NODEDC_MISSION_CORE/plugins/xgrids-k1/macos/associate_wifi.swift

650 lines
22 KiB
Swift

import AppKit
import CoreWLAN
import Foundation
import Security
private let keychainService = "NODEDC Mission Core Host Wi-Fi Profiles"
private let credentialMaterialKeychainService =
"NODEDC Mission Core Device Credential Materials"
private struct HostWifiRequest: Decodable {
let action: String
let profileID: String
let ssid: String?
let password: String?
let scanTimeoutSeconds: Double?
let credentialSourceID: String?
enum CodingKeys: String, CodingKey {
case action
case profileID = "profile_id"
case ssid
case password
case scanTimeoutSeconds = "scan_timeout_seconds"
case credentialSourceID = "credential_source_id"
}
}
private struct StoredProfile: Codable {
let schemaVersion: Int
let ssid: String
let password: String
let credentialSource: String?
enum CodingKeys: String, CodingKey {
case schemaVersion = "schema_version"
case ssid
case password
case credentialSource = "credential_source"
}
}
private struct StoredCredentialMaterial: Codable {
let schemaVersion: Int
let password: String
enum CodingKeys: String, CodingKey {
case schemaVersion = "schema_version"
case password
}
}
private struct HostWifiResponse: Encodable {
let ok: Bool
let adapter: String?
let alreadyAssociated: Bool?
let stored: Bool?
let found: Bool?
let profileAvailable: Bool?
let profileEnrolled: Bool?
let scanAttemptCount: Int?
let scanElapsedMilliseconds: Int?
let credentialSource: String?
let reasonCode: String?
enum CodingKeys: String, CodingKey {
case ok
case adapter
case alreadyAssociated = "already_associated"
case stored
case found
case profileAvailable = "profile_available"
case profileEnrolled = "profile_enrolled"
case scanAttemptCount = "scan_attempt_count"
case scanElapsedMilliseconds = "scan_elapsed_ms"
case credentialSource = "credential_source"
case reasonCode = "reason_code"
}
}
private func emit(
ok: Bool,
adapter: String? = nil,
alreadyAssociated: Bool? = nil,
stored: Bool? = nil,
found: Bool? = nil,
profileAvailable: Bool? = nil,
profileEnrolled: Bool? = nil,
scanAttemptCount: Int? = nil,
scanElapsedMilliseconds: Int? = nil,
credentialSource: String? = nil,
reasonCode: String? = nil,
exitCode: Int32
) -> Never {
let response = HostWifiResponse(
ok: ok,
adapter: adapter,
alreadyAssociated: alreadyAssociated,
stored: stored,
found: found,
profileAvailable: profileAvailable,
profileEnrolled: profileEnrolled,
scanAttemptCount: scanAttemptCount,
scanElapsedMilliseconds: scanElapsedMilliseconds,
credentialSource: credentialSource,
reasonCode: reasonCode
)
if let data = try? JSONEncoder().encode(response) {
FileHandle.standardOutput.write(data)
}
exit(exitCode)
}
private func profileIsValid(_ profile: StoredProfile) -> Bool {
guard profile.schemaVersion == 1,
let ssidData = profile.ssid.data(using: .utf8),
(1 ... 32).contains(ssidData.count),
let passwordData = profile.password.data(using: .utf8),
(1 ... 64).contains(passwordData.count)
else {
return false
}
return true
}
private func credentialMaterialIsValid(_ material: StoredCredentialMaterial) -> Bool {
guard material.schemaVersion == 1,
let passwordData = material.password.data(using: .utf8),
(8 ... 63).contains(passwordData.count)
else {
return false
}
return true
}
private func keychainQuery(service: String, account: String) -> [String: Any] {
return [
kSecClass as String: kSecClassGenericPassword,
kSecAttrService as String: service,
kSecAttrAccount as String: account,
]
}
private func profileKeychainQuery(profileID: String) -> [String: Any] {
return keychainQuery(service: keychainService, account: profileID)
}
private func materialKeychainQuery(sourceID: String) -> [String: Any] {
return keychainQuery(service: credentialMaterialKeychainService, account: sourceID)
}
private func loadProfile(profileID: String) throws -> StoredProfile {
var query = profileKeychainQuery(profileID: profileID)
query[kSecReturnData as String] = true
query[kSecMatchLimit as String] = kSecMatchLimitOne
var item: CFTypeRef?
