1package eu.siacs.conversations.crypto.axolotl;
2
3import android.os.Bundle;
4import android.security.KeyChain;
5import android.support.annotation.NonNull;
6import android.support.annotation.Nullable;
7import android.util.Log;
8import android.util.Pair;
9
10import org.bouncycastle.jce.provider.BouncyCastleProvider;
11import org.whispersystems.libsignal.SignalProtocolAddress;
12import org.whispersystems.libsignal.IdentityKey;
13import org.whispersystems.libsignal.IdentityKeyPair;
14import org.whispersystems.libsignal.InvalidKeyException;
15import org.whispersystems.libsignal.InvalidKeyIdException;
16import org.whispersystems.libsignal.SessionBuilder;
17import org.whispersystems.libsignal.UntrustedIdentityException;
18import org.whispersystems.libsignal.ecc.ECPublicKey;
19import org.whispersystems.libsignal.state.PreKeyBundle;
20import org.whispersystems.libsignal.state.PreKeyRecord;
21import org.whispersystems.libsignal.state.SignedPreKeyRecord;
22import org.whispersystems.libsignal.util.KeyHelper;
23
24import java.security.PrivateKey;
25import java.security.Security;
26import java.security.Signature;
27import java.security.cert.X509Certificate;
28import java.util.ArrayList;
29import java.util.Arrays;
30import java.util.Collection;
31import java.util.Collections;
32import java.util.HashMap;
33import java.util.HashSet;
34import java.util.Iterator;
35import java.util.List;
36import java.util.Map;
37import java.util.Random;
38import java.util.Set;
39import java.util.concurrent.atomic.AtomicBoolean;
40
41import eu.siacs.conversations.Config;
42import eu.siacs.conversations.entities.Account;
43import eu.siacs.conversations.entities.Contact;
44import eu.siacs.conversations.entities.Conversation;
45import eu.siacs.conversations.entities.Message;
46import eu.siacs.conversations.parser.IqParser;
47import eu.siacs.conversations.services.XmppConnectionService;
48import eu.siacs.conversations.utils.CryptoHelper;
49import eu.siacs.conversations.utils.SerialSingleThreadExecutor;
50import eu.siacs.conversations.xml.Element;
51import eu.siacs.conversations.xml.Namespace;
52import eu.siacs.conversations.xmpp.OnAdvancedStreamFeaturesLoaded;
53import eu.siacs.conversations.xmpp.OnIqPacketReceived;
54import eu.siacs.conversations.xmpp.pep.PublishOptions;
55import eu.siacs.conversations.xmpp.stanzas.IqPacket;
56import eu.siacs.conversations.xmpp.stanzas.MessagePacket;
57import rocks.xmpp.addr.Jid;
58
59public class AxolotlService implements OnAdvancedStreamFeaturesLoaded {
60
61 public static final String PEP_PREFIX = "eu.siacs.conversations.axolotl";
62 public static final String PEP_DEVICE_LIST = PEP_PREFIX + ".devicelist";
63 public static final String PEP_DEVICE_LIST_NOTIFY = PEP_DEVICE_LIST + "+notify";
64 public static final String PEP_BUNDLES = PEP_PREFIX + ".bundles";
65 public static final String PEP_VERIFICATION = PEP_PREFIX + ".verification";
66 public static final String PEP_OMEMO_WHITELISTED = PEP_PREFIX + ".whitelisted";
67
68 public static final String LOGPREFIX = "AxolotlService";
69
70 public static final int NUM_KEYS_TO_PUBLISH = 100;
71 public static final int publishTriesThreshold = 3;
72
73 private final Account account;
74 private final XmppConnectionService mXmppConnectionService;
75 private final SQLiteAxolotlStore axolotlStore;
76 private final SessionMap sessions;
77 private final Map<Jid, Set<Integer>> deviceIds;
78 private final Map<String, XmppAxolotlMessage> messageCache;
79 private final FetchStatusMap fetchStatusMap;
80 private final Map<Jid, Boolean> fetchDeviceListStatus = new HashMap<>();
81 private final HashMap<Jid, List<OnDeviceIdsFetched>> fetchDeviceIdsMap = new HashMap<>();
82 private final SerialSingleThreadExecutor executor;
83 private int numPublishTriesOnEmptyPep = 0;
84 private boolean pepBroken = false;
85 private int lastDeviceListNotificationHash = 0;
86 private Set<XmppAxolotlSession> postponedSessions = new HashSet<>(); //sessions stored here will receive after mam catchup treatment
87
88 private AtomicBoolean changeAccessMode = new AtomicBoolean(false);
89
90 @Override
91 public void onAdvancedStreamFeaturesAvailable(Account account) {
92 if (Config.supportOmemo()
93 && account.getXmppConnection() != null
94 && account.getXmppConnection().getFeatures().pep()) {
95 publishBundlesIfNeeded(true, false);
96 } else {
97 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": skipping OMEMO initialization");
98 }
99 }
100
101 private boolean hasErrorFetchingDeviceList(Jid jid) {
102 Boolean status = fetchDeviceListStatus.get(jid);
103 return status != null && !status;
104 }
105
106 public boolean hasErrorFetchingDeviceList(List<Jid> jids) {
107 for(Jid jid : jids) {
108 if (hasErrorFetchingDeviceList(jid)) {
109 return true;
110 }
111 }
112 return false;
113 }
114
115 public boolean fetchMapHasErrors(List<Jid> jids) {
116 for (Jid jid : jids) {
117 if (deviceIds.get(jid) != null) {
118 for (Integer foreignId : this.deviceIds.get(jid)) {
119 SignalProtocolAddress address = new SignalProtocolAddress(jid.toString(), foreignId);
120 if (fetchStatusMap.getAll(address.getName()).containsValue(FetchStatus.ERROR)) {
121 return true;
122 }
123 }
124 }
125 }
126 return false;
127 }
128
129 public void preVerifyFingerprint(Contact contact, String fingerprint) {
130 axolotlStore.preVerifyFingerprint(contact.getAccount(), contact.getJid().asBareJid().toString(), fingerprint);
131 }
132
133 public void preVerifyFingerprint(Account account, String fingerprint) {
134 axolotlStore.preVerifyFingerprint(account, account.getJid().asBareJid().toString(), fingerprint);
135 }
136
137 public boolean hasVerifiedKeys(String name) {
138 for (XmppAxolotlSession session : this.sessions.getAll(name).values()) {
139 if (session.getTrust().isVerified()) {
140 return true;
141 }
142 }
143 return false;
144 }
145
146 private static class AxolotlAddressMap<T> {
147 protected Map<String, Map<Integer, T>> map;
148 protected final Object MAP_LOCK = new Object();
149
150 public AxolotlAddressMap() {
151 this.map = new HashMap<>();
152 }
153
154 public void put(SignalProtocolAddress address, T value) {
155 synchronized (MAP_LOCK) {
156 Map<Integer, T> devices = map.get(address.getName());
157 if (devices == null) {
158 devices = new HashMap<>();
159 map.put(address.getName(), devices);
160 }
161 devices.put(address.getDeviceId(), value);
162 }
163 }
164
165 public T get(SignalProtocolAddress address) {
166 synchronized (MAP_LOCK) {
167 Map<Integer, T> devices = map.get(address.getName());
168 if (devices == null) {
169 return null;
170 }
171 return devices.get(address.getDeviceId());
172 }
173 }
174
175 public Map<Integer, T> getAll(String name) {
176 synchronized (MAP_LOCK) {
177 Map<Integer, T> devices = map.get(name);
178 if (devices == null) {
179 return new HashMap<>();
180 }
181 return devices;
182 }
183 }
184
185 public boolean hasAny(SignalProtocolAddress address) {
186 synchronized (MAP_LOCK) {
187 Map<Integer, T> devices = map.get(address.getName());
188 return devices != null && !devices.isEmpty();
189 }
190 }
191
192 public void clear() {
193 map.clear();
194 }
195
196 }
197
198 private static class SessionMap extends AxolotlAddressMap<XmppAxolotlSession> {
199 private final XmppConnectionService xmppConnectionService;
200 private final Account account;
201
202 public SessionMap(XmppConnectionService service, SQLiteAxolotlStore store, Account account) {
203 super();
204 this.xmppConnectionService = service;
