1package eu.siacs.conversations.crypto.axolotl;
2
3import android.os.Bundle;
4import android.security.KeyChain;
5import android.support.annotation.NonNull;
6import android.support.annotation.Nullable;
7import android.util.Log;
8import android.util.Pair;
9
10import org.bouncycastle.jce.provider.BouncyCastleProvider;
11import org.whispersystems.libsignal.SignalProtocolAddress;
12import org.whispersystems.libsignal.IdentityKey;
13import org.whispersystems.libsignal.IdentityKeyPair;
14import org.whispersystems.libsignal.InvalidKeyException;
15import org.whispersystems.libsignal.InvalidKeyIdException;
16import org.whispersystems.libsignal.SessionBuilder;
17import org.whispersystems.libsignal.UntrustedIdentityException;
18import org.whispersystems.libsignal.ecc.ECPublicKey;
19import org.whispersystems.libsignal.state.PreKeyBundle;
20import org.whispersystems.libsignal.state.PreKeyRecord;
21import org.whispersystems.libsignal.state.SignedPreKeyRecord;
22import org.whispersystems.libsignal.util.KeyHelper;
23
24import java.security.PrivateKey;
25import java.security.Security;
26import java.security.Signature;
27import java.security.cert.X509Certificate;
28import java.util.ArrayList;
29import java.util.Arrays;
30import java.util.Collection;
31import java.util.Collections;
32import java.util.HashMap;
33import java.util.HashSet;
34import java.util.Iterator;
35import java.util.List;
36import java.util.Map;
37import java.util.Random;
38import java.util.Set;
39import java.util.concurrent.atomic.AtomicBoolean;
40
41import eu.siacs.conversations.Config;
42import eu.siacs.conversations.entities.Account;
43import eu.siacs.conversations.entities.Contact;
44import eu.siacs.conversations.entities.Conversation;
45import eu.siacs.conversations.entities.Message;
46import eu.siacs.conversations.parser.IqParser;
47import eu.siacs.conversations.services.XmppConnectionService;
48import eu.siacs.conversations.utils.CryptoHelper;
49import eu.siacs.conversations.utils.SerialSingleThreadExecutor;
50import eu.siacs.conversations.xml.Element;
51import eu.siacs.conversations.xml.Namespace;
52import eu.siacs.conversations.xmpp.OnAdvancedStreamFeaturesLoaded;
53import eu.siacs.conversations.xmpp.OnIqPacketReceived;
54import eu.siacs.conversations.xmpp.jid.InvalidJidException;
55import eu.siacs.conversations.xmpp.jid.Jid;
56import eu.siacs.conversations.xmpp.pep.PublishOptions;
57import eu.siacs.conversations.xmpp.stanzas.IqPacket;
58
59public class AxolotlService implements OnAdvancedStreamFeaturesLoaded {
60
61 public static final String PEP_PREFIX = "eu.siacs.conversations.axolotl";
62 public static final String PEP_DEVICE_LIST = PEP_PREFIX + ".devicelist";
63 public static final String PEP_DEVICE_LIST_NOTIFY = PEP_DEVICE_LIST + "+notify";
64 public static final String PEP_BUNDLES = PEP_PREFIX + ".bundles";
65 public static final String PEP_VERIFICATION = PEP_PREFIX + ".verification";
66 public static final String PEP_OMEMO_WHITELISTED = PEP_PREFIX + ".whitelisted";
67
68 public static final String LOGPREFIX = "AxolotlService";
69
70 public static final int NUM_KEYS_TO_PUBLISH = 100;
71 public static final int publishTriesThreshold = 3;
72
73 private final Account account;
74 private final XmppConnectionService mXmppConnectionService;
75 private final SQLiteAxolotlStore axolotlStore;
76 private final SessionMap sessions;
77 private final Map<Jid, Set<Integer>> deviceIds;
78 private final Map<String, XmppAxolotlMessage> messageCache;
79 private final FetchStatusMap fetchStatusMap;
80 private final HashMap<Jid,List<OnDeviceIdsFetched>> fetchDeviceIdsMap = new HashMap<>();
81 private final SerialSingleThreadExecutor executor;
82 private int numPublishTriesOnEmptyPep = 0;
83 private boolean pepBroken = false;
84 private int lastDeviceListNotificationHash = 0;
85
86 private AtomicBoolean changeAccessMode = new AtomicBoolean(false);
87
88 @Override
89 public void onAdvancedStreamFeaturesAvailable(Account account) {
90 if (Config.supportOmemo()
91 && account.getXmppConnection() != null
92 && account.getXmppConnection().getFeatures().pep()) {
93 publishBundlesIfNeeded(true, false);
94 } else {
95 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": skipping OMEMO initialization");
96 }
97 }
98
99 public boolean fetchMapHasErrors(List<Jid> jids) {
100 for(Jid jid : jids) {
101 if (deviceIds.get(jid) != null) {
102 for (Integer foreignId : this.deviceIds.get(jid)) {
103 SignalProtocolAddress address = new SignalProtocolAddress(jid.toPreppedString(), foreignId);
104 if (fetchStatusMap.getAll(address.getName()).containsValue(FetchStatus.ERROR)) {
105 return true;
106 }
107 }
108 }
109 }
110 return false;
111 }
112
113 public void preVerifyFingerprint(Contact contact, String fingerprint) {
114 axolotlStore.preVerifyFingerprint(contact.getAccount(), contact.getJid().toBareJid().toPreppedString(), fingerprint);
115 }
116
117 public void preVerifyFingerprint(Account account, String fingerprint) {
118 axolotlStore.preVerifyFingerprint(account, account.getJid().toBareJid().toPreppedString(), fingerprint);
119 }
120
121 public boolean hasVerifiedKeys(String name) {
122 for(XmppAxolotlSession session : this.sessions.getAll(name).values()) {
123 if (session.getTrust().isVerified()) {
124 return true;
125 }
126 }
127 return false;
128 }
129
130 private static class AxolotlAddressMap<T> {
131 protected Map<String, Map<Integer, T>> map;
132 protected final Object MAP_LOCK = new Object();
133
134 public AxolotlAddressMap() {
135 this.map = new HashMap<>();
136 }
137
138 public void put(SignalProtocolAddress address, T value) {
139 synchronized (MAP_LOCK) {
140 Map<Integer, T> devices = map.get(address.getName());
141 if (devices == null) {
142 devices = new HashMap<>();
143 map.put(address.getName(), devices);
144 }
145 devices.put(address.getDeviceId(), value);
146 }
147 }
148
149 public T get(SignalProtocolAddress address) {
150 synchronized (MAP_LOCK) {
151 Map<Integer, T> devices = map.get(address.getName());
152 if (devices == null) {
153 return null;
154 }
155 return devices.get(address.getDeviceId());
156 }
157 }
158
159 public Map<Integer, T> getAll(String name) {
160 synchronized (MAP_LOCK) {
161 Map<Integer, T> devices = map.get(name);
162 if (devices == null) {
163 return new HashMap<>();
164 }
165 return devices;
166 }
167 }
168
169 public boolean hasAny(SignalProtocolAddress address) {
170 synchronized (MAP_LOCK) {
171 Map<Integer, T> devices = map.get(address.getName());
172 return devices != null && !devices.isEmpty();
173 }
174 }
175
176 public void clear() {
177 map.clear();
178 }
179
180 }
181
182 private static class SessionMap extends AxolotlAddressMap<XmppAxolotlSession> {
183 private final XmppConnectionService xmppConnectionService;
184 private final Account account;
185
186 public SessionMap(XmppConnectionService service, SQLiteAxolotlStore store, Account account) {
187 super();
188 this.xmppConnectionService = service;
189 this.account = account;
190 this.fillMap(store);
191 }
192
193 private void putDevicesForJid(String bareJid, List<Integer> deviceIds, SQLiteAxolotlStore store) {
