1  //
  2  //  KCJoiningSession.m
  3  //  Security
  4  //
  5  //
  6  
  7  #import <Foundation/Foundation.h>
  8  
  9  #import <KeychainCircle/KCJoiningSession.h>
 10  
 11  #import <KeychainCircle/KCError.h>
 12  #import <KeychainCircle/KCDer.h>
 13  #import <KeychainCircle/KCSRPContext.h>
 14  
 15  #import <KeychainCircle/KCJoiningMessages.h>
 16  
 17  #include <corecrypto/ccrng.h>
 18  #include <corecrypto/ccsha2.h>
 19  #include <corecrypto/ccdh_gp.h>
 20  #include <corecrypto/ccder.h>
 21  #import <Security/SecureObjectSync/SOSTypes.h>
 22  #include <utilities/debugging.h>
 23  
 24  #if OCTAGON
 25  #import <Security/OTConstants.h>
 26  #import "keychain/ot/OTControl.h"
 27  #import "keychain/ot/OTControlProtocol.h"
 28  #import "keychain/ot/OctagonControlServer.h"
 29  #import "keychain/ot/OTJoiningConfiguration.h"
 30  #import "KeychainCircle/KCJoiningRequestSession+Internal.h"
 31  
 32  #import "keychain/ot/proto/generated_source/OTApplicantToSponsorRound2M1.h"
 33  #import "keychain/ot/proto/generated_source/OTSponsorToApplicantRound2M2.h"
 34  #import "keychain/ot/proto/generated_source/OTSponsorToApplicantRound1M2.h"
 35  #import "keychain/ot/proto/generated_source/OTGlobalEnums.h"
 36  #import "keychain/ot/proto/generated_source/OTSupportSOSMessage.h"
 37  #import "keychain/ot/proto/generated_source/OTSupportOctagonMessage.h"
 38  #import "keychain/ot/proto/generated_source/OTPairingMessage.h"
 39  #endif
 40  #import <KeychainCircle/NSError+KCCreationHelpers.h>
 41  
 42  typedef enum {
 43      kExpectingB,
 44      kExpectingHAMK,
 45      kRequestSecretDone
 46  } KCJoiningRequestSecretSessionState;
 47  
 48  #if OCTAGON
 49  static bool KCJoiningOctagonPiggybackingDefault = false;
 50  bool KCSetJoiningOctagonPiggybackingEnabled(bool value)
 51  {
 52      KCJoiningOctagonPiggybackingDefault = value;
 53      return value;
 54  }
 55  
 56  // defaults write com.apple.security.octagon enable -bool YES
 57  bool KCJoiningOctagonPiggybackingEnabled() {
 58      bool result = KCJoiningOctagonPiggybackingDefault ? KCJoiningOctagonPiggybackingDefault : OctagonIsEnabled();
 59      secnotice("octagon", "Octagon Piggybacking is %@ ", result ? @"on" : @"off");
 60      return result;
 61  }
 62  #endif
 63  
 64  
 65  @interface KCJoiningRequestSecretSession ()
 66  @property (weak) id<KCJoiningRequestSecretDelegate> secretDelegate;
 67  @property (readonly) KCSRPClientContext* context;
 68  @property (readonly) uint64_t dsid;
 69  @property (readonly) KCJoiningRequestSecretSessionState state;
 70  @property (readwrite) NSString* piggy_uuid;
 71  @property (readwrite) uint64_t piggy_version;
 72  @property (readwrite) uint64_t epoch;
 73  @property (readwrite) NSData* challenge;
 74  @property (readwrite) NSData* salt;
 75  @property (readwrite) NSString* sessionUUID;
 76  
 77  #if OCTAGON
 78  @property (nonatomic, strong) OTControl *otControl;
 79  #endif
 80  @property (nonatomic, strong) NSMutableDictionary *defaults;
 81  @end
 82  
 83  @implementation KCJoiningRequestSecretSession : NSObject
 84  
 85  
 86  - (nullable NSData*) createUUID
 87  {
 88      NSUUID *uuid = [NSUUID UUID];
 89      uuid_t uuidBytes;
 90  
 91      self.piggy_uuid = [uuid UUIDString];
 92      [uuid getUUIDBytes:uuidBytes];
 93      NSData *uuidData = [NSData dataWithBytes:uuidBytes length:sizeof(uuid_t)];
 94      return uuidData;
 95  }
 96  