205 this.account = account;
206 this.fillMap(store);
207 }
208
209 private void putDevicesForJid(String bareJid, List<Integer> deviceIds, SQLiteAxolotlStore store) {
210 for (Integer deviceId : deviceIds) {
211 SignalProtocolAddress axolotlAddress = new SignalProtocolAddress(bareJid, deviceId);
212 IdentityKey identityKey = store.loadSession(axolotlAddress).getSessionState().getRemoteIdentityKey();
213 if (Config.X509_VERIFICATION) {
214 X509Certificate certificate = store.getFingerprintCertificate(CryptoHelper.bytesToHex(identityKey.getPublicKey().serialize()));
215 if (certificate != null) {
216 Bundle information = CryptoHelper.extractCertificateInformation(certificate);
217 try {
218 final String cn = information.getString("subject_cn");
219 final Jid jid = Jid.of(bareJid);
220 Log.d(Config.LOGTAG, "setting common name for " + jid + " to " + cn);
221 account.getRoster().getContact(jid).setCommonName(cn);
222 } catch (final IllegalArgumentException ignored) {
223 //ignored
224 }
225 }
226 }
227 this.put(axolotlAddress, new XmppAxolotlSession(account, store, axolotlAddress, identityKey));
228 }
229 }
230
231 private void fillMap(SQLiteAxolotlStore store) {
232 List<Integer> deviceIds = store.getSubDeviceSessions(account.getJid().asBareJid().toString());
233 putDevicesForJid(account.getJid().asBareJid().toString(), deviceIds, store);
234 for (String address : store.getKnownAddresses()) {
235 deviceIds = store.getSubDeviceSessions(address);
236 putDevicesForJid(address, deviceIds, store);
237 }
238 }
239
240 @Override
241 public void put(SignalProtocolAddress address, XmppAxolotlSession value) {
242 super.put(address, value);
243 value.setNotFresh();
244 }
245
246 public void put(XmppAxolotlSession session) {
247 this.put(session.getRemoteAddress(), session);
248 }
249 }
250
251 public enum FetchStatus {
252 PENDING,
253 SUCCESS,
254 SUCCESS_VERIFIED,
255 TIMEOUT,
256 SUCCESS_TRUSTED,
257 ERROR
258 }
259
260 private static class FetchStatusMap extends AxolotlAddressMap<FetchStatus> {
261
262 public void clearErrorFor(Jid jid) {
263 synchronized (MAP_LOCK) {
264 Map<Integer, FetchStatus> devices = this.map.get(jid.asBareJid().toString());
265 if (devices == null) {
266 return;
267 }
268 for (Map.Entry<Integer, FetchStatus> entry : devices.entrySet()) {
269 if (entry.getValue() == FetchStatus.ERROR) {
270 Log.d(Config.LOGTAG, "resetting error for " + jid.asBareJid() + "(" + entry.getKey() + ")");
271 entry.setValue(FetchStatus.TIMEOUT);
272 }
273 }
274 }
275 }
276 }
277
278 public static String getLogprefix(Account account) {
279 return LOGPREFIX + " (" + account.getJid().asBareJid().toString() + "): ";
280 }
281
282 public AxolotlService(Account account, XmppConnectionService connectionService) {
283 if (account == null || connectionService == null) {
284 throw new IllegalArgumentException("account and service cannot be null");
285 }
286 if (Security.getProvider("BC") == null) {
287 Security.addProvider(new BouncyCastleProvider());
288 }
289 this.mXmppConnectionService = connectionService;
290 this.account = account;
291 this.axolotlStore = new SQLiteAxolotlStore(this.account, this.mXmppConnectionService);
292 this.deviceIds = new HashMap<>();
293 this.messageCache = new HashMap<>();
294 this.sessions = new SessionMap(mXmppConnectionService, axolotlStore, account);
295 this.fetchStatusMap = new FetchStatusMap();
296 this.executor = new SerialSingleThreadExecutor("Axolotl");
297 }
298
299 public String getOwnFingerprint() {
300 return CryptoHelper.bytesToHex(axolotlStore.getIdentityKeyPair().getPublicKey().serialize());
301 }
302
303 public Set<IdentityKey> getKeysWithTrust(FingerprintStatus status) {
304 return axolotlStore.getContactKeysWithTrust(account.getJid().asBareJid().toString(), status);
305 }
306
307 public Set<IdentityKey> getKeysWithTrust(FingerprintStatus status, Jid jid) {
308 return axolotlStore.getContactKeysWithTrust(jid.asBareJid().toString(), status);
309 }
310
311 public Set<IdentityKey> getKeysWithTrust(FingerprintStatus status, List<Jid> jids) {
312 Set<IdentityKey> keys = new HashSet<>();
313 for (Jid jid : jids) {
314 keys.addAll(axolotlStore.getContactKeysWithTrust(jid.toString(), status));
315 }
316 return keys;
317 }
318
319 public long getNumTrustedKeys(Jid jid) {
320 return axolotlStore.getContactNumTrustedKeys(jid.asBareJid().toString());
321 }
322
323 public boolean anyTargetHasNoTrustedKeys(List<Jid> jids) {
324 for (Jid jid : jids) {
325 if (axolotlStore.getContactNumTrustedKeys(jid.asBareJid().toString()) == 0) {
326 return true;
327 }
328 }
329 return false;
330 }
331
332 private SignalProtocolAddress getAddressForJid(Jid jid) {
333 return new SignalProtocolAddress(jid.toString(), 0);
334 }
335
336 public Collection<XmppAxolotlSession> findOwnSessions() {
337 SignalProtocolAddress ownAddress = getAddressForJid(account.getJid().asBareJid());
338 ArrayList<XmppAxolotlSession> s = new ArrayList<>(this.sessions.getAll(ownAddress.getName()).values());
339 Collections.sort(s);
340 return s;
341 }
342
343
344 public Collection<XmppAxolotlSession> findSessionsForContact(Contact contact) {
345 SignalProtocolAddress contactAddress = getAddressForJid(contact.getJid());
346 ArrayList<XmppAxolotlSession> s = new ArrayList<>(this.sessions.getAll(contactAddress.getName()).values());
347 Collections.sort(s);
348 return s;
349 }
350
351 private Set<XmppAxolotlSession> findSessionsForConversation(Conversation conversation) {
352 if (conversation.getContact().isSelf()) {
353 //will be added in findOwnSessions()
354 return Collections.emptySet();
355 }
356 HashSet<XmppAxolotlSession> sessions = new HashSet<>();
357 for (Jid jid : conversation.getAcceptedCryptoTargets()) {
358 sessions.addAll(this.sessions.getAll(getAddressForJid(jid).getName()).values());
359 }
360 return sessions;
361 }
362
363 private boolean hasAny(Jid jid) {
364 return sessions.hasAny(getAddressForJid(jid));
365 }
366
367 public boolean isPepBroken() {
368 return this.pepBroken;
369 }
370
371 public void resetBrokenness() {
372 this.pepBroken = false;
373 this.numPublishTriesOnEmptyPep = 0;
374 this.lastDeviceListNotificationHash = 0;
375 }
376
377 public void clearErrorsInFetchStatusMap(Jid jid) {
378 fetchStatusMap.clearErrorFor(jid);
379 fetchDeviceListStatus.remove(jid);
380 }
381
382 public void regenerateKeys(boolean wipeOther) {
383 axolotlStore.regenerate();
384 sessions.clear();
385 fetchStatusMap.clear();
386 fetchDeviceIdsMap.clear();
387 fetchDeviceListStatus.clear();
388 publishBundlesIfNeeded(true, wipeOther);
389 }
390
391 public void destroy() {
392 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": destroying old axolotl service. no longer in use");
393 mXmppConnectionService.databaseBackend.wipeAxolotlDb(account);
394 }
395
396 public AxolotlService makeNew() {
397 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": make new axolotl service");
398 return new AxolotlService(this.account, this.mXmppConnectionService);
399 }
400
401 public int getOwnDeviceId() {
402 return axolotlStore.getLocalRegistrationId();
403 }
404
405 public SignalProtocolAddress getOwnAxolotlAddress() {
406 return new SignalProtocolAddress(account.getJid().asBareJid().toString(), getOwnDeviceId());
407 }
408
409 public Set<Integer> getOwnDeviceIds() {
410 return this.deviceIds.get(account.getJid().asBareJid());
411 }
412
413 public void registerDevices(final Jid jid, @NonNull final Set<Integer> deviceIds) {