194 for (Integer deviceId : deviceIds) {
195 SignalProtocolAddress axolotlAddress = new SignalProtocolAddress(bareJid, deviceId);
196 IdentityKey identityKey = store.loadSession(axolotlAddress).getSessionState().getRemoteIdentityKey();
197 if(Config.X509_VERIFICATION) {
198 X509Certificate certificate = store.getFingerprintCertificate(CryptoHelper.bytesToHex(identityKey.getPublicKey().serialize()));
199 if (certificate != null) {
200 Bundle information = CryptoHelper.extractCertificateInformation(certificate);
201 try {
202 final String cn = information.getString("subject_cn");
203 final Jid jid = Jid.fromString(bareJid);
204 Log.d(Config.LOGTAG,"setting common name for "+jid+" to "+cn);
205 account.getRoster().getContact(jid).setCommonName(cn);
206 } catch (final InvalidJidException ignored) {
207 //ignored
208 }
209 }
210 }
211 this.put(axolotlAddress, new XmppAxolotlSession(account, store, axolotlAddress, identityKey));
212 }
213 }
214
215 private void fillMap(SQLiteAxolotlStore store) {
216 List<Integer> deviceIds = store.getSubDeviceSessions(account.getJid().toBareJid().toPreppedString());
217 putDevicesForJid(account.getJid().toBareJid().toPreppedString(), deviceIds, store);
218 for (String address : store.getKnownAddresses()) {
219 deviceIds = store.getSubDeviceSessions(address);
220 putDevicesForJid(address, deviceIds, store);
221 }
222 }
223
224 @Override
225 public void put(SignalProtocolAddress address, XmppAxolotlSession value) {
226 super.put(address, value);
227 value.setNotFresh();
228 }
229
230 public void put(XmppAxolotlSession session) {
231 this.put(session.getRemoteAddress(), session);
232 }
233 }
234
235 public enum FetchStatus {
236 PENDING,
237 SUCCESS,
238 SUCCESS_VERIFIED,
239 TIMEOUT,
240 SUCCESS_TRUSTED,
241 ERROR
242 }
243
244 private static class FetchStatusMap extends AxolotlAddressMap<FetchStatus> {
245
246 public void clearErrorFor(Jid jid) {
247 synchronized (MAP_LOCK) {
248 Map<Integer, FetchStatus> devices = this.map.get(jid.toBareJid().toPreppedString());
249 if (devices == null) {
250 return;
251 }
252 for(Map.Entry<Integer, FetchStatus> entry : devices.entrySet()) {
253 if (entry.getValue() == FetchStatus.ERROR) {
254 Log.d(Config.LOGTAG,"resetting error for "+jid.toBareJid()+"("+entry.getKey()+")");
255 entry.setValue(FetchStatus.TIMEOUT);
256 }
257 }
258 }
259 }
260 }
261
262 public static String getLogprefix(Account account) {
263 return LOGPREFIX + " (" + account.getJid().toBareJid().toString() + "): ";
264 }
265
266 public AxolotlService(Account account, XmppConnectionService connectionService) {
267 if (account == null || connectionService == null) {
268 throw new IllegalArgumentException("account and service cannot be null");
269 }
270 if (Security.getProvider("BC") == null) {
271 Security.addProvider(new BouncyCastleProvider());
272 }
273 this.mXmppConnectionService = connectionService;
274 this.account = account;
275 this.axolotlStore = new SQLiteAxolotlStore(this.account, this.mXmppConnectionService);
276 this.deviceIds = new HashMap<>();
277 this.messageCache = new HashMap<>();
278 this.sessions = new SessionMap(mXmppConnectionService, axolotlStore, account);
279 this.fetchStatusMap = new FetchStatusMap();
280 this.executor = new SerialSingleThreadExecutor("Axolotl");
281 }
282
283 public String getOwnFingerprint() {
284 return CryptoHelper.bytesToHex(axolotlStore.getIdentityKeyPair().getPublicKey().serialize());
285 }
286
287 public Set<IdentityKey> getKeysWithTrust(FingerprintStatus status) {
288 return axolotlStore.getContactKeysWithTrust(account.getJid().toBareJid().toPreppedString(), status);
289 }
290
291 public Set<IdentityKey> getKeysWithTrust(FingerprintStatus status, Jid jid) {
292 return axolotlStore.getContactKeysWithTrust(jid.toBareJid().toPreppedString(), status);
293 }
294
295 public Set<IdentityKey> getKeysWithTrust(FingerprintStatus status, List<Jid> jids) {
296 Set<IdentityKey> keys = new HashSet<>();
297 for(Jid jid : jids) {
298 keys.addAll(axolotlStore.getContactKeysWithTrust(jid.toPreppedString(), status));
299 }
300 return keys;
301 }
302
303 public long getNumTrustedKeys(Jid jid) {
304 return axolotlStore.getContactNumTrustedKeys(jid.toBareJid().toPreppedString());
305 }
306
307 public boolean anyTargetHasNoTrustedKeys(List<Jid> jids) {
308 for(Jid jid : jids) {
309 if (axolotlStore.getContactNumTrustedKeys(jid.toBareJid().toPreppedString()) == 0) {
310 return true;
311 }
312 }
313 return false;
314 }
315
316 private SignalProtocolAddress getAddressForJid(Jid jid) {
317 return new SignalProtocolAddress(jid.toPreppedString(), 0);
318 }
319
320 public Collection<XmppAxolotlSession> findOwnSessions() {
321 SignalProtocolAddress ownAddress = getAddressForJid(account.getJid().toBareJid());
322 ArrayList<XmppAxolotlSession> s = new ArrayList<>(this.sessions.getAll(ownAddress.getName()).values());
323 Collections.sort(s);
324 return s;
325 }
326
327
328
329 public Collection<XmppAxolotlSession> findSessionsForContact(Contact contact) {
330 SignalProtocolAddress contactAddress = getAddressForJid(contact.getJid());
331 ArrayList<XmppAxolotlSession> s = new ArrayList<>(this.sessions.getAll(contactAddress.getName()).values());
332 Collections.sort(s);
333 return s;
334 }
335
336 private Set<XmppAxolotlSession> findSessionsForConversation(Conversation conversation) {
337 HashSet<XmppAxolotlSession> sessions = new HashSet<>();
338 for(Jid jid : conversation.getAcceptedCryptoTargets()) {
339 sessions.addAll(this.sessions.getAll(getAddressForJid(jid).getName()).values());
340 }
341 return sessions;
342 }
343
344 private boolean hasAny(Jid jid) {
345 return sessions.hasAny(getAddressForJid(jid));
346 }
347
348 public boolean isPepBroken() {
349 return this.pepBroken;
350 }
351
352 public void resetBrokenness() {
353 this.pepBroken = false;
354 this.numPublishTriesOnEmptyPep = 0;
355 this.lastDeviceListNotificationHash = 0;
356 }
357
358 public void clearErrorsInFetchStatusMap(Jid jid) {
359 fetchStatusMap.clearErrorFor(jid);
360 }
361
362 public void regenerateKeys(boolean wipeOther) {
363 axolotlStore.regenerate();
364 sessions.clear();
365 fetchStatusMap.clear();
366 fetchDeviceIdsMap.clear();
367 publishBundlesIfNeeded(true, wipeOther);
368 }
369
370 public void destroy() {
371 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": destroying old axolotl service. no longer in use");
372 mXmppConnectionService.databaseBackend.wipeAxolotlDb(account);
373 }
374
375 public AxolotlService makeNew() {
376 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": make new axolotl service");
377 return new AxolotlService(this.account,this.mXmppConnectionService);
378 }
379
380 public int getOwnDeviceId() {
381 return axolotlStore.getLocalRegistrationId();
382 }
383
384 public SignalProtocolAddress getOwnAxolotlAddress() {
385 return new SignalProtocolAddress(account.getJid().toBareJid().toPreppedString(),getOwnDeviceId());
386 }
387
388 public Set<Integer> getOwnDeviceIds() {
389 return this.deviceIds.get(account.getJid().toBareJid());