let status = SecItemCopyMatching(query as CFDictionary, &item)
guard status == errSecSuccess, let data = item as? Data else {
throw NSError(domain: "HostWifiProfile", code: Int(status))
}
let profile = try JSONDecoder().decode(StoredProfile.self, from: data)
guard profileIsValid(profile) else {
throw NSError(domain: "HostWifiProfile", code: Int(errSecDecode))
}
return profile
}
private func storeProfile(profileID: String, profile: StoredProfile) throws {
guard profileIsValid(profile) else {
throw NSError(domain: "HostWifiProfile", code: Int(errSecParam))
}
let data = try JSONEncoder().encode(profile)
let query = profileKeychainQuery(profileID: profileID)
let attributes = [
kSecValueData as String: data,
kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly,
] as [String: Any]
let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
if updateStatus == errSecSuccess {
return
}
guard updateStatus == errSecItemNotFound else {
throw NSError(domain: "HostWifiProfile", code: Int(updateStatus))
}
var newItem = query
attributes.forEach { key, value in newItem[key] = value }
let addStatus = SecItemAdd(newItem as CFDictionary, nil)
guard addStatus == errSecSuccess else {
throw NSError(domain: "HostWifiProfile", code: Int(addStatus))
}
}
private func loadCredentialMaterial(sourceID: String) throws -> StoredCredentialMaterial {
var query = materialKeychainQuery(sourceID: sourceID)
query[kSecReturnData as String] = true
query[kSecMatchLimit as String] = kSecMatchLimitOne
var item: CFTypeRef?
let status = SecItemCopyMatching(query as CFDictionary, &item)
guard status == errSecSuccess, let data = item as? Data else {
throw NSError(domain: "HostWifiCredentialMaterial", code: Int(status))
}
let material = try JSONDecoder().decode(StoredCredentialMaterial.self, from: data)
guard credentialMaterialIsValid(material) else {
throw NSError(domain: "HostWifiCredentialMaterial", code: Int(errSecDecode))
}
return material
}
private func storeCredentialMaterial(
sourceID: String,
material: StoredCredentialMaterial
) throws {
guard credentialMaterialIsValid(material) else {
throw NSError(domain: "HostWifiCredentialMaterial", code: Int(errSecParam))
}
let data = try JSONEncoder().encode(material)
let query = materialKeychainQuery(sourceID: sourceID)
let attributes = [
kSecValueData as String: data,
kSecAttrAccessible as String: kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly,
] as [String: Any]
let updateStatus = SecItemUpdate(query as CFDictionary, attributes as CFDictionary)
if updateStatus == errSecSuccess {
return
}
guard updateStatus == errSecItemNotFound else {
throw NSError(domain: "HostWifiCredentialMaterial", code: Int(updateStatus))
}
var newItem = query
attributes.forEach { key, value in newItem[key] = value }
let addStatus = SecItemAdd(newItem as CFDictionary, nil)
guard addStatus == errSecSuccess else {
throw NSError(domain: "HostWifiCredentialMaterial", code: Int(addStatus))
}
}
private func loadSystemWiFiProfile(ssid: String, ssidData: Data) -> StoredProfile? {
var password: NSString?
