1package eu.siacs.conversations.crypto.axolotl;
2
3import android.os.Bundle;
4import android.security.KeyChain;
5import android.support.annotation.NonNull;
6import android.support.annotation.Nullable;
7import android.util.Log;
8import android.util.Pair;
9
10import org.bouncycastle.jce.provider.BouncyCastleProvider;
11import org.whispersystems.libsignal.SignalProtocolAddress;
12import org.whispersystems.libsignal.IdentityKey;
13import org.whispersystems.libsignal.IdentityKeyPair;
14import org.whispersystems.libsignal.InvalidKeyException;
15import org.whispersystems.libsignal.InvalidKeyIdException;
16import org.whispersystems.libsignal.SessionBuilder;
17import org.whispersystems.libsignal.UntrustedIdentityException;
18import org.whispersystems.libsignal.ecc.ECPublicKey;
19import org.whispersystems.libsignal.state.PreKeyBundle;
20import org.whispersystems.libsignal.state.PreKeyRecord;
21import org.whispersystems.libsignal.state.SignedPreKeyRecord;
22import org.whispersystems.libsignal.util.KeyHelper;
23
24import java.security.PrivateKey;
25import java.security.Security;
26import java.security.Signature;
27import java.security.cert.X509Certificate;
28import java.util.ArrayList;
29import java.util.Arrays;
30import java.util.Collection;
31import java.util.Collections;
32import java.util.HashMap;
33import java.util.HashSet;
34import java.util.List;
35import java.util.Map;
36import java.util.Random;
37import java.util.Set;
38import java.util.concurrent.atomic.AtomicBoolean;
39
40import eu.siacs.conversations.Config;
41import eu.siacs.conversations.entities.Account;
42import eu.siacs.conversations.entities.Contact;
43import eu.siacs.conversations.entities.Conversation;
44import eu.siacs.conversations.entities.Message;
45import eu.siacs.conversations.parser.IqParser;
46import eu.siacs.conversations.services.XmppConnectionService;
47import eu.siacs.conversations.utils.CryptoHelper;
48import eu.siacs.conversations.utils.SerialSingleThreadExecutor;
49import eu.siacs.conversations.xml.Element;
50import eu.siacs.conversations.xmpp.OnAdvancedStreamFeaturesLoaded;
51import eu.siacs.conversations.xmpp.OnIqPacketReceived;
52import eu.siacs.conversations.xmpp.jid.InvalidJidException;
53import eu.siacs.conversations.xmpp.jid.Jid;
54import eu.siacs.conversations.xmpp.pep.PublishOptions;
55import eu.siacs.conversations.xmpp.stanzas.IqPacket;
56
57public class AxolotlService implements OnAdvancedStreamFeaturesLoaded {
58
59 public static final String PEP_PREFIX = "eu.siacs.conversations.axolotl";
60 public static final String PEP_DEVICE_LIST = PEP_PREFIX + ".devicelist";
61 public static final String PEP_DEVICE_LIST_NOTIFY = PEP_DEVICE_LIST + "+notify";
62 public static final String PEP_BUNDLES = PEP_PREFIX + ".bundles";
63 public static final String PEP_VERIFICATION = PEP_PREFIX + ".verification";
64
65 public static final String LOGPREFIX = "AxolotlService";
66
67 public static final int NUM_KEYS_TO_PUBLISH = 100;
68 public static final int publishTriesThreshold = 3;
69
70 private final Account account;
71 private final XmppConnectionService mXmppConnectionService;
72 private final SQLiteAxolotlStore axolotlStore;
73 private final SessionMap sessions;
74 private final Map<Jid, Set<Integer>> deviceIds;
75 private final Map<String, XmppAxolotlMessage> messageCache;
76 private final FetchStatusMap fetchStatusMap;
77 private final SerialSingleThreadExecutor executor;
78 private int numPublishTriesOnEmptyPep = 0;
79 private boolean pepBroken = false;
80
81 private AtomicBoolean ownPushPending = new AtomicBoolean(false);
82
83 @Override
84 public void onAdvancedStreamFeaturesAvailable(Account account) {
85 if (Config.supportOmemo()
86 && account.getXmppConnection() != null
87 && account.getXmppConnection().getFeatures().pep()) {
88 publishBundlesIfNeeded(true, false);
89 } else {
90 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": skipping OMEMO initialization");
91 }
92 }
93
94 public boolean fetchMapHasErrors(List<Jid> jids) {
95 for(Jid jid : jids) {
96 if (deviceIds.get(jid) != null) {
97 for (Integer foreignId : this.deviceIds.get(jid)) {
98 SignalProtocolAddress address = new SignalProtocolAddress(jid.toPreppedString(), foreignId);
99 if (fetchStatusMap.getAll(address.getName()).containsValue(FetchStatus.ERROR)) {
100 return true;
101 }
102 }
103 }
104 }
105 return false;
106 }
107
108 public void preVerifyFingerprint(Contact contact, String fingerprint) {
109 axolotlStore.preVerifyFingerprint(contact.getAccount(), contact.getJid().toBareJid().toPreppedString(), fingerprint);
110 }
111
112 public void preVerifyFingerprint(Account account, String fingerprint) {
113 axolotlStore.preVerifyFingerprint(account, account.getJid().toBareJid().toPreppedString(), fingerprint);
114 }
115
116 public boolean hasVerifiedKeys(String name) {
117 for(XmppAxolotlSession session : this.sessions.getAll(name).values()) {
118 if (session.getTrust().isVerified()) {
119 return true;
120 }
121 }
122 return false;
123 }
124
125 private static class AxolotlAddressMap<T> {
126 protected Map<String, Map<Integer, T>> map;
127 protected final Object MAP_LOCK = new Object();
128
129 public AxolotlAddressMap() {
130 this.map = new HashMap<>();
131 }
132
133 public void put(SignalProtocolAddress address, T value) {
134 synchronized (MAP_LOCK) {
135 Map<Integer, T> devices = map.get(address.getName());
136 if (devices == null) {
137 devices = new HashMap<>();
138 map.put(address.getName(), devices);
139 }
140 devices.put(address.getDeviceId(), value);
141 }
142 }
143
144 public T get(SignalProtocolAddress address) {
145 synchronized (MAP_LOCK) {
146 Map<Integer, T> devices = map.get(address.getName());
147 if (devices == null) {
148 return null;
149 }
150 return devices.get(address.getDeviceId());
151 }
152 }
153
154 public Map<Integer, T> getAll(String name) {
155 synchronized (MAP_LOCK) {
156 Map<Integer, T> devices = map.get(name);
157 if (devices == null) {
158 return new HashMap<>();
159 }
160 return devices;
161 }
162 }
163
164 public boolean hasAny(SignalProtocolAddress address) {
165 synchronized (MAP_LOCK) {
166 Map<Integer, T> devices = map.get(address.getName());
167 return devices != null && !devices.isEmpty();
168 }
169 }
170
171 public void clear() {
172 map.clear();
173 }