390 }
391
392 public void registerDevices(final Jid jid, @NonNull final Set<Integer> deviceIds) {
393 final int hash = deviceIds.hashCode();
394 final boolean me = jid.toBareJid().equals(account.getJid().toBareJid());
395 if (me) {
396 if (hash != 0 && hash == this.lastDeviceListNotificationHash) {
397 Log.d(Config.LOGTAG, account.getJid().toBareJid() + ": ignoring duplicate own device id list");
398 return;
399 }
400 this.lastDeviceListNotificationHash = hash;
401 }
402 boolean needsPublishing = me && !deviceIds.contains(getOwnDeviceId());
403 if (me) {
404 deviceIds.remove(getOwnDeviceId());
405 }
406 Set<Integer> expiredDevices = new HashSet<>(axolotlStore.getSubDeviceSessions(jid.toBareJid().toPreppedString()));
407 expiredDevices.removeAll(deviceIds);
408 for (Integer deviceId : expiredDevices) {
409 SignalProtocolAddress address = new SignalProtocolAddress(jid.toBareJid().toPreppedString(), deviceId);
410 XmppAxolotlSession session = sessions.get(address);
411 if (session != null && session.getFingerprint() != null) {
412 if (session.getTrust().isActive()) {
413 session.setTrust(session.getTrust().toInactive());
414 }
415 }
416 }
417 Set<Integer> newDevices = new HashSet<>(deviceIds);
418 for (Integer deviceId : newDevices) {
419 SignalProtocolAddress address = new SignalProtocolAddress(jid.toBareJid().toPreppedString(), deviceId);
420 XmppAxolotlSession session = sessions.get(address);
421 if (session != null && session.getFingerprint() != null) {
422 if (!session.getTrust().isActive()) {
423 Log.d(Config.LOGTAG,"reactivating device with fingerprint "+session.getFingerprint());
424 session.setTrust(session.getTrust().toActive());
425 }
426 }
427 }
428 if (me) {
429 if (Config.OMEMO_AUTO_EXPIRY != 0) {
430 needsPublishing |= deviceIds.removeAll(getExpiredDevices());
431 }
432 needsPublishing |= this.changeAccessMode.get();
433 for (Integer deviceId : deviceIds) {
434 SignalProtocolAddress ownDeviceAddress = new SignalProtocolAddress(jid.toBareJid().toPreppedString(), deviceId);
435 if (sessions.get(ownDeviceAddress) == null) {
436 FetchStatus status = fetchStatusMap.get(ownDeviceAddress);
437 if (status == null || status == FetchStatus.TIMEOUT) {
438 fetchStatusMap.put(ownDeviceAddress, FetchStatus.PENDING);
439 this.buildSessionFromPEP(ownDeviceAddress);
440 }
441 }
442 }
443 if (needsPublishing) {
444 publishOwnDeviceId(deviceIds);
445 }
446 }
447 this.deviceIds.put(jid, deviceIds);
448 mXmppConnectionService.updateConversationUi(); //update the lock icon
449 mXmppConnectionService.keyStatusUpdated(null);
450 }
451
452 public void wipeOtherPepDevices() {
453 if (pepBroken) {
454 Log.d(Config.LOGTAG, getLogprefix(account) + "wipeOtherPepDevices called, but PEP is broken. Ignoring... ");
455 return;
456 }
457 Set<Integer> deviceIds = new HashSet<>();
458 deviceIds.add(getOwnDeviceId());
459 publishDeviceIdsAndRefineAccessModel(deviceIds);
460 }
461
462 public void distrustFingerprint(final String fingerprint) {
463 final String fp = fingerprint.replaceAll("\\s", "");
464 final FingerprintStatus fingerprintStatus = axolotlStore.getFingerprintStatus(fp);
465 axolotlStore.setFingerprintStatus(fp,fingerprintStatus.toUntrusted());
466 }
467
468 public void publishOwnDeviceIdIfNeeded() {
469 if (pepBroken) {
470 Log.d(Config.LOGTAG, getLogprefix(account) + "publishOwnDeviceIdIfNeeded called, but PEP is broken. Ignoring... ");
471 return;
472 }
473 IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveDeviceIds(account.getJid().toBareJid());
474 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
475 @Override
476 public void onIqPacketReceived(Account account, IqPacket packet) {
477 if (packet.getType() == IqPacket.TYPE.TIMEOUT) {
478 Log.d(Config.LOGTAG, getLogprefix(account) + "Timeout received while retrieving own Device Ids.");
479 } else {
480 Element item = mXmppConnectionService.getIqParser().getItem(packet);
481 Set<Integer> deviceIds = mXmppConnectionService.getIqParser().deviceIds(item);
482 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": retrieved own device list: "+deviceIds);
483 registerDevices(account.getJid().toBareJid(),deviceIds);
484 }
485 }
486 });
487 }
488
489 private Set<Integer> getExpiredDevices() {
490 Set<Integer> devices = new HashSet<>();
491 for(XmppAxolotlSession session : findOwnSessions()) {
492 if (session.getTrust().isActive()) {
493 long diff = System.currentTimeMillis() - session.getTrust().getLastActivation();
494 if (diff > Config.OMEMO_AUTO_EXPIRY) {
495 long lastMessageDiff = System.currentTimeMillis() - mXmppConnectionService.databaseBackend.getLastTimeFingerprintUsed(account,session.getFingerprint());
496 long hours = Math.round(lastMessageDiff/(1000*60.0*60.0));
497 if (lastMessageDiff > Config.OMEMO_AUTO_EXPIRY) {
498 devices.add(session.getRemoteAddress().getDeviceId());
499 session.setTrust(session.getTrust().toInactive());
500 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": added own device " + session.getFingerprint() + " to list of expired devices. Last message received "+hours+" hours ago");
501 } else {
502 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": own device "+session.getFingerprint()+" was active "+hours+" hours ago");
503 }
504 }
505 }
506 }
507 return devices;
508 }
509
510 public void publishOwnDeviceId(Set<Integer> deviceIds) {
511 Set<Integer> deviceIdsCopy = new HashSet<>(deviceIds);
512 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "publishing own device ids");
513 if (deviceIdsCopy.isEmpty()) {
514 if (numPublishTriesOnEmptyPep >= publishTriesThreshold) {
515 Log.w(Config.LOGTAG, getLogprefix(account) + "Own device publish attempt threshold exceeded, aborting...");
516 pepBroken = true;
517 return;
518 } else {
519 numPublishTriesOnEmptyPep++;
520 Log.w(Config.LOGTAG, getLogprefix(account) + "Own device list empty, attempting to publish (try " + numPublishTriesOnEmptyPep + ")");
521 }
522 } else {
523 numPublishTriesOnEmptyPep = 0;
524 }
525 deviceIdsCopy.add(getOwnDeviceId());
526 publishDeviceIdsAndRefineAccessModel(deviceIdsCopy);
527 }
528
529 private void publishDeviceIdsAndRefineAccessModel(Set<Integer> ids) {
530 publishDeviceIdsAndRefineAccessModel(ids,true);
531 }
532
533 private void publishDeviceIdsAndRefineAccessModel(final Set<Integer> ids, final boolean firstAttempt) {
534 final Bundle publishOptions = account.getXmppConnection().getFeatures().pepPublishOptions() ? PublishOptions.openAccess() : null;
535 IqPacket publish = mXmppConnectionService.getIqGenerator().publishDeviceIds(ids, publishOptions);
536 mXmppConnectionService.sendIqPacket(account, publish, new OnIqPacketReceived() {
537 @Override
538 public void onIqPacketReceived(Account account, IqPacket packet) {
539 Element error = packet.getType() == IqPacket.TYPE.ERROR ? packet.findChild("error") : null;
540 if (firstAttempt && error != null && error.hasChild("precondition-not-met",Namespace.PUBSUB_ERROR)) {
541 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": precondition wasn't met for device list. pushing node configuration");