let status = CWKeychainFindWiFiPassword(
CWKeychainDomain.user,
ssidData,
&password
)
guard status == errSecSuccess, let password else {
return nil
}
let profile = StoredProfile(
schemaVersion: 1,
ssid: ssid,
password: password as String,
credentialSource: "system-wifi-keychain"
)
return profileIsValid(profile) ? profile : nil
}
private struct TargetedScanResult {
let network: CWNetwork?
let attemptCount: Int
let elapsedMilliseconds: Int
}
private func scanForExpectedNetwork(
interface: CWInterface,
ssid: String,
ssidData: Data,
timeoutSeconds: Double
) throws -> TargetedScanResult {
let started = ProcessInfo.processInfo.systemUptime
var attemptCount = 0
while true {
attemptCount += 1
let networks = try interface.scanForNetworks(withSSID: ssidData)
if let network = networks.first(where: { $0.ssid == ssid }) {
return TargetedScanResult(
network: network,
attemptCount: attemptCount,
elapsedMilliseconds: max(
0,
Int((ProcessInfo.processInfo.systemUptime - started) * 1_000)
)
)
}
let elapsed = ProcessInfo.processInfo.systemUptime - started
let remaining = timeoutSeconds - elapsed
if remaining <= 0 {
return TargetedScanResult(
network: nil,
attemptCount: attemptCount,
elapsedMilliseconds: max(0, Int(elapsed * 1_000))
)
}
Thread.sleep(forTimeInterval: min(0.75, remaining))
}
}
private func promptForDevicePassword(ssid: String) -> String? {
let application = NSApplication.shared
application.setActivationPolicy(.accessory)
let passwordField = NSSecureTextField(frame: NSRect(x: 0, y: 0, width: 360, height: 24))
passwordField.placeholderString = "Пароль точки доступа K1"
let alert = NSAlert()
alert.alertStyle = .informational
alert.messageText = "Первое подключение к \(ssid)"
alert.informativeText = "macOS не нашла локальный профиль этой точки доступа. Если credential вам неизвестен, нажмите «Отмена» и выполните авторизованный импорт device-профиля LixelGO. Введённое значение будет сохранено только в Keychain этого Mac и не попадёт в браузер, API, журнал или evidence Mission Core."
alert.accessoryView = passwordField
alert.addButton(withTitle: "Подключиться")
alert.addButton(withTitle: "Отмена")
application.activate(ignoringOtherApps: true)
guard alert.runModal() == .alertFirstButtonReturn else {
return nil
}
return passwordField.stringValue
}
private let input = FileHandle.standardInput.readDataToEndOfFile()
guard input.count <= 2048 else {
emit(ok: false, reasonCode: "request-too-large", exitCode: 1)
}
do {
let request = try JSONDecoder().decode(HostWifiRequest.self, from: input)
guard (1 ... 128).contains(request.profileID.count),
request.profileID.allSatisfy({
$0.isASCII && ($0.isLetter || $0.isNumber || ".-_".contains($0))
})
else {
emit(ok: false, reasonCode: "profile-id-invalid", exitCode: 1)
}
if request.action == "store-profile" {
guard let ssid = request.ssid, let password = request.password else {
emit(ok: false, reasonCode: "credential-missing", exitCode: 1)
}
try storeProfile(
profileID: request.profileID,
profile: StoredProfile(
schemaVersion: 1,
ssid: ssid,
password: password,
credentialSource: nil
)
)
emit(ok: true, adapter: "macOS Keychain", stored: true, exitCode: 0)
}
if request.action == "store-credential-material" {
guard let password = request.password else {
emit(ok: false, reasonCode: "credential-missing", exitCode: 1)
}
try storeCredentialMaterial(
sourceID: request.profileID,
material: StoredCredentialMaterial(schemaVersion: 1, password: password)