174
175 }
176
177 private static class SessionMap extends AxolotlAddressMap<XmppAxolotlSession> {
178 private final XmppConnectionService xmppConnectionService;
179 private final Account account;
180
181 public SessionMap(XmppConnectionService service, SQLiteAxolotlStore store, Account account) {
182 super();
183 this.xmppConnectionService = service;
184 this.account = account;
185 this.fillMap(store);
186 }
187
188 private void putDevicesForJid(String bareJid, List<Integer> deviceIds, SQLiteAxolotlStore store) {
189 for (Integer deviceId : deviceIds) {
190 SignalProtocolAddress axolotlAddress = new SignalProtocolAddress(bareJid, deviceId);
191 IdentityKey identityKey = store.loadSession(axolotlAddress).getSessionState().getRemoteIdentityKey();
192 if(Config.X509_VERIFICATION) {
193 X509Certificate certificate = store.getFingerprintCertificate(CryptoHelper.bytesToHex(identityKey.getPublicKey().serialize()));
194 if (certificate != null) {
195 Bundle information = CryptoHelper.extractCertificateInformation(certificate);
196 try {
197 final String cn = information.getString("subject_cn");
198 final Jid jid = Jid.fromString(bareJid);
199 Log.d(Config.LOGTAG,"setting common name for "+jid+" to "+cn);
200 account.getRoster().getContact(jid).setCommonName(cn);
201 } catch (final InvalidJidException ignored) {
202 //ignored
203 }
204 }
205 }
206 this.put(axolotlAddress, new XmppAxolotlSession(account, store, axolotlAddress, identityKey));
207 }
208 }
209
210 private void fillMap(SQLiteAxolotlStore store) {
211 List<Integer> deviceIds = store.getSubDeviceSessions(account.getJid().toBareJid().toPreppedString());
212 putDevicesForJid(account.getJid().toBareJid().toPreppedString(), deviceIds, store);
213 for (Contact contact : account.getRoster().getContacts()) {
214 Jid bareJid = contact.getJid().toBareJid();
215 String address = bareJid.toPreppedString();
216 deviceIds = store.getSubDeviceSessions(address);
217 putDevicesForJid(address, deviceIds, store);
218 }
219
220 }
221
222 @Override
223 public void put(SignalProtocolAddress address, XmppAxolotlSession value) {
224 super.put(address, value);
225 value.setNotFresh();
226 xmppConnectionService.syncRosterToDisk(account); //TODO why?
227 }
228
229 public void put(XmppAxolotlSession session) {
230 this.put(session.getRemoteAddress(), session);
231 }
232 }
233
234 public enum FetchStatus {
235 PENDING,
236 SUCCESS,
237 SUCCESS_VERIFIED,
238 TIMEOUT,
239 SUCCESS_TRUSTED,
240 ERROR
241 }
242
243 private static class FetchStatusMap extends AxolotlAddressMap<FetchStatus> {
244
245 public void clearErrorFor(Jid jid) {
246 synchronized (MAP_LOCK) {
247 Map<Integer, FetchStatus> devices = this.map.get(jid.toBareJid().toPreppedString());
248 if (devices == null) {
249 return;
250 }
251 for(Map.Entry<Integer, FetchStatus> entry : devices.entrySet()) {
252 if (entry.getValue() == FetchStatus.ERROR) {
253 Log.d(Config.LOGTAG,"resetting error for "+jid.toBareJid()+"("+entry.getKey()+")");
254 entry.setValue(FetchStatus.TIMEOUT);
255 }
256 }
257 }
258 }
259 }
260
261 public static String getLogprefix(Account account) {
262 return LOGPREFIX + " (" + account.getJid().toBareJid().toString() + "): ";
263 }
264
265 public AxolotlService(Account account, XmppConnectionService connectionService) {
266 if (Security.getProvider("BC") == null) {
267 Security.addProvider(new BouncyCastleProvider());
268 }
269 this.mXmppConnectionService = connectionService;
270 this.account = account;
271 this.axolotlStore = new SQLiteAxolotlStore(this.account, this.mXmppConnectionService);
272 this.deviceIds = new HashMap<>();
273 this.messageCache = new HashMap<>();
274 this.sessions = new SessionMap(mXmppConnectionService, axolotlStore, account);
275 this.fetchStatusMap = new FetchStatusMap();
276 this.executor = new SerialSingleThreadExecutor();
277 }
278
279 public String getOwnFingerprint() {
280 return CryptoHelper.bytesToHex(axolotlStore.getIdentityKeyPair().getPublicKey().serialize());
281 }
282
283 public Set<IdentityKey> getKeysWithTrust(FingerprintStatus status) {
284 return axolotlStore.getContactKeysWithTrust(account.getJid().toBareJid().toPreppedString(), status);
285 }
286
287 public Set<IdentityKey> getKeysWithTrust(FingerprintStatus status, Jid jid) {
288 return axolotlStore.getContactKeysWithTrust(jid.toBareJid().toPreppedString(), status);
289 }
290
291 public Set<IdentityKey> getKeysWithTrust(FingerprintStatus status, List<Jid> jids) {
292 Set<IdentityKey> keys = new HashSet<>();
293 for(Jid jid : jids) {
294 keys.addAll(axolotlStore.getContactKeysWithTrust(jid.toPreppedString(), status));
295 }
296 return keys;
297 }
298
299 public long getNumTrustedKeys(Jid jid) {
300 return axolotlStore.getContactNumTrustedKeys(jid.toBareJid().toPreppedString());
301 }
302
303 public boolean anyTargetHasNoTrustedKeys(List<Jid> jids) {
304 for(Jid jid : jids) {
305 if (axolotlStore.getContactNumTrustedKeys(jid.toBareJid().toPreppedString()) == 0) {
306 return true;
307 }
308 }
309 return false;
310 }
311
312 private SignalProtocolAddress getAddressForJid(Jid jid) {
313 return new SignalProtocolAddress(jid.toPreppedString(), 0);
314 }
315
316 public Collection<XmppAxolotlSession> findOwnSessions() {
317 SignalProtocolAddress ownAddress = getAddressForJid(account.getJid().toBareJid());
318 ArrayList<XmppAxolotlSession> s = new ArrayList<>(this.sessions.getAll(ownAddress.getName()).values());
319 Collections.sort(s);
320 return s;
321 }
322
323
324
325 public Collection<XmppAxolotlSession> findSessionsForContact(Contact contact) {
326 SignalProtocolAddress contactAddress = getAddressForJid(contact.getJid());
327 ArrayList<XmppAxolotlSession> s = new ArrayList<>(this.sessions.getAll(contactAddress.getName()).values());
328 Collections.sort(s);
329 return s;
330 }
331
332 private Set<XmppAxolotlSession> findSessionsForConversation(Conversation conversation) {
333 HashSet<XmppAxolotlSession> sessions = new HashSet<>();
334 for(Jid jid : conversation.getAcceptedCryptoTargets()) {
335 sessions.addAll(this.sessions.getAll(getAddressForJid(jid).getName()).values());
336 }
337 return sessions;
338 }
339
340 private boolean hasAny(Jid jid) {
341 return sessions.hasAny(getAddressForJid(jid));
342 }
343
344 public boolean isPepBroken() {
