No OneTemporary
Actions

Size

48 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/src/crypto/crypto.cpp b/src/crypto/crypto.cpp
	index 1272204..50a54ab 100644
	--- a/src/crypto/crypto.cpp
	+++ b/src/crypto/crypto.cpp
	@@ -1,644 +1,675 @@
	/*
	* Copyright (C) 2020-2021 Tusooa Zhu <tusooa@kazv.moe>
	*
	* This file is part of libkazv.
	*
	* libkazv is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License as
	* published by the Free Software Foundation, either version 3 of the
	* License, or (at your option) any later version.
	*
	* libkazv is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU Affero General Public License for more details.
	*
	* You should have received a copy of the GNU Affero General Public License
	* along with libkazv. If not, see <https://www.gnu.org/licenses/>.
	*/

	#include <libkazv-config.hpp>

	#include <vector>

	#include <zug/transducer/filter.hpp>

	#include <olm/olm.h>

	#include <nlohmann/json.hpp>

	#include <debug.hpp>
	#include <event.hpp>
	#include <cursorutil.hpp>
	#include <types.hpp>

	#include "crypto-p.hpp"
	#include "session-p.hpp"

	#include "crypto-util.hpp"
	#include "time-util.hpp"

	namespace Kazv
	{
	using namespace CryptoConstants;

	CryptoPrivate::CryptoPrivate()
	: accountData(olm_account_size(), 0)
	, account(olm_account(accountData.data()))
	, utilityData(olm_utility_size(), '\0')
	, utility(olm_utility(utilityData.data()))
	{
	auto randLen = Crypto::constructRandomSize();
	auto randomData = genRandom(randLen);
	checkError(olm_create_account(account, randomData.data(), randLen));
	}

	CryptoPrivate::CryptoPrivate(RandomTag, RandomData data)
	: accountData(olm_account_size(), 0)
	, account(olm_account(accountData.data()))
	, utilityData(olm_utility_size(), '\0')
	, utility(olm_utility(utilityData.data()))
	{
	auto randLenNeeded = Crypto::constructRandomSize();
	checkError(olm_create_account(account, data.data(), randLenNeeded));
	}


	CryptoPrivate::~CryptoPrivate()
	{
	olm_clear_account(account);
	}

	CryptoPrivate::CryptoPrivate(const CryptoPrivate &that)
	: accountData(olm_account_size(), 0)
	, account(olm_account(accountData.data()))
	, uploadedOneTimeKeysCount(that.uploadedOneTimeKeysCount)
	, numUnpublishedKeys(that.numUnpublishedKeys)
	, knownSessions(that.knownSessions)
	, inboundGroupSessions(that.inboundGroupSessions)
	, outboundGroupSessions(that.outboundGroupSessions)
	, utilityData(olm_utility_size(), '\0')
	, utility(olm_utility(utilityData.data()))
	{
	unpickle(that.pickle());
	}

	std::string CryptoPrivate::pickle() const
	{
	auto key = ByteArray(3, 'x');
	auto pickleData = std::string(olm_pickle_account_length(account), '\0');
	checkError(olm_pickle_account(account, key.data(), key.size(),
	pickleData.data(), pickleData.size()));
	return pickleData;
	}

	void CryptoPrivate::unpickle(std::string pickleData)
	{
	auto key = ByteArray(3, 'x');
	checkError(olm_unpickle_account(account, key.data(), key.size(),
	pickleData.data(), pickleData.size()));
	}

	std::size_t CryptoPrivate::checkError(std::size_t code) const
	{
	if (code == olm_error()) {
	kzo.crypto.warn() << "Olm error: " << olm_account_last_error(account) << std::endl;
	}
	return code;
	}

	std::size_t CryptoPrivate::checkUtilError(std::size_t code) const
	{
	if (code == olm_error()) {
	kzo.crypto.warn() << "Olm utility error: " << olm_utility_last_error(utility) << std::endl;
	}
	return code;
	}


	MaybeString CryptoPrivate::decryptOlm(nlohmann::json content)
	{
	auto theirCurve25519IdentityKey = content.at("sender_key").get<std::string>();

	auto ourCurve25519IdentityKey = curve25519IdentityKey();

	if (! content.at("ciphertext").contains(ourCurve25519IdentityKey)) {
	return NotBut("Message not intended for us");
	}

	auto type = content.at("ciphertext").at(ourCurve25519IdentityKey).at("type").get<int>();
	auto body = content.at("ciphertext").at(ourCurve25519IdentityKey).at("body").get<std::string>();

	auto hasKnownSession = knownSessions.find(theirCurve25519IdentityKey) != knownSessions.end();

	if (type == 0) { // pre-key message
	bool shouldCreateNewSession =
	// there is no possible session
	(! hasKnownSession)
	// the possible session does not match this message
	\|\| (! knownSessions.at(theirCurve25519IdentityKey).matches(body));

	if (shouldCreateNewSession) {
	auto created = createInboundSession(theirCurve25519IdentityKey, body);
	if (! created) { // cannot create session, thus cannot decrypt
	return NotBut("Cannot create session");
	}
	}

	auto &session = knownSessions.at(theirCurve25519IdentityKey);

	return session.decrypt(type, body);
	} else {
	if (! hasKnownSession) {
	return NotBut("No available session");
	}

	auto &session = knownSessions.at(theirCurve25519IdentityKey);
	return session.decrypt(type, body);
	}
	}