542 mXmppConnectionService.pushNodeConfiguration(account, AxolotlService.PEP_DEVICE_LIST, publishOptions, new XmppConnectionService.OnConfigurationPushed() {
543 @Override
544 public void onPushSucceeded() {
545 publishDeviceIdsAndRefineAccessModel(ids, false);
546 }
547
548 @Override
549 public void onPushFailed() {
550 publishDeviceIdsAndRefineAccessModel(ids, false);
551 }
552 });
553 } else {
554 if (AxolotlService.this.changeAccessMode.compareAndSet(true,false)) {
555 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": done changing access mode");
556 account.setOption(Account.OPTION_REQUIRES_ACCESS_MODE_CHANGE,false);
557 mXmppConnectionService.databaseBackend.updateAccount(account);
558 }
559 if (packet.getType() == IqPacket.TYPE.ERROR) {
560 pepBroken = true;
561 Log.d(Config.LOGTAG, getLogprefix(account) + "Error received while publishing own device id" + packet.findChild("error"));
562 }
563 }
564 }
565 });
566 }
567
568 public void publishDeviceVerificationAndBundle(final SignedPreKeyRecord signedPreKeyRecord,
569 final Set<PreKeyRecord> preKeyRecords,
570 final boolean announceAfter,
571 final boolean wipe) {
572 try {
573 IdentityKey axolotlPublicKey = axolotlStore.getIdentityKeyPair().getPublicKey();
574 PrivateKey x509PrivateKey = KeyChain.getPrivateKey(mXmppConnectionService, account.getPrivateKeyAlias());
575 X509Certificate[] chain = KeyChain.getCertificateChain(mXmppConnectionService, account.getPrivateKeyAlias());
576 Signature verifier = Signature.getInstance("sha256WithRSA");
577 verifier.initSign(x509PrivateKey,mXmppConnectionService.getRNG());
578 verifier.update(axolotlPublicKey.serialize());
579 byte[] signature = verifier.sign();
580 IqPacket packet = mXmppConnectionService.getIqGenerator().publishVerification(signature, chain, getOwnDeviceId());
581 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + ": publish verification for device "+getOwnDeviceId());
582 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
583 @Override
584 public void onIqPacketReceived(final Account account, IqPacket packet) {
585 String node = AxolotlService.PEP_VERIFICATION+":"+getOwnDeviceId();
586 mXmppConnectionService.pushNodeConfiguration(account, node, PublishOptions.openAccess(), new XmppConnectionService.OnConfigurationPushed() {
587 @Override
588 public void onPushSucceeded() {
589 Log.d(Config.LOGTAG,getLogprefix(account) + "configured verification node to be world readable");
590 publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe);
591 }
592
593 @Override
594 public void onPushFailed() {
595 Log.d(Config.LOGTAG,getLogprefix(account) + "unable to set access model on verification node");
596 publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe);
597 }
598 });
599 }
600 });
601 } catch (Exception e) {
602 e.printStackTrace();
603 }
604 }
605
606 public void publishBundlesIfNeeded(final boolean announce, final boolean wipe) {
607 if (pepBroken) {
608 Log.d(Config.LOGTAG, getLogprefix(account) + "publishBundlesIfNeeded called, but PEP is broken. Ignoring... ");
609 return;
610 }
611
612 if (account.getXmppConnection().getFeatures().pepPublishOptions()) {
613 this.changeAccessMode.set(account.isOptionSet(Account.OPTION_REQUIRES_ACCESS_MODE_CHANGE));
614 } else {
615 if (account.setOption(Account.OPTION_REQUIRES_ACCESS_MODE_CHANGE,true)) {
616 Log.d(Config.LOGTAG, account.getJid().toBareJid() + ": server doesn’t support publish-options. setting for later access mode change");
617 mXmppConnectionService.databaseBackend.updateAccount(account);
618 }
619 }
620 if (this.changeAccessMode.get()) {
621 Log.d(Config.LOGTAG, account.getJid().toBareJid() + ": server gained publish-options capabilities. changing access model");
622 }
623 IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveBundlesForDevice(account.getJid().toBareJid(), getOwnDeviceId());
624 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
625 @Override
626 public void onIqPacketReceived(Account account, IqPacket packet) {
627
628 if (packet.getType() == IqPacket.TYPE.TIMEOUT) {
629 return; //ignore timeout. do nothing
630 }
631
632 if (packet.getType() == IqPacket.TYPE.ERROR) {
633 Element error = packet.findChild("error");
634 if (error == null || !error.hasChild("item-not-found")) {
635 pepBroken = true;
636 Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "request for device bundles came back with something other than item-not-found" + packet);
637 return;
638 }
639 }
640
641 PreKeyBundle bundle = mXmppConnectionService.getIqParser().bundle(packet);
642 Map<Integer, ECPublicKey> keys = mXmppConnectionService.getIqParser().preKeyPublics(packet);
643 boolean flush = false;
644 if (bundle == null) {
645 Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Received invalid bundle:" + packet);
646 bundle = new PreKeyBundle(-1, -1, -1, null, -1, null, null, null);
647 flush = true;
648 }
649 if (keys == null) {
650 Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Received invalid prekeys:" + packet);
651 }
652 try {
653 boolean changed = false;
654 // Validate IdentityKey
655 IdentityKeyPair identityKeyPair = axolotlStore.getIdentityKeyPair();
656 if (flush || !identityKeyPair.getPublicKey().equals(bundle.getIdentityKey())) {
657 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding own IdentityKey " + identityKeyPair.getPublicKey() + " to PEP.");
658 changed = true;
659 }
660
661 // Validate signedPreKeyRecord + ID
662 SignedPreKeyRecord signedPreKeyRecord;
663 int numSignedPreKeys = axolotlStore.getSignedPreKeysCount();
664 try {
665 signedPreKeyRecord = axolotlStore.loadSignedPreKey(bundle.getSignedPreKeyId());
666 if (flush
667 || !bundle.getSignedPreKey().equals(signedPreKeyRecord.getKeyPair().getPublicKey())
668 || !Arrays.equals(bundle.getSignedPreKeySignature(), signedPreKeyRecord.getSignature())) {
669 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding new signedPreKey with ID " + (numSignedPreKeys + 1) + " to PEP.");
670 signedPreKeyRecord = KeyHelper.generateSignedPreKey(identityKeyPair, numSignedPreKeys + 1);
671 axolotlStore.storeSignedPreKey(signedPreKeyRecord.getId(), signedPreKeyRecord);
672 changed = true;
673 }
674 } catch (InvalidKeyIdException e) {
675 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding new signedPreKey with ID " + (numSignedPreKeys + 1) + " to PEP.");
676 signedPreKeyRecord = KeyHelper.generateSignedPreKey(identityKeyPair, numSignedPreKeys + 1);
677 axolotlStore.storeSignedPreKey(signedPreKeyRecord.getId(), signedPreKeyRecord);
678 changed = true;
679 }
680
681 // Validate PreKeys
682 Set<PreKeyRecord> preKeyRecords = new HashSet<>();
683 if (keys != null) {
684 for (Integer id : keys.keySet()) {
685 try {
686 PreKeyRecord preKeyRecord = axolotlStore.loadPreKey(id);
687 if (preKeyRecord.getKeyPair().getPublicKey().equals(keys.get(id))) {
688 preKeyRecords.add(preKeyRecord);
689 }
690 } catch (InvalidKeyIdException ignored) {
691 }
692 }
693 }
694 int newKeys = NUM_KEYS_TO_PUBLISH - preKeyRecords.size();
695 if (newKeys > 0) {
