keychain/ot/OTJoinWithVoucherOperation.m

   1 /*
   2  * Copyright (c) 2018 Apple Inc. All Rights Reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. Please obtain a copy of the License at
  10  * http://www.opensource.apple.com/apsl/ and read it before using this
  11  * file.
  12  *
  13  * The Original Code and all software distributed under the License are
  14  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18  * Please see the License for the specific language governing rights and
  19  * limitations under the License.
  20  *
  21  * @APPLE_LICENSE_HEADER_END@
  22  */
  23
  24 #if OCTAGON
  25
  26 #import <utilities/debugging.h>
  27
  28 #import <CloudKit/CloudKit_Private.h>
  29
  30 #import "keychain/ot/OTJoinWithVoucherOperation.h"
  31 #import "keychain/ot/OTOperationDependencies.h"
  32 #import "keychain/ot/OTFetchCKKSKeysOperation.h"
  33 #import "keychain/ckks/CKKSNearFutureScheduler.h"
  34 #import "keychain/ckks/CloudKitCategories.h"
  35
  36 #import "keychain/TrustedPeersHelper/TrustedPeersHelperProtocol.h"
  37 #import "keychain/ot/ObjCImprovements.h"
  38 #import "keychain/ot/OTStates.h"
  39
  40 @interface OTJoinWithVoucherOperation ()
  41 @property OTOperationDependencies* deps;
  42
  43 @property OctagonState* ckksConflictState;
  44
  45 @property NSOperation* finishedOp;
  46 @end
  47
  48 @implementation OTJoinWithVoucherOperation
  49
  50 @synthesize intendedState = _intendedState;
  51
  52 - (instancetype)initWithDependencies:(OTOperationDependencies*)dependencies
  53                        intendedState:(OctagonState*)intendedState
  54                    ckksConflictState:(OctagonState*)ckksConflictState
  55                           errorState:(OctagonState*)errorState
  56 {
  57     if((self = [super init])) {
  58         _deps = dependencies;
  59
  60         _intendedState = intendedState;
  61         _nextState = errorState;
  62         _ckksConflictState = ckksConflictState;
  63
  64         _peerID = nil;
  65         _voucherData = nil;
  66         _voucherSig = nil;
  67     }
  68     return self;
  69 }
  70
  71 - (void)groupStart
  72 {
  73     // Load the voucher from the state handler
  74     NSError* error = nil;
  75     OTAccountMetadataClassC* metadata = [self.deps.stateHolder loadOrCreateAccountMetadata:&error];
  76
  77     if(!metadata.voucher || !metadata.voucherSignature || error) {
  78         secnotice("octagon", "No voucher available: %@", error);
  79         self.error = error;
  80         return;
  81     }
  82
  83     self.voucherData = metadata.voucher;
  84     self.voucherSig = metadata.voucherSignature;
  85
  86     secnotice("octagon", "joining with a voucher: %@", self.voucherData);
  87
  88     self.finishedOp = [[NSOperation alloc] init];
  89     [self dependOnBeforeGroupFinished:self.finishedOp];
  90
  91     WEAKIFY(self);
  92
  93     OTFetchCKKSKeysOperation* fetchKeysOp = [[OTFetchCKKSKeysOperation alloc] initWithDependencies:self.deps
  94                                                                                      refetchNeeded:NO];
  95     // We only care about TLKs that are ready for upload. Don't wait long.