414 final int hash = deviceIds.hashCode();
415 final boolean me = jid.asBareJid().equals(account.getJid().asBareJid());
416 if (me) {
417 if (hash != 0 && hash == this.lastDeviceListNotificationHash) {
418 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": ignoring duplicate own device id list");
419 return;
420 }
421 this.lastDeviceListNotificationHash = hash;
422 }
423 boolean needsPublishing = me && !deviceIds.contains(getOwnDeviceId());
424 if (me) {
425 deviceIds.remove(getOwnDeviceId());
426 }
427 Set<Integer> expiredDevices = new HashSet<>(axolotlStore.getSubDeviceSessions(jid.asBareJid().toString()));
428 expiredDevices.removeAll(deviceIds);
429 for (Integer deviceId : expiredDevices) {
430 SignalProtocolAddress address = new SignalProtocolAddress(jid.asBareJid().toString(), deviceId);
431 XmppAxolotlSession session = sessions.get(address);
432 if (session != null && session.getFingerprint() != null) {
433 if (session.getTrust().isActive()) {
434 session.setTrust(session.getTrust().toInactive());
435 }
436 }
437 }
438 Set<Integer> newDevices = new HashSet<>(deviceIds);
439 for (Integer deviceId : newDevices) {
440 SignalProtocolAddress address = new SignalProtocolAddress(jid.asBareJid().toString(), deviceId);
441 XmppAxolotlSession session = sessions.get(address);
442 if (session != null && session.getFingerprint() != null) {
443 if (!session.getTrust().isActive()) {
444 Log.d(Config.LOGTAG, "reactivating device with fingerprint " + session.getFingerprint());
445 session.setTrust(session.getTrust().toActive());
446 }
447 }
448 }
449 if (me) {
450 if (Config.OMEMO_AUTO_EXPIRY != 0) {
451 needsPublishing |= deviceIds.removeAll(getExpiredDevices());
452 }
453 needsPublishing |= this.changeAccessMode.get();
454 for (Integer deviceId : deviceIds) {
455 SignalProtocolAddress ownDeviceAddress = new SignalProtocolAddress(jid.asBareJid().toString(), deviceId);
456 if (sessions.get(ownDeviceAddress) == null) {
457 FetchStatus status = fetchStatusMap.get(ownDeviceAddress);
458 if (status == null || status == FetchStatus.TIMEOUT) {
459 fetchStatusMap.put(ownDeviceAddress, FetchStatus.PENDING);
460 this.buildSessionFromPEP(ownDeviceAddress);
461 }
462 }
463 }
464 if (needsPublishing) {
465 publishOwnDeviceId(deviceIds);
466 }
467 }
468 this.deviceIds.put(jid, deviceIds);
469 mXmppConnectionService.updateConversationUi(); //update the lock icon
470 mXmppConnectionService.keyStatusUpdated(null);
471 }
472
473 public void wipeOtherPepDevices() {
474 if (pepBroken) {
475 Log.d(Config.LOGTAG, getLogprefix(account) + "wipeOtherPepDevices called, but PEP is broken. Ignoring... ");
476 return;
477 }
478 Set<Integer> deviceIds = new HashSet<>();
479 deviceIds.add(getOwnDeviceId());
480 publishDeviceIdsAndRefineAccessModel(deviceIds);
481 }
482
483 public void distrustFingerprint(final String fingerprint) {
484 final String fp = fingerprint.replaceAll("\\s", "");
485 final FingerprintStatus fingerprintStatus = axolotlStore.getFingerprintStatus(fp);
486 axolotlStore.setFingerprintStatus(fp, fingerprintStatus.toUntrusted());
487 }
488
489 public void publishOwnDeviceIdIfNeeded() {
490 if (pepBroken) {
491 Log.d(Config.LOGTAG, getLogprefix(account) + "publishOwnDeviceIdIfNeeded called, but PEP is broken. Ignoring... ");
492 return;
493 }
494 IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveDeviceIds(account.getJid().asBareJid());
495 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
496 @Override
497 public void onIqPacketReceived(Account account, IqPacket packet) {
498 if (packet.getType() == IqPacket.TYPE.TIMEOUT) {
499 Log.d(Config.LOGTAG, getLogprefix(account) + "Timeout received while retrieving own Device Ids.");
500 } else {
501 Element item = mXmppConnectionService.getIqParser().getItem(packet);
502 Set<Integer> deviceIds = mXmppConnectionService.getIqParser().deviceIds(item);
503 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": retrieved own device list: " + deviceIds);
504 registerDevices(account.getJid().asBareJid(), deviceIds);
505 }
506 }
507 });
508 }
509
510 private Set<Integer> getExpiredDevices() {
511 Set<Integer> devices = new HashSet<>();
512 for (XmppAxolotlSession session : findOwnSessions()) {
513 if (session.getTrust().isActive()) {
514 long diff = System.currentTimeMillis() - session.getTrust().getLastActivation();
515 if (diff > Config.OMEMO_AUTO_EXPIRY) {
516 long lastMessageDiff = System.currentTimeMillis() - mXmppConnectionService.databaseBackend.getLastTimeFingerprintUsed(account, session.getFingerprint());
517 long hours = Math.round(lastMessageDiff / (1000 * 60.0 * 60.0));
518 if (lastMessageDiff > Config.OMEMO_AUTO_EXPIRY) {
519 devices.add(session.getRemoteAddress().getDeviceId());
520 session.setTrust(session.getTrust().toInactive());
521 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": added own device " + session.getFingerprint() + " to list of expired devices. Last message received " + hours + " hours ago");
522 } else {
523 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": own device " + session.getFingerprint() + " was active " + hours + " hours ago");
524 }
525 }
526 }
527 }
528 return devices;
529 }
530
531 public void publishOwnDeviceId(Set<Integer> deviceIds) {
532 Set<Integer> deviceIdsCopy = new HashSet<>(deviceIds);
533 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "publishing own device ids");
534 if (deviceIdsCopy.isEmpty()) {
535 if (numPublishTriesOnEmptyPep >= publishTriesThreshold) {
536 Log.w(Config.LOGTAG, getLogprefix(account) + "Own device publish attempt threshold exceeded, aborting...");
537 pepBroken = true;
538 return;
539 } else {
540 numPublishTriesOnEmptyPep++;
541 Log.w(Config.LOGTAG, getLogprefix(account) + "Own device list empty, attempting to publish (try " + numPublishTriesOnEmptyPep + ")");
542 }
543 } else {
544 numPublishTriesOnEmptyPep = 0;
545 }
546 deviceIdsCopy.add(getOwnDeviceId());
547 publishDeviceIdsAndRefineAccessModel(deviceIdsCopy);
548 }
549
550 private void publishDeviceIdsAndRefineAccessModel(Set<Integer> ids) {
551 publishDeviceIdsAndRefineAccessModel(ids, true);
552 }
553
554 private void publishDeviceIdsAndRefineAccessModel(final Set<Integer> ids, final boolean firstAttempt) {
555 final Bundle publishOptions = account.getXmppConnection().getFeatures().pepPublishOptions() ? PublishOptions.openAccess() : null;
556 IqPacket publish = mXmppConnectionService.getIqGenerator().publishDeviceIds(ids, publishOptions);
557 mXmppConnectionService.sendIqPacket(account, publish, new OnIqPacketReceived() {
558 @Override
559 public void onIqPacketReceived(Account account, IqPacket packet) {
560 Element error = packet.getType() == IqPacket.TYPE.ERROR ? packet.findChild("error") : null;
561 if (firstAttempt && error != null && error.hasChild("precondition-not-met", Namespace.PUBSUB_ERROR)) {
562 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": precondition wasn't met for device list. pushing node configuration");
563 mXmppConnectionService.pushNodeConfiguration(account, AxolotlService.PEP_DEVICE_LIST, publishOptions, new XmppConnectionService.OnConfigurationPushed() {
564 @Override
565 public void onPushSucceeded() {
566 publishDeviceIdsAndRefineAccessModel(ids, false);
567 }
568
569 @Override
570 public void onPushFailed() {
571 publishDeviceIdsAndRefineAccessModel(ids, false);
572 }
573 });
574 } else {
575 if (AxolotlService.this.changeAccessMode.compareAndSet(true, false)) {
