keejef
/
session-desktop
mirror of https://github.com/oxen-io/session-desktop
2
0
Fork 0
Code Issues 8 Projects Releases Wiki Activity

Unify processVerifiedMessage with Java implementation

Browse Source 
This removes our support for the New Key/DEFAULT case, which iOS will
sync to us. Why? Because it ensures that in out of date scenarios, we
don't lose the higher-security state we were in previously.

FREEBIE
pull/749/head
Scott Nonnenberg 8 years ago
parent 5bba6d3f17
commit 91f50c028f
2 changed files with 93 additions and 39 deletions
Show Stats Download Patch File Download Diff File

96
js/signal_protocol_store.js
Unescape Escape View File

@ -580,6 +580,72 @@
}); });
}, },
// Resolves to true if a new identity key was saved // Resolves to true if a new identity key was saved
processContactSyncVerificationState: function(identifier, verifiedStatus, publicKey) {
if (verifiedStatus === VerifiedStatus.UNVERIFIED) {
return this.processUnverifiedMessage(identifier, verifiedStatus, publicKey);
} else {
return this.processVerifiedMessage(identifier, verifiedStatus, publicKey);
}
},
// This function encapsulates the non-Java behavior, since the mobile apps don't
// currently receive contact syncs and therefore will see a verify sync with
// UNVERIFIED status
processUnverifiedMessage: function(identifier, verifiedStatus, publicKey) {
if (identifier === null || identifier === undefined) {
throw new Error("Tried to set verified for undefined/null key");
}
if (publicKey !== undefined && !(publicKey instanceof ArrayBuffer)) {
throw new Error("Invalid public key");
}
return new Promise(function(resolve, reject) {
var identityRecord = new IdentityRecord({id: identifier});
var isPresent = false;
var isEqual = false;
identityRecord.fetch().then(function() {
isPresent = true;
if (publicKey) {
isEqual = equalArrayBuffers(publicKey, identityRecord.get('publicKey'));
}
}).always(function() {
if (isPresent
&& isEqual
&& identityRecord.get('verified') !== VerifiedStatus.UNVERIFIED) {
return textsecure.storage.protocol.setVerified(
identifier, verifiedStatus, publicKey
).then(resolve, reject);
}
if (!isPresent || !isEqual) {
return textsecure.storage.protocol.saveIdentityWithAttributes(identifier, {
publicKey : publicKey,
verified : verifiedStatus,
firstUse : false,
timestamp : Date.now(),
nonblockingApproval : true
}).then(function() {
if (isPresent && !isEqual) {
this.trigger('keychange', identifier);
return this.archiveAllSessions(identifier).then(function() {
// true signifies that we overwrote a previous key with a new one
return resolve(true);
}, reject);
}
return resolve();
}.bind(this), reject);
}
// The situation which could get us here is:
// 1. had a previous key
// 2. new key is the same
// 3. desired new status is same as what we had before
return resolve();
}.bind(this));
}.bind(this));
},
// This matches the Java method as of
// https://github.com/WhisperSystems/Signal-Android/blob/d0bb68e1378f689e4d10ac6a46014164992ca4e4/src/org/thoughtcrime/securesms/util/IdentityUtil.java#L188
processVerifiedMessage: function(identifier, verifiedStatus, publicKey) { processVerifiedMessage: function(identifier, verifiedStatus, publicKey) {
if (identifier === null || identifier === undefined) { if (identifier === null || identifier === undefined) {
throw new Error("Tried to set verified for undefined/null key"); throw new Error("Tried to set verified for undefined/null key");
@ -600,35 +666,24 @@
isEqual = equalArrayBuffers(publicKey, identityRecord.get('publicKey')); isEqual = equalArrayBuffers(publicKey, identityRecord.get('publicKey'));
} }
}).always(function() { }).always(function() {
// Because new keys always start as DEFAULT, we don't need to create new record here
if (!isPresent && verifiedStatus === VerifiedStatus.DEFAULT) { if (!isPresent && verifiedStatus === VerifiedStatus.DEFAULT) {
console.log('No existing record for default status'); console.log('No existing record for default status');
return resolve(); return resolve();
} }
// If we had a key before and it's the same, and we're not changing to
// VERIFIED, then it's a simple update of the verified flag.
if (isPresent && isEqual if (isPresent && isEqual
&& identityRecord.get('verified') !== verifiedStatus && identityRecord.get('verified') !== VerifiedStatus.DEFAULT
&& verifiedStatus !== VerifiedStatus.VERIFIED) { && verifiedStatus === VerifiedStatus.DEFAULT) {
return textsecure.storage.protocol.setVerified( return textsecure.storage.protocol.setVerified(
identifier, verifiedStatus, publicKey identifier, verifiedStatus, publicKey
).then(resolve, reject); ).then(resolve, reject);
} }
// We need to create a new record in three cases: if (verifiedStatus === VerifiedStatus.VERIFIED
// 1. We had no key previously (checks above ensure that this is && (!isPresent
// either VERIFIED/UNVERIFIED) || (isPresent && !isEqual)
// 2. We had a key before, but we got a new key || (isPresent && identityRecord.get('verified') !== VerifiedStatus.VERIFIED))) {
// (no matter the VERIFIED state)
// 3. It's the same key, but we weren't VERIFIED before and are now
// (checks above handle the situation when 'state != VERIFIED')
if (!isPresent
|| (isPresent && !isEqual)
|| (isPresent
&& identityRecord.get('verified') !== verifiedStatus
&& verifiedStatus === VerifiedStatus.VERIFIED)) {
return textsecure.storage.protocol.saveIdentityWithAttributes(identifier, { return textsecure.storage.protocol.saveIdentityWithAttributes(identifier, {
publicKey : publicKey, publicKey : publicKey,
@ -649,10 +704,9 @@
}.bind(this), reject); }.bind(this), reject);
} }
// The situation which could get us here is: // We get here if we got a new key and the status is DEFAULT. If the
// 1. had a previous key // message is out of date, we don't want to lose whatever more-secure
// 2. new key is the same // state we had before.
// 3. desired new status is same as what we had before
return resolve(); return resolve();
}.bind(this)); }.bind(this));
}.bind(this)); }.bind(this));