)
emit(ok: true, adapter: "macOS Keychain", stored: true, exitCode: 0)
}
if request.action == "check-credential-material" {
do {
_ = try loadCredentialMaterial(sourceID: request.profileID)
emit(
ok: true,
adapter: "macOS Keychain",
profileAvailable: true,
credentialSource: "exact-firmware-profile",
exitCode: 0
)
} catch {
emit(
ok: true,
adapter: "macOS Keychain",
profileAvailable: false,
exitCode: 0
)
}
}
if request.action == "ensure-profile" {
guard let ssid = request.ssid,
let ssidData = ssid.data(using: .utf8),
(1 ... 32).contains(ssidData.count),
let sourceID = request.credentialSourceID,
(1 ... 128).contains(sourceID.count),
sourceID.allSatisfy({
$0.isASCII && ($0.isLetter || $0.isNumber || ".-_".contains($0))
})
else {
emit(ok: false, reasonCode: "credential-source-invalid", exitCode: 1)
}
let material: StoredCredentialMaterial
do {
material = try loadCredentialMaterial(sourceID: sourceID)
} catch {
emit(
ok: true,
adapter: "macOS Keychain",
profileAvailable: false,
profileEnrolled: false,
reasonCode: "credential-source-unavailable",
exitCode: 0
)
}
do {
let existing = try loadProfile(profileID: request.profileID)
guard existing.ssid == ssid else {
emit(
ok: false,
adapter: "macOS Keychain",
profileAvailable: false,
profileEnrolled: false,
reasonCode: "profile-ssid-mismatch",
exitCode: 1
)
}
if existing.password == material.password,
existing.credentialSource != "exact-firmware-profile" {
try storeProfile(
profileID: request.profileID,
profile: StoredProfile(
schemaVersion: 1,
ssid: ssid,
password: existing.password,
credentialSource: "exact-firmware-profile"
)
)
}
emit(
ok: true,
adapter: "macOS Keychain",
profileAvailable: true,
profileEnrolled: false,
credentialSource: existing.password == material.password
? "exact-firmware-profile"
: (existing.credentialSource ?? "mission-core-keychain"),
exitCode: 0
)
} catch {
try storeProfile(
profileID: request.profileID,
profile: StoredProfile(
schemaVersion: 1,
ssid: ssid,
password: material.password,
credentialSource: "exact-firmware-profile"
)
)
emit(
ok: true,
adapter: "macOS Keychain",
profileAvailable: true,
profileEnrolled: true,
credentialSource: "exact-firmware-profile",
exitCode: 0
)
}
}
if request.action == "check-profile" {
let profile: StoredProfile
do {
profile = try loadProfile(profileID: request.profileID)
} catch {
emit(
ok: true,
adapter: "macOS Keychain",
profileAvailable: false,
exitCode: 0
)
}
if let expectedSSID = request.ssid, profile.ssid != expectedSSID {
emit(
ok: false,
adapter: "macOS Keychain",
profileAvailable: false,
reasonCode: "profile-ssid-mismatch",
exitCode: 1
)
}
emit(
ok: true,
adapter: "macOS Keychain",
profileAvailable: true,
exitCode: 0
)
}
guard request.action == "associate" || request.action == "scan-profile" else {
emit(ok: false, reasonCode: "action-unsupported", exitCode: 1)
}
guard let interface = CWWiFiClient.shared().interface() else {
emit(ok: false, reasonCode: "wifi-interface-unavailable", exitCode: 1)
}
let scanTimeoutSeconds = request.scanTimeoutSeconds ?? 0
guard scanTimeoutSeconds >= 0, scanTimeoutSeconds <= 60 else {
emit(ok: false, reasonCode: "scan-timeout-invalid", exitCode: 1)
}
if request.action == "scan-profile" {
let profile: StoredProfile
do {
profile = try loadProfile(profileID: request.profileID)
} catch {
emit(ok: false, reasonCode: "profile-unavailable", exitCode: 1)
}
let ssidData = profile.ssid.data(using: .utf8)!
