weave/src/device-manager/cocoa/NLWeaveKeyExportClient.mm

/*
 *
 *    Copyright (c) 2016-2017 Nest Labs, Inc.
 *    All rights reserved.
 *
 *    Licensed under the Apache License, Version 2.0 (the "License");
 *    you may not use this file except in compliance with the License.
 *    You may obtain a copy of the License at
 *
 *        http://www.apache.org/licenses/LICENSE-2.0
 *
 *    Unless required by applicable law or agreed to in writing, software
 *    distributed under the License is distributed on an "AS IS" BASIS,
 *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *    See the License for the specific language governing permissions and
 *    limitations under the License.
 */

/**
 *    @file
 *      This file defines a Wrapper for C++ implementation of key export functionality
 *      to support pin encryption.
 *
 */
#import "NLWeaveKeyExportClient.h"
#import "NLWeaveKeyExportSupport.h"
#include <Weave/Core/WeaveCore.h>
#include <Weave/Core/WeaveKeyIds.h>
#include <Weave/Support/CodeUtils.h>
#include <Weave/Profiles/security/WeaveKeyExportClient.h>

using namespace nl::Weave::Profiles::Security::KeyExport;

NSString *const NLWeaveKeyExportClientErrorDomain = @"NLWeaveKeyExportClientErrorDomain";

@interface NLWeaveKeyExportClient ()
{
    WeaveStandAloneKeyExportClient * _mKeyExportClientCpp;
}
@end

@implementation NLWeaveKeyExportClient

static UInt32 const kMaxPubKeySize = (((WEAVE_CONFIG_MAX_EC_BITS + 7) / 8) + 1) * 2;
static UInt32 const kMaxECDSASigSize = kMaxPubKeySize;

- (nullable NSData *) generateKeyExportRequest: (UInt32) keyId
                               responderNodeId: (UInt64) responderNodeId
                                   accessToken: (NSData *) accessToken
                                         error: (NSError **) errOut {
    WEAVE_ERROR err = WEAVE_NO_ERROR;
    uint16_t exportReqLen = 0;
    
    if (accessToken == nil) {
        if (errOut) {
            *errOut = [NSError errorWithDomain: NLWeaveKeyExportClientErrorDomain
                                          code: NLWeaveKeyExportClientErrorDomainInvalidArgument
                                      userInfo: nil];
        }
        return nil;
    }
    
    size_t exportReqBufSize =
    7                       // Key export request header size
    + kMaxPubKeySize          // Ephemeral public key size
    + kMaxECDSASigSize        // Size of bare signature field
    +  [accessToken length]   // Size equal to at least the total size of the client certificates
    + 1024;                   // Space for additional signature fields plus encoding overhead
    
    if (exportReqBufSize > UINT16_MAX) {
        if (errOut) {
            *errOut = [NSError errorWithDomain: NLWeaveKeyExportClientErrorDomain
                                          code:NLWeaveKeyExportClientErrorDomainInvalidExportBufferSize
                                      userInfo:nil];
        }
        return nil;
    }
    
    NSMutableData * exportReqBuf = [[NSMutableData alloc] initWithLength:exportReqBufSize];
    
    err = _mKeyExportClientCpp->GenerateKeyExportRequest((uint32_t) keyId,
                                                         (uint64_t) responderNodeId,
                                                         (unsigned char *) [accessToken bytes],
                                                         [accessToken length],
                                                         (unsigned char *) [exportReqBuf mutableBytes],
                                                         exportReqBufSize,
                                                         exportReqLen);
    
    if (err != WEAVE_NO_ERROR) {
        if (errOut) {
            NSString *failureReason = [NSString stringWithFormat:NSLocalizedString(
                                            @"GenerateKeyExportRequest error: %d", @""), err];
            NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason };
            *errOut = [NSError errorWithDomain:NLWeaveKeyExportClientErrorDomain
                                          code:NLWeaveKeyExportClientErrorDomainKeyExportRequestFailure userInfo: userInfo];
        }
        
        return nil;
    }
    
    [exportReqBuf setLength: exportReqLen];
    
    return exportReqBuf;
}

- (nullable NSData *) generateKeyExportRequest: (UInt32) keyId
                               responderNodeId: (UInt64) responderNodeId
                                    clientCert: (NSData *) clientCert
                                     clientKey: (NSData *) clientKey
                                         error: (NSError **) errOut {
    WEAVE_ERROR err = WEAVE_NO_ERROR;
    uint16_t exportReqLen = 0;
    
    if (clientKey == nil || clientCert){
        if (errOut) {
            *errOut = [NSError errorWithDomain:NLWeaveKeyExportClientErrorDomain
                       code:NLWeaveKeyExportClientErrorDomainInvalidArgument
                       userInfo:nil];
        }
        return nil;
    }
    
    size_t exportReqBufSize =
    7                       // Key export request header size
    + kMaxPubKeySize          // Ephemeral public key size
    + kMaxECDSASigSize        // Size of bare signature field
    +  [clientCert length]   // Size equal to at least the total size of the client certificates
    + 1024;                   // Space for additional signature fields plus encoding overhead
    
    if (exportReqBufSize > UINT16_MAX) {
        if (errOut) {
            *errOut = [NSError errorWithDomain:NLWeaveKeyExportClientErrorDomain
                       code:NLWeaveKeyExportClientErrorDomainInvalidExportBufferSize
                       userInfo:nil];
        }
        return nil;
    }
    