576 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": done changing access mode");
577 account.setOption(Account.OPTION_REQUIRES_ACCESS_MODE_CHANGE, false);
578 mXmppConnectionService.databaseBackend.updateAccount(account);
579 }
580 if (packet.getType() == IqPacket.TYPE.ERROR) {
581 pepBroken = true;
582 Log.d(Config.LOGTAG, getLogprefix(account) + "Error received while publishing own device id" + packet.findChild("error"));
583 }
584 }
585 }
586 });
587 }
588
589 public void publishDeviceVerificationAndBundle(final SignedPreKeyRecord signedPreKeyRecord,
590 final Set<PreKeyRecord> preKeyRecords,
591 final boolean announceAfter,
592 final boolean wipe) {
593 try {
594 IdentityKey axolotlPublicKey = axolotlStore.getIdentityKeyPair().getPublicKey();
595 PrivateKey x509PrivateKey = KeyChain.getPrivateKey(mXmppConnectionService, account.getPrivateKeyAlias());
596 X509Certificate[] chain = KeyChain.getCertificateChain(mXmppConnectionService, account.getPrivateKeyAlias());
597 Signature verifier = Signature.getInstance("sha256WithRSA");
598 verifier.initSign(x509PrivateKey, mXmppConnectionService.getRNG());
599 verifier.update(axolotlPublicKey.serialize());
600 byte[] signature = verifier.sign();
601 IqPacket packet = mXmppConnectionService.getIqGenerator().publishVerification(signature, chain, getOwnDeviceId());
602 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + ": publish verification for device " + getOwnDeviceId());
603 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
604 @Override
605 public void onIqPacketReceived(final Account account, IqPacket packet) {
606 String node = AxolotlService.PEP_VERIFICATION + ":" + getOwnDeviceId();
607 mXmppConnectionService.pushNodeConfiguration(account, node, PublishOptions.openAccess(), new XmppConnectionService.OnConfigurationPushed() {
608 @Override
609 public void onPushSucceeded() {
610 Log.d(Config.LOGTAG, getLogprefix(account) + "configured verification node to be world readable");
611 publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe);
612 }
613
614 @Override
615 public void onPushFailed() {
616 Log.d(Config.LOGTAG, getLogprefix(account) + "unable to set access model on verification node");
617 publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe);
618 }
619 });
620 }
621 });
622 } catch (Exception e) {
623 e.printStackTrace();
624 }
625 }
626
627 public void publishBundlesIfNeeded(final boolean announce, final boolean wipe) {
628 if (pepBroken) {
629 Log.d(Config.LOGTAG, getLogprefix(account) + "publishBundlesIfNeeded called, but PEP is broken. Ignoring... ");
630 return;
631 }
632
633 if (account.getXmppConnection().getFeatures().pepPublishOptions()) {
634 this.changeAccessMode.set(account.isOptionSet(Account.OPTION_REQUIRES_ACCESS_MODE_CHANGE));
635 } else {
636 if (account.setOption(Account.OPTION_REQUIRES_ACCESS_MODE_CHANGE, true)) {
637 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": server doesn’t support publish-options. setting for later access mode change");
638 mXmppConnectionService.databaseBackend.updateAccount(account);
639 }
640 }
641 if (this.changeAccessMode.get()) {
642 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": server gained publish-options capabilities. changing access model");
643 }
644 IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveBundlesForDevice(account.getJid().asBareJid(), getOwnDeviceId());
645 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
646 @Override
647 public void onIqPacketReceived(Account account, IqPacket packet) {
648
649 if (packet.getType() == IqPacket.TYPE.TIMEOUT) {
650 return; //ignore timeout. do nothing
651 }
652
653 if (packet.getType() == IqPacket.TYPE.ERROR) {
654 Element error = packet.findChild("error");
655 if (error == null || !error.hasChild("item-not-found")) {
656 pepBroken = true;
657 Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "request for device bundles came back with something other than item-not-found" + packet);
658 return;
659 }
660 }
661
662 PreKeyBundle bundle = mXmppConnectionService.getIqParser().bundle(packet);
663 Map<Integer, ECPublicKey> keys = mXmppConnectionService.getIqParser().preKeyPublics(packet);
664 boolean flush = false;
665 if (bundle == null) {
666 Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Received invalid bundle:" + packet);
667 bundle = new PreKeyBundle(-1, -1, -1, null, -1, null, null, null);
668 flush = true;
669 }
670 if (keys == null) {
671 Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Received invalid prekeys:" + packet);
672 }
673 try {
674 boolean changed = false;
675 // Validate IdentityKey
676 IdentityKeyPair identityKeyPair = axolotlStore.getIdentityKeyPair();
677 if (flush || !identityKeyPair.getPublicKey().equals(bundle.getIdentityKey())) {
678 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding own IdentityKey " + identityKeyPair.getPublicKey() + " to PEP.");
679 changed = true;
680 }
681
682 // Validate signedPreKeyRecord + ID
683 SignedPreKeyRecord signedPreKeyRecord;
684 int numSignedPreKeys = axolotlStore.getSignedPreKeysCount();
685 try {
686 signedPreKeyRecord = axolotlStore.loadSignedPreKey(bundle.getSignedPreKeyId());
687 if (flush
688 || !bundle.getSignedPreKey().equals(signedPreKeyRecord.getKeyPair().getPublicKey())
689 || !Arrays.equals(bundle.getSignedPreKeySignature(), signedPreKeyRecord.getSignature())) {
690 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding new signedPreKey with ID " + (numSignedPreKeys + 1) + " to PEP.");
691 signedPreKeyRecord = KeyHelper.generateSignedPreKey(identityKeyPair, numSignedPreKeys + 1);
692 axolotlStore.storeSignedPreKey(signedPreKeyRecord.getId(), signedPreKeyRecord);
693 changed = true;
694 }
695 } catch (InvalidKeyIdException e) {
696 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding new signedPreKey with ID " + (numSignedPreKeys + 1) + " to PEP.");
697 signedPreKeyRecord = KeyHelper.generateSignedPreKey(identityKeyPair, numSignedPreKeys + 1);
698 axolotlStore.storeSignedPreKey(signedPreKeyRecord.getId(), signedPreKeyRecord);
699 changed = true;
700 }
701
702 // Validate PreKeys
703 Set<PreKeyRecord> preKeyRecords = new HashSet<>();
704 if (keys != null) {
705 for (Integer id : keys.keySet()) {
706 try {
707 PreKeyRecord preKeyRecord = axolotlStore.loadPreKey(id);
708 if (preKeyRecord.getKeyPair().getPublicKey().equals(keys.get(id))) {
709 preKeyRecords.add(preKeyRecord);
710 }
711 } catch (InvalidKeyIdException ignored) {
712 }
713 }
714 }
715 int newKeys = NUM_KEYS_TO_PUBLISH - preKeyRecords.size();
716 if (newKeys > 0) {
717 List<PreKeyRecord> newRecords = KeyHelper.generatePreKeys(
718 axolotlStore.getCurrentPreKeyId() + 1, newKeys);
719 preKeyRecords.addAll(newRecords);
720 for (PreKeyRecord record : newRecords) {
721 axolotlStore.storePreKey(record.getId(), record);
722 }
723 changed = true;
724 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Adding " + newKeys + " new preKeys to PEP.");
725 }
726
727
728 if (changed || changeAccessMode.get()) {
729 if (account.getPrivateKeyAlias() != null && Config.X509_VERIFICATION) {
730 mXmppConnectionService.publishDisplayName(account);
731 publishDeviceVerificationAndBundle(signedPreKeyRecord, preKeyRecords, announce, wipe);
732 } else {
733 publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announce, wipe);
734 }
735 } else {
736 Log.d(Config.LOGTAG, getLogprefix(account) + "Bundle " + getOwnDeviceId() + " in PEP was current");