696 List<PreKeyRecord> newRecords = KeyHelper.generatePreKeys(
697 axolotlStore.getCurrentPreKeyId() + 1, newKeys);
698 preKeyRecords.addAll(newRecords);
699 for (PreKeyRecord record : newRecords) {
700 axolotlStore.storePreKey(record.getId(), record);
701 }
702 changed = true;
703 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding " + newKeys + " new preKeys to PEP.");
704 }
705
706
707 if (changed || changeAccessMode.get()) {
708 if (account.getPrivateKeyAlias() != null && Config.X509_VERIFICATION) {
709 mXmppConnectionService.publishDisplayName(account);
710 publishDeviceVerificationAndBundle(signedPreKeyRecord, preKeyRecords, announce, wipe);
711 } else {
712 publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announce, wipe);
713 }
714 } else {
715 Log.d(Config.LOGTAG, getLogprefix(account) + "Bundle " + getOwnDeviceId() + " in PEP was current");
716 if (wipe) {
717 wipeOtherPepDevices();
718 } else if (announce) {
719 Log.d(Config.LOGTAG, getLogprefix(account) + "Announcing device " + getOwnDeviceId());
720 publishOwnDeviceIdIfNeeded();
721 }
722 }
723 } catch (InvalidKeyException e) {
724 Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Failed to publish bundle " + getOwnDeviceId() + ", reason: " + e.getMessage());
725 }
726 }
727 });
728 }
729
730 private void publishDeviceBundle(SignedPreKeyRecord signedPreKeyRecord,
731 Set<PreKeyRecord> preKeyRecords,
732 final boolean announceAfter,
733 final boolean wipe) {
734 publishDeviceBundle(signedPreKeyRecord,preKeyRecords,announceAfter,wipe,true);
735 }
736
737 private void publishDeviceBundle(final SignedPreKeyRecord signedPreKeyRecord,
738 final Set<PreKeyRecord> preKeyRecords,
739 final boolean announceAfter,
740 final boolean wipe,
741 final boolean firstAttempt) {
742 final Bundle publishOptions = account.getXmppConnection().getFeatures().pepPublishOptions() ? PublishOptions.openAccess() : null;
743 IqPacket publish = mXmppConnectionService.getIqGenerator().publishBundles(
744 signedPreKeyRecord, axolotlStore.getIdentityKeyPair().getPublicKey(),
745 preKeyRecords, getOwnDeviceId(),publishOptions);
746 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + ": Bundle " + getOwnDeviceId() + " in PEP not current. Publishing...");
747 mXmppConnectionService.sendIqPacket(account, publish, new OnIqPacketReceived() {
748 @Override
749 public void onIqPacketReceived(final Account account, IqPacket packet) {
750 Element error = packet.getType() == IqPacket.TYPE.ERROR ? packet.findChild("error") : null;
751 if (firstAttempt && error != null && error.hasChild("precondition-not-met", Namespace.PUBSUB_ERROR)) {
752 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": precondition wasn't met for bundle. pushing node configuration");
753 final String node = AxolotlService.PEP_BUNDLES + ":" + getOwnDeviceId();
754 mXmppConnectionService.pushNodeConfiguration(account, node, publishOptions, new XmppConnectionService.OnConfigurationPushed() {
755 @Override
756 public void onPushSucceeded() {
757 publishDeviceBundle(signedPreKeyRecord,preKeyRecords, announceAfter, wipe, false);
758 }
759
760 @Override
761 public void onPushFailed() {
762 publishDeviceBundle(signedPreKeyRecord,preKeyRecords, announceAfter, wipe, false);
763 }
764 });
765 } else if (packet.getType() == IqPacket.TYPE.RESULT) {
766 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Successfully published bundle. ");
767 if (wipe) {
768 wipeOtherPepDevices();
769 } else if (announceAfter) {
770 Log.d(Config.LOGTAG, getLogprefix(account) + "Announcing device " + getOwnDeviceId());
771 publishOwnDeviceIdIfNeeded();
772 }
773 } else if (packet.getType() == IqPacket.TYPE.ERROR) {
774 pepBroken = true;
775 Log.d(Config.LOGTAG, getLogprefix(account) + "Error received while publishing bundle: " + packet.findChild("error"));
776 }
777 }
778 });
779 }
780
781 public enum AxolotlCapability {
782 FULL,
783 MISSING_PRESENCE,
784 MISSING_KEYS,
785 WRONG_CONFIGURATION,
786 NO_MEMBERS
787 }
788
789 public boolean isConversationAxolotlCapable(Conversation conversation) {
790 return conversation.getMode() == Conversation.MODE_SINGLE || (conversation.getMucOptions().nonanonymous() && conversation.getMucOptions().membersOnly());
791 }
792
793 public Pair<AxolotlCapability,Jid> isConversationAxolotlCapableDetailed(Conversation conversation) {
794 if (conversation.getMode() == Conversation.MODE_SINGLE
795 || (conversation.getMucOptions().membersOnly() && conversation.getMucOptions().nonanonymous())) {
796 final List<Jid> jids = getCryptoTargets(conversation);
797 for(Jid jid : jids) {
798 if (!hasAny(jid) && (!deviceIds.containsKey(jid) || deviceIds.get(jid).isEmpty())) {
799 if (conversation.getAccount().getRoster().getContact(jid).mutualPresenceSubscription()) {
800 return new Pair<>(AxolotlCapability.MISSING_KEYS,jid);
801 } else {
802 return new Pair<>(AxolotlCapability.MISSING_PRESENCE,jid);
803 }
804 }
805 }
806 if (jids.size() > 0) {
807 return new Pair<>(AxolotlCapability.FULL, null);
808 } else {
809 return new Pair<>(AxolotlCapability.NO_MEMBERS, null);
810 }
811 } else {
812 return new Pair<>(AxolotlCapability.WRONG_CONFIGURATION, null);
813 }
814 }
815
816 public List<Jid> getCryptoTargets(Conversation conversation) {
817 final List<Jid> jids;
818 if (conversation.getMode() == Conversation.MODE_SINGLE) {
819 jids = new ArrayList<>();
820 jids.add(conversation.getJid().toBareJid());
821 } else {
822 jids = conversation.getMucOptions().getMembers();
823 }
824 return jids;
825 }
826
827 public FingerprintStatus getFingerprintTrust(String fingerprint) {
828 return axolotlStore.getFingerprintStatus(fingerprint);
829 }
830
831 public X509Certificate getFingerprintCertificate(String fingerprint) {
832 return axolotlStore.getFingerprintCertificate(fingerprint);
833 }
834
835 public void setFingerprintTrust(String fingerprint, FingerprintStatus status) {
836 axolotlStore.setFingerprintStatus(fingerprint, status);
837 }
838
839 private void verifySessionWithPEP(final XmppAxolotlSession session) {
840 Log.d(Config.LOGTAG, "trying to verify fresh session (" + session.getRemoteAddress().getName() + ") with pep");
841 final SignalProtocolAddress address = session.getRemoteAddress();
842 final IdentityKey identityKey = session.getIdentityKey();
843 try {
844 IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveVerificationForDevice(Jid.fromString(address.getName()), address.getDeviceId());
845 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
846 @Override
847 public void onIqPacketReceived(Account account, IqPacket packet) {
848 Pair<X509Certificate[],byte[]> verification = mXmppConnectionService.getIqParser().verification(packet);
849 if (verification != null) {
850 try {
851 Signature verifier = Signature.getInstance("sha256WithRSA");
852 verifier.initVerify(verification.first[0]);
853 verifier.update(identityKey.serialize());
854 if (verifier.verify(verification.second)) {
855 try {
856 mXmppConnectionService.getMemorizingTrustManager().getNonInteractive().checkClientTrusted(verification.first, "RSA");
