2132 lines
88 KiB
JavaScript
2132 lines
88 KiB
JavaScript
import _objectSpread from "@babel/runtime/helpers/objectSpread2";
|
|
import _defineProperty from "@babel/runtime/helpers/defineProperty";
|
|
/*
|
|
Copyright 2022-2023 The Matrix.org Foundation C.I.C.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
import anotherjson from "another-json";
|
|
import * as RustSdkCryptoJs from "@matrix-org/matrix-sdk-crypto-wasm";
|
|
import { KnownMembership } from "../@types/membership.js";
|
|
import { MatrixEventEvent } from "../models/event.js";
|
|
import { DecryptionError } from "../common-crypto/CryptoBackend.js";
|
|
import { LogSpan } from "../logger.js";
|
|
import { Method } from "../http-api/index.js";
|
|
import { RoomEncryptor } from "./RoomEncryptor.js";
|
|
import { OutgoingRequestProcessor } from "./OutgoingRequestProcessor.js";
|
|
import { KeyClaimManager } from "./KeyClaimManager.js";
|
|
import { MapWithDefault } from "../utils.js";
|
|
import { AllDevicesIsolationMode, CrossSigningKey, CryptoEvent, DecryptionFailureCode, DecryptionKeyDoesNotMatchError, deriveRecoveryKeyFromPassphrase, DeviceIsolationModeKind, DeviceVerificationStatus, encodeRecoveryKey, EventShieldColour, EventShieldReason, ImportRoomKeyStage, UserVerificationStatus } from "../crypto-api/index.js";
|
|
import { deviceKeysToDeviceMap, rustDeviceToJsDevice } from "./device-converter.js";
|
|
import { SECRET_STORAGE_ALGORITHM_V1_AES } from "../secret-storage.js";
|
|
import { CrossSigningIdentity } from "./CrossSigningIdentity.js";
|
|
import { secretStorageContainsCrossSigningKeys } from "./secret-storage.js";
|
|
import { isVerificationEvent, RustVerificationRequest, verificationMethodIdentifierToMethod } from "./verification.js";
|
|
import { EventType, MsgType } from "../@types/event.js";
|
|
import { TypedEventEmitter } from "../models/typed-event-emitter.js";
|
|
import { decryptionKeyMatchesKeyBackupInfo, RustBackupManager } from "./backup.js";
|
|
import { TypedReEmitter } from "../ReEmitter.js";
|
|
import { secureRandomString } from "../randomstring.js";
|
|
import { ClientStoppedError } from "../errors.js";
|
|
import { decodeBase64, encodeBase64 } from "../base64.js";
|
|
import { OutgoingRequestsManager } from "./OutgoingRequestsManager.js";
|
|
import { PerSessionKeyBackupDownloader } from "./PerSessionKeyBackupDownloader.js";
|
|
import { DehydratedDeviceManager } from "./DehydratedDeviceManager.js";
|
|
import { VerificationMethod } from "../types.js";
|
|
import { keyFromAuthData } from "../common-crypto/key-passphrase.js";
|
|
import { getHttpUriForMxc } from "../content-repo.js";
|
|
const ALL_VERIFICATION_METHODS = [VerificationMethod.Sas, VerificationMethod.ScanQrCode, VerificationMethod.ShowQrCode, VerificationMethod.Reciprocate];
|
|
/** The maximum time, in milliseconds, since we accepted an invite, that we should accept a key bundle. */
|
|
export const MAX_INVITE_ACCEPTANCE_MS_FOR_KEY_BUNDLE = 24 * 60 * 60 * 1000; // 24 hours
|
|
|
|
/**
|
|
* An implementation of {@link CryptoBackend} using the Rust matrix-sdk-crypto.
|
|
*
|
|
* @internal
|
|
*/
|
|
export class RustCrypto extends TypedEventEmitter {
|
|
constructor(logger, /** The `OlmMachine` from the underlying rust crypto sdk. */
|
|
olmMachine,
|
|
/**
|
|
* Low-level HTTP interface: used to make outgoing requests required by the rust SDK.
|
|
*
|
|
* We expect it to set the access token, etc.
|
|
*/
|
|
http, /** The local user's User ID. */
|
|
userId, /** The local user's Device ID. */
|
|
_deviceId, /** Interface to server-side secret storage */
|
|
secretStorage, /** Crypto callbacks provided by the application */
|
|
cryptoCallbacks, /** Enable support for encrypted state events under MSC4362. */
|
|
enableEncryptedStateEvents = false) {
|
|
super();
|
|
/**
|
|
* The number of iterations to use when deriving a recovery key from a passphrase.