	MaybeString CryptoPrivate::decryptMegOlm(nlohmann::json eventJson)
	{
	auto content = eventJson.at("content");

	auto senderKey = content.at("sender_key").get<std::string>();
	auto sessionId = content.at("session_id").get<std::string>();
	auto roomId = eventJson.at("room_id").get<std::string>();

	auto k = KeyOfGroupSession{roomId, senderKey, sessionId};

	if (inboundGroupSessions.find(k) == inboundGroupSessions.end()) {
	return NotBut("We do not have the keys for this");
	} else {
	auto msg = content.at("ciphertext").get<std::string>();
	auto eventId = eventJson.at("event_id").get<std::string>();
	auto originServerTs = eventJson.at("origin_server_ts").get<Timestamp>();
	auto &session = inboundGroupSessions.at(k);

	return session.decrypt(msg, eventId, originServerTs);
	}
	}

	bool CryptoPrivate::createInboundSession(std::string theirCurve25519IdentityKey,
	std::string message)
	{
	auto s = Session(InboundSessionTag{}, account,
	theirCurve25519IdentityKey, message);

	if (s.valid()) {
	checkError(olm_remove_one_time_keys(account, s.m_d->session));
	knownSessions.insert_or_assign(theirCurve25519IdentityKey, std::move(s));
	return true;
	}

	return false;
	}

	bool CryptoPrivate::reuseOrCreateOutboundGroupSession(
	RandomData random, Timestamp timeMs,
	std::string roomId, std::optional<MegOlmSessionRotateDesc> desc)
	{
	bool valid = true;
	if (! desc.has_value()) { // force rotate
	valid = false;
	} else {
	auto it = outboundGroupSessions.find(roomId);
	if (it == outboundGroupSessions.end()) {
	valid = false;
	} else {
	auto &session = it->second;
	if (timeMs - session.creationTimeMs() >= desc.value().ms) {
	valid = false;
	} else if (session.messageIndex() >= desc.value().messages) {
	valid = false;
	}
	}
	}

	if (! valid) {
	outboundGroupSessions.insert_or_assign(roomId, OutboundGroupSession(RandomTag{}, random, timeMs));
	auto &session = outboundGroupSessions.at(roomId);
	auto sessionId = session.sessionId();
	auto sessionKey = session.sessionKey();
	auto senderKey = curve25519IdentityKey();

	auto k = KeyOfGroupSession{roomId, senderKey, sessionId};

	if (! createInboundGroupSession(k, sessionKey, ed25519IdentityKey())) {
	kzo.client.warn() << "Create inbound group session from outbound group session failed. We may not be able to read our own messages." << std::endl;
	}
	}
	return valid;
	}


	std::size_t Crypto::constructRandomSize()
	{
	static std::size_t s =
	[] {
	std::vector<char> acc(olm_account_size(), 0);
	OlmAccount *account = olm_account(acc.data());
	return olm_create_account_random_length(account);
	}();
	return s;
	}

	Crypto::Crypto()
	: m_d(new CryptoPrivate{})
	{
	}

	Crypto::Crypto(RandomTag, RandomData data)
	: m_d(new CryptoPrivate(RandomTag{}, std::move(data)))
	{
	}

	Crypto::~Crypto() = default;

	Crypto::Crypto(const Crypto &that)
	: m_d(new CryptoPrivate(*that.m_d))
	{
	}

	Crypto::Crypto(Crypto &&that)
	: m_d(std::move(that.m_d))
	{
	}

	Crypto &Crypto::operator=(const Crypto &that)
	{
	m_d.reset(new CryptoPrivate(*that.m_d));
	return *this;
	}

	Crypto &Crypto::operator=(Crypto &&that)
	{
	m_d = std::move(that.m_d);
	return *this;
	}

	ByteArray CryptoPrivate::identityKeys()
	{
	auto ret = ByteArray(olm_account_identity_keys_length(account), '\0');
	checkError(olm_account_identity_keys(account, ret.data(), ret.size()));
	return ret;
	}

	std::string CryptoPrivate::ed25519IdentityKey()
	{
	auto keys = identityKeys();
	auto keyStr = std::string(keys.begin(), keys.end());
	auto keyJson = nlohmann::json::parse(keyStr);
	return keyJson.at(ed25519);
	}

	std::string CryptoPrivate::curve25519IdentityKey()
	{
	auto keys = identityKeys();
	auto keyStr = std::string(keys.begin(), keys.end());
	auto keyJson = nlohmann::json::parse(keyStr);
	return keyJson.at(curve25519);
	}

	std::string Crypto::ed25519IdentityKey()
	{
	return m_d->ed25519IdentityKey();
	}

	std::string Crypto::curve25519IdentityKey()
	{
	return m_d->curve25519IdentityKey();
	}

	std::string Crypto::sign(nlohmann::json j)
	{
	j.erase("signatures");
	j.erase("unsigned");

	auto str = j.dump();

	auto ret = ByteArray(olm_account_signature_length(m_d->account), '\0');

	kzo.crypto.dbg() << "We are about to sign: " << str << std::endl;

	m_d->checkError(olm_account_sign(m_d->account,
	str.data(), str.size(),
	ret.data(), ret.size()));

	return std::string{ret.begin(), ret.end()};
	}

	void Crypto::setUploadedOneTimeKeysCount(immer::map<std::string /* algorithm */, int> uploadedOneTimeKeysCount)
	{
	m_d->uploadedOneTimeKeysCount = uploadedOneTimeKeysCount;
	}

	int Crypto::maxNumberOfOneTimeKeys()
	{
	return olm_account_max_number_of_one_time_keys(m_d->account);
	}

	std::size_t Crypto::genOneTimeKeysRandomSize(int num)
	{
	static std::size_t oneKeyRandomSize =
	[] {
	std::vector<char> acc(olm_account_size(), 0);
	OlmAccount *account = olm_account(acc.data());
	return olm_account_generate_one_time_keys_random_length(account, 1);
	}();