345 return this.pepBroken;
346 }
347
348 public void resetBrokenness() {
349 this.pepBroken = false;
350 numPublishTriesOnEmptyPep = 0;
351 }
352
353 public void clearErrorsInFetchStatusMap(Jid jid) {
354 fetchStatusMap.clearErrorFor(jid);
355 }
356
357 public void regenerateKeys(boolean wipeOther) {
358 axolotlStore.regenerate();
359 sessions.clear();
360 fetchStatusMap.clear();
361 publishBundlesIfNeeded(true, wipeOther);
362 }
363
364 public int getOwnDeviceId() {
365 return axolotlStore.getLocalRegistrationId();
366 }
367
368 public SignalProtocolAddress getOwnAxolotlAddress() {
369 return new SignalProtocolAddress(account.getJid().toBareJid().toPreppedString(),getOwnDeviceId());
370 }
371
372 public Set<Integer> getOwnDeviceIds() {
373 return this.deviceIds.get(account.getJid().toBareJid());
374 }
375
376 public void registerDevices(final Jid jid, @NonNull final Set<Integer> deviceIds) {
377 boolean me = jid.toBareJid().equals(account.getJid().toBareJid());
378 if (me && ownPushPending.getAndSet(false)) {
379 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": ignoring own device update because of pending push");
380 return;
381 }
382 boolean needsPublishing = me && !deviceIds.contains(getOwnDeviceId());
383 if (me) {
384 deviceIds.remove(getOwnDeviceId());
385 }
386 Set<Integer> expiredDevices = new HashSet<>(axolotlStore.getSubDeviceSessions(jid.toBareJid().toPreppedString()));
387 expiredDevices.removeAll(deviceIds);
388 for (Integer deviceId : expiredDevices) {
389 SignalProtocolAddress address = new SignalProtocolAddress(jid.toBareJid().toPreppedString(), deviceId);
390 XmppAxolotlSession session = sessions.get(address);
391 if (session != null && session.getFingerprint() != null) {
392 if (session.getTrust().isActive()) {
393 session.setTrust(session.getTrust().toInactive());
394 }
395 }
396 }
397 Set<Integer> newDevices = new HashSet<>(deviceIds);
398 for (Integer deviceId : newDevices) {
399 SignalProtocolAddress address = new SignalProtocolAddress(jid.toBareJid().toPreppedString(), deviceId);
400 XmppAxolotlSession session = sessions.get(address);
401 if (session != null && session.getFingerprint() != null) {
402 if (!session.getTrust().isActive()) {
403 Log.d(Config.LOGTAG,"reactivating device with fingerprint "+session.getFingerprint());
404 session.setTrust(session.getTrust().toActive());
405 }
406 }
407 }
408 if (me) {
409 if (Config.OMEMO_AUTO_EXPIRY != 0) {
410 needsPublishing |= deviceIds.removeAll(getExpiredDevices());
411 }
412 for (Integer deviceId : deviceIds) {
413 SignalProtocolAddress ownDeviceAddress = new SignalProtocolAddress(jid.toBareJid().toPreppedString(), deviceId);
414 if (sessions.get(ownDeviceAddress) == null) {
415 FetchStatus status = fetchStatusMap.get(ownDeviceAddress);
416 if (status == null || status == FetchStatus.TIMEOUT) {
417 fetchStatusMap.put(ownDeviceAddress, FetchStatus.PENDING);
418 this.buildSessionFromPEP(ownDeviceAddress);
419 }
420 }
421 }
422 if (needsPublishing) {
423 publishOwnDeviceId(deviceIds);
424 }
425 }
426 this.deviceIds.put(jid, deviceIds);
427 mXmppConnectionService.updateConversationUi(); //update the lock icon
428 mXmppConnectionService.keyStatusUpdated(null);
429 }
430
431 public void wipeOtherPepDevices() {
432 if (pepBroken) {
433 Log.d(Config.LOGTAG, getLogprefix(account) + "wipeOtherPepDevices called, but PEP is broken. Ignoring... ");
434 return;
435 }
436 Set<Integer> deviceIds = new HashSet<>();
437 deviceIds.add(getOwnDeviceId());
438 IqPacket publish = mXmppConnectionService.getIqGenerator().publishDeviceIds(deviceIds);
439 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Wiping all other devices from Pep:" + publish);
440 mXmppConnectionService.sendIqPacket(account, publish, new OnIqPacketReceived() {
441 @Override
442 public void onIqPacketReceived(Account account, IqPacket packet) {
443 if (packet.getType() == IqPacket.TYPE.RESULT) {
444 mXmppConnectionService.pushNodeConfiguration(account, AxolotlService.PEP_DEVICE_LIST, PublishOptions.openAccess(), null);
445 }
446 }
447 });
448 }
449
450 public void distrustFingerprint(final String fingerprint) {
451 final String fp = fingerprint.replaceAll("\\s", "");
452 final FingerprintStatus fingerprintStatus = axolotlStore.getFingerprintStatus(fp);
453 axolotlStore.setFingerprintStatus(fp,fingerprintStatus.toUntrusted());
454 }
455
456 public void publishOwnDeviceIdIfNeeded() {
457 if (pepBroken) {
458 Log.d(Config.LOGTAG, getLogprefix(account) + "publishOwnDeviceIdIfNeeded called, but PEP is broken. Ignoring... ");
459 return;
460 }
461 IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveDeviceIds(account.getJid().toBareJid());
462 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
463 @Override
464 public void onIqPacketReceived(Account account, IqPacket packet) {
465 if (packet.getType() == IqPacket.TYPE.TIMEOUT) {
466 Log.d(Config.LOGTAG, getLogprefix(account) + "Timeout received while retrieving own Device Ids.");
467 } else {
468 Element item = mXmppConnectionService.getIqParser().getItem(packet);
469 Set<Integer> deviceIds = mXmppConnectionService.getIqParser().deviceIds(item);
470 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": retrieved own device list: "+deviceIds);
471 registerDevices(account.getJid().toBareJid(),deviceIds);
472 }
473 }
474 });
475 }
476
477 private Set<Integer> getExpiredDevices() {
478 Set<Integer> devices = new HashSet<>();
479 for(XmppAxolotlSession session : findOwnSessions()) {
480 if (session.getTrust().isActive()) {
481 long diff = System.currentTimeMillis() - session.getTrust().getLastActivation();
482 if (diff > Config.OMEMO_AUTO_EXPIRY) {
483 long lastMessageDiff = System.currentTimeMillis() - mXmppConnectionService.databaseBackend.getLastTimeFingerprintUsed(account,session.getFingerprint());
484 long hours = Math.round(lastMessageDiff/(1000*60.0*60.0));
485 if (lastMessageDiff > Config.OMEMO_AUTO_EXPIRY) {
486 devices.add(session.getRemoteAddress().getDeviceId());
487 session.setTrust(session.getTrust().toInactive());
488 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": added own device " + session.getFingerprint() + " to list of expired devices. Last message received "+hours+" hours ago");
489 } else {