 97  - (nullable NSData*) initialMessage: (NSError**) error {
 98      NSData* start = [self->_context copyStart: error];
 99      if (start == nil) return nil;
100      
101      NSMutableData* initialMessage = NULL;
102      secnotice("joining", "joining: KCJoiningRequestSecretSession initialMessage called");
103  
104      if(self.piggy_version == kPiggyV2){
105  #if OCTAGON
106          if(KCJoiningOctagonPiggybackingEnabled()){
107              NSData* uuidData = [self createUUID];
108  
109              NSString* version = @"o";
110              NSData* octagonVersion = [version dataUsingEncoding:kCFStringEncodingUTF8];
111  
112              initialMessage = [NSMutableData dataWithLength: sizeof_initialmessage_version2(start, kPiggyV1, uuidData, octagonVersion)];
113  
114              if (NULL == encode_initialmessage_version2(start, uuidData, octagonVersion, error, initialMessage.mutableBytes, initialMessage.mutableBytes + initialMessage.length)){
115                  secerror("failed to create version 2 message");
116                  return nil;
117              }
118          }
119  #endif
120      }
121      else if(self.piggy_version == kPiggyV1){
122          NSData* uuidData = [self createUUID];
123          initialMessage = [NSMutableData dataWithLength: sizeof_initialmessage_version1(start, kPiggyV1, uuidData)];
124  
125          if (NULL == encode_initialmessage_version1(start, uuidData, kPiggyV1, error, initialMessage.mutableBytes, initialMessage.mutableBytes + initialMessage.length)){
126              secerror("failed to create version 1 message: %@", *error);
127              return nil;
128          }
129      }
130      else{
131          initialMessage = [NSMutableData dataWithLength: sizeof_initialmessage(start)];
132          if (NULL == encode_initialmessage(start, error, initialMessage.mutableBytes, initialMessage.mutableBytes + initialMessage.length)){
133              return nil;
134          }
135      }
136      
137      return initialMessage;
138  }
139  
140  - (bool) isDone {
141      return self->_state == kRequestSecretDone;
142  }
143  
144  - (bool) setupSession: (NSError**) error {
145      NSData* key = [self->_context getKey];
146  
147      if (key == nil) {
148          KCJoiningErrorCreate(kInternalError, error, @"No session key available");
149          return nil;
150      }
151  
152      self->_session = [KCAESGCMDuplexSession sessionAsSender:key context:self.dsid];
153      self.session.pairingUUID = self.sessionUUID;
154      self.session.piggybackingVersion = self.piggy_version;
155  
156      return self.session != nil;
157  }
158  
159  - (nullable NSData*) copyResponseForChallenge:(NSData*) challenge
160                                           salt:(NSData*) salt
161                                         secret: (NSString*) password
162                                          error: (NSError**) error {
163  
164      secnotice("joining", "joining: KCJoiningRequestSecretSession copyResponseForChallenge called");
165      NSData* response = [self->_context copyResposeToChallenge:challenge
166                                                       password:password
167                                                           salt:salt
168                                                          error:error];
169  
170      if (!response) {
171          // @@@ return error to other side???