    NSMutableData * exportReqBuf = [[NSMutableData alloc] initWithLength:exportReqBufSize];
    
    err = _mKeyExportClientCpp->GenerateKeyExportRequest((uint32_t) keyId,
                                     (uint64_t) responderNodeId,
                                     (unsigned char *) [clientCert bytes],
                                     [clientCert length],
                                     (unsigned char *) [clientKey bytes],
                                     [clientKey length],
                                      (unsigned char *) [exportReqBuf mutableBytes],
                                     exportReqBufSize,
                                     exportReqLen);
    
    if (err != WEAVE_NO_ERROR) {
        if (errOut) {
            NSString *failureReason = [NSString stringWithFormat:NSLocalizedString(
                                                                                   @"GenerateKeyExportRequest error: %d", @""), err];
            NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason };
            *errOut = [NSError errorWithDomain:NLWeaveKeyExportClientErrorDomain
                                          code:NLWeaveKeyExportClientErrorDomainKeyExportRequestFailure userInfo: userInfo];
        }
        
        return nil;
    }
    
    [exportReqBuf setLength: exportReqLen];
    return exportReqBuf;
}

- (nullable NSData *) processKeyExportResponse: (UInt64) responderNodeId
                                    exportResp: (NSData *) exportResp
                                         error: (NSError **) errOut {
    WEAVE_ERROR err = WEAVE_NO_ERROR;
    
    if (exportResp == nil) {
        if (errOut) {
            *errOut = [NSError  errorWithDomain: NLWeaveKeyExportClientErrorDomain
                                           code: NLWeaveKeyExportClientErrorDomainInvalidArgument
                                       userInfo: nil];
            }
        return nil;
    }
  
    
    // Since the exported key is contained within the export response, a buffer of the same size
    // is guaranteed to be sufficient.
    size_t exportedKeyBufLen = [exportResp length];
    NSMutableData * exportedKeyBuf = [[NSMutableData alloc] initWithLength:exportedKeyBufLen];
    
    uint16_t exportedKeyLen;
    uint32_t exportedKeyId;
    err = _mKeyExportClientCpp->ProcessKeyExportResponse(
                                                         (unsigned char *) [exportResp bytes],
                                                         [exportResp length],
                                                         (uint64_t) responderNodeId,
                                                         (unsigned char *) [exportedKeyBuf mutableBytes],
                                                         exportedKeyBufLen,
                                                         exportedKeyLen,
                                                         exportedKeyId);
    
    if (err != WEAVE_NO_ERROR) {
        if (errOut) {
            NSString *failureReason = [NSString stringWithFormat:NSLocalizedString(
                                                                                   @"ProcessKeyExportResponse error:: %d", @""), err];
            NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason };
            *errOut = [NSError errorWithDomain:NLWeaveKeyExportClientErrorDomain
                                          code:NLWeaveKeyExportClientErrorDomainKeyExportResponseFailure userInfo: userInfo];
        }
        
        return nil;
    }
    
    [exportedKeyBuf setLength: exportedKeyLen];
    return exportedKeyBuf;
}

- (void) reset {
    _mKeyExportClientCpp->Reset();
}

/**
 @note
 This function can only be called by the ARC runtime
 */
- (void)dealloc
{
    _mKeyExportClientCpp->Reset();
    delete _mKeyExportClientCpp;
}

- (BOOL) processKeyExportReconfigure: (NSData *) reconfig
                            error: (NSError **) errOut {
    
    WEAVE_ERROR err = WEAVE_NO_ERROR;
    
    if (reconfig == nil) {
        if (errOut) {
            *errOut = [NSError errorWithDomain: NLWeaveKeyExportClientErrorDomain
                                          code: NLWeaveKeyExportClientErrorDomainInvalidArgument
                                      userInfo: nil];
        }
        return false;
    }
    
    err = _mKeyExportClientCpp->ProcessKeyExportReconfigure((unsigned char *) [reconfig bytes], [reconfig length]);
    
    if (err != WEAVE_NO_ERROR) {
        if (errOut) {
            NSString *failureReason = [NSString stringWithFormat:NSLocalizedString(
                                                                                   @"ProcessKeyExportResponse error: %d", @""), err];
            NSDictionary *userInfo = @{ NSLocalizedFailureReasonErrorKey: failureReason };
            *errOut = [NSError errorWithDomain:NLWeaveKeyExportClientErrorDomain
                                          code:NLWeaveKeyExportClientErrorDomainProcessReconfiugreFailure userInfo: userInfo];
        }
        return false;
    }
    
    return true;
}

- (BOOL) allowNestDevelopmentDevices {
    
    return _mKeyExportClientCpp->AllowNestDevelopmentDevices();
}

- (void) setAllowNestDevelopmentDevices: (BOOL) nestDev {
    _mKeyExportClientCpp->AllowNestDevelopmentDevices(nestDev);
}

- (BOOL) allowSHA1DeviceCertificates {
    return _mKeyExportClientCpp->AllowSHA1DeviceCerts();
}

- (void) setAllowSHA1DeviceCertificates: (BOOL) nestDev {
    _mKeyExportClientCpp->AllowSHA1DeviceCerts(nestDev);
}

- (instancetype) init {
    self = [super init];
    
    if (self) {
        _mKeyExportClientCpp = new WeaveStandAloneKeyExportClient();
        _mKeyExportClientCpp->Init();
    }
    return self;
}

@end