490 Log.d(Config.LOGTAG,account.getJid().toBareJid()+": own device "+session.getFingerprint()+" was active "+hours+" hours ago");
491 }
492 }
493 }
494 }
495 return devices;
496 }
497
498 public void publishOwnDeviceId(Set<Integer> deviceIds) {
499 Set<Integer> deviceIdsCopy = new HashSet<>(deviceIds);
500 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "publishing own device ids");
501 if (deviceIdsCopy.isEmpty()) {
502 if (numPublishTriesOnEmptyPep >= publishTriesThreshold) {
503 Log.w(Config.LOGTAG, getLogprefix(account) + "Own device publish attempt threshold exceeded, aborting...");
504 pepBroken = true;
505 return;
506 } else {
507 numPublishTriesOnEmptyPep++;
508 Log.w(Config.LOGTAG, getLogprefix(account) + "Own device list empty, attempting to publish (try " + numPublishTriesOnEmptyPep + ")");
509 }
510 } else {
511 numPublishTriesOnEmptyPep = 0;
512 }
513 deviceIdsCopy.add(getOwnDeviceId());
514 IqPacket publish = mXmppConnectionService.getIqGenerator().publishDeviceIds(deviceIdsCopy);
515 ownPushPending.set(true);
516 mXmppConnectionService.sendIqPacket(account, publish, new OnIqPacketReceived() {
517 @Override
518 public void onIqPacketReceived(Account account, IqPacket packet) {
519 ownPushPending.set(false);
520 if (packet.getType() == IqPacket.TYPE.ERROR) {
521 pepBroken = true;
522 Log.d(Config.LOGTAG, getLogprefix(account) + "Error received while publishing own device id" + packet.findChild("error"));
523 } else if (packet.getType() != IqPacket.TYPE.TIMEOUT) {
524 mXmppConnectionService.pushNodeConfiguration(account, AxolotlService.PEP_DEVICE_LIST, PublishOptions.openAccess(), null);
525 }
526 }
527 });
528 }
529
530 public void publishDeviceVerificationAndBundle(final SignedPreKeyRecord signedPreKeyRecord,
531 final Set<PreKeyRecord> preKeyRecords,
532 final boolean announceAfter,
533 final boolean wipe) {
534 try {
535 IdentityKey axolotlPublicKey = axolotlStore.getIdentityKeyPair().getPublicKey();
536 PrivateKey x509PrivateKey = KeyChain.getPrivateKey(mXmppConnectionService, account.getPrivateKeyAlias());
537 X509Certificate[] chain = KeyChain.getCertificateChain(mXmppConnectionService, account.getPrivateKeyAlias());
538 Signature verifier = Signature.getInstance("sha256WithRSA");
539 verifier.initSign(x509PrivateKey,mXmppConnectionService.getRNG());
540 verifier.update(axolotlPublicKey.serialize());
541 byte[] signature = verifier.sign();
542 IqPacket packet = mXmppConnectionService.getIqGenerator().publishVerification(signature, chain, getOwnDeviceId());
543 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + ": publish verification for device "+getOwnDeviceId());
544 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
545 @Override
546 public void onIqPacketReceived(final Account account, IqPacket packet) {
547 String node = AxolotlService.PEP_VERIFICATION+":"+getOwnDeviceId();
548 mXmppConnectionService.pushNodeConfiguration(account, node, PublishOptions.openAccess(), new XmppConnectionService.OnConfigurationPushed() {
549 @Override
550 public void onPushSucceeded() {
551 Log.d(Config.LOGTAG,getLogprefix(account) + "configured verification node to be world readable");
552 publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe);
553 }
554
555 @Override
556 public void onPushFailed() {
557 Log.d(Config.LOGTAG,getLogprefix(account) + "unable to set access model on verification node");
558 publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe);
559 }
560 });
561 }
562 });
563 } catch (Exception e) {
564 e.printStackTrace();
565 }
566 }
567
568 public void publishBundlesIfNeeded(final boolean announce, final boolean wipe) {
569 if (pepBroken) {
570 Log.d(Config.LOGTAG, getLogprefix(account) + "publishBundlesIfNeeded called, but PEP is broken. Ignoring... ");
571 return;
572 }
573 IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveBundlesForDevice(account.getJid().toBareJid(), getOwnDeviceId());
574 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
575 @Override
576 public void onIqPacketReceived(Account account, IqPacket packet) {
577
578 if (packet.getType() == IqPacket.TYPE.TIMEOUT) {
579 return; //ignore timeout. do nothing
580 }
581
582 if (packet.getType() == IqPacket.TYPE.ERROR) {
583 Element error = packet.findChild("error");
584 if (error == null || !error.hasChild("item-not-found")) {
585 pepBroken = true;
586 Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "request for device bundles came back with something other than item-not-found" + packet);
587 return;
588 }
589 }
590
591 PreKeyBundle bundle = mXmppConnectionService.getIqParser().bundle(packet);
592 Map<Integer, ECPublicKey> keys = mXmppConnectionService.getIqParser().preKeyPublics(packet);
593 boolean flush = false;
594 if (bundle == null) {
595 Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Received invalid bundle:" + packet);
596 bundle = new PreKeyBundle(-1, -1, -1, null, -1, null, null, null);
597 flush = true;
598 }
599 if (keys == null) {
600 Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Received invalid prekeys:" + packet);
601 }
602 try {
603 boolean changed = false;
604 // Validate IdentityKey
605 IdentityKeyPair identityKeyPair = axolotlStore.getIdentityKeyPair();
606 if (flush || !identityKeyPair.getPublicKey().equals(bundle.getIdentityKey())) {
607 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding own IdentityKey " + identityKeyPair.getPublicKey() + " to PEP.");
608 changed = true;
609 }
610
611 // Validate signedPreKeyRecord + ID
612 SignedPreKeyRecord signedPreKeyRecord;
613 int numSignedPreKeys = axolotlStore.getSignedPreKeysCount();
614 try {
615 signedPreKeyRecord = axolotlStore.loadSignedPreKey(bundle.getSignedPreKeyId());
616 if (flush
617 || !bundle.getSignedPreKey().equals(signedPreKeyRecord.getKeyPair().getPublicKey())
618 || !Arrays.equals(bundle.getSignedPreKeySignature(), signedPreKeyRecord.getSignature())) {
619 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding new signedPreKey with ID " + (numSignedPreKeys + 1) + " to PEP.");
620 signedPreKeyRecord = KeyHelper.generateSignedPreKey(identityKeyPair, numSignedPreKeys + 1);
621 axolotlStore.storeSignedPreKey(signedPreKeyRecord.getId(), signedPreKeyRecord);
622 changed = true;
623 }
624 } catch (InvalidKeyIdException e) {