36
test/storage_test.js
Unescape Escape View File

@ -355,7 +355,7 @@ describe("SignalProtocolStore", function() {
}); });
}); });
}); });
describe('processVerifiedMessage', function() { describe('processContactSyncVerificationState', function() {
var record; var record;
var newIdentity = libsignal.crypto.getRandomBytes(33); var newIdentity = libsignal.crypto.getRandomBytes(33);
var keychangeTriggered; var keychangeTriggered;
@ -387,12 +387,12 @@ describe("SignalProtocolStore", function() {
}); });
it ('does nothing', function() { it ('does nothing', function() {
return store.processVerifiedMessage( return store.processContactSyncVerificationState(
identifier, store.VerifiedStatus.DEFAULT, newIdentity identifier, store.VerifiedStatus.DEFAULT, newIdentity
).then(fetchRecord).then(function() { ).then(fetchRecord).then(function() {
// fetchRecord resolved so there is a record. // fetchRecord resolved so there is a record.
// Bad. // Bad.
throw new Error("processVerifiedMessage should not save new records"); throw new Error("processContactSyncVerificationState should not save new records");
}, function() { }, function() {
assert.strictEqual(keychangeTriggered, 0); assert.strictEqual(keychangeTriggered, 0);
}); });
@ -412,13 +412,13 @@ describe("SignalProtocolStore", function() {
return wrapDeferred(record.save()); return wrapDeferred(record.save());
}); });
it ('saves the new identity and marks it DEFAULT', function() { it ('does not save the new identity (because this is a less secure state)', function() {
return store.processVerifiedMessage( return store.processContactSyncVerificationState(
identifier, store.VerifiedStatus.DEFAULT, newIdentity identifier, store.VerifiedStatus.DEFAULT, newIdentity
).then(fetchRecord).then(function() { ).then(fetchRecord).then(function() {
assert.strictEqual(record.get('verified'), store.VerifiedStatus.DEFAULT); assert.strictEqual(record.get('verified'), store.VerifiedStatus.VERIFIED);
assertEqualArrayBuffers(record.get('publicKey'), newIdentity); assertEqualArrayBuffers(record.get('publicKey'), testKey.pubKey);
assert.strictEqual(keychangeTriggered, 1); assert.strictEqual(keychangeTriggered, 0);
}); });
}); });
}); });
@ -436,7 +436,7 @@ describe("SignalProtocolStore", function() {
}); });
it ('updates the verified status', function() { it ('updates the verified status', function() {
return store.processVerifiedMessage( return store.processContactSyncVerificationState(
identifier, store.VerifiedStatus.DEFAULT, testKey.pubKey identifier, store.VerifiedStatus.DEFAULT, testKey.pubKey
).then(fetchRecord).then(function() { ).then(fetchRecord).then(function() {
assert.strictEqual(record.get('verified'), store.VerifiedStatus.DEFAULT); assert.strictEqual(record.get('verified'), store.VerifiedStatus.DEFAULT);
@ -459,7 +459,7 @@ describe("SignalProtocolStore", function() {
}); });
it ('does not hang', function() { it ('does not hang', function() {
return store.processVerifiedMessage( return store.processContactSyncVerificationState(
identifier, store.VerifiedStatus.DEFAULT, testKey.pubKey identifier, store.VerifiedStatus.DEFAULT, testKey.pubKey
).then(fetchRecord).then(function() { ).then(fetchRecord).then(function() {
assert.strictEqual(keychangeTriggered, 0); assert.strictEqual(keychangeTriggered, 0);
@ -476,7 +476,7 @@ describe("SignalProtocolStore", function() {
}); });
it ('saves the new identity and marks it verified', function() { it ('saves the new identity and marks it verified', function() {
return store.processVerifiedMessage( return store.processContactSyncVerificationState(
identifier, store.VerifiedStatus.UNVERIFIED, newIdentity identifier, store.VerifiedStatus.UNVERIFIED, newIdentity
).then(fetchRecord).then(function() { ).then(fetchRecord).then(function() {
assert.strictEqual(record.get('verified'), store.VerifiedStatus.UNVERIFIED); assert.strictEqual(record.get('verified'), store.VerifiedStatus.UNVERIFIED);
@ -500,7 +500,7 @@ describe("SignalProtocolStore", function() {
}); });