	return oneKeyRandomSize * num;
	}

	void Crypto::genOneTimeKeys(int num)
	{
	auto random = genRandomData(genOneTimeKeysRandomSize(num));
	genOneTimeKeysWithRandom(std::move(random), num);
	}

	void Crypto::genOneTimeKeysWithRandom(RandomData random, int num)
	{
	assert(random.size() >= genOneTimeKeysRandomSize(num));

	auto res = m_d->checkError(
	olm_account_generate_one_time_keys(
	m_d->account,
	num,
	random.data(), random.size()));

	if (res != olm_error()) {
	m_d->numUnpublishedKeys += num;
	}
	}


	nlohmann::json Crypto::unpublishedOneTimeKeys()
	{
	auto keys = ByteArray(olm_account_one_time_keys_length(m_d->account), '\0');
	m_d->checkError(olm_account_one_time_keys(m_d->account, keys.data(), keys.size()));

	return nlohmann::json::parse(std::string(keys.begin(), keys.end()));
	}

	void Crypto::markOneTimeKeysAsPublished()
	{
	auto ret = m_d->checkError(olm_account_mark_keys_as_published(m_d->account));
	if (ret != olm_error()) {
	m_d->numUnpublishedKeys = 0;
	}
	}

	int Crypto::numUnpublishedOneTimeKeys() const
	{
	return m_d->numUnpublishedKeys;
	}

	int Crypto::uploadedOneTimeKeysCount(std::string algorithm) const
	{
	return m_d->uploadedOneTimeKeysCount[algorithm];
	}

	MaybeString Crypto::decrypt(nlohmann::json eventJson)
	{
	auto content = eventJson.at("content");
	auto algo = content.at("algorithm").get<std::string>();
	if (algo == olmAlgo) {
	return m_d->decryptOlm(std::move(content));
	} else if (algo == megOlmAlgo) {
	return m_d->decryptMegOlm(eventJson);
	}
	return NotBut("Algorithm " + algo + " not supported");
	}

	bool Crypto::createInboundGroupSession(KeyOfGroupSession k, std::string sessionKey, std::string ed25519Key)
	{
	return m_d->createInboundGroupSession(std::move(k), std::move(sessionKey), std::move(ed25519Key));
	}

	bool CryptoPrivate::createInboundGroupSession(KeyOfGroupSession k, std::string sessionKey, std::string ed25519Key)
	{
	auto session = InboundGroupSession(sessionKey, ed25519Key);
	if (session.valid()) {
	inboundGroupSessions.insert_or_assign(k, std::move(session));
	return true;
	}
	return false;
	}

	bool Crypto::verify(nlohmann::json object, std::string userId, std::string deviceId, std::string ed25519Key)
	{
	if (! object.contains("signatures")) {
	return false;
	}
	std::string signature;
	try {
	signature = object.at("signatures").at(userId).at(ed25519 + ":" + deviceId);
	} catch(const std::exception &) {
	return false;
	}
	object.erase("signatures");
	object.erase("unsigned");

	auto message = object.dump();

	auto res = m_d->checkUtilError(
	olm_ed25519_verify(m_d->utility,
	ed25519Key.c_str(), ed25519Key.size(),
	message.c_str(), message.size(),
	signature.data(), signature.size()));

	return res != olm_error();
	}

	MaybeString Crypto::getInboundGroupSessionEd25519KeyFromEvent(const nlohmann::json &eventJson) const
	{
	auto content = eventJson.at("content");

	auto senderKey = content.at("sender_key").get<std::string>();
	auto sessionId = content.at("session_id").get<std::string>();
	auto roomId = eventJson.at("room_id").get<std::string>();

	auto k = KeyOfGroupSession{roomId, senderKey, sessionId};

	if (m_d->inboundGroupSessions.find(k) == m_d->inboundGroupSessions.end()) {
	return NotBut("We do not have the keys for this");
	} else {
	auto &session = m_d->inboundGroupSessions.at(k);
	return session.ed25519Key();
	}
	}

	+ std::size_t Crypto::encryptOlmRandomSize(std::string /* theirCurve25519IdentityKey */) const
	+ {
	+ // HACK: To prevent a possible race condition where we call
	+ // encryptedOlmRandomSize() -> randomGenerator.generateRange() ~> [encryptOlm()]
	+ //
	+ // Here, encryptOlm() must be called in the reducer,
	+ // as it changes the status of
	+ // Crypto (so we should not risk any infomation lose in Crypto).
	+ // Also, for the reducer to be pure, we may not call generateRange() in the reducer,
	+ // as that is not a pure function. This means it can only be called in an effect,
	+ // or .then() continuation. This means, the sequence from encryptedOlmRandomSize()
	+ // to encryptOlm() can never be atomic. That is, there may be other encryptOlm()
	+ // calls within, and that may increase the random data needed, and as a result,
	+ // we will not have enough random data.
	+ //
	+ // According to the olm headers:
	+ // https://gitlab.matrix.org/matrix-org/olm/-/blob/master/include/olm/ratchet.hh
	+ // The maximum random size needed to encrypt is 32. We use this to ensure we
	+ // will always have enough random data fot the encryption.
	+ static std::size_t maxRandomSizeNeeded = 32;
	+ return maxRandomSizeNeeded;
	+ }
	+
	nlohmann::json Crypto::encryptOlm(nlohmann::json eventJson, std::string theirCurve25519IdentityKey)
	{
	+ auto random = genRandomData(encryptOlmRandomSize(theirCurve25519IdentityKey));
	+ return encryptOlmWithRandom(random, std::move(eventJson), std::move(theirCurve25519IdentityKey));
	+ }
	+
	+ nlohmann::json Crypto::encryptOlmWithRandom(
	+ RandomData random, nlohmann::json eventJson, std::string theirCurve25519IdentityKey)
	+ {
	+ assert(random.size() >= encryptOlmRandomSize(theirCurve25519IdentityKey));
	try {
	auto &session = m_d->knownSessions.at(theirCurve25519IdentityKey);
	- auto [type, body] = session.encrypt(eventJson.dump());
	+ auto [type, body] = session.encryptWithRandom(random, eventJson.dump());
	return nlohmann::json{
	{
	theirCurve25519IdentityKey, {
	{"type", type},
	{"body", body}
	}
	}
	};
	} catch (const std::exception &) {
	return nlohmann::json::object();
	}
	}