172          return nil;
173      } else {
174          if (![self setupSession: error]) return nil;
175  
176          self.challenge = challenge;
177          self.salt = salt;
178  
179          self->_state = kExpectingHAMK;
180          return [[KCJoiningMessage messageWithType:kResponse
181                                               data:response
182                                              error:error] der];
183      }
184  }
185  
186  
187  - (nullable NSData*) copyResponseForSecret: (NSString*) password
188                                       error: (NSError**) error {
189      return [self copyResponseForChallenge:self.challenge salt:self.salt secret:password error:error];
190  }
191  
192  - (nullable NSData*) handleChallengeData: (NSData*) challengeData
193                                    secret: (NSString*) password
194                                     error: (NSError**) error {
195      secnotice("joining", "joining: KCJoiningRequestSecretSession handleChallengeData called");
196      NSData* challenge = nil;
197      NSData* salt = nil;
198  
199      if (![challengeData decodeSequenceData:&salt data:&challenge error:error]) return nil;
200  
201      return [self copyResponseForChallenge:challenge salt:salt secret:password error:error];
202  
203  }
204  
205  - (nullable NSData*) handleChallenge: (KCJoiningMessage*) message
206                                secret: (NSString*) password
207                                 error: (NSError**)error {
208      secnotice("joining", "joining: KCJoiningRequestSecretSession handleChallenge called");
209      // Parse the challenge message
210      // Salt and Challenge packet
211      if ([message type] != kChallenge) {
212          KCJoiningErrorCreate(kUnexpectedMessage, error, @"Expected challenge!");
213          return nil;
214      }
215  #if OCTAGON
216      //handle octagon data if it exists
217      if (KCJoiningOctagonPiggybackingEnabled()){
218          self.piggy_version = [message secondData] ? kPiggyV2 : kPiggyV1;
219  
220          // The session may or may not exist at this point. If it doesn't, the version will be set at object creation time.
221          self.session.piggybackingVersion = self.piggy_version;
222  
223          if (self.piggy_version == kPiggyV2){
224              OTPairingMessage* pairingMessage = [[OTPairingMessage alloc]initWithData: [message secondData]];
225              if (pairingMessage.hasEpoch) {
226                  secnotice("octagon", "received epoch message: %@", [pairingMessage.epoch dictionaryRepresentation]);
227                  self.epoch = pairingMessage.epoch.epoch;
228              }
229              else{
230                  secerror("octagon: acceptor did not send its epoch. discontinuing octagon protocol. downgrading to verison 1");
231                  self.piggy_version = kPiggyV1;
232              }
233          }
234      }else{
235          self.piggy_version = kPiggyV1;
236      }
237  #endif
238      return [self handleChallengeData:[message firstData] secret:password error:error];
239  }
240  
241  - (NSData*) handleChallenge: (KCJoiningMessage*) message error: (NSError**)error {
242      return [self handleChallenge:message
243                            secret:[self.secretDelegate secret]
244                             error:error];
245  
246  }
247  
248  - (NSData*) handleVerification: (KCJoiningMessage*) message error: (NSError**) error {
249      secnotice("joining", "joining: KCJoiningRequestSecretSession handleVerification called");
250      id<KCJoiningRequestSecretDelegate> secretDelegate = self.secretDelegate;
251  
252      if ([message type] == kError) {
253          bool newCode = [[message firstData] length] == 0;
254          NSString* nextSecret = [secretDelegate verificationFailed: newCode];
255  
256          if (nextSecret) {
257              if (newCode) {
258                  return [self copyResponseForSecret:nextSecret error:error];
259              } else {
260                  return [self handleChallengeData:[message firstData] secret:nextSecret error:error];
261              }
262          } else {
263              return nil;
264          }
265      }
266  
267      if ([message type] != kVerification) {
268          KCJoiningErrorCreate(kUnexpectedMessage, error, @"Expected verification!");
269          return nil;
270      }
271  
272      if (![self.context verifyConfirmation:[message firstData] error:error]) {
273          // Sender thought we had it right, but he can't prove he has it right!