857 String fingerprint = session.getFingerprint();
858 Log.d(Config.LOGTAG, "verified session with x.509 signature. fingerprint was: "+fingerprint);
859 setFingerprintTrust(fingerprint, FingerprintStatus.createActiveVerified(true));
860 axolotlStore.setFingerprintCertificate(fingerprint, verification.first[0]);
861 fetchStatusMap.put(address, FetchStatus.SUCCESS_VERIFIED);
862 Bundle information = CryptoHelper.extractCertificateInformation(verification.first[0]);
863 try {
864 final String cn = information.getString("subject_cn");
865 final Jid jid = Jid.fromString(address.getName());
866 Log.d(Config.LOGTAG,"setting common name for "+jid+" to "+cn);
867 account.getRoster().getContact(jid).setCommonName(cn);
868 } catch (final InvalidJidException ignored) {
869 //ignored
870 }
871 finishBuildingSessionsFromPEP(address);
872 return;
873 } catch (Exception e) {
874 Log.d(Config.LOGTAG,"could not verify certificate");
875 }
876 }
877 } catch (Exception e) {
878 Log.d(Config.LOGTAG, "error during verification " + e.getMessage());
879 }
880 } else {
881 Log.d(Config.LOGTAG,"no verification found");
882 }
883 fetchStatusMap.put(address, FetchStatus.SUCCESS);
884 finishBuildingSessionsFromPEP(address);
885 }
886 });
887 } catch (InvalidJidException e) {
888 fetchStatusMap.put(address, FetchStatus.SUCCESS);
889 finishBuildingSessionsFromPEP(address);
890 }
891 }
892
893 private final Set<Integer> PREVIOUSLY_REMOVED_FROM_ANNOUNCEMENT = new HashSet<>();
894
895 private void finishBuildingSessionsFromPEP(final SignalProtocolAddress address) {
896 SignalProtocolAddress ownAddress = new SignalProtocolAddress(account.getJid().toBareJid().toPreppedString(), 0);
897 Map<Integer, FetchStatus> own = fetchStatusMap.getAll(ownAddress.getName());
898 Map<Integer, FetchStatus> remote = fetchStatusMap.getAll(address.getName());
899 if (!own.containsValue(FetchStatus.PENDING) && !remote.containsValue(FetchStatus.PENDING)) {
900 FetchStatus report = null;
901 if (own.containsValue(FetchStatus.SUCCESS) || remote.containsValue(FetchStatus.SUCCESS)) {
902 report = FetchStatus.SUCCESS;
903 } else if (own.containsValue(FetchStatus.SUCCESS_VERIFIED) || remote.containsValue(FetchStatus.SUCCESS_VERIFIED)) {
904 report = FetchStatus.SUCCESS_VERIFIED;
905 } else if (own.containsValue(FetchStatus.SUCCESS_TRUSTED) || remote.containsValue(FetchStatus.SUCCESS_TRUSTED)) {
906 report = FetchStatus.SUCCESS_TRUSTED;
907 } else if (own.containsValue(FetchStatus.ERROR) || remote.containsValue(FetchStatus.ERROR)) {
908 report = FetchStatus.ERROR;
909 }
910 mXmppConnectionService.keyStatusUpdated(report);
911 }
912 if (Config.REMOVE_BROKEN_DEVICES) {
913 Set<Integer> ownDeviceIds = new HashSet<>(getOwnDeviceIds());
914 boolean publish = false;
915 for (Map.Entry<Integer, FetchStatus> entry : own.entrySet()) {
916 int id = entry.getKey();
917 if (entry.getValue() == FetchStatus.ERROR && PREVIOUSLY_REMOVED_FROM_ANNOUNCEMENT.add(id) && ownDeviceIds.remove(id)) {
918 publish = true;
919 Log.d(Config.LOGTAG, account.getJid().toBareJid() + ": error fetching own device with id " + id + ". removing from announcement");
920 }
921 }
922 if (publish) {
923 publishOwnDeviceId(ownDeviceIds);
924 }
925 }
926 }
927
928 public boolean hasEmptyDeviceList(Jid jid) {
929 return !hasAny(jid) && (!deviceIds.containsKey(jid) || deviceIds.get(jid).isEmpty());
930 }
931
932 public interface OnDeviceIdsFetched {
933 void fetched(Jid jid, Set<Integer> deviceIds);
934 }
935
936 public interface OnMultipleDeviceIdFetched {
937 void fetched();
938 }
939
940 public void fetchDeviceIds(final Jid jid) {
941 fetchDeviceIds(jid,null);
942 }
943
944 public void fetchDeviceIds(final Jid jid, OnDeviceIdsFetched callback) {
945 synchronized (this.fetchDeviceIdsMap) {
946 List<OnDeviceIdsFetched> callbacks = this.fetchDeviceIdsMap.get(jid);
947 if (callbacks != null) {
948 if (callback != null) {
949 callbacks.add(callback);
950 }
951 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": fetching device ids for "+jid+" already running. adding callback");
952 } else {
953 callbacks = new ArrayList<>();
954 if (callback != null) {
955 callbacks.add(callback);
956 }
957 this.fetchDeviceIdsMap.put(jid,callbacks);
958 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": fetching device ids for " + jid);
959 IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveDeviceIds(jid);
960 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
961 @Override
962 public void onIqPacketReceived(Account account, IqPacket packet) {
963 synchronized (fetchDeviceIdsMap) {
964 List<OnDeviceIdsFetched> callbacks = fetchDeviceIdsMap.remove(jid);
965 if (packet.getType() == IqPacket.TYPE.RESULT) {
966 Element item = mXmppConnectionService.getIqParser().getItem(packet);
967 Set<Integer> deviceIds = mXmppConnectionService.getIqParser().deviceIds(item);
968 registerDevices(jid, deviceIds);
969 if (callbacks != null) {
970 for(OnDeviceIdsFetched callback : callbacks) {
971 callback.fetched(jid, deviceIds);
972 }
973 }
974 } else {
975 Log.d(Config.LOGTAG, packet.toString());
976 if (callbacks != null) {
977 for(OnDeviceIdsFetched callback : callbacks) {
978 callback.fetched(jid, null);
979 }
980 }
981 }
982 }
983 }
984 });
985 }
986 }
987 }
988
989 private void fetchDeviceIds(List<Jid> jids, final OnMultipleDeviceIdFetched callback) {
990 final ArrayList<Jid> unfinishedJids = new ArrayList<>(jids);
991 synchronized (unfinishedJids) {
992 for (Jid jid : unfinishedJids) {
993 fetchDeviceIds(jid, new OnDeviceIdsFetched() {
994 @Override
995 public void fetched(Jid jid, Set<Integer> deviceIds) {
996 synchronized (unfinishedJids) {
997 unfinishedJids.remove(jid);
998 if (unfinishedJids.size() == 0 && callback != null) {
999 callback.fetched();
1000 }
1001 }
1002 }
1003 });
1004 }
1005 }
1006 }
1007
1008 private void buildSessionFromPEP(final SignalProtocolAddress address) {
1009 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Building new session for " + address.toString());
1010 if (address.equals(getOwnAxolotlAddress())) {
1011 throw new AssertionError("We should NEVER build a session with ourselves. What happened here?!");
1012 }
1013
1014 try {
1015 IqPacket bundlesPacket = mXmppConnectionService.getIqGenerator().retrieveBundlesForDevice(
1016 Jid.fromString(address.getName()), address.getDeviceId());
1017 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Retrieving bundle: " + bundlesPacket);
1018 mXmppConnectionService.sendIqPacket(account, bundlesPacket, new OnIqPacketReceived() {
1019
1020 @Override
1021 public void onIqPacketReceived(Account account, IqPacket packet) {
1022 if (packet.getType() == IqPacket.TYPE.TIMEOUT) {
1023 fetchStatusMap.put(address, FetchStatus.TIMEOUT);
1024 } else if (packet.getType() == IqPacket.TYPE.RESULT) {
1025 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Received preKey IQ packet, processing...");
1026 final IqParser parser = mXmppConnectionService.getIqParser();
1027 final List<PreKeyBundle> preKeyBundleList = parser.preKeys(packet);