	nlohmann::json Crypto::encryptMegOlm(nlohmann::json eventJson)
	{
	auto roomId = eventJson.at("room_id").get<std::string>();
	auto content = eventJson.at("content");
	auto type = eventJson.at("type").get<std::string>();

	auto jsonToEncrypt = nlohmann::json::object();
	jsonToEncrypt["room_id"] = roomId;
	jsonToEncrypt["content"] = std::move(content);
	jsonToEncrypt["type"] = type;

	auto textToEncrypt = std::move(jsonToEncrypt).dump();

	auto &session = m_d->outboundGroupSessions.at(roomId);

	auto ciphertext = session.encrypt(std::move(textToEncrypt));

	return
	json{
	{"algorithm", CryptoConstants::megOlmAlgo},
	{"sender_key", curve25519IdentityKey()},
	{"ciphertext", ciphertext},
	{"session_id", session.sessionId()},
	};
	}

	std::size_t Crypto::rotateMegOlmSessionRandomSize()
	{
	return OutboundGroupSession::constructRandomSize();
	}

	std::string Crypto::rotateMegOlmSession(std::string roomId)
	{
	return rotateMegOlmSessionWithRandom(genRandomData(rotateMegOlmSessionRandomSize()), currentTimeMs(), roomId);
	}

	std::string Crypto::rotateMegOlmSessionWithRandom(RandomData random, Timestamp timeMs, std::string roomId)
	{
	m_d->reuseOrCreateOutboundGroupSession(
	random, timeMs,
	roomId, std::nullopt);
	return outboundGroupSessionCurrentKey(roomId);
	}

	std::optional<std::string> Crypto::rotateMegOlmSessionIfNeeded(std::string roomId, MegOlmSessionRotateDesc desc)
	{
	return rotateMegOlmSessionWithRandomIfNeeded(
	genRandomData(rotateMegOlmSessionRandomSize()), currentTimeMs(),
	roomId, desc);
	}

	std::optional<std::string> Crypto::rotateMegOlmSessionWithRandomIfNeeded(
	RandomData random, Timestamp timeMs,
	std::string roomId, MegOlmSessionRotateDesc desc)
	{
	auto oldSessionValid = m_d->reuseOrCreateOutboundGroupSession(random, timeMs, roomId, std::move(desc));
	return oldSessionValid ? std::nullopt : std::optional(outboundGroupSessionCurrentKey(roomId));
	}

	std::string Crypto::outboundGroupSessionInitialKey(std::string roomId)
	{
	auto &session = m_d->outboundGroupSessions.at(roomId);
	return session.initialSessionKey();
	}

	std::string Crypto::outboundGroupSessionCurrentKey(std::string roomId)
	{
	auto &session = m_d->outboundGroupSessions.at(roomId);
	return session.sessionKey();
	}

	auto Crypto::devicesMissingOutboundSessionKey(
	immer::map<std::string, immer::map<std::string /* deviceId */,
	std::string /* curve25519IdentityKey */>> keyMap) const -> UserIdToDeviceIdMap
	{
	auto ret = UserIdToDeviceIdMap{};
	for (auto [userId, devices] : keyMap) {
	auto unknownDevices =
	intoImmer(immer::flex_vector<std::string>{},
	zug::filter([=](auto kv) {
	auto [deviceId, theirCurve25519IdentityKey] = kv;
	return m_d->knownSessions.find(theirCurve25519IdentityKey)
	== m_d->knownSessions.end();
	})
	\| zug::map([=](auto kv) {
	auto [deviceId, key] = kv;
	return deviceId;
	}),
	devices);
	if (! unknownDevices.empty()) {
	ret = std::move(ret).set(userId, std::move(unknownDevices));
	}
	}
	return ret;
	}

	std::size_t Crypto::createOutboundSessionRandomSize()
	{
	return Session::constructOutboundRandomSize();
	}

	// TODO remove this
	void Crypto::createOutboundSession(std::string theirIdentityKey,
	std::string theirOneTimeKey)
	{
	createOutboundSessionWithRandom(
	genRandomData(createOutboundSessionRandomSize()),
	theirIdentityKey, theirOneTimeKey);
	}

	void Crypto::createOutboundSessionWithRandom(
	RandomData random,
	std::string theirIdentityKey,
	std::string theirOneTimeKey)
	{
	assert(random.size() >= createOutboundSessionRandomSize());
	auto session = Session(OutboundSessionTag{},
	RandomTag{},
	random,
	m_d->account,
	theirIdentityKey,
	theirOneTimeKey);

	if (session.valid()) {
	m_d->knownSessions.insert_or_assign(theirIdentityKey,
	std::move(session));
	}
	}

	nlohmann::json Crypto::toJson() const
	{
	std::string pickledData = m_d->pickle();
	auto j = nlohmann::json::object({
	{"account", std::move(pickledData)},
	{"uploadedOneTimeKeysCount", m_d->uploadedOneTimeKeysCount},
	{"numUnpublishedKeys", m_d->numUnpublishedKeys},
	{"knownSessions", nlohmann::json(m_d->knownSessions)},
	{"inboundGroupSessions", nlohmann::json(m_d->inboundGroupSessions)},
	{"outboundGroupSessions", nlohmann::json(m_d->outboundGroupSessions)},
	});