737 if (wipe) {
738 wipeOtherPepDevices();
739 } else if (announce) {
740 Log.d(Config.LOGTAG, getLogprefix(account) + "Announcing device " + getOwnDeviceId());
741 publishOwnDeviceIdIfNeeded();
742 }
743 }
744 } catch (InvalidKeyException e) {
745 Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Failed to publish bundle " + getOwnDeviceId() + ", reason: " + e.getMessage());
746 }
747 }
748 });
749 }
750
751 private void publishDeviceBundle(SignedPreKeyRecord signedPreKeyRecord,
752 Set<PreKeyRecord> preKeyRecords,
753 final boolean announceAfter,
754 final boolean wipe) {
755 publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe, true);
756 }
757
758 private void publishDeviceBundle(final SignedPreKeyRecord signedPreKeyRecord,
759 final Set<PreKeyRecord> preKeyRecords,
760 final boolean announceAfter,
761 final boolean wipe,
762 final boolean firstAttempt) {
763 final Bundle publishOptions = account.getXmppConnection().getFeatures().pepPublishOptions() ? PublishOptions.openAccess() : null;
764 IqPacket publish = mXmppConnectionService.getIqGenerator().publishBundles(
765 signedPreKeyRecord, axolotlStore.getIdentityKeyPair().getPublicKey(),
766 preKeyRecords, getOwnDeviceId(), publishOptions);
767 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + ": Bundle " + getOwnDeviceId() + " in PEP not current. Publishing...");
768 mXmppConnectionService.sendIqPacket(account, publish, new OnIqPacketReceived() {
769 @Override
770 public void onIqPacketReceived(final Account account, IqPacket packet) {
771 Element error = packet.getType() == IqPacket.TYPE.ERROR ? packet.findChild("error") : null;
772 if (firstAttempt && error != null && error.hasChild("precondition-not-met", Namespace.PUBSUB_ERROR)) {
773 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": precondition wasn't met for bundle. pushing node configuration");
774 final String node = AxolotlService.PEP_BUNDLES + ":" + getOwnDeviceId();
775 mXmppConnectionService.pushNodeConfiguration(account, node, publishOptions, new XmppConnectionService.OnConfigurationPushed() {
776 @Override
777 public void onPushSucceeded() {
778 publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe, false);
779 }
780
781 @Override
782 public void onPushFailed() {
783 publishDeviceBundle(signedPreKeyRecord, preKeyRecords, announceAfter, wipe, false);
784 }
785 });
786 } else if (packet.getType() == IqPacket.TYPE.RESULT) {
787 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Successfully published bundle. ");
788 if (wipe) {
789 wipeOtherPepDevices();
790 } else if (announceAfter) {
791 Log.d(Config.LOGTAG, getLogprefix(account) + "Announcing device " + getOwnDeviceId());
792 publishOwnDeviceIdIfNeeded();
793 }
794 } else if (packet.getType() == IqPacket.TYPE.ERROR) {
795 pepBroken = true;
796 Log.d(Config.LOGTAG, getLogprefix(account) + "Error received while publishing bundle: " + packet.findChild("error"));
797 }
798 }
799 });
800 }
801
802 public enum AxolotlCapability {
803 FULL,
804 MISSING_PRESENCE,
805 MISSING_KEYS,
806 WRONG_CONFIGURATION,
807 NO_MEMBERS
808 }
809
810 public boolean isConversationAxolotlCapable(Conversation conversation) {
811 return conversation.isSingleOrPrivateAndNonAnonymous();
812 }
813
814 public Pair<AxolotlCapability, Jid> isConversationAxolotlCapableDetailed(Conversation conversation) {
815 if (conversation.isSingleOrPrivateAndNonAnonymous()) {
816 final List<Jid> jids = getCryptoTargets(conversation);
817 for (Jid jid : jids) {
818 if (!hasAny(jid) && (!deviceIds.containsKey(jid) || deviceIds.get(jid).isEmpty())) {
819 if (conversation.getAccount().getRoster().getContact(jid).mutualPresenceSubscription()) {
820 return new Pair<>(AxolotlCapability.MISSING_KEYS, jid);
821 } else {
822 return new Pair<>(AxolotlCapability.MISSING_PRESENCE, jid);
823 }
824 }
825 }
826 if (jids.size() > 0) {
827 return new Pair<>(AxolotlCapability.FULL, null);
828 } else {
829 return new Pair<>(AxolotlCapability.NO_MEMBERS, null);
830 }
831 } else {
832 return new Pair<>(AxolotlCapability.WRONG_CONFIGURATION, null);
833 }
834 }
835
836 public List<Jid> getCryptoTargets(Conversation conversation) {
837 final List<Jid> jids;
838 if (conversation.getMode() == Conversation.MODE_SINGLE) {
839 jids = new ArrayList<>();
840 jids.add(conversation.getJid().asBareJid());
841 } else {
842 jids = conversation.getMucOptions().getMembers();
843 }
844 return jids;
845 }
846
847 public FingerprintStatus getFingerprintTrust(String fingerprint) {
848 return axolotlStore.getFingerprintStatus(fingerprint);
849 }
850
851 public X509Certificate getFingerprintCertificate(String fingerprint) {
852 return axolotlStore.getFingerprintCertificate(fingerprint);
853 }
854
855 public void setFingerprintTrust(String fingerprint, FingerprintStatus status) {
856 axolotlStore.setFingerprintStatus(fingerprint, status);
857 }
858
859 private void verifySessionWithPEP(final XmppAxolotlSession session) {
860 Log.d(Config.LOGTAG, "trying to verify fresh session (" + session.getRemoteAddress().getName() + ") with pep");
861 final SignalProtocolAddress address = session.getRemoteAddress();
862 final IdentityKey identityKey = session.getIdentityKey();
863 try {
864 IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveVerificationForDevice(Jid.of(address.getName()), address.getDeviceId());
865 mXmppConnectionService.sendIqPacket(account, packet, new OnIqPacketReceived() {
866 @Override
867 public void onIqPacketReceived(Account account, IqPacket packet) {
868 Pair<X509Certificate[], byte[]> verification = mXmppConnectionService.getIqParser().verification(packet);
869 if (verification != null) {
870 try {
871 Signature verifier = Signature.getInstance("sha256WithRSA");
872 verifier.initVerify(verification.first[0]);
873 verifier.update(identityKey.serialize());
874 if (verifier.verify(verification.second)) {
875 try {
876 mXmppConnectionService.getMemorizingTrustManager().getNonInteractive().checkClientTrusted(verification.first, "RSA");
877 String fingerprint = session.getFingerprint();
878 Log.d(Config.LOGTAG, "verified session with x.509 signature. fingerprint was: " + fingerprint);
879 setFingerprintTrust(fingerprint, FingerprintStatus.createActiveVerified(true));
880 axolotlStore.setFingerprintCertificate(fingerprint, verification.first[0]);
881 fetchStatusMap.put(address, FetchStatus.SUCCESS_VERIFIED);
882 Bundle information = CryptoHelper.extractCertificateInformation(verification.first[0]);
883 try {
884 final String cn = information.getString("subject_cn");
885 final Jid jid = Jid.of(address.getName());
886 Log.d(Config.LOGTAG, "setting common name for " + jid + " to " + cn);
887 account.getRoster().getContact(jid).setCommonName(cn);
888 } catch (final IllegalArgumentException ignored) {
889 //ignored
890 }
891 finishBuildingSessionsFromPEP(address);
892 return;
893 } catch (Exception e) {
894 Log.d(Config.LOGTAG, "could not verify certificate");
895 }
896 }
897 } catch (Exception e) {
898 Log.d(Config.LOGTAG, "error during verification " + e.getMessage());
899 }
900 } else {
901 Log.d(Config.LOGTAG, "no verification found");
902 }
903 fetchStatusMap.put(address, FetchStatus.SUCCESS);
904 finishBuildingSessionsFromPEP(address);
905 }
906 });
907 } catch (IllegalArgumentException e) {
908 fetchStatusMap.put(address, FetchStatus.SUCCESS);
909 finishBuildingSessionsFromPEP(address);
910 }
911 }
912
913 private final Set<Integer> PREVIOUSLY_REMOVED_FROM_ANNOUNCEMENT = new HashSet<>();