625 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding new signedPreKey with ID " + (numSignedPreKeys + 1) + " to PEP.");
626 signedPreKeyRecord = KeyHelper.generateSignedPreKey(identityKeyPair, numSignedPreKeys + 1);
627 axolotlStore.storeSignedPreKey(signedPreKeyRecord.getId(), signedPreKeyRecord);
628 changed = true;
629 }
630
631 // Validate PreKeys
632 Set<PreKeyRecord> preKeyRecords = new HashSet<>();
633 if (keys != null) {
634 for (Integer id : keys.keySet()) {
635 try {
636 PreKeyRecord preKeyRecord = axolotlStore.loadPreKey(id);
637 if (preKeyRecord.getKeyPair().getPublicKey().equals(keys.get(id))) {
638 preKeyRecords.add(preKeyRecord);
639 }
640 } catch (InvalidKeyIdException ignored) {
641 }
642 }
643 }
644 int newKeys = NUM_KEYS_TO_PUBLISH - preKeyRecords.size();
645 if (newKeys > 0) {
646 List<PreKeyRecord> newRecords = KeyHelper.generatePreKeys(
647 axolotlStore.getCurrentPreKeyId() + 1, newKeys);
648 preKeyRecords.addAll(newRecords);
649 for (PreKeyRecord record : newRecords) {
650 axolotlStore.storePreKey(record.getId(), record);
651 }
652 changed = true;
653 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding " + newKeys + " new preKeys to PEP.");
654 }
655
656
657 if (changed) {
658 if (account.getPrivateKeyAlias() != null && Config.X509_VERIFICATION) {
659 mXmppConnectionService.publishDisplayName(account);
660 publishDeviceVerificationAndBundle(signedPreKeyRecord, preKeyRecords, announce, wipe);
661 } else {
662 publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announce, wipe);
663 }
664 } else {
665 Log.d(Config.LOGTAG, getLogprefix(account) + "Bundle " + getOwnDeviceId() + " in PEP was current");
666 if (wipe) {
667 wipeOtherPepDevices();
668 } else if (announce) {
669 Log.d(Config.LOGTAG, getLogprefix(account) + "Announcing device " + getOwnDeviceId());
670 publishOwnDeviceIdIfNeeded();
671 }
672 }
673 } catch (InvalidKeyException e) {
674 Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Failed to publish bundle " + getOwnDeviceId() + ", reason: " + e.getMessage());
675 }
676 }
677 });
678 }
679
680 private void publishDeviceBundle(SignedPreKeyRecord signedPreKeyRecord,
681 Set<PreKeyRecord> preKeyRecords,
682 final boolean announceAfter,
683 final boolean wipe) {
684 IqPacket publish = mXmppConnectionService.getIqGenerator().publishBundles(
685 signedPreKeyRecord, axolotlStore.getIdentityKeyPair().getPublicKey(),
686 preKeyRecords, getOwnDeviceId());
687 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + ": Bundle " + getOwnDeviceId() + " in PEP not current. Publishing...");
688 mXmppConnectionService.sendIqPacket(account, publish, new OnIqPacketReceived() {
689 @Override
690 public void onIqPacketReceived(final Account account, IqPacket packet) {
691 if (packet.getType() == IqPacket.TYPE.RESULT) {
692 final String node = AxolotlService.PEP_BUNDLES + ":" + getOwnDeviceId();
693 mXmppConnectionService.pushNodeConfiguration(account, node, PublishOptions.openAccess(), new XmppConnectionService.OnConfigurationPushed() {
694 @Override
695 public void onPushSucceeded() {
696 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Successfully published bundle. ");
697 if (wipe) {
698 wipeOtherPepDevices();
699 } else if (announceAfter) {
700 Log.d(Config.LOGTAG, getLogprefix(account) + "Announcing device " + getOwnDeviceId());
701 publishOwnDeviceIdIfNeeded();
702 }
703 }
704
705 @Override
706 public void onPushFailed() {
707 Log.d(Config.LOGTAG,"unable to change access model for pubsub node");
708 }
709 });
710 } else if (packet.getType() == IqPacket.TYPE.ERROR) {
711 pepBroken = true;
712 Log.d(Config.LOGTAG, getLogprefix(account) + "Error received while publishing bundle: " + packet.findChild("error"));
713 }
714 }
715 });
716 }
717
718 public enum AxolotlCapability {
719 FULL,
720 MISSING_PRESENCE,
721 MISSING_KEYS,
722 WRONG_CONFIGURATION,
723 NO_MEMBERS
724 }
725
726 public boolean isConversationAxolotlCapable(Conversation conversation) {
727 return isConversationAxolotlCapableDetailed(conversation).first == AxolotlCapability.FULL;
728 }
729
730 public Pair<AxolotlCapability,Jid> isConversationAxolotlCapableDetailed(Conversation conversation) {
731 if (conversation.getMode() == Conversation.MODE_SINGLE
732 || (conversation.getMucOptions().membersOnly() && conversation.getMucOptions().nonanonymous())) {
733 final List<Jid> jids = getCryptoTargets(conversation);
734 for(Jid jid : jids) {
735 if (!hasAny(jid) && (!deviceIds.containsKey(jid) || deviceIds.get(jid).isEmpty())) {
736 if (conversation.getAccount().getRoster().getContact(jid).mutualPresenceSubscription()) {
737 return new Pair<>(AxolotlCapability.MISSING_KEYS,jid);
738 } else {
739 return new Pair<>(AxolotlCapability.MISSING_PRESENCE,jid);
740 }
741 }
742 }
743 if (jids.size() > 0) {
744 return new Pair<>(AxolotlCapability.FULL, null);
745 } else {
746 return new Pair<>(AxolotlCapability.NO_MEMBERS, null);
747 }
748 } else {
749 return new Pair<>(AxolotlCapability.WRONG_CONFIGURATION, null);
750 }
751 }
752
753 public List<Jid> getCryptoTargets(Conversation conversation) {
754 final List<Jid> jids;
755 if (conversation.getMode() == Conversation.MODE_SINGLE) {
756 jids = Arrays.asList(conversation.getJid().toBareJid());
757 } else {
758 jids = conversation.getMucOptions().getMembers();
759 }
760 return jids;
761 }
762
763 public FingerprintStatus getFingerprintTrust(String fingerprint) {
764 return axolotlStore.getFingerprintStatus(fingerprint);
765 }
766
767 public X509Certificate getFingerprintCertificate(String fingerprint) {
768 return axolotlStore.getFingerprintCertificate(fingerprint);
769 }
770
771 public void setFingerprintTrust(String fingerprint, FingerprintStatus status) {
772 axolotlStore.setFingerprintStatus(fingerprint, status);
773 }
774
775 private void verifySessionWithPEP(final XmppAxolotlSession session) {
776 Log.d(Config.LOGTAG, "trying to verify fresh session (" + session.getRemoteAddress().getName() + ") with pep");
777 final SignalProtocolAddress address = session.getRemoteAddress();
778 final IdentityKey identityKey = session.getIdentityKey();
779 try {
780 IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveVerificationForDevice(Jid.fromString(address.getName()), address.getDeviceId());
781 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