it ('saves the new identity and marks it UNVERIFIED', function() { it ('saves the new identity and marks it UNVERIFIED', function() {
return store.processVerifiedMessage( return store.processContactSyncVerificationState(
identifier, store.VerifiedStatus.UNVERIFIED, newIdentity identifier, store.VerifiedStatus.UNVERIFIED, newIdentity
).then(fetchRecord).then(function() { ).then(fetchRecord).then(function() {
assert.strictEqual(record.get('verified'), store.VerifiedStatus.UNVERIFIED); assert.strictEqual(record.get('verified'), store.VerifiedStatus.UNVERIFIED);
@ -523,7 +523,7 @@ describe("SignalProtocolStore", function() {
}); });
it ('updates the verified status', function() { it ('updates the verified status', function() {
return store.processVerifiedMessage( return store.processContactSyncVerificationState(
identifier, store.VerifiedStatus.UNVERIFIED, testKey.pubKey identifier, store.VerifiedStatus.UNVERIFIED, testKey.pubKey
).then(fetchRecord).then(function() { ).then(fetchRecord).then(function() {
assert.strictEqual(record.get('verified'), store.VerifiedStatus.UNVERIFIED); assert.strictEqual(record.get('verified'), store.VerifiedStatus.UNVERIFIED);
@ -546,7 +546,7 @@ describe("SignalProtocolStore", function() {
}); });
it ('does not hang', function() { it ('does not hang', function() {
return store.processVerifiedMessage( return store.processContactSyncVerificationState(
identifier, store.VerifiedStatus.UNVERIFIED, testKey.pubKey identifier, store.VerifiedStatus.UNVERIFIED, testKey.pubKey
).then(fetchRecord).then(function() { ).then(fetchRecord).then(function() {
assert.strictEqual(keychangeTriggered, 0); assert.strictEqual(keychangeTriggered, 0);
@ -565,7 +565,7 @@ describe("SignalProtocolStore", function() {
}); });
it ('saves the new identity and marks it verified', function() { it ('saves the new identity and marks it verified', function() {
return store.processVerifiedMessage( return store.processContactSyncVerificationState(
identifier, store.VerifiedStatus.VERIFIED, newIdentity identifier, store.VerifiedStatus.VERIFIED, newIdentity
).then(fetchRecord).then(function() { ).then(fetchRecord).then(function() {
assert.strictEqual(record.get('verified'), store.VerifiedStatus.VERIFIED); assert.strictEqual(record.get('verified'), store.VerifiedStatus.VERIFIED);
@ -589,7 +589,7 @@ describe("SignalProtocolStore", function() {
}); });
it ('saves the new identity and marks it VERIFIED', function() { it ('saves the new identity and marks it VERIFIED', function() {
return store.processVerifiedMessage( return store.processContactSyncVerificationState(
identifier, store.VerifiedStatus.VERIFIED, newIdentity identifier, store.VerifiedStatus.VERIFIED, newIdentity
).then(fetchRecord).then(function() { ).then(fetchRecord).then(function() {
assert.strictEqual(record.get('verified'), store.VerifiedStatus.VERIFIED); assert.strictEqual(record.get('verified'), store.VerifiedStatus.VERIFIED);
@ -612,7 +612,7 @@ describe("SignalProtocolStore", function() {
}); });
it ('saves the identity and marks it verified', function() { it ('saves the identity and marks it verified', function() {
return store.processVerifiedMessage( return store.processContactSyncVerificationState(
identifier, store.VerifiedStatus.VERIFIED, testKey.pubKey identifier, store.VerifiedStatus.VERIFIED, testKey.pubKey
).then(fetchRecord).then(function() { ).then(fetchRecord).then(function() {
assert.strictEqual(record.get('verified'), store.VerifiedStatus.VERIFIED); assert.strictEqual(record.get('verified'), store.VerifiedStatus.VERIFIED);
@ -635,7 +635,7 @@ describe("SignalProtocolStore", function() {
}); });
it ('does not hang', function() { it ('does not hang', function() {
return store.processVerifiedMessage( return store.processContactSyncVerificationState(
identifier, store.VerifiedStatus.VERIFIED, testKey.pubKey identifier, store.VerifiedStatus.VERIFIED, testKey.pubKey
).then(fetchRecord).then(function() { ).then(fetchRecord).then(function() {
assert.strictEqual(keychangeTriggered, 0); assert.strictEqual(keychangeTriggered, 0);

Write Preview
Loading…
Cancel
Save