	return j;
	}

	void Crypto::loadJson(const nlohmann::json &j)
	{
	const auto &pickledData = j.at("account").template get<std::string>();
	m_d->unpickle(pickledData);
	m_d->uploadedOneTimeKeysCount = j.at("uploadedOneTimeKeysCount");
	m_d->numUnpublishedKeys = j.at("numUnpublishedKeys");
	m_d->knownSessions = j.at("knownSessions").template get<decltype(m_d->knownSessions)>();
	m_d->inboundGroupSessions = j.at("inboundGroupSessions").template get<decltype(m_d->inboundGroupSessions)>();
	m_d->outboundGroupSessions = j.at("outboundGroupSessions").template get<decltype(m_d->outboundGroupSessions)>();
	}
	}
	diff --git a/src/crypto/crypto.hpp b/src/crypto/crypto.hpp
	index d762c25..dcd9400 100644
	--- a/src/crypto/crypto.hpp
	+++ b/src/crypto/crypto.hpp
	@@ -1,257 +1,284 @@
	/*
	* Copyright (C) 2020-2021 Tusooa Zhu <tusooa@kazv.moe>
	*
	* This file is part of libkazv.
	*
	* libkazv is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License as
	* published by the Free Software Foundation, either version 3 of the
	* License, or (at your option) any later version.
	*
	* libkazv is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU Affero General Public License for more details.
	*
	* You should have received a copy of the GNU Affero General Public License
	* along with libkazv. If not, see <https://www.gnu.org/licenses/>.
	*/

	#pragma once
	#include <libkazv-config.hpp>

	#include <memory>

	#include <nlohmann/json.hpp>

	#include <immer/map.hpp>
	#include <immer/flex_vector.hpp>

	#include <maybe.hpp>

	#include "crypto-util.hpp"
	#include "time-util.hpp"

	namespace Kazv
	{
	class Session;

	struct MegOlmSessionRotateDesc
	{
	/// The time limit of the megolm session, in milliseconds.
	Timestamp ms{};
	/// The message limit of the megolm session.
	int messages{};
	};

	struct CryptoPrivate;
	class Crypto
	{
	public:
	[[deprecated("Use deterministic variant instead. In the future, this will construct an invalid Crypto.")]]
	explicit Crypto();

	/**
	* @return The size of random data needed to construct a Crypto.
	*/
	static std::size_t constructRandomSize();

	/**
	* Constructs a Crypto using user-provided random data.
	*
	* @param data Random data of size at least `constructRandomSize()`.
	*/
	Crypto(RandomTag, RandomData data);

	Crypto(const Crypto &that);
	Crypto(Crypto &&that);
	Crypto &operator=(const Crypto &that);
	Crypto &operator=(Crypto &&that);
	~Crypto();

	std::string ed25519IdentityKey();
	std::string curve25519IdentityKey();

	std::string sign(nlohmann::json j);

	void setUploadedOneTimeKeysCount(immer::map<std::string /* algorithm */, int> uploadedOneTimeKeysCount);

	int uploadedOneTimeKeysCount(std::string algorithm) const;

	int maxNumberOfOneTimeKeys();

	/**
	* Get the size of random data needed to generate `num`
	* one-time keys.
	*
	* @param num The number of one-time keys to generate.
	*
	* @return The size of random data needed to generate
	* `num` one-time keys.
	*/
	static std::size_t genOneTimeKeysRandomSize(int num);

	[[deprecated("Use the deterministic variant. In the future, this will be removed.")]]
	void genOneTimeKeys(int num);

	/**
	* Generate `num` one-time keys with user-provided random data.
	*
	* @param random The random data. Must be of at least size
	* `genOneTimeKeysRandomSize(num)`.
	* @param num The number of one-time keys to generate.
	*/
	void genOneTimeKeysWithRandom(RandomData random, int num);

	/**
	* According to olm.h, this returns an object like
	*
	* {
	* curve25519: {
	* "AAAAAA": "wo76WcYtb0Vk/pBOdmduiGJ0wIEjW4IBMbbQn7aSnTo",
	* "AAAAAB": "LRvjo46L1X2vx69sS9QNFD29HWulxrmW11Up5AfAjgU"
	* }
	* }
	*/
	nlohmann::json unpublishedOneTimeKeys();

	int numUnpublishedOneTimeKeys() const;

	void markOneTimeKeysAsPublished();

	/// Returns decrypted message if we can decrypt it
	/// otherwise returns the error
	MaybeString decrypt(nlohmann::json eventJson);

	+ /**
	+ * @return The size of random data needed to encrypt a message
	+ * for the session identified with `theirCurve25519IdentityKey`.
	+ */
	+ std::size_t encryptOlmRandomSize(std::string theirCurve25519IdentityKey) const;

	/** returns a json object that looks like
	* {
	* "<their identity key>": {
	* "type": <number>,
	* "body": "<body>"
	* }
	* }
	*/
	+ [[deprecated("Use deterministic variant instead. In the future, this will be removed.")]]
	nlohmann::json encryptOlm(nlohmann::json eventJson, std::string theirCurve25519IdentityKey);