782 @Override
783 public void onIqPacketReceived(Account account, IqPacket packet) {
784 Pair<X509Certificate[],byte[]> verification = mXmppConnectionService.getIqParser().verification(packet);
785 if (verification != null) {
786 try {
787 Signature verifier = Signature.getInstance("sha256WithRSA");
788 verifier.initVerify(verification.first[0]);
789 verifier.update(identityKey.serialize());
790 if (verifier.verify(verification.second)) {
791 try {
792 mXmppConnectionService.getMemorizingTrustManager().getNonInteractive().checkClientTrusted(verification.first, "RSA");
793 String fingerprint = session.getFingerprint();
794 Log.d(Config.LOGTAG, "verified session with x.509 signature. fingerprint was: "+fingerprint);
795 setFingerprintTrust(fingerprint, FingerprintStatus.createActiveVerified(true));
796 axolotlStore.setFingerprintCertificate(fingerprint, verification.first[0]);
797 fetchStatusMap.put(address, FetchStatus.SUCCESS_VERIFIED);
798 Bundle information = CryptoHelper.extractCertificateInformation(verification.first[0]);
799 try {
800 final String cn = information.getString("subject_cn");
801 final Jid jid = Jid.fromString(address.getName());
802 Log.d(Config.LOGTAG,"setting common name for "+jid+" to "+cn);
803 account.getRoster().getContact(jid).setCommonName(cn);
804 } catch (final InvalidJidException ignored) {
805 //ignored
806 }
807 finishBuildingSessionsFromPEP(address);
808 return;
809 } catch (Exception e) {
810 Log.d(Config.LOGTAG,"could not verify certificate");
811 }
812 }
813 } catch (Exception e) {
814 Log.d(Config.LOGTAG, "error during verification " + e.getMessage());
815 }
816 } else {
817 Log.d(Config.LOGTAG,"no verification found");
818 }
819 fetchStatusMap.put(address, FetchStatus.SUCCESS);
820 finishBuildingSessionsFromPEP(address);
821 }
822 });
823 } catch (InvalidJidException e) {
824 fetchStatusMap.put(address, FetchStatus.SUCCESS);
825 finishBuildingSessionsFromPEP(address);
826 }
827 }
828
829 private final Set<Integer> PREVIOUSLY_REMOVED_FROM_ANNOUNCEMENT = new HashSet<>();
830
831 private void finishBuildingSessionsFromPEP(final SignalProtocolAddress address) {
832 SignalProtocolAddress ownAddress = new SignalProtocolAddress(account.getJid().toBareJid().toPreppedString(), 0);
833 Map<Integer, FetchStatus> own = fetchStatusMap.getAll(ownAddress.getName());
834 Map<Integer, FetchStatus> remote = fetchStatusMap.getAll(address.getName());
835 if (!own.containsValue(FetchStatus.PENDING) && !remote.containsValue(FetchStatus.PENDING)) {
836 FetchStatus report = null;
837 if (own.containsValue(FetchStatus.SUCCESS) || remote.containsValue(FetchStatus.SUCCESS)) {
838 report = FetchStatus.SUCCESS;
839 } else if (own.containsValue(FetchStatus.SUCCESS_VERIFIED) || remote.containsValue(FetchStatus.SUCCESS_VERIFIED)) {
840 report = FetchStatus.SUCCESS_VERIFIED;
841 } else if (own.containsValue(FetchStatus.SUCCESS_TRUSTED) || remote.containsValue(FetchStatus.SUCCESS_TRUSTED)) {
842 report = FetchStatus.SUCCESS_TRUSTED;
843 } else if (own.containsValue(FetchStatus.ERROR) || remote.containsValue(FetchStatus.ERROR)) {
844 report = FetchStatus.ERROR;
845 }
846 mXmppConnectionService.keyStatusUpdated(report);
847 }
848 if (Config.REMOVE_BROKEN_DEVICES) {
849 Set<Integer> ownDeviceIds = new HashSet<>(getOwnDeviceIds());
850 boolean publish = false;
851 for (Map.Entry<Integer, FetchStatus> entry : own.entrySet()) {
852 int id = entry.getKey();
853 if (entry.getValue() == FetchStatus.ERROR && PREVIOUSLY_REMOVED_FROM_ANNOUNCEMENT.add(id) && ownDeviceIds.remove(id)) {
854 publish = true;
855 Log.d(Config.LOGTAG, account.getJid().toBareJid() + ": error fetching own device with id " + id + ". removing from announcement");
856 }
857 }
858 if (publish) {
859 publishOwnDeviceId(ownDeviceIds);
860 }
861 }
862 }
863
864 public boolean hasEmptyDeviceList(Jid jid) {
865 return !hasAny(jid) && (!deviceIds.containsKey(jid) || deviceIds.get(jid).isEmpty());
866 }
867
868 public void fetchDeviceIds(final Jid jid) {
869 Log.d(Config.LOGTAG,"fetching device ids for "+jid);
870 IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveDeviceIds(jid);
871 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
872 @Override
873 public void onIqPacketReceived(Account account, IqPacket packet) {
874 if (packet.getType() == IqPacket.TYPE.RESULT) {
875 Element item = mXmppConnectionService.getIqParser().getItem(packet);
876 Set<Integer> deviceIds = mXmppConnectionService.getIqParser().deviceIds(item);
877 registerDevices(jid,deviceIds);
878 } else {
879 Log.d(Config.LOGTAG,packet.toString());
880 }
881 }
882 });
883 }
884
885 private void buildSessionFromPEP(final SignalProtocolAddress address) {
886 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Building new session for " + address.toString());
887 if (address.equals(getOwnAxolotlAddress())) {
888 throw new AssertionError("We should NEVER build a session with ourselves. What happened here?!");
889 }
890
891 try {
892 IqPacket bundlesPacket = mXmppConnectionService.getIqGenerator().retrieveBundlesForDevice(
893 Jid.fromString(address.getName()), address.getDeviceId());
894 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Retrieving bundle: " + bundlesPacket);
895 mXmppConnectionService.sendIqPacket(account, bundlesPacket, new OnIqPacketReceived() {
896
897 @Override
898 public void onIqPacketReceived(Account account, IqPacket packet) {
899 if (packet.getType() == IqPacket.TYPE.TIMEOUT) {
900 fetchStatusMap.put(address, FetchStatus.TIMEOUT);
901 } else if (packet.getType() == IqPacket.TYPE.RESULT) {
902 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Received preKey IQ packet, processing...");
903 final IqParser parser = mXmppConnectionService.getIqParser();
904 final List<PreKeyBundle> preKeyBundleList = parser.preKeys(packet);
905 final PreKeyBundle bundle = parser.bundle(packet);
906 if (preKeyBundleList.isEmpty() || bundle == null) {
907 Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "preKey IQ packet invalid: " + packet);
908 fetchStatusMap.put(address, FetchStatus.ERROR);
909 finishBuildingSessionsFromPEP(address);
910 return;
911 }
912 Random random = new Random();
913 final PreKeyBundle preKey = preKeyBundleList.get(random.nextInt(preKeyBundleList.size()));
914 if (preKey == null) {
915 //should never happen
916 fetchStatusMap.put(address, FetchStatus.ERROR);
917 finishBuildingSessionsFromPEP(address);
918 return;
919 }
920
921 final PreKeyBundle preKeyBundle = new PreKeyBundle(0, address.getDeviceId(),
922 preKey.getPreKeyId(), preKey.getPreKey(),
923 bundle.getSignedPreKeyId(), bundle.getSignedPreKey(),
924 bundle.getSignedPreKeySignature(), bundle.getIdentityKey());
925
926 try {
927 SessionBuilder builder = new SessionBuilder(axolotlStore, address);
928 builder.process(preKeyBundle);
929 XmppAxolotlSession session = new XmppAxolotlSession(account, axolotlStore, address, bundle.getIdentityKey());
930 sessions.put(address, session);
931 if (Config.X509_VERIFICATION) {
932 verifySessionWithPEP(session);
933 } else {
934 FingerprintStatus status = getFingerprintTrust(CryptoHelper.bytesToHex(bundle.getIdentityKey().getPublicKey().serialize()));
935 FetchStatus fetchStatus;
936 if (status != null && status.isVerified()) {
937 fetchStatus = FetchStatus.SUCCESS_VERIFIED;
938 } else if (status != null && status.isTrusted()) {
939 fetchStatus = FetchStatus.SUCCESS_TRUSTED;
940 } else {
941 fetchStatus = FetchStatus.SUCCESS;
942 }
943 fetchStatusMap.put(address, fetchStatus);
944 finishBuildingSessionsFromPEP(address);
945 }
946 } catch (UntrustedIdentityException | InvalidKeyException e) {
947 Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Error building session for " + address + ": "
948 + e.getClass().getName() + ", " + e.getMessage());
949 fetchStatusMap.put(address, FetchStatus.ERROR);
950 finishBuildingSessionsFromPEP(address);
951 }
952 } else {
953 fetchStatusMap.put(address, FetchStatus.ERROR);
954 Log.d(Config.LOGTAG, getLogprefix(account) + "Error received while building session:" + packet.findChild("error"));
955 finishBuildingSessionsFromPEP(address);
956 }
957 }
958 });
959 } catch (InvalidJidException e) {
960 Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Got address with invalid jid: " + address.getName());
961 }
962 }
963
964 public Set<SignalProtocolAddress> findDevicesWithoutSession(final Conversation conversation) {
965 Set<SignalProtocolAddress> addresses = new HashSet<>();
966 for(Jid jid : getCryptoTargets(conversation)) {
967 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Finding devices without session for " + jid);
968 if (deviceIds.get(jid) != null) {
969 for (Integer foreignId : this.deviceIds.get(jid)) {
970 SignalProtocolAddress address = new SignalProtocolAddress(jid.toPreppedString(), foreignId);
971 if (sessions.get(address) == null) {
972 IdentityKey identityKey = axolotlStore.loadSession(address).getSessionState().getRemoteIdentityKey();
973 if (identityKey != null) {
974 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Already have session for " + address.toString() + ", adding to cache...");
975 XmppAxolotlSession session = new XmppAxolotlSession(account, axolotlStore, address, identityKey);
976 sessions.put(address, session);
977 } else {
978 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Found device " + jid + ":" + foreignId);
979 if (fetchStatusMap.get(address) != FetchStatus.ERROR) {
980 addresses.add(address);
981 } else {
982 Log.d(Config.LOGTAG, getLogprefix(account) + "skipping over " + address + " because it's broken");
983 }
984 }
985 }
986 }
987 } else {
988 Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Have no target devices in PEP!");
989 }
990 }
991 if (deviceIds.get(account.getJid().toBareJid()) != null) {
992 for (Integer ownId : this.deviceIds.get(account.getJid().toBareJid())) {
993 SignalProtocolAddress address = new SignalProtocolAddress(account.getJid().toBareJid().toPreppedString(), ownId);
994 if (sessions.get(address) == null) {
995 IdentityKey identityKey = axolotlStore.loadSession(address).getSessionState().getRemoteIdentityKey();
996 if (identityKey != null) {
997 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Already have session for " + address.toString() + ", adding to cache...");
998 XmppAxolotlSession session = new XmppAxolotlSession(account, axolotlStore, address, identityKey);
999 sessions.put(address, session);
1000 } else {
1001 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Found device " + account.getJid().toBareJid() + ":" + ownId);
1002 if (fetchStatusMap.get(address) != FetchStatus.ERROR) {
1003 addresses.add(address);
1004 } else {
1005 Log.d(Config.LOGTAG,getLogprefix(account)+"skipping over "+address+" because it's broken");
1006 }
1007 }
1008 }
1009 }
1010 }
1011
1012 return addresses;
1013 }
1014
1015 public boolean createSessionsIfNeeded(final Conversation conversation) {
1016 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Creating axolotl sessions if needed...");
1017 boolean newSessions = false;
1018 Set<SignalProtocolAddress> addresses = findDevicesWithoutSession(conversation);
1019 for (SignalProtocolAddress address : addresses) {
1020 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Processing device: " + address.toString());
1021 FetchStatus status = fetchStatusMap.get(address);
1022 if (status == null || status == FetchStatus.TIMEOUT) {
1023 fetchStatusMap.put(address, FetchStatus.PENDING);
1024 this.buildSessionFromPEP(address);
1025 newSessions = true;
1026 } else if (status == FetchStatus.PENDING) {
1027 newSessions = true;
1028 } else {
1029 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Already fetching bundle for " + address.toString());
1030 }
1031 }
1032
1033 return newSessions;
1034 }
1035
1036 public boolean trustedSessionVerified(final Conversation conversation) {
1037 Set<XmppAxolotlSession> sessions = findSessionsForConversation(conversation);
1038 sessions.addAll(findOwnSessions());
1039 boolean verified = false;
1040 for(XmppAxolotlSession session : sessions) {
1041 if (session.getTrust().isTrustedAndActive()) {
1042 if (session.getTrust().getTrust() == FingerprintStatus.Trust.VERIFIED_X509) {
1043 verified = true;
1044 } else {
1045 return false;
1046 }
1047 }
1048 }
1049 return verified;
1050 }
1051
1052 public boolean hasPendingKeyFetches(Account account, List<Jid> jids) {
1053 SignalProtocolAddress ownAddress = new SignalProtocolAddress(account.getJid().toBareJid().toPreppedString(), 0);
1054 if (fetchStatusMap.getAll(ownAddress.getName()).containsValue(FetchStatus.PENDING)) {
1055 return true;
1056 }
1057 for(Jid jid : jids) {
1058 SignalProtocolAddress foreignAddress = new SignalProtocolAddress(jid.toBareJid().toPreppedString(), 0);
1059 if (fetchStatusMap.getAll(foreignAddress.getName()).containsValue(FetchStatus.PENDING)) {
1060 return true;
1061 }
1062 }
1063 return false;
1064 }
1065
1066 @Nullable
1067 private boolean buildHeader(XmppAxolotlMessage axolotlMessage, Conversation conversation) {
1068 Set<XmppAxolotlSession> remoteSessions = findSessionsForConversation(conversation);
1069 Collection<XmppAxolotlSession> ownSessions = findOwnSessions();
1070 if (remoteSessions.isEmpty()) {
1071 return false;
1072 }
1073 for (XmppAxolotlSession session : remoteSessions) {
1074 axolotlMessage.addDevice(session);
1075 }
1076 for (XmppAxolotlSession session : ownSessions) {
1077 axolotlMessage.addDevice(session);
1078 }
1079
1080 return true;
1081 }
1082
1083 @Nullable
1084 public XmppAxolotlMessage encrypt(Message message) {
1085 final XmppAxolotlMessage axolotlMessage = new XmppAxolotlMessage(account.getJid().toBareJid(), getOwnDeviceId());
1086 final String content;
1087 if (message.hasFileOnRemoteHost()) {
1088 content = message.getFileParams().url.toString();
1089 } else {
1090 content = message.getBody();
1091 }
1092 try {
1093 axolotlMessage.encrypt(content);
1094 } catch (CryptoFailedException e) {
1095 Log.w(Config.LOGTAG, getLogprefix(account) + "Failed to encrypt message: " + e.getMessage());
1096 return null;
1097 }
1098 if (!buildHeader(axolotlMessage,message.getConversation())) {
1099 return null;
1100 }
1101
1102 return axolotlMessage;
1103 }
1104
1105 public void preparePayloadMessage(final Message message, final boolean delay) {
1106 executor.execute(new Runnable() {
1107 @Override
1108 public void run() {
1109 XmppAxolotlMessage axolotlMessage = encrypt(message);
1110 if (axolotlMessage == null) {
1111 mXmppConnectionService.markMessage(message, Message.STATUS_SEND_FAILED);
1112 //mXmppConnectionService.updateConversationUi();
1113 } else {
1114 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Generated message, caching: " + message.getUuid());
1115 messageCache.put(message.getUuid(), axolotlMessage);
1116 mXmppConnectionService.resendMessage(message, delay);
1117 }
1118 }
1119 });
1120 }
1121
1122 public void prepareKeyTransportMessage(final Conversation conversation, final OnMessageCreatedCallback onMessageCreatedCallback) {
1123 executor.execute(new Runnable() {
1124 @Override
1125 public void run() {
1126 final XmppAxolotlMessage axolotlMessage = new XmppAxolotlMessage(account.getJid().toBareJid(), getOwnDeviceId());
1127 if (buildHeader(axolotlMessage,conversation)) {
1128 onMessageCreatedCallback.run(axolotlMessage);
1129 } else {
1130 onMessageCreatedCallback.run(null);
1131 }
1132 }
1133 });
1134 }
1135
1136 public XmppAxolotlMessage fetchAxolotlMessageFromCache(Message message) {
1137 XmppAxolotlMessage axolotlMessage = messageCache.get(message.getUuid());
1138 if (axolotlMessage != null) {
1139 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Cache hit: " + message.getUuid());
1140 messageCache.remove(message.getUuid());
1141 } else {
1142 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Cache miss: " + message.getUuid());
1143 }
1144 return axolotlMessage;
1145 }
1146
1147 private XmppAxolotlSession recreateUncachedSession(SignalProtocolAddress address) {
1148 IdentityKey identityKey = axolotlStore.loadSession(address).getSessionState().getRemoteIdentityKey();
1149 return (identityKey != null)
1150 ? new XmppAxolotlSession(account, axolotlStore, address, identityKey)
1151 : null;
1152 }
1153
1154 private XmppAxolotlSession getReceivingSession(XmppAxolotlMessage message) {
1155 SignalProtocolAddress senderAddress = new SignalProtocolAddress(message.getFrom().toPreppedString(),
1156 message.getSenderDeviceId());
1157 XmppAxolotlSession session = sessions.get(senderAddress);
1158 if (session == null) {
1159 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Account: " + account.getJid() + " No axolotl session found while parsing received message " + message);
1160 session = recreateUncachedSession(senderAddress);
1161 if (session == null) {
1162 session = new XmppAxolotlSession(account, axolotlStore, senderAddress);
1163 }
1164 }
1165 return session;
1166 }
1167
1168 public XmppAxolotlMessage.XmppAxolotlPlaintextMessage processReceivingPayloadMessage(XmppAxolotlMessage message) {
1169 XmppAxolotlMessage.XmppAxolotlPlaintextMessage plaintextMessage = null;
1170
1171 XmppAxolotlSession session = getReceivingSession(message);
1172 try {
1173 plaintextMessage = message.decrypt(session, getOwnDeviceId());
1174 Integer preKeyId = session.getPreKeyId();
1175 if (preKeyId != null) {
1176 publishBundlesIfNeeded(false, false);
1177 session.resetPreKeyId();
1178 }
1179 } catch (CryptoFailedException e) {
1180 Log.w(Config.LOGTAG, getLogprefix(account) + "Failed to decrypt message from "+message.getFrom()+": " + e.getMessage());
1181 }
1182
1183 if (session.isFresh() && plaintextMessage != null) {
1184 putFreshSession(session);
1185 }
1186
1187 return plaintextMessage;
1188 }
1189
1190 public XmppAxolotlMessage.XmppAxolotlKeyTransportMessage processReceivingKeyTransportMessage(XmppAxolotlMessage message) {
1191 XmppAxolotlMessage.XmppAxolotlKeyTransportMessage keyTransportMessage;
1192
1193 XmppAxolotlSession session = getReceivingSession(message);
1194 try {
1195 keyTransportMessage = message.getParameters(session, getOwnDeviceId());
1196 } catch (CryptoFailedException e) {
1197 Log.d(Config.LOGTAG,"could not decrypt keyTransport message "+e.getMessage());
1198 keyTransportMessage = null;
1199 }
1200
1201 if (session.isFresh() && keyTransportMessage != null) {
1202 putFreshSession(session);
1203 }
1204
1205 return keyTransportMessage;
1206 }
1207
1208 private void putFreshSession(XmppAxolotlSession session) {
1209 Log.d(Config.LOGTAG,"put fresh session");
1210 sessions.put(session);
1211 if (Config.X509_VERIFICATION) {
1212 if (session.getIdentityKey() != null) {
1213 verifySessionWithPEP(session);
1214 } else {
1215 Log.e(Config.LOGTAG,account.getJid().toBareJid()+": identity key was empty after reloading for x509 verification");
1216 }
1217 }
1218 }
1219}