  96     fetchKeysOp.desiredTimeout = 2*NSEC_PER_SEC;
  97     [self runBeforeGroupFinished:fetchKeysOp];
  98
  99     CKKSResultOperation* proceedWithKeys = [CKKSResultOperation named:@"vouch-with-keys"
 100                                                             withBlock:^{
 101                                                                 STRONGIFY(self);
 102                                                                 [self proceedWithKeys:fetchKeysOp.viewKeySets
 103                                                                      pendingTLKShares:fetchKeysOp.pendingTLKShares];
 104                                                             }];
 105
 106     [proceedWithKeys addDependency:fetchKeysOp];
 107     [self runBeforeGroupFinished:proceedWithKeys];
 108 }
 109
 110 - (void)proceedWithKeys:(NSArray<CKKSKeychainBackedKeySet*>*)viewKeySets pendingTLKShares:(NSArray<CKKSTLKShare*>*)pendingTLKShares
 111 {
 112     WEAKIFY(self);
 113
 114     NSArray<NSData*>* publicSigningSPKIs = nil;
 115     if(self.deps.sosAdapter.sosEnabled) {
 116         NSError* sosPreapprovalError = nil;
 117         publicSigningSPKIs = [OTSOSAdapterHelpers peerPublicSigningKeySPKIsForCircle:self.deps.sosAdapter error:&sosPreapprovalError];
 118
 119         if(publicSigningSPKIs) {
 120             secnotice("octagon-sos", "SOS preapproved keys are %@", publicSigningSPKIs);
 121         } else {
 122             secnotice("octagon-sos", "Unable to fetch SOS preapproved keys: %@", sosPreapprovalError);
 123         }
 124
 125     } else {
 126         secnotice("octagon-sos", "SOS not enabled; no preapproved keys");
 127     }
 128
 129     [self.deps.cuttlefishXPCWrapper joinWithContainer:self.deps.containerName
 130                                               context:self.deps.contextID
 131                                           voucherData:self.voucherData
 132                                            voucherSig:self.voucherSig
 133                                              ckksKeys:viewKeySets
 134                                             tlkShares:pendingTLKShares
 135                                       preapprovedKeys:publicSigningSPKIs
 136                                                 reply:^(NSString * _Nullable peerID,
 137                                                         NSArray<CKRecord*>* keyHierarchyRecords,
 138                                                         TPSyncingPolicy* _Nullable syncingPolicy,
 139                                                         NSError * _Nullable error) {
 140             STRONGIFY(self);
 141             if(error){
 142                 secerror("octagon: Error joining with voucher: %@", error);
 143                 [[CKKSAnalytics logger] logRecoverableError:error forEvent:OctagonEventJoinWithVoucher withAttributes:NULL];
 144
 145                 // IF this is a CKKS conflict error, don't retry
 146                 if ([error isCuttlefishError:CuttlefishErrorKeyHierarchyAlreadyExists]) {
 147                     secnotice("octagon-ckks", "A CKKS key hierarchy is out of date; going to state '%@'", self.ckksConflictState);
 148                     self.nextState = self.ckksConflictState;
 149                 } else if ([error isCuttlefishError:CuttlefishErrorResultGraphNotFullyReachable]) {
 150                     secnotice("octagon", "requesting cuttlefish health check");
 151                     self.nextState = OctagonStateCuttlefishTrustCheck;
 152                     self.error = error;
 153                 } else {
 154                     self.error = error;
 155                 }
 156             } else {
 157                 self.peerID = peerID;
 158
 159                 [[CKKSAnalytics logger] logSuccessForEventNamed:OctagonEventJoinWithVoucher];
 160
 161                 [self.deps.viewManager setCurrentSyncingPolicy:syncingPolicy];
 162
 163                 NSError* localError = nil;
 164                 BOOL persisted = [self.deps.stateHolder persistAccountChanges:^OTAccountMetadataClassC * _Nonnull(OTAccountMetadataClassC * _Nonnull metadata) {
 165                     metadata.trustState = OTAccountMetadataClassC_TrustState_TRUSTED;
 166                     metadata.peerID = peerID;
 167
 168                     metadata.voucher = nil;
 169                     metadata.voucherSignature = nil;
 170
 171                     [metadata setTPSyncingPolicy:syncingPolicy];
 172                     return metadata;
 173                 } error:&localError];
 174                 if(!persisted || localError) {
 175                     secnotice("octagon", "Couldn't persist results: %@", localError);
 176                     self.error = localError;
 177                 } else {
 178                     secerror("octagon: join successful");
 179                     self.nextState = self.intendedState;
 180                 }
 181
 182                 // Tell CKKS about our shiny new records!
 183                 for (id key in self.deps.viewManager.views) {
 184                     CKKSKeychainView* view = self.deps.viewManager.views[key];
 185                     secnotice("octagon-ckks", "Providing join() records to %@", view);
 186                     [view receiveTLKUploadRecords: keyHierarchyRecords];
 187                 }
 188             }
 189             [self runBeforeGroupFinished:self.finishedOp];
 190         }];
 191 }
 192
 193 @end
 194
 195 #endif // OCTAGON