keychain/ot/OTResetCKKSZonesLackingTLKsOperation.m

   1 #if OCTAGON
   2
   3 #import "utilities/debugging.h"
   4
   5 #import <CloudKit/CloudKit_Private.h>
   6
   7 #import "keychain/ot/OTResetCKKSZonesLackingTLKsOperation.h"
   8 #import "keychain/ot/OTCuttlefishAccountStateHolder.h"
   9 #import "keychain/ot/OTFetchCKKSKeysOperation.h"
  10
  11 #import "keychain/ckks/CloudKitCategories.h"
  12 #import "keychain/ckks/CKKSCurrentKeyPointer.h"
  13 #import "keychain/ckks/CKKSKeychainView.h"
  14
  15 #import "keychain/ot/ObjCImprovements.h"
  16
  17 @interface OTResetCKKSZonesLackingTLKsOperation ()
  18 @property OTOperationDependencies* deps;
  19
  20 @property NSOperation* finishedOp;
  21 @end
  22
  23 @implementation OTResetCKKSZonesLackingTLKsOperation
  24 @synthesize nextState = _nextState;
  25 @synthesize intendedState = _intendedState;
  26
  27 - (instancetype)initWithDependencies:(OTOperationDependencies*)dependencies
  28                        intendedState:(OctagonState*)intendedState
  29                           errorState:(OctagonState*)errorState
  30 {
  31     if((self = [super init])) {
  32         _deps = dependencies;
  33
  34         _intendedState = intendedState;
  35         _nextState = errorState;
  36     }
  37     return self;
  38 }
  39
  40 - (void)groupStart
  41 {
  42     secnotice("octagon", "Checking if any CKKS zones need resetting");
  43
  44     WEAKIFY(self);
  45
  46     self.finishedOp = [NSBlockOperation blockOperationWithBlock:^{
  47         STRONGIFY(self);
  48         secnotice("octagon", "Finishing resetting CKKS missing TLKs operation with %@", self.error ?: @"no error");
  49     }];
  50     [self dependOnBeforeGroupFinished:self.finishedOp];
  51
  52     OTFetchCKKSKeysOperation* fetchKeysOp = [[OTFetchCKKSKeysOperation alloc] initWithDependencies:self.deps];
  53     [self runBeforeGroupFinished:fetchKeysOp];
  54
  55     CKKSResultOperation* proceedWithKeys = [CKKSResultOperation named:@"continue-ckks-resets"
  56                                                             withBlock:^{
  57                                                                 STRONGIFY(self);
  58                                                                 [self proceedWithKeys:fetchKeysOp.viewKeySets
  59                                                                     incompleteKeySets:fetchKeysOp.incompleteKeySets
  60                                                                      pendingTLKShares:fetchKeysOp.tlkShares];
  61                                                             }];
  62
  63     [proceedWithKeys addDependency:fetchKeysOp];
  64     [self runBeforeGroupFinished:proceedWithKeys];
  65 }
  66
  67 - (void)proceedWithKeys:(NSArray<CKKSKeychainBackedKeySet*>*)viewKeySets
  68       incompleteKeySets:(NSArray<CKKSCurrentKeySet*>*)incompleteKeySets
  69        pendingTLKShares:(NSArray<CKKSTLKShare*>*)pendingTLKShares
  70 {
  71     // Now that CKKS has returned, what are we even doing
  72     NSMutableSet<CKKSKeychainView*>* viewsToReset = [NSMutableSet set];
  73
  74     for(CKKSCurrentKeySet* incompleteKeySet in incompleteKeySets) {
  75         if(incompleteKeySet.error == nil) {
  76             CKKSKeychainView* viewMatchingSet = [self.deps.viewManager findView:incompleteKeySet.viewName];
  77
  78             if(!viewMatchingSet) {
  79                 secnotice("octagon-ckks", "No view matching viewset %@?", incompleteKeySet);
  80                 continue;
  81             }
  82
  83             if(incompleteKeySet.currentTLKPointer != nil &&
  84                incompleteKeySet.tlk == nil) {
  85
  86                 BOOL otherDevicesAlive = [viewMatchingSet otherDevicesReportHavingTLKs:incompleteKeySet];
  87                 if(otherDevicesAlive) {
  88                     secnotice("octagon-ckks", "Recently active devices claim to have TLK from key set %@; not scheduling for reset", incompleteKeySet);
  89                 } else {
  90                     secnotice("octagon-ckks", "Key set %@ has no TLK; scheduling for reset", incompleteKeySet);
  91                     [viewsToReset addObject:viewMatchingSet];
  92                 }
  93             }
  94         } else {
  95             secnotice("octagon-ckks", "Error loading key set %@; not attempting reset", incompleteKeySet);
  96         }
  97     }
  98
  99     if(viewsToReset.count == 0) {
 100         // Nothing to do; return to ready
 101         secnotice("octagon-ckks", "No CKKS views need resetting");
 102         self.nextState = self.intendedState;
 103         [self runBeforeGroupFinished:self.finishedOp];
 104         return;
 105     }
 106
 107     [self resetViews:viewsToReset];
 108 }
 109
 110 - (void)resetViews:(NSSet<CKKSKeychainView*>*)viewsToReset {
 111     CKOperationGroup* opGroup = [CKOperationGroup CKKSGroupWithName:@"octagon-reset-missing-tlks"];
 112     for (CKKSKeychainView* view in viewsToReset) {
 113         secnotice("octagon-ckks", "Resetting CKKS %@", view);
 114         CKKSResultOperation* op = [view resetCloudKitZone:opGroup];
 115
 116         // Use an intermediary operation, just to ensure we have a timeout
 117         CKKSResultOperation* waitOp = [CKKSResultOperation named:[NSString stringWithFormat:@"wait-for-%@", view.zoneName]
 118                                                        withBlock:^{}];
 119         [waitOp timeout:120*NSEC_PER_SEC];
 120         [waitOp addDependency:op];
 121         [self.operationQueue addOperation:waitOp];
 122
 123         [self.finishedOp addDependency:waitOp];
 124     }
 125
 126     self.nextState = self.intendedState;
 127     [self.operationQueue addOperation:self.finishedOp];
 128 }
 129
 130 @end
 131
 132 #endif // OCTAGON