	+ /**
	+ * Encrypt `eventJson` with olm, for the recipient identified with `theirCurve25519IdentityKey`.
	+ *
	+ * @param random The random data to use for encryption. Must be of
	+ * at least size `encryptOlmRandomSize(theirCurve25519IdentityKey)`.
	+ * @param eventJson The event json to encrypt.
	+ * @param theirCurve25519IdentityKey The curve25519 identity key of the recipient.
	+ *
	+ * @return A json object that looks like
	+ * ```
	+ * {
	+ * "<their identity key>": {
	+ * "type": <number>,
	+ * "body": "<body>"
	+ * }
	+ * }
	+ * ```
	+ */
	+ nlohmann::json encryptOlmWithRandom(
	+ RandomData random, nlohmann::json eventJson, std::string theirCurve25519IdentityKey);
	+
	/// returns the content template with everything but deviceId
	/// eventJson should contain type, room_id and content
	nlohmann::json encryptMegOlm(nlohmann::json eventJson);

	bool createInboundGroupSession(KeyOfGroupSession k, std::string sessionKey, std::string ed25519Key);

	std::string outboundGroupSessionInitialKey(std::string roomId);

	std::string outboundGroupSessionCurrentKey(std::string roomId);

	/// Check whether the signature of userId/deviceId is valid in object
	bool verify(nlohmann::json object, std::string userId, std::string deviceId, std::string ed25519Key);

	MaybeString getInboundGroupSessionEd25519KeyFromEvent(const nlohmann::json &eventJson) const;

	/**
	* @return The size of random data needed for `rotateMegOlmSessionWithRandom()`
	* and `rotateMegOlmSessionWithRandomIfNeeded()`.
	*/
	static std::size_t rotateMegOlmSessionRandomSize();

	/// Returns the new session key
	[[deprecated("Use deterministic variant instead. In the future, this will be removed.")]]
	std::string rotateMegOlmSession(std::string roomId);

	/**
	* Rotate the megolm session using user-provided random data.
	*
	* @param random The random data. Must be of at least size
	* `rotateMegOlmSessionRandomSize()`.
	* @param timeMs The creation time of the new megolm session.
	* @param roomId The room id of the megolm session to rotate.
	*
	* @return The new session key.
	*/
	std::string rotateMegOlmSessionWithRandom(RandomData random, Timestamp timeMs, std::string roomId);

	/// Returns the new session key only if it is rotated
	[[deprecated("Use deterministic variant instead. In the future, this will be removed.")]]
	std::optional<std::string> rotateMegOlmSessionIfNeeded(std::string roomId, MegOlmSessionRotateDesc desc);

	/**
	* Rotate the megolm session using user-provided random data,
	* if we need to rotate it.
	*
	* The session will be rotated if and only if
	* - The difference between `timeMs` and the creation time of
	* the megolm session has reached the time limit in `desc`, OR;
	* - The number of messages this megolm session has encrypted has
	* reached the message limit in `desc`.
	*
	* @param random The random data. Must be of at least size
	* `rotateMegOlmSessionRandomSize()`.
	* @param timeMs The timestamp to judge whether the session
	* has reached its time limit. If the megolm session is rotated,
	* this will also be the creation time of the new megolm session.
	* @param roomId The room id of the megolm session to rotate.
	* @param desc The rotation specification of this room.
	*
	* @return The session key if the session is rotated,
	* `std::nullopt` otherwise.
	*/
	std::optional<std::string> rotateMegOlmSessionWithRandomIfNeeded(
	RandomData random,
	Timestamp timeMs,
	std::string roomId,
	MegOlmSessionRotateDesc desc);

	using UserIdToDeviceIdMap = immer::map<std::string, immer::flex_vector<std::string>>;
	UserIdToDeviceIdMap devicesMissingOutboundSessionKey(
	immer::map<std::string, immer::map<std::string /* deviceId */,
	std::string /* curve25519IdentityKey */>> keyMap) const;

	[[deprecated("Use deterministic variant instead. In the future, this will be removed.")]]
	void createOutboundSession(std::string theirIdentityKey,
	std::string theirOneTimeKey);

	/**
	* @return The size of random data needed for `createOutboundSessionWithRandom()`.
	*/
	static std::size_t createOutboundSessionRandomSize();

	/**
	* Create an outbound session using user-provided random data.
	*
	* @param random The random data to use. It must be at least of
	* size `createOutboundSessionRandomSize()`.
	* @param theirIdeneityKey The identity key of the recipient.
	* @param theirOneTimeKey The one-time key of the recipient.
	*/
	void createOutboundSessionWithRandom(
	RandomData random,
	std::string theirIdentityKey,
	std::string theirOneTimeKey);

	template<class Archive>
	void save(Archive & ar, const unsigned int /* version */) const {
	ar << toJson().dump();
	}

	template<class Archive>
	void load(Archive &ar, const unsigned int /* version */) {
	std::string j;
	ar >> j;
	loadJson(nlohmann::json::parse(std::move(j)));
	}

	BOOST_SERIALIZATION_SPLIT_MEMBER()

	nlohmann::json toJson() const;
	void loadJson(const nlohmann::json &j);

	private:

	friend class Session;
	friend class SessionPrivate;
	std::unique_ptr<CryptoPrivate> m_d;
	};
	}

	BOOST_CLASS_VERSION(Kazv::Crypto, 0)
	diff --git a/src/crypto/session.cpp b/src/crypto/session.cpp
	index 5011351..5b42f80 100644
	--- a/src/crypto/session.cpp
	+++ b/src/crypto/session.cpp
	@@ -1,291 +1,301 @@
	/*
	* Copyright (C) 2021 Tusooa Zhu <tusooa@kazv.moe>
	*
	* This file is part of libkazv.
	*
	* libkazv is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License as
	* published by the Free Software Foundation, either version 3 of the
	* License, or (at your option) any later version.
	*
	* libkazv is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU Affero General Public License for more details.
	*
	* You should have received a copy of the GNU Affero General Public License
	* along with libkazv. If not, see <https://www.gnu.org/licenses/>.
	*/