1028 final PreKeyBundle bundle = parser.bundle(packet);
1029 if (preKeyBundleList.isEmpty() || bundle == null) {
1030 Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "preKey IQ packet invalid: " + packet);
1031 fetchStatusMap.put(address, FetchStatus.ERROR);
1032 finishBuildingSessionsFromPEP(address);
1033 return;
1034 }
1035 Random random = new Random();
1036 final PreKeyBundle preKey = preKeyBundleList.get(random.nextInt(preKeyBundleList.size()));
1037 if (preKey == null) {
1038 //should never happen
1039 fetchStatusMap.put(address, FetchStatus.ERROR);
1040 finishBuildingSessionsFromPEP(address);
1041 return;
1042 }
1043
1044 final PreKeyBundle preKeyBundle = new PreKeyBundle(0, address.getDeviceId(),
1045 preKey.getPreKeyId(), preKey.getPreKey(),
1046 bundle.getSignedPreKeyId(), bundle.getSignedPreKey(),
1047 bundle.getSignedPreKeySignature(), bundle.getIdentityKey());
1048
1049 try {
1050 SessionBuilder builder = new SessionBuilder(axolotlStore, address);
1051 builder.process(preKeyBundle);
1052 XmppAxolotlSession session = new XmppAxolotlSession(account, axolotlStore, address, bundle.getIdentityKey());
1053 sessions.put(address, session);
1054 if (Config.X509_VERIFICATION) {
1055 verifySessionWithPEP(session);
1056 } else {
1057 FingerprintStatus status = getFingerprintTrust(CryptoHelper.bytesToHex(bundle.getIdentityKey().getPublicKey().serialize()));
1058 FetchStatus fetchStatus;
1059 if (status != null && status.isVerified()) {
1060 fetchStatus = FetchStatus.SUCCESS_VERIFIED;
1061 } else if (status != null && status.isTrusted()) {
1062 fetchStatus = FetchStatus.SUCCESS_TRUSTED;
1063 } else {
1064 fetchStatus = FetchStatus.SUCCESS;
1065 }
1066 fetchStatusMap.put(address, fetchStatus);
1067 finishBuildingSessionsFromPEP(address);
1068 }
1069 } catch (UntrustedIdentityException | InvalidKeyException e) {
1070 Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Error building session for " + address + ": "
1071 + e.getClass().getName() + ", " + e.getMessage());
1072 fetchStatusMap.put(address, FetchStatus.ERROR);
1073 finishBuildingSessionsFromPEP(address);
1074 }
1075 } else {
1076 fetchStatusMap.put(address, FetchStatus.ERROR);
1077 Log.d(Config.LOGTAG, getLogprefix(account) + "Error received while building session:" + packet.findChild("error"));
1078 finishBuildingSessionsFromPEP(address);
1079 }
1080 }
1081 });
1082 } catch (InvalidJidException e) {
1083 Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Got address with invalid jid: " + address.getName());
1084 }
1085 }
1086
1087 public Set<SignalProtocolAddress> findDevicesWithoutSession(final Conversation conversation) {
1088 Set<SignalProtocolAddress> addresses = new HashSet<>();
1089 for(Jid jid : getCryptoTargets(conversation)) {
1090 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Finding devices without session for " + jid);
1091 if (deviceIds.get(jid) != null) {
1092 for (Integer foreignId : this.deviceIds.get(jid)) {
1093 SignalProtocolAddress address = new SignalProtocolAddress(jid.toPreppedString(), foreignId);
1094 if (sessions.get(address) == null) {
1095 IdentityKey identityKey = axolotlStore.loadSession(address).getSessionState().getRemoteIdentityKey();
1096 if (identityKey != null) {
1097 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Already have session for " + address.toString() + ", adding to cache...");
1098 XmppAxolotlSession session = new XmppAxolotlSession(account, axolotlStore, address, identityKey);
1099 sessions.put(address, session);
1100 } else {
1101 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Found device " + jid + ":" + foreignId);
1102 if (fetchStatusMap.get(address) != FetchStatus.ERROR) {
1103 addresses.add(address);
1104 } else {
1105 Log.d(Config.LOGTAG, getLogprefix(account) + "skipping over " + address + " because it's broken");
1106 }
1107 }
1108 }
1109 }
1110 } else {
1111 mXmppConnectionService.keyStatusUpdated(FetchStatus.ERROR);
1112 Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Have no target devices in PEP!");
1113 }
1114 }
1115 if (deviceIds.get(account.getJid().toBareJid()) != null) {
1116 for (Integer ownId : this.deviceIds.get(account.getJid().toBareJid())) {
1117 SignalProtocolAddress address = new SignalProtocolAddress(account.getJid().toBareJid().toPreppedString(), ownId);
1118 if (sessions.get(address) == null) {
1119 IdentityKey identityKey = axolotlStore.loadSession(address).getSessionState().getRemoteIdentityKey();
1120 if (identityKey != null) {
1121 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Already have session for " + address.toString() + ", adding to cache...");
1122 XmppAxolotlSession session = new XmppAxolotlSession(account, axolotlStore, address, identityKey);
1123 sessions.put(address, session);
1124 } else {
1125 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Found device " + account.getJid().toBareJid() + ":" + ownId);
1126 if (fetchStatusMap.get(address) != FetchStatus.ERROR) {
1127 addresses.add(address);
1128 } else {
1129 Log.d(Config.LOGTAG,getLogprefix(account)+"skipping over "+address+" because it's broken");
1130 }
1131 }
1132 }
1133 }
1134 }
1135
1136 return addresses;
1137 }
1138
1139 public boolean createSessionsIfNeeded(final Conversation conversation) {
1140 final List<Jid> jidsWithEmptyDeviceList = getCryptoTargets(conversation);
1141 for(Iterator<Jid> iterator = jidsWithEmptyDeviceList.iterator(); iterator.hasNext();) {
1142 final Jid jid = iterator.next();
1143 if (!hasEmptyDeviceList(jid)) {
1144 iterator.remove();
1145 }
1146 }
1147 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": createSessionsIfNeeded() - jids with empty device list: "+jidsWithEmptyDeviceList);
1148 if (jidsWithEmptyDeviceList.size() > 0) {
1149 fetchDeviceIds(jidsWithEmptyDeviceList, new OnMultipleDeviceIdFetched() {
1150 @Override
1151 public void fetched() {
1152 createSessionsIfNeededActual(conversation);
1153 }
1154 });
1155 return true;
1156 } else {
1157 return createSessionsIfNeededActual(conversation);
1158 }
1159 }
1160
1161 private boolean createSessionsIfNeededActual(final Conversation conversation) {
1162 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Creating axolotl sessions if needed...");
1163 boolean newSessions = false;
1164 Set<SignalProtocolAddress> addresses = findDevicesWithoutSession(conversation);
1165 for (SignalProtocolAddress address : addresses) {
1166 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Processing device: " + address.toString());
1167 FetchStatus status = fetchStatusMap.get(address);
1168 if (status == null || status == FetchStatus.TIMEOUT) {
1169 fetchStatusMap.put(address, FetchStatus.PENDING);
1170 this.buildSessionFromPEP(address);
1171 newSessions = true;
1172 } else if (status == FetchStatus.PENDING) {
1173 newSessions = true;
1174 } else {
1175 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Already fetching bundle for " + address.toString());
1176 }
1177 }
1178
1179 return newSessions;
1180 }
1181
1182 public boolean trustedSessionVerified(final Conversation conversation) {