let scan = try scanForExpectedNetwork(
interface: interface,
ssid: profile.ssid,
ssidData: ssidData,
timeoutSeconds: scanTimeoutSeconds
)
emit(
ok: true,
adapter: "CoreWLAN",
found: scan.network != nil,
scanAttemptCount: scan.attemptCount,
scanElapsedMilliseconds: scan.elapsedMilliseconds,
exitCode: 0
)
}
guard request.action == "associate" else {
emit(ok: false, reasonCode: "action-unsupported", exitCode: 1)
}
guard let expectedSSID = request.ssid,
let expectedSSIDData = expectedSSID.data(using: .utf8),
(1 ... 32).contains(expectedSSIDData.count)
else {
emit(ok: false, reasonCode: "ssid-invalid", exitCode: 1)
}
let scan = try scanForExpectedNetwork(
interface: interface,
ssid: expectedSSID,
ssidData: expectedSSIDData,
timeoutSeconds: scanTimeoutSeconds
)
guard let network = scan.network else {
emit(
ok: false,
scanAttemptCount: scan.attemptCount,
scanElapsedMilliseconds: scan.elapsedMilliseconds,
reasonCode: "network-not-found",
exitCode: 1
)
}
var profileEnrolled = false
var profileNeedsStore = false
let credentialSource: String
let profile: StoredProfile
do {
profile = try loadProfile(profileID: request.profileID)
credentialSource = profile.credentialSource ?? "mission-core-keychain"
} catch {
if let systemProfile = loadSystemWiFiProfile(
ssid: expectedSSID,
ssidData: expectedSSIDData
) {
profile = systemProfile
credentialSource = "system-wifi-keychain"
profileNeedsStore = true
} else {
guard let password = promptForDevicePassword(ssid: expectedSSID) else {
emit(
ok: false,
scanAttemptCount: scan.attemptCount,
scanElapsedMilliseconds: scan.elapsedMilliseconds,
reasonCode: "credential-entry-cancelled",
exitCode: 1
)
}
guard let passwordData = password.data(using: .utf8),
(1 ... 64).contains(passwordData.count)
else {
emit(
ok: false,
scanAttemptCount: scan.attemptCount,
scanElapsedMilliseconds: scan.elapsedMilliseconds,
reasonCode: "credential-invalid",
exitCode: 1
)
}
profile = StoredProfile(
schemaVersion: 1,
ssid: expectedSSID,
password: password,
credentialSource: "native-secure-prompt"
)
credentialSource = "native-secure-prompt"
profileNeedsStore = true
}
}
guard profile.ssid == expectedSSID else {
emit(
ok: false,
scanAttemptCount: scan.attemptCount,
scanElapsedMilliseconds: scan.elapsedMilliseconds,
reasonCode: "profile-ssid-mismatch",
exitCode: 1
)
}
if interface.ssid() == profile.ssid {
if profileNeedsStore {
try storeProfile(profileID: request.profileID, profile: profile)
profileEnrolled = true
}
emit(
ok: true,
adapter: "CoreWLAN",
alreadyAssociated: true,
profileEnrolled: profileEnrolled,
scanAttemptCount: scan.attemptCount,
scanElapsedMilliseconds: scan.elapsedMilliseconds,
credentialSource: credentialSource,
exitCode: 0
)
}
try interface.associate(to: network, password: profile.password)
if profileNeedsStore {
try storeProfile(profileID: request.profileID, profile: profile)
profileEnrolled = true
}
// CoreWLAN's synchronous association call throws on failure. Reading the
// current SSID again would require Location authorization on recent macOS
// versions and could turn a successful association into a false negative.
emit(
ok: true,
adapter: "CoreWLAN",
alreadyAssociated: false,
profileEnrolled: profileEnrolled,
scanAttemptCount: scan.attemptCount,
scanElapsedMilliseconds: scan.elapsedMilliseconds,
credentialSource: credentialSource,
exitCode: 0
)
} catch {
emit(ok: false, reasonCode: "corewlan-error", exitCode: 1)
}