274          KCJoiningErrorCreate(kInternalError, error, @"Got verification but  acceptor doesn't have matching secret: %@", self);
275          secnotice("request-session", "Verification failed: %@", self);
276          return nil;
277      }
278  
279      {
280          NSData* payload = [self.session decryptAndVerify:[message secondData] error:error];
281          if (payload == nil) return nil;
282  
283          NSString* accountCode = [NSString decodeFromDER:payload error:error];
284          if (accountCode == nil) return nil;
285  
286          if (![secretDelegate processAccountCode:accountCode error:error]) return nil;
287      }
288  
289      self->_state = kRequestSecretDone;
290  
291      return [NSData data];
292  }
293  
294  - (NSData*) processMessage: (NSData*) incomingMessage error: (NSError**) error {
295      secnotice("joining", "joining: KCJoiningRequestSecretSession processMessage called");
296      NSData* result = nil;
297      KCJoiningMessage* message = [KCJoiningMessage messageWithDER: incomingMessage error: error];
298      if (message == nil) return nil;
299  
300      switch(self->_state) {
301          case kExpectingB:
302              return [self handleChallenge:message error: error];
303              break;
304          case kExpectingHAMK:
305              return [self handleVerification:message error:error];
306              break;
307          case kRequestSecretDone:
308              KCJoiningErrorCreate(kUnexpectedMessage, error, @"Done, no messages expected.");
309              break;
310      }
311  
312      return result;
313  }
314  
315  + (nullable instancetype)sessionWithSecretDelegate: (NSObject<KCJoiningRequestSecretDelegate>*) secretDelegate
316                                                dsid: (uint64_t)dsid
317                                               error: (NSError**) error {
318      return [[KCJoiningRequestSecretSession alloc] initWithSecretDelegate:secretDelegate
319                                                                      dsid:dsid
320                                                                     error:error];
321  }
322  
323  - (nullable instancetype)initWithSecretDelegate: (NSObject<KCJoiningRequestSecretDelegate>*) secretDelegate
324                                             dsid: (uint64_t)dsid
325                                            error: (NSError**)error {
326      int cc_error = 0;
327      struct ccrng_state * rng = ccrng(&cc_error);
328  
329      if (rng == nil) {
330          CoreCryptoError(cc_error, error, @"RNG fetch failed");
331          return nil;
332      }
333  
334      return [self initWithSecretDelegate: secretDelegate
335                                     dsid: dsid
336                                      rng: rng
337                                    error: error];
338  }
339  
340  - (nullable instancetype)initWithSecretDelegate: (NSObject<KCJoiningRequestSecretDelegate>*) secretDelegate
341                                             dsid: (uint64_t)dsid
342                                              rng: (struct ccrng_state *)rng
343                                            error: (NSError**)error {
344      secnotice("joining", "joining: initWithSecretDelegate called");
345      if ((self = [super init])) {
346          self->_secretDelegate = secretDelegate;
347          self->_state = kExpectingB;
348          self->_dsid = dsid;
349          self->_defaults = [NSMutableDictionary dictionary];
350  
351  #if OCTAGON
352          self->_piggy_version = KCJoiningOctagonPiggybackingEnabled() ? kPiggyV2 : kPiggyV1;
353          self->_otControl = [OTControl controlObject:true error:error];
354  
355          _sessionUUID = [[NSUUID UUID] UUIDString];
356  #else
357          self->_piggy_version = kPiggyV1;
358  #endif
359  
360          secnotice("joining", "joining: initWithSecretDelegate called, uuid=%@", self.sessionUUID);
361  
362          NSString* name = [NSString stringWithFormat: @"%llu", dsid];
363      
364          self->_context = [[KCSRPClientContext alloc] initWithUser: name
365                                                         digestInfo: ccsha256_di()
366                                                              group: ccsrp_gp_rfc5054_3072()
367                                                       randomSource: rng];
368      }
369      return self;
370  }
371  
372  - (NSString*) stateString {
373      switch (self.state) {
374          case kExpectingB: return @"→B";
375          case kExpectingHAMK: return @"→HAMK";
376          case kRequestSecretDone: return @"SecretDone";
377          default: return [NSString stringWithFormat:@"%d", self.state];
378      }
379  }
380  
381  - (NSString *)description {
382      return [NSString stringWithFormat: @"<KCJoiningAcceptSession@%p %lld %@ %@>", self, self.dsid, [self stateString], self.context];
383  }
384  #if OCTAGON
385  /* for test */
386  -(void)setControlObject:(OTControl*)control
387  {
388      self.otControl = control;
389  }
390  #endif
391  
392  @end