914
915 private void finishBuildingSessionsFromPEP(final SignalProtocolAddress address) {
916 SignalProtocolAddress ownAddress = new SignalProtocolAddress(account.getJid().asBareJid().toString(), 0);
917 Map<Integer, FetchStatus> own = fetchStatusMap.getAll(ownAddress.getName());
918 Map<Integer, FetchStatus> remote = fetchStatusMap.getAll(address.getName());
919 if (!own.containsValue(FetchStatus.PENDING) && !remote.containsValue(FetchStatus.PENDING)) {
920 FetchStatus report = null;
921 if (own.containsValue(FetchStatus.SUCCESS) || remote.containsValue(FetchStatus.SUCCESS)) {
922 report = FetchStatus.SUCCESS;
923 } else if (own.containsValue(FetchStatus.SUCCESS_VERIFIED) || remote.containsValue(FetchStatus.SUCCESS_VERIFIED)) {
924 report = FetchStatus.SUCCESS_VERIFIED;
925 } else if (own.containsValue(FetchStatus.SUCCESS_TRUSTED) || remote.containsValue(FetchStatus.SUCCESS_TRUSTED)) {
926 report = FetchStatus.SUCCESS_TRUSTED;
927 } else if (own.containsValue(FetchStatus.ERROR) || remote.containsValue(FetchStatus.ERROR)) {
928 report = FetchStatus.ERROR;
929 }
930 mXmppConnectionService.keyStatusUpdated(report);
931 }
932 if (Config.REMOVE_BROKEN_DEVICES) {
933 Set<Integer> ownDeviceIds = new HashSet<>(getOwnDeviceIds());
934 boolean publish = false;
935 for (Map.Entry<Integer, FetchStatus> entry : own.entrySet()) {
936 int id = entry.getKey();
937 if (entry.getValue() == FetchStatus.ERROR && PREVIOUSLY_REMOVED_FROM_ANNOUNCEMENT.add(id) && ownDeviceIds.remove(id)) {
938 publish = true;
939 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": error fetching own device with id " + id + ". removing from announcement");
940 }
941 }
942 if (publish) {
943 publishOwnDeviceId(ownDeviceIds);
944 }
945 }
946 }
947
948 public boolean hasEmptyDeviceList(Jid jid) {
949 return !hasAny(jid) && (!deviceIds.containsKey(jid) || deviceIds.get(jid).isEmpty());
950 }
951
952 public interface OnDeviceIdsFetched {
953 void fetched(Jid jid, Set<Integer> deviceIds);
954 }
955
956 public interface OnMultipleDeviceIdFetched {
957 void fetched();
958 }
959
960 public void fetchDeviceIds(final Jid jid) {
961 fetchDeviceIds(jid, null);
962 }
963
964 public void fetchDeviceIds(final Jid jid, OnDeviceIdsFetched callback) {
965 synchronized (this.fetchDeviceIdsMap) {
966 List<OnDeviceIdsFetched> callbacks = this.fetchDeviceIdsMap.get(jid);
967 if (callbacks != null) {
968 if (callback != null) {
969 callbacks.add(callback);
970 }
971 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": fetching device ids for " + jid + " already running. adding callback");
972 } else {
973 callbacks = new ArrayList<>();
974 if (callback != null) {
975 callbacks.add(callback);
976 }
977 this.fetchDeviceIdsMap.put(jid, callbacks);
978 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": fetching device ids for " + jid);
979 IqPacket packet = mXmppConnectionService.getIqGenerator().retrieveDeviceIds(jid);
980 mXmppConnectionService.sendIqPacket(account, packet, (account, response) -> {
981 synchronized (fetchDeviceIdsMap) {
982 List<OnDeviceIdsFetched> callbacks1 = fetchDeviceIdsMap.remove(jid);
983 if (response.getType() == IqPacket.TYPE.RESULT) {
984 fetchDeviceListStatus.put(jid, true);
985 Element item = mXmppConnectionService.getIqParser().getItem(response);
986 Set<Integer> deviceIds = mXmppConnectionService.getIqParser().deviceIds(item);
987 registerDevices(jid, deviceIds);
988 if (callbacks1 != null) {
989 for (OnDeviceIdsFetched callback1 : callbacks1) {
990 callback1.fetched(jid, deviceIds);
991 }
992 }
993 } else {
994 if (response.getType() == IqPacket.TYPE.TIMEOUT) {
995 fetchDeviceListStatus.remove(jid);
996 } else {
997 fetchDeviceListStatus.put(jid, false);
998 }
999 Log.d(Config.LOGTAG, response.toString());
1000 if (callbacks1 != null) {
1001 for (OnDeviceIdsFetched callback1 : callbacks1) {
1002 callback1.fetched(jid, null);
1003 }
1004 }
1005 }
1006 }
1007 });
1008 }
1009 }
1010 }
1011
1012 private void fetchDeviceIds(List<Jid> jids, final OnMultipleDeviceIdFetched callback) {
1013 final ArrayList<Jid> unfinishedJids = new ArrayList<>(jids);
1014 synchronized (unfinishedJids) {
1015 for (Jid jid : unfinishedJids) {
1016 fetchDeviceIds(jid, (j, deviceIds) -> {
1017 synchronized (unfinishedJids) {
1018 unfinishedJids.remove(j);
1019 if (unfinishedJids.size() == 0 && callback != null) {
1020 callback.fetched();
1021 }
1022 }
1023 });
1024 }
1025 }
1026 }
1027
1028 private void buildSessionFromPEP(final SignalProtocolAddress address) {
1029 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Building new session for " + address.toString());
1030 if (address.equals(getOwnAxolotlAddress())) {
1031 throw new AssertionError("We should NEVER build a session with ourselves. What happened here?!");
1032 }
1033
1034 try {
1035 IqPacket bundlesPacket = mXmppConnectionService.getIqGenerator().retrieveBundlesForDevice(
1036 Jid.of(address.getName()), address.getDeviceId());
1037 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Retrieving bundle: " + bundlesPacket);
1038 mXmppConnectionService.sendIqPacket(account, bundlesPacket, new OnIqPacketReceived() {
1039
1040 @Override
1041 public void onIqPacketReceived(Account account, IqPacket packet) {
1042 if (packet.getType() == IqPacket.TYPE.TIMEOUT) {
1043 fetchStatusMap.put(address, FetchStatus.TIMEOUT);
1044 } else if (packet.getType() == IqPacket.TYPE.RESULT) {
1045 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Received preKey IQ packet, processing...");
1046 final IqParser parser = mXmppConnectionService.getIqParser();
1047 final List<PreKeyBundle> preKeyBundleList = parser.preKeys(packet);
1048 final PreKeyBundle bundle = parser.bundle(packet);
1049 if (preKeyBundleList.isEmpty() || bundle == null) {
1050 Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "preKey IQ packet invalid: " + packet);
1051 fetchStatusMap.put(address, FetchStatus.ERROR);
1052 finishBuildingSessionsFromPEP(address);
1053 return;
1054 }
1055 Random random = new Random();
1056 final PreKeyBundle preKey = preKeyBundleList.get(random.nextInt(preKeyBundleList.size()));
1057 if (preKey == null) {
1058 //should never happen
1059 fetchStatusMap.put(address, FetchStatus.ERROR);
1060 finishBuildingSessionsFromPEP(address);
1061 return;
1062 }
1063
1064 final PreKeyBundle preKeyBundle = new PreKeyBundle(0, address.getDeviceId(),
1065 preKey.getPreKeyId(), preKey.getPreKey(),
1066 bundle.getSignedPreKeyId(), bundle.getSignedPreKey(),
1067 bundle.getSignedPreKeySignature(), bundle.getIdentityKey());
1068
1069 try {
1070 SessionBuilder builder = new SessionBuilder(axolotlStore, address);
1071 builder.process(preKeyBundle);
1072 XmppAxolotlSession session = new XmppAxolotlSession(account, axolotlStore, address, bundle.getIdentityKey());
1073 sessions.put(address, session);
1074 if (Config.X509_VERIFICATION) {
1075 verifySessionWithPEP(session);
1076 } else {
1077 FingerprintStatus status = getFingerprintTrust(CryptoHelper.bytesToHex(bundle.getIdentityKey().getPublicKey().serialize()));
1078 FetchStatus fetchStatus;
1079 if (status != null && status.isVerified()) {
1080 fetchStatus = FetchStatus.SUCCESS_VERIFIED;
1081 } else if (status != null && status.isTrusted()) {
1082 fetchStatus = FetchStatus.SUCCESS_TRUSTED;
1083 } else {
1084 fetchStatus = FetchStatus.SUCCESS;
1085 }
1086 fetchStatusMap.put(address, fetchStatus);
1087 finishBuildingSessionsFromPEP(address);