	#include <libkazv-config.hpp>

	#include <olm/olm.h>

	#include <debug.hpp>

	#include "crypto-p.hpp"
	#include "session-p.hpp"


	namespace Kazv
	{
	std::size_t SessionPrivate::checkError(std::size_t code) const
	{
	if (code == olm_error()) {
	kzo.crypto.warn() << "Olm session error: " << olm_session_last_error(session) << std::endl;
	}
	return code;
	}

	SessionPrivate::SessionPrivate()
	: sessionData(olm_session_size(), '\0')
	, session(olm_session(sessionData.data()))
	{
	}

	SessionPrivate::SessionPrivate(OutboundSessionTag,
	OlmAccount *acc,
	std::string theirIdentityKey,
	std::string theirOneTimeKey)
	: SessionPrivate()
	{
	auto random = genRandom(Session::constructOutboundRandomSize());

	auto res = checkError(olm_create_outbound_session(
	session,
	acc,
	theirIdentityKey.c_str(), theirIdentityKey.size(),
	theirOneTimeKey.c_str(), theirOneTimeKey.size(),
	random.data(), random.size()));

	if (res != olm_error()) {
	valid = true;
	}
	}

	SessionPrivate::SessionPrivate(OutboundSessionTag,
	RandomTag,
	RandomData random,
	OlmAccount *acc,
	std::string theirIdentityKey,
	std::string theirOneTimeKey)
	: SessionPrivate()
	{
	assert(random.size() >= Session::constructOutboundRandomSize());

	auto res = checkError(olm_create_outbound_session(
	session,
	acc,
	theirIdentityKey.c_str(), theirIdentityKey.size(),
	theirOneTimeKey.c_str(), theirOneTimeKey.size(),
	random.data(), random.size()));

	if (res != olm_error()) {
	valid = true;
	}
	}

	SessionPrivate::SessionPrivate(InboundSessionTag,
	OlmAccount *acc,
	std::string theirIdentityKey,
	std::string message)
	: SessionPrivate()
	{
	auto res = checkError(olm_create_inbound_session_from(
	session,
	acc,
	theirIdentityKey.c_str(), theirIdentityKey.size(),
	message.data(), message.size()));

	if (res != olm_error()) {
	valid = true;
	}
	}

	SessionPrivate::SessionPrivate(const SessionPrivate &that)
	: SessionPrivate()
	{
	valid = unpickle(that.pickle());
	}

	std::string SessionPrivate::pickle() const
	{
	auto pickleData = std::string(olm_pickle_session_length(session), '\0');
	auto key = ByteArray(3, 'x');
	checkError(olm_pickle_session(session,
	key.data(), key.size(),
	pickleData.data(), pickleData.size()));
	return pickleData;
	}

	bool SessionPrivate::unpickle(std::string pickleData)
	{
	auto key = ByteArray(3, 'x');
	auto res = checkError(olm_unpickle_session(
	session,
	key.data(), key.size(),
	pickleData.data(), pickleData.size()));

	return res != olm_error();
	}


	std::size_t Session::constructOutboundRandomSize()
	{
	static size_t s =
	[] {
	ByteArray sessionData(olm_session_size(), '\0');
	OlmSession *session(olm_session(sessionData.data()));
	return olm_create_outbound_session_random_length(session);
	}();
	return s;
	}

	Session::Session()
	: m_d(new SessionPrivate)
	{
	}

	Session::Session(OutboundSessionTag,
	OlmAccount *acc,
	std::string theirIdentityKey,
	std::string theirOneTimeKey)
	: m_d(new SessionPrivate{
	OutboundSessionTag{},
	acc,
	theirIdentityKey,
	theirOneTimeKey})
	{
	}

	Session::Session(OutboundSessionTag,
	RandomTag,
	RandomData data,
	OlmAccount *acc,
	std::string theirIdentityKey,
	std::string theirOneTimeKey)
	: m_d(new SessionPrivate{
	OutboundSessionTag{},
	RandomTag{},
	std::move(data),
	acc,
	theirIdentityKey,
	theirOneTimeKey})
	{
	}

	Session::Session(InboundSessionTag,
	OlmAccount *acc,
	std::string theirIdentityKey,
	std::string theirOneTimeKey)
	: m_d(new SessionPrivate{
	InboundSessionTag{},
	acc,
	theirIdentityKey,
	theirOneTimeKey})
	{
	}

	Session::~Session() = default;

	Session::Session(const Session &that)
	: m_d(new SessionPrivate(*that.m_d))
	{
	}

	Session::Session(Session &&that)
	: m_d(std::move(that.m_d))
	{
	}

	Session &Session::operator=(const Session &that)
	{
	m_d.reset(new SessionPrivate(*that.m_d));
	return *this;
	}

	Session &Session::operator=(Session &&that)
	{
	m_d = std::move(that.m_d);
	return *this;
	}


	bool Session::matches(std::string message)
	{
	auto res = m_d->checkError(
	olm_matches_inbound_session(m_d->session, message.data(), message.size()));

	// if match, returns 1
	return res == 1;
	}

	bool Session::valid() const
	{
	// maybe a moved-from state, so check m_d first
	return m_d && m_d->valid;
	}

	MaybeString Session::decrypt(int type, std::string message)
	{
	auto msgBuffer = ByteArray(message.begin(), message.end());

	auto size = m_d->checkError(olm_decrypt_max_plaintext_length(
	m_d->session, type, msgBuffer.data(), msgBuffer.size()));

	if (size == olm_error()) {
	return NotBut(m_d->error());
	}

	auto plainTextBuffer = ByteArray(size, '\0');

	auto actualSize = m_d->checkError(
	olm_decrypt(m_d->session, type,
	message.data(), message.size(),
	plainTextBuffer.data(), plainTextBuffer.size()));

	if (actualSize == olm_error()) {
	return NotBut(m_d->error());
	}

	return std::string(plainTextBuffer.begin(), plainTextBuffer.begin() + actualSize);
	}