1183 Set<XmppAxolotlSession> sessions = findSessionsForConversation(conversation);
1184 sessions.addAll(findOwnSessions());
1185 boolean verified = false;
1186 for(XmppAxolotlSession session : sessions) {
1187 if (session.getTrust().isTrustedAndActive()) {
1188 if (session.getTrust().getTrust() == FingerprintStatus.Trust.VERIFIED_X509) {
1189 verified = true;
1190 } else {
1191 return false;
1192 }
1193 }
1194 }
1195 return verified;
1196 }
1197
1198 public boolean hasPendingKeyFetches(Account account, List<Jid> jids) {
1199 SignalProtocolAddress ownAddress = new SignalProtocolAddress(account.getJid().toBareJid().toPreppedString(), 0);
1200 if (fetchStatusMap.getAll(ownAddress.getName()).containsValue(FetchStatus.PENDING)) {
1201 return true;
1202 }
1203 synchronized (this.fetchDeviceIdsMap) {
1204 for (Jid jid : jids) {
1205 SignalProtocolAddress foreignAddress = new SignalProtocolAddress(jid.toBareJid().toPreppedString(), 0);
1206 if (fetchStatusMap.getAll(foreignAddress.getName()).containsValue(FetchStatus.PENDING) || this.fetchDeviceIdsMap.containsKey(jid)) {
1207 return true;
1208 }
1209 }
1210 }
1211 return false;
1212 }
1213
1214 @Nullable
1215 private boolean buildHeader(XmppAxolotlMessage axolotlMessage, Conversation conversation) {
1216 Set<XmppAxolotlSession> remoteSessions = findSessionsForConversation(conversation);
1217 Collection<XmppAxolotlSession> ownSessions = findOwnSessions();
1218 if (remoteSessions.isEmpty()) {
1219 return false;
1220 }
1221 for (XmppAxolotlSession session : remoteSessions) {
1222 axolotlMessage.addDevice(session);
1223 }
1224 for (XmppAxolotlSession session : ownSessions) {
1225 axolotlMessage.addDevice(session);
1226 }
1227
1228 return true;
1229 }
1230
1231 @Nullable
1232 public XmppAxolotlMessage encrypt(Message message) {
1233 final XmppAxolotlMessage axolotlMessage = new XmppAxolotlMessage(account.getJid().toBareJid(), getOwnDeviceId());
1234 final String content;
1235 if (message.hasFileOnRemoteHost()) {
1236 content = message.getFileParams().url.toString();
1237 } else {
1238 content = message.getBody();
1239 }
1240 try {
1241 axolotlMessage.encrypt(content);
1242 } catch (CryptoFailedException e) {
1243 Log.w(Config.LOGTAG, getLogprefix(account) + "Failed to encrypt message: " + e.getMessage());
1244 return null;
1245 }
1246 if (!buildHeader(axolotlMessage,message.getConversation())) {
1247 return null;
1248 }
1249
1250 return axolotlMessage;
1251 }
1252
1253 public void preparePayloadMessage(final Message message, final boolean delay) {
1254 executor.execute(new Runnable() {
1255 @Override
1256 public void run() {
1257 XmppAxolotlMessage axolotlMessage = encrypt(message);
1258 if (axolotlMessage == null) {
1259 mXmppConnectionService.markMessage(message, Message.STATUS_SEND_FAILED);
1260 //mXmppConnectionService.updateConversationUi();
1261 } else {
1262 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Generated message, caching: " + message.getUuid());
1263 messageCache.put(message.getUuid(), axolotlMessage);
1264 mXmppConnectionService.resendMessage(message, delay);
1265 }
1266 }
1267 });
1268 }
1269
1270 public void prepareKeyTransportMessage(final Conversation conversation, final OnMessageCreatedCallback onMessageCreatedCallback) {
1271 executor.execute(new Runnable() {
1272 @Override
1273 public void run() {
1274 final XmppAxolotlMessage axolotlMessage = new XmppAxolotlMessage(account.getJid().toBareJid(), getOwnDeviceId());
1275 if (buildHeader(axolotlMessage,conversation)) {
1276 onMessageCreatedCallback.run(axolotlMessage);
1277 } else {
1278 onMessageCreatedCallback.run(null);
1279 }
1280 }
1281 });
1282 }
1283
1284 public XmppAxolotlMessage fetchAxolotlMessageFromCache(Message message) {
1285 XmppAxolotlMessage axolotlMessage = messageCache.get(message.getUuid());
1286 if (axolotlMessage != null) {
1287 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Cache hit: " + message.getUuid());
1288 messageCache.remove(message.getUuid());
1289 } else {
1290 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Cache miss: " + message.getUuid());
1291 }
1292 return axolotlMessage;
1293 }
1294
1295 private XmppAxolotlSession recreateUncachedSession(SignalProtocolAddress address) {
1296 IdentityKey identityKey = axolotlStore.loadSession(address).getSessionState().getRemoteIdentityKey();
1297 return (identityKey != null)
1298 ? new XmppAxolotlSession(account, axolotlStore, address, identityKey)
1299 : null;
1300 }
1301
1302 private XmppAxolotlSession getReceivingSession(XmppAxolotlMessage message) {
1303 SignalProtocolAddress senderAddress = new SignalProtocolAddress(message.getFrom().toPreppedString(),
1304 message.getSenderDeviceId());
1305 XmppAxolotlSession session = sessions.get(senderAddress);
1306 if (session == null) {
1307 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Account: " + account.getJid() + " No axolotl session found while parsing received message " + message);
1308 session = recreateUncachedSession(senderAddress);
1309 if (session == null) {
1310 session = new XmppAxolotlSession(account, axolotlStore, senderAddress);
1311 }
1312 }
1313 return session;
1314 }
1315
1316 public XmppAxolotlMessage.XmppAxolotlPlaintextMessage processReceivingPayloadMessage(XmppAxolotlMessage message) {
1317 XmppAxolotlMessage.XmppAxolotlPlaintextMessage plaintextMessage = null;
1318
1319 XmppAxolotlSession session = getReceivingSession(message);
1320 try {
1321 plaintextMessage = message.decrypt(session, getOwnDeviceId());
1322 Integer preKeyId = session.getPreKeyId();
1323 if (preKeyId != null) {
1324 publishBundlesIfNeeded(false, false);
1325 session.resetPreKeyId();
1326 }
1327 } catch (CryptoFailedException e) {
1328 Log.w(Config.LOGTAG, getLogprefix(account) + "Failed to decrypt message from "+message.getFrom()+": " + e.getMessage());
1329 }
1330
1331 if (session.isFresh() && plaintextMessage != null) {
1332 putFreshSession(session);
1333 }
1334
1335 return plaintextMessage;
1336 }
1337
1338 public XmppAxolotlMessage.XmppAxolotlKeyTransportMessage processReceivingKeyTransportMessage(XmppAxolotlMessage message) {
1339 XmppAxolotlMessage.XmppAxolotlKeyTransportMessage keyTransportMessage;
1340
1341 XmppAxolotlSession session = getReceivingSession(message);
1342 try {
1343 keyTransportMessage = message.getParameters(session, getOwnDeviceId());
1344 } catch (CryptoFailedException e) {
1345 Log.d(Config.LOGTAG,"could not decrypt keyTransport message "+e.getMessage());
1346 keyTransportMessage = null;
1347 }
1348
1349 if (session.isFresh() && keyTransportMessage != null) {
1350 putFreshSession(session);
1351 }
1352
1353 return keyTransportMessage;
1354 }
1355
1356 private void putFreshSession(XmppAxolotlSession session) {
1357 Log.d(Config.LOGTAG,"put fresh session");
1358 sessions.put(session);
1359 if (Config.X509_VERIFICATION) {
1360 if (session.getIdentityKey() != null) {
1361 verifySessionWithPEP(session);
1362 } else {
1363 Log.e(Config.LOGTAG,account.getJid().toBareJid()+": identity key was empty after reloading for x509 verification");
1364 }
1365 }
1366 }
1367}