1088 }
1089 } catch (UntrustedIdentityException | InvalidKeyException e) {
1090 Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Error building session for " + address + ": "
1091 + e.getClass().getName() + ", " + e.getMessage());
1092 fetchStatusMap.put(address, FetchStatus.ERROR);
1093 finishBuildingSessionsFromPEP(address);
1094 }
1095 } else {
1096 fetchStatusMap.put(address, FetchStatus.ERROR);
1097 Log.d(Config.LOGTAG, getLogprefix(account) + "Error received while building session:" + packet.findChild("error"));
1098 finishBuildingSessionsFromPEP(address);
1099 }
1100 }
1101 });
1102 } catch (IllegalArgumentException e) {
1103 Log.e(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Got address with invalid jid: " + address.getName());
1104 }
1105 }
1106
1107 public Set<SignalProtocolAddress> findDevicesWithoutSession(final Conversation conversation) {
1108 Set<SignalProtocolAddress> addresses = new HashSet<>();
1109 for (Jid jid : getCryptoTargets(conversation)) {
1110 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Finding devices without session for " + jid);
1111 if (deviceIds.get(jid) != null) {
1112 for (Integer foreignId : this.deviceIds.get(jid)) {
1113 SignalProtocolAddress address = new SignalProtocolAddress(jid.toString(), foreignId);
1114 if (sessions.get(address) == null) {
1115 IdentityKey identityKey = axolotlStore.loadSession(address).getSessionState().getRemoteIdentityKey();
1116 if (identityKey != null) {
1117 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Already have session for " + address.toString() + ", adding to cache...");
1118 XmppAxolotlSession session = new XmppAxolotlSession(account, axolotlStore, address, identityKey);
1119 sessions.put(address, session);
1120 } else {
1121 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Found device " + jid + ":" + foreignId);
1122 if (fetchStatusMap.get(address) != FetchStatus.ERROR) {
1123 addresses.add(address);
1124 } else {
1125 Log.d(Config.LOGTAG, getLogprefix(account) + "skipping over " + address + " because it's broken");
1126 }
1127 }
1128 }
1129 }
1130 } else {
1131 mXmppConnectionService.keyStatusUpdated(FetchStatus.ERROR);
1132 Log.w(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Have no target devices in PEP!");
1133 }
1134 }
1135 if (deviceIds.get(account.getJid().asBareJid()) != null) {
1136 for (Integer ownId : this.deviceIds.get(account.getJid().asBareJid())) {
1137 SignalProtocolAddress address = new SignalProtocolAddress(account.getJid().asBareJid().toString(), ownId);
1138 if (sessions.get(address) == null) {
1139 IdentityKey identityKey = axolotlStore.loadSession(address).getSessionState().getRemoteIdentityKey();
1140 if (identityKey != null) {
1141 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Already have session for " + address.toString() + ", adding to cache...");
1142 XmppAxolotlSession session = new XmppAxolotlSession(account, axolotlStore, address, identityKey);
1143 sessions.put(address, session);
1144 } else {
1145 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Found device " + account.getJid().asBareJid() + ":" + ownId);
1146 if (fetchStatusMap.get(address) != FetchStatus.ERROR) {
1147 addresses.add(address);
1148 } else {
1149 Log.d(Config.LOGTAG, getLogprefix(account) + "skipping over " + address + " because it's broken");
1150 }
1151 }
1152 }
1153 }
1154 }
1155
1156 return addresses;
1157 }
1158
1159 public boolean createSessionsIfNeeded(final Conversation conversation) {
1160 final List<Jid> jidsWithEmptyDeviceList = getCryptoTargets(conversation);
1161 for (Iterator<Jid> iterator = jidsWithEmptyDeviceList.iterator(); iterator.hasNext(); ) {
1162 final Jid jid = iterator.next();
1163 if (!hasEmptyDeviceList(jid)) {
1164 iterator.remove();
1165 }
1166 }
1167 Log.d(Config.LOGTAG, account.getJid().asBareJid() + ": createSessionsIfNeeded() - jids with empty device list: " + jidsWithEmptyDeviceList);
1168 if (jidsWithEmptyDeviceList.size() > 0) {
1169 fetchDeviceIds(jidsWithEmptyDeviceList, new OnMultipleDeviceIdFetched() {
1170 @Override
1171 public void fetched() {
1172 createSessionsIfNeededActual(conversation);
1173 }
1174 });
1175 return true;
1176 } else {
1177 return createSessionsIfNeededActual(conversation);
1178 }
1179 }
1180
1181 private boolean createSessionsIfNeededActual(final Conversation conversation) {
1182 Log.i(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Creating axolotl sessions if needed...");
1183 boolean newSessions = false;
1184 Set<SignalProtocolAddress> addresses = findDevicesWithoutSession(conversation);
1185 for (SignalProtocolAddress address : addresses) {
1186 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Processing device: " + address.toString());
1187 FetchStatus status = fetchStatusMap.get(address);
1188 if (status == null || status == FetchStatus.TIMEOUT) {
1189 fetchStatusMap.put(address, FetchStatus.PENDING);
1190 this.buildSessionFromPEP(address);
1191 newSessions = true;
1192 } else if (status == FetchStatus.PENDING) {
1193 newSessions = true;
1194 } else {
1195 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Already fetching bundle for " + address.toString());
1196 }
1197 }
1198
1199 return newSessions;
1200 }
1201
1202 public boolean trustedSessionVerified(final Conversation conversation) {
1203 final Set<XmppAxolotlSession> sessions = new HashSet<>();
1204 sessions.addAll(findSessionsForConversation(conversation));
1205 sessions.addAll(findOwnSessions());
1206 boolean verified = false;
1207 for (XmppAxolotlSession session : sessions) {
1208 if (session.getTrust().isTrustedAndActive()) {
1209 if (session.getTrust().getTrust() == FingerprintStatus.Trust.VERIFIED_X509) {
1210 verified = true;
1211 } else {
1212 return false;
1213 }
1214 }
1215 }
1216 return verified;
1217 }
1218
1219 public boolean hasPendingKeyFetches(Account account, List<Jid> jids) {
1220 SignalProtocolAddress ownAddress = new SignalProtocolAddress(account.getJid().asBareJid().toString(), 0);
1221 if (fetchStatusMap.getAll(ownAddress.getName()).containsValue(FetchStatus.PENDING)) {
1222 return true;
1223 }
1224 synchronized (this.fetchDeviceIdsMap) {
1225 for (Jid jid : jids) {
1226 SignalProtocolAddress foreignAddress = new SignalProtocolAddress(jid.asBareJid().toString(), 0);
1227 if (fetchStatusMap.getAll(foreignAddress.getName()).containsValue(FetchStatus.PENDING) || this.fetchDeviceIdsMap.containsKey(jid)) {
1228 return true;
1229 }
1230 }
1231 }
1232 return false;
1233 }
1234
1235 @Nullable
1236 private boolean buildHeader(XmppAxolotlMessage axolotlMessage, Conversation c) {
1237 Set<XmppAxolotlSession> remoteSessions = findSessionsForConversation(c);
1238 final boolean acceptEmpty = (c.getMode() == Conversation.MODE_MULTI && c.getMucOptions().getUserCount() == 0) || c.getContact().isSelf();
1239 Collection<XmppAxolotlSession> ownSessions = findOwnSessions();
1240 if (remoteSessions.isEmpty() && !acceptEmpty) {
1241 return false;
1242 }
1243 for (XmppAxolotlSession session : remoteSessions) {
1244 axolotlMessage.addDevice(session);
1245 }
1246 for (XmppAxolotlSession session : ownSessions) {
1247 axolotlMessage.addDevice(session);
1248 }
1249
1250 return true;
1251 }
1252
1253 //this is being used for private muc messages only
1254 private boolean buildHeader(XmppAxolotlMessage axolotlMessage, Jid jid) {
1255 if (jid == null) {
1256 return false;
1257 }
1258 HashSet<XmppAxolotlSession> sessions = new HashSet<>();