	+ std::size_t Session::encryptRandomSize() const
	+ {
	+ return olm_encrypt_random_length(m_d->session);
	+ }
	+
	std::pair<int, std::string> Session::encrypt(std::string plainText)
	{
	- auto randomData = genRandom(olm_encrypt_random_length(m_d->session));
	+ return encryptWithRandom(genRandomData(encryptRandomSize()), std::move(plainText));
	+ }
	+
	+ std::pair<int, std::string> Session::encryptWithRandom(RandomData random, std::string plainText)
	+ {
	+ assert(random.size() >= encryptRandomSize());

	auto type = m_d->checkError(olm_encrypt_message_type(m_d->session));

	auto size = m_d->checkError(olm_encrypt_message_length(m_d->session, plainText.size()));

	auto buf = ByteArray(size, '\0');

	auto actualSize = m_d->checkError(
	olm_encrypt(m_d->session, plainText.c_str(), plainText.size(),
	- randomData.data(), randomData.size(),
	+ random.data(), random.size(),
	buf.data(), buf.size()));

	if (actualSize != olm_error()) {
	return { type, std::string(buf.begin(), buf.begin() + actualSize) };
	}

	return { -1, "" };
	}

	void to_json(nlohmann::json &j, const Session &s)
	{
	j = nlohmann::json::object({
	{"valid", s.m_d->valid},
	{"data", s.m_d->valid ? s.m_d->pickle() : std::string()}
	});
	}

	void from_json(const nlohmann::json &j, Session &s)
	{
	if (j.at("valid").template get<bool>()) {
	s.m_d->valid = s.m_d->unpickle(j.at("data"));
	}
	}

	}
	diff --git a/src/crypto/session.hpp b/src/crypto/session.hpp
	index df34b98..8849e61 100644
	--- a/src/crypto/session.hpp
	+++ b/src/crypto/session.hpp
	@@ -1,99 +1,117 @@
	/*
	* Copyright (C) 2021 Tusooa Zhu <tusooa@kazv.moe>
	*
	* This file is part of libkazv.
	*
	* libkazv is free software: you can redistribute it and/or modify
	* it under the terms of the GNU Affero General Public License as
	* published by the Free Software Foundation, either version 3 of the
	* License, or (at your option) any later version.
	*
	* libkazv is distributed in the hope that it will be useful,
	* but WITHOUT ANY WARRANTY; without even the implied warranty of
	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
	* GNU Affero General Public License for more details.
	*
	* You should have received a copy of the GNU Affero General Public License
	* along with libkazv. If not, see <https://www.gnu.org/licenses/>.
	*/

	#pragma once
	#include <libkazv-config.hpp>

	#include <memory>
	#include <tuple>

	#include <olm/olm.h>

	#include <maybe.hpp>

	#include "crypto-util.hpp"

	namespace Kazv
	{
	class Crypto;

	struct InboundSessionTag {};
	struct OutboundSessionTag {};

	struct SessionPrivate;
	class Session
	{
	/**
	* @return The size of random data needed to construct an outbound session.
	*/
	static std::size_t constructOutboundRandomSize();

	// Creates an outbound session
	[[deprecated("Use deterministic variant instead. In the future, this will be removed.")]]
	explicit Session(OutboundSessionTag,
	OlmAccount *acc,
	std::string theirIdentityKey,
	std::string theirOneTimeKey);

	/**
	* Construct an outbound session with custom random data.
	*
	* @param data The custom random data. Must be of at least
	* size `constructOutboundRandomSize()`.
	*/
	explicit Session(OutboundSessionTag,
	RandomTag,
	RandomData data,
	OlmAccount *acc,
	std::string theirIdentityKey,
	std::string theirOneTimeKey);

	// Creates an inbound session
	explicit Session(InboundSessionTag,
	OlmAccount *acc,
	std::string theirIdentityKey,
	std::string message);

	public:
	explicit Session();

	Session(const Session &that);
	Session(Session &&that);
	Session &operator=(const Session &that);
	Session &operator=(Session &&that);
	~Session();

	bool matches(std::string message);

	bool valid() const;

	MaybeString decrypt(int type, std::string message);

	+ /**
	+ * @return The size of random data needed for the next encryption.
	+ */
	+ std::size_t encryptRandomSize() const;
	+
	+ [[deprecated("Use deterministic variant instead. In the future, this will be removed.")]]
	std::pair<int /* type /, std::string / message */> encrypt(std::string plainText);

	+ /**
	+ * Encrypt plainText.
	+ *
	+ * @param random The random data needed for the encryption. Must be
	+ * of at least size `encryptRandomSize()`.
	+ * @param plainText The plain text to encrypt.
	+ *
	+ * @return A pair containing the type and encrypted message string.
	+ */
	+ std::pair<int /* type /, std::string / message */> encryptWithRandom(
	+ RandomData random, std::string plainText);
	+
	private:
	friend class Crypto;
	friend class CryptoPrivate;
	friend class SessionPrivate;

	friend void to_json(nlohmann::json &j, const Session &s);
	friend void from_json(const nlohmann::json &j, Session &s);
	std::unique_ptr<SessionPrivate> m_d;
	};
	}

File Metadata

Mime Type: text/x-diff
Expires: Wed, Oct 14, 2:01 AM (1 d, 20 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1786970
Default Alt Text: (48 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions