* _Nonnull)error {
 110     NSError* underlyingError = error.userInfo[NSUnderlyingErrorKey];
 111     int ret = self->_delay;
 112     if (underlyingError) {
 113         id tmp = underlyingError.userInfo[@"retryafter"];
 114         if ([tmp isKindOfClass:[NSNumber class]]) {
 115             ret = [(NSNumber*)tmp intValue];
 116         }
 117     }
 118     ret = MAX(MIN(ret, 32), self->_delay);
 119     self->_delay *= 2;
 120     return ret;
 121 }
 122
 123 - (void)proceedWithKeys:(NSArray<CKKSKeychainBackedKeySet*>*)viewKeySets pendingTLKShares:(NSArray<CKKSTLKShare*>*)pendingTLKShares
 124 {
 125     WEAKIFY(self);
 126
 127     [[self.deps.cuttlefishXPC remoteObjectProxyWithErrorHandler:^(NSError * _Nonnull error) {
 128         STRONGIFY(self);
 129         secerror("octagon: Can't talk with TrustedPeersHelper: %@", error);
 130         [[CKKSAnalytics logger] logRecoverableError:error forEvent:OctagonEventJoinWithVoucher withAttributes:NULL];
 131         self.error = error;
 132         [self runBeforeGroupFinished:self.finishedOp];
 133
 134     }] joinWithContainer:self.deps.containerName
 135                  context:self.deps.contextID
 136              voucherData:self.voucherData
 137               voucherSig:self.voucherSig
 138                 ckksKeys:viewKeySets
 139                tlkShares:pendingTLKShares
 140          preapprovedKeys:self.preapprovedKeys
 141                    reply:^(NSString * _Nullable peerID, NSArray<CKRecord*>* keyHierarchyRecords, NSError * _Nullable error) {
 142         if(error){
 143             secerror("octagon: Error joining with voucher: %@", error);
 144             [[CKKSAnalytics logger] logRecoverableError:error forEvent:OctagonEventJoinWithVoucher withAttributes:NULL];
 145
 146             if (self.retries < self.maxRetries && [self isRetryable:error]) {
 147                 ++self.retries;
 148                 if (!self.retrySched) {
 149                     self.retrySched = [[CKKSNearFutureScheduler alloc] initWithName:@"cuttlefish-join-retry"
 150                                                                               delay:1*NSEC_PER_SEC
 151                                                                    keepProcessAlive:true
 152                                                           dependencyDescriptionCode:CKKSResultDescriptionNone
 153                                                                               block:^{
 154                                                                                   CKKSResultOperation* proceedWithKeys = [CKKSResultOperation named:@"vouch-with-keys"
 155                                                                                                                                           withBlock:^{
 156                                                                                                                                               STRONGIFY(self);
 157                                                                                                                                               secnotice("octagon", "retrying (%d/%d) join", self.retries, self->_maxRetries);
 158                                                                                                                                               [self proceedWithKeys:viewKeySets
 159                                                                                                                                                    pendingTLKShares:pendingTLKShares];
 160                                                                                                                                           }];
 161                                                                                   STRONGIFY(self);
 162                                                                                   [self runBeforeGroupFinished:proceedWithKeys];
 163                                                                               }];
 164                 }
 165                 int delay_s = [self retryDelay:error];
 166                 [self.retrySched waitUntil:delay_s*NSEC_PER_SEC];
 167                 [self.retrySched trigger];
 168                 return;
 169             }
 170
 171             // IF this is a CKKS conflict error, don't retry
 172             if ([error isCuttlefishError:CuttlefishErrorKeyHierarchyAlreadyExists]) {
 173                 secnotice("octagon-ckks", "A CKKS key hierarchy is out of date; going to state '%@'", self.ckksConflictState);
 174                 self.nextState = self.ckksConflictState;
 175             } else {
 176                 self.error = error;
 177             }
 178         } else {
 179             self.peerID = peerID;
 180
 181             [[CKKSAnalytics logger] logSuccessForEventNamed:OctagonEventJoinWithVoucher];
 182
 183             NSError* localError = nil;
 184             BOOL persisted = [self.deps.stateHolder persistAccountChanges:^OTAccountMetadataClassC * _Nonnull(OTAccountMetadataClassC * _Nonnull metadata) {
 185                 metadata.trustState = OTAccountMetadataClassC_TrustState_TRUSTED;
 186                 metadata.peerID = peerID;
 187                 return metadata;
 188             } error:&localError];
 189             if(!persisted || localError) {
 190                 secnotice("octagon", "Couldn't persist results: %@", localError);
 191                 self.error = localError;
 192             } else {
 193                 secerror("octagon: join successful");
 194                 self.nextState = self.intendedState;
 195             }
 196
 197             // Tell CKKS about our shiny new records!
 198             for (id key in self.deps.viewManager.views) {
 199                 CKKSKeychainView* view = self.deps.viewManager.views[key];
 200                 secnotice("octagon-ckks", "Providing join() records to %@", view);
 201                 [view receiveTLKUploadRecords: keyHierarchyRecords];
 202             }
 203         }
 204         [self runBeforeGroupFinished:self.finishedOp];
 205     }];
 206 }
 207
 208 @end
 209
 210 #endif // OCTAGON