1259 sessions.addAll(this.sessions.getAll(getAddressForJid(jid).getName()).values());
1260 if (sessions.isEmpty()) {
1261 return false;
1262 }
1263 sessions.addAll(findOwnSessions());
1264 for(XmppAxolotlSession session : sessions) {
1265 axolotlMessage.addDevice(session);
1266 }
1267 return true;
1268 }
1269
1270 @Nullable
1271 public XmppAxolotlMessage encrypt(Message message) {
1272 final XmppAxolotlMessage axolotlMessage = new XmppAxolotlMessage(account.getJid().asBareJid(), getOwnDeviceId());
1273 final String content;
1274 if (message.hasFileOnRemoteHost()) {
1275 content = message.getFileParams().url.toString();
1276 } else {
1277 content = message.getBody();
1278 }
1279 try {
1280 axolotlMessage.encrypt(content);
1281 } catch (CryptoFailedException e) {
1282 Log.w(Config.LOGTAG, getLogprefix(account) + "Failed to encrypt message: " + e.getMessage());
1283 return null;
1284 }
1285
1286 final boolean success;
1287 if (message.getType() == Message.TYPE_PRIVATE) {
1288 success = buildHeader(axolotlMessage, message.getTrueCounterpart());
1289 } else {
1290 success = buildHeader(axolotlMessage, message.getConversation());
1291 }
1292 return success ? axolotlMessage : null;
1293 }
1294
1295 public void preparePayloadMessage(final Message message, final boolean delay) {
1296 executor.execute(new Runnable() {
1297 @Override
1298 public void run() {
1299 XmppAxolotlMessage axolotlMessage = encrypt(message);
1300 if (axolotlMessage == null) {
1301 mXmppConnectionService.markMessage(message, Message.STATUS_SEND_FAILED);
1302 //mXmppConnectionService.updateConversationUi();
1303 } else {
1304 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Generated message, caching: " + message.getUuid());
1305 messageCache.put(message.getUuid(), axolotlMessage);
1306 mXmppConnectionService.resendMessage(message, delay);
1307 }
1308 }
1309 });
1310 }
1311
1312 public void prepareKeyTransportMessage(final Conversation conversation, final OnMessageCreatedCallback onMessageCreatedCallback) {
1313 executor.execute(new Runnable() {
1314 @Override
1315 public void run() {
1316 final XmppAxolotlMessage axolotlMessage = new XmppAxolotlMessage(account.getJid().asBareJid(), getOwnDeviceId());
1317 if (buildHeader(axolotlMessage, conversation)) {
1318 onMessageCreatedCallback.run(axolotlMessage);
1319 } else {
1320 onMessageCreatedCallback.run(null);
1321 }
1322 }
1323 });
1324 }
1325
1326 public XmppAxolotlMessage fetchAxolotlMessageFromCache(Message message) {
1327 XmppAxolotlMessage axolotlMessage = messageCache.get(message.getUuid());
1328 if (axolotlMessage != null) {
1329 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Cache hit: " + message.getUuid());
1330 messageCache.remove(message.getUuid());
1331 } else {
1332 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Cache miss: " + message.getUuid());
1333 }
1334 return axolotlMessage;
1335 }
1336
1337 private XmppAxolotlSession recreateUncachedSession(SignalProtocolAddress address) {
1338 IdentityKey identityKey = axolotlStore.loadSession(address).getSessionState().getRemoteIdentityKey();
1339 return (identityKey != null)
1340 ? new XmppAxolotlSession(account, axolotlStore, address, identityKey)
1341 : null;
1342 }
1343
1344 private XmppAxolotlSession getReceivingSession(XmppAxolotlMessage message) {
1345 SignalProtocolAddress senderAddress = new SignalProtocolAddress(message.getFrom().toString(),
1346 message.getSenderDeviceId());
1347 XmppAxolotlSession session = sessions.get(senderAddress);
1348 if (session == null) {
1349 Log.d(Config.LOGTAG, AxolotlService.getLogprefix(account) + "Account: " + account.getJid() + " No axolotl session found while parsing received message " + message);
1350 session = recreateUncachedSession(senderAddress);
1351 if (session == null) {
1352 session = new XmppAxolotlSession(account, axolotlStore, senderAddress);
1353 }
1354 }
1355 return session;
1356 }
1357
1358 public XmppAxolotlMessage.XmppAxolotlPlaintextMessage processReceivingPayloadMessage(XmppAxolotlMessage message, boolean postponePreKeyMessageHandling) {
1359 XmppAxolotlMessage.XmppAxolotlPlaintextMessage plaintextMessage = null;
1360
1361 XmppAxolotlSession session = getReceivingSession(message);
1362 try {
1363 plaintextMessage = message.decrypt(session, getOwnDeviceId());
1364 Integer preKeyId = session.getPreKeyIdAndReset();
1365 if (preKeyId != null) {
1366 postPreKeyMessageHandling(session, preKeyId, postponePreKeyMessageHandling);
1367 }
1368 } catch (CryptoFailedException e) {
1369 Log.w(Config.LOGTAG, getLogprefix(account) + "Failed to decrypt message from " + message.getFrom() + ": " + e.getMessage());
1370 }
1371
1372 if (session.isFresh() && plaintextMessage != null) {
1373 putFreshSession(session);
1374 }
1375
1376 return plaintextMessage;
1377 }
1378
1379 private void postPreKeyMessageHandling(final XmppAxolotlSession session, int preKeyId, final boolean postpone) {
1380 if (postpone) {
1381 postponedSessions.add(session);
1382 } else {
1383 //TODO: do not republish if we already removed this preKeyId
1384 publishBundlesIfNeeded(false, false);
1385 completeSession(session);
1386 }
1387 }
1388
1389 public void processPostponed() {
1390 if (postponedSessions.size() > 0) {
1391 publishBundlesIfNeeded(false, false);
1392 }
1393 Iterator<XmppAxolotlSession> iterator = postponedSessions.iterator();
1394 while (iterator.hasNext()) {
1395 completeSession(iterator.next());
1396 iterator.remove();
1397 }
1398 }
1399
1400 private void completeSession(XmppAxolotlSession session) {
1401 final XmppAxolotlMessage axolotlMessage = new XmppAxolotlMessage(account.getJid().asBareJid(), getOwnDeviceId());
1402 axolotlMessage.addDevice(session);
1403 try {
1404 Jid jid = Jid.of(session.getRemoteAddress().getName());
1405 MessagePacket packet = mXmppConnectionService.getMessageGenerator().generateKeyTransportMessage(jid, axolotlMessage);
1406 mXmppConnectionService.sendMessagePacket(account, packet);
1407 } catch (IllegalArgumentException e) {
1408 throw new Error("Remote addresses are created from jid and should convert back to jid", e);
1409 }
1410 }
1411
1412
1413 public XmppAxolotlMessage.XmppAxolotlKeyTransportMessage processReceivingKeyTransportMessage(XmppAxolotlMessage message, final boolean postponePreKeyMessageHandling) {
1414 XmppAxolotlMessage.XmppAxolotlKeyTransportMessage keyTransportMessage;
1415
1416 XmppAxolotlSession session = getReceivingSession(message);
1417 try {
1418 keyTransportMessage = message.getParameters(session, getOwnDeviceId());
1419 Integer preKeyId = session.getPreKeyIdAndReset();
1420 if (preKeyId != null) {
1421 postPreKeyMessageHandling(session, preKeyId, postponePreKeyMessageHandling);
1422 }
1423 } catch (CryptoFailedException e) {
1424 Log.d(Config.LOGTAG, "could not decrypt keyTransport message " + e.getMessage());
1425 keyTransportMessage = null;
1426 }
1427
1428 if (session.isFresh() && keyTransportMessage != null) {
1429 putFreshSession(session);
1430 }
1431
1432 return keyTransportMessage;
1433 }
1434
1435 private void putFreshSession(XmppAxolotlSession session) {
1436 Log.d(Config.LOGTAG, "put fresh session");
1437 sessions.put(session);
1438 if (Config.X509_VERIFICATION) {
1439 if (session.getIdentityKey() != null) {
1440 verifySessionWithPEP(session);
1441 } else {
1442 Log.e(Config.LOGTAG, account.getJid().asBareJid() + ": identity key was empty after reloading for x509 verification");
1443 }
1444 }
1445 }
1446}