keychain/ot/OTVouchWithBottleOperation.m

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #if OCTAGON
  25
  26 #import <utilities/debugging.h>
  27
  28 #import "keychain/ot/OTVouchWithBottleOperation.h"
  29 #import "keychain/ot/OTClientStateMachine.h"
  30 #import "keychain/ot/OTCuttlefishContext.h"
  31 #import "keychain/ot/OTFetchCKKSKeysOperation.h"
  32
  33 #import "keychain/TrustedPeersHelper/TrustedPeersHelperProtocol.h"
  34 #import "keychain/ot/ObjCImprovements.h"
  35
  36 @interface OTVouchWithBottleOperation ()
  37 @property OTOperationDependencies* deps;
  38
  39 @property NSOperation* finishedOp;
  40 @end
  41
  42 @implementation OTVouchWithBottleOperation
  43 @synthesize intendedState = _intendedState;
  44
  45 - (instancetype)initWithDependencies:(OTOperationDependencies*)dependencies
  46                        intendedState:(OctagonState*)intendedState
  47                           errorState:(OctagonState*)errorState
  48                             bottleID:(NSString*)bottleID
  49                              entropy:(NSData*)entropy
  50                           bottleSalt:(NSString*)bottleSalt
  51 {
  52     if((self = [super init])) {
  53         _deps = dependencies;
  54         _intendedState = intendedState;
  55         _nextState = errorState;
  56
  57         _bottleID = bottleID;
  58         _entropy = entropy;
  59         _bottleSalt = bottleSalt;
  60     }
  61     return self;
  62 }
  63
  64 - (void)groupStart
  65 {
  66     secnotice("octagon", "creating voucher using a bottle with escrow record id: %@", self.bottleID);
  67
  68     self.finishedOp = [[NSOperation alloc] init];
  69     [self dependOnBeforeGroupFinished:self.finishedOp];
  70
  71     if(self.bottleSalt != nil) {
  72         secnotice("octagon", "using passed in altdsid, altdsid is: %@", self.bottleSalt);
  73     } else{
  74         if(self.deps.authKitAdapter.primaryiCloudAccountAltDSID){
  75             secnotice("octagon", "using auth kit adapter, altdsid is: %@", self.deps.authKitAdapter.primaryiCloudAccountAltDSID);
  76             self.bottleSalt = self.deps.authKitAdapter.primaryiCloudAccountAltDSID;
  77         }
  78         else {
  79             NSError* accountError = nil;
  80             OTAccountMetadataClassC* account = [self.deps.stateHolder loadOrCreateAccountMetadata:&accountError];
  81
  82             if(account && !accountError) {
  83                 secnotice("octagon", "retrieved account, altdsid is: %@", account.altDSID);
  84                 self.bottleSalt = account.altDSID;
  85             }
  86             if(accountError || !account){
  87                 secerror("failed to rerieve account object: %@", accountError);
  88             }
  89         }
  90     }
  91
  92     WEAKIFY(self);
  93
  94     // After a vouch, we also want to acquire all TLKs that the bottled peer might have had
  95     OTFetchCKKSKeysOperation* fetchKeysOp = [[OTFetchCKKSKeysOperation alloc] initWithDependencies:self.deps];
  96     [self runBeforeGroupFinished:fetchKeysOp];
  97
  98     CKKSResultOperation* proceedWithKeys = [CKKSResultOperation named:@"bottle-tlks"
  99                                                             withBlock:^{
 100                                                                 STRONGIFY(self);
 101                                                                 [self proceedWithKeys:fetchKeysOp.viewKeySets tlkShares:fetchKeysOp.tlkShares];
 102                                                             }];
 103
 104     [proceedWithKeys addDependency:fetchKeysOp];
 105     [self runBeforeGroupFinished:proceedWithKeys];
 106 }
 107
 108 - (void)proceedWithKeys:(NSArray<CKKSKeychainBackedKeySet*>*)viewKeySets tlkShares:(NSArray<CKKSTLKShare*>*)tlkShares
 109 {
 110     WEAKIFY(self);
 111
 112     [[self.deps.cuttlefishXPC remoteObjectProxyWithErrorHandler:^(NSError * _Nonnull error) {
 113         STRONGIFY(self);
 114         secerror("octagon: Can't talk with TrustedPeersHelper: %@", error);
 115         [[CKKSAnalytics logger] logRecoverableError:error forEvent:OctagonEventVoucherWithBottle withAttributes:NULL];
 116         self.error = error;
 117         [self runBeforeGroupFinished:self.finishedOp];
 118
 119     }] vouchWithBottleWithContainer:self.deps.containerName
 120      context:self.deps.contextID
 121      bottleID:self.bottleID
 122      entropy:self.entropy
 123      bottleSalt:self.bottleSalt
 124      tlkShares:tlkShares
 125      reply:^(NSData * _Nullable voucher, NSData * _Nullable voucherSig, NSError * _Nullable error) {
 126          [[CKKSAnalytics logger] logResultForEvent:OctagonEventVoucherWithBottle hardFailure:true result:error];
 127
 128          if(error){
 129              secerror("octagon: Error preparing voucher using bottle: %@", error);
 130              self.error = error;
 131              [self runBeforeGroupFinished:self.finishedOp];
 132              return;
 133          }
 134
 135          secnotice("octagon", "Received bottle voucher");
 136
 137          self.voucher = voucher;
 138          self.voucherSig = voucherSig;
 139          self.nextState = self.intendedState;
 140          [self runBeforeGroupFinished:self.finishedOp];
 141      }];
 142 }
 143
 144 @end
 145
 146 #endif // OCTAGON