|
|
*/
|
|
_defineProperty(this, "RECOVERY_KEY_DERIVATION_ITERATIONS", 500000);
|
|
_defineProperty(this, "_trustCrossSignedDevices", true);
|
|
_defineProperty(this, "deviceIsolationMode", new AllDevicesIsolationMode(false));
|
|
/** whether {@link stop} has been called */
|
|
_defineProperty(this, "stopped", false);
|
|
/** mapping of roomId → encryptor class */
|
|
_defineProperty(this, "roomEncryptors", {});
|
|
_defineProperty(this, "eventDecryptor", void 0);
|
|
_defineProperty(this, "keyClaimManager", void 0);
|
|
_defineProperty(this, "outgoingRequestProcessor", void 0);
|
|
_defineProperty(this, "crossSigningIdentity", void 0);
|
|
_defineProperty(this, "backupManager", void 0);
|
|
_defineProperty(this, "outgoingRequestsManager", void 0);
|
|
_defineProperty(this, "perSessionBackupDownloader", void 0);
|
|
_defineProperty(this, "dehydratedDeviceManager", void 0);
|
|
_defineProperty(this, "reemitter", new TypedReEmitter(this));
|
|
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
//
|
|
// CryptoApi implementation
|
|
//
|
|
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
_defineProperty(this, "globalBlacklistUnverifiedDevices", false);
|
|
/**
|
|
* The verification methods we offer to the other side during an interactive verification.
|
|
*/
|
|
_defineProperty(this, "_supportedVerificationMethods", ALL_VERIFICATION_METHODS);
|
|
this.logger = logger;
|
|
this.olmMachine = olmMachine;
|
|
this.http = http;
|
|
this.userId = userId;
|
|
this.secretStorage = secretStorage;
|
|
this.cryptoCallbacks = cryptoCallbacks;
|
|
this.enableEncryptedStateEvents = enableEncryptedStateEvents;
|
|
this.outgoingRequestProcessor = new OutgoingRequestProcessor(logger, olmMachine, http);
|
|
this.outgoingRequestsManager = new OutgoingRequestsManager(this.logger, olmMachine, this.outgoingRequestProcessor);
|
|
this.keyClaimManager = new KeyClaimManager(olmMachine, this.outgoingRequestProcessor);
|
|
this.backupManager = new RustBackupManager(logger, olmMachine, http, this.outgoingRequestProcessor);
|
|
this.perSessionBackupDownloader = new PerSessionKeyBackupDownloader(this.logger, this.olmMachine, this.http, this.backupManager);
|
|
this.dehydratedDeviceManager = new DehydratedDeviceManager(this.logger, olmMachine, http, this.outgoingRequestProcessor, secretStorage);
|
|
this.eventDecryptor = new EventDecryptor(this.logger, olmMachine, this.perSessionBackupDownloader);
|
|
|
|
// re-emit the events emitted by managers
|
|
this.reemitter.reEmit(this.backupManager, [CryptoEvent.KeyBackupStatus, CryptoEvent.KeyBackupSessionsRemaining, CryptoEvent.KeyBackupFailed, CryptoEvent.KeyBackupDecryptionKeyCached]);
|
|
this.reemitter.reEmit(this.dehydratedDeviceManager, [CryptoEvent.DehydratedDeviceCreated, CryptoEvent.DehydratedDeviceUploaded, CryptoEvent.RehydrationStarted, CryptoEvent.RehydrationProgress, CryptoEvent.RehydrationCompleted, CryptoEvent.RehydrationError, CryptoEvent.DehydrationKeyCached, CryptoEvent.DehydratedDeviceRotationError]);
|
|
this.crossSigningIdentity = new CrossSigningIdentity(logger, olmMachine, this.outgoingRequestProcessor, secretStorage);
|
|
|
|
// Check and start in background the key backup connection
|
|
this.checkKeyBackupAndEnable();
|
|
}
|
|
|
|
/**
|
|
* Return the OlmMachine only if {@link RustCrypto#stop} has not been called.
|
|
*
|
|
* This allows us to better handle race conditions where the client is stopped before or during a crypto API call.
|
|
*
|
|
* @throws ClientStoppedError if {@link RustCrypto#stop} has been called.
|
|
*/
|
|
getOlmMachineOrThrow() {
|
|
if (this.stopped) {
|
|
throw new ClientStoppedError();
|
|
}
|
|
return this.olmMachine;
|
|
}
|
|
|
|
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
//
|
|
// CryptoBackend implementation
|
|
//
|
|
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
|
|
set globalErrorOnUnknownDevices(_v) {
|
|
// Not implemented for rust crypto.
|
|
}
|
|
get globalErrorOnUnknownDevices() {
|
|
// Not implemented for rust crypto.
|
|
return false;
|
|
}
|
|
stop() {
|
|
// stop() may be called multiple times, but attempting to close() the OlmMachine twice
|
|
// will cause an error.
|
|
if (this.stopped) {
|
|
return;
|
|
}
|
|
this.stopped = true;
|
|
this.keyClaimManager.stop();
|
|
this.backupManager.stop();
|
|
this.outgoingRequestsManager.stop();
|
|
this.perSessionBackupDownloader.stop();
|
|
this.dehydratedDeviceManager.stop();
|
|
|
|
// make sure we close() the OlmMachine; doing so means that all the Rust objects will be
|
|
// cleaned up; in particular, the indexeddb connections will be closed, which means they
|
|
// can then be deleted.
|
|
this.olmMachine.close();
|
|
}
|
|
async encryptEvent(event, _room) {
|
|
const roomId = event.getRoomId();
|
|
const encryptor = this.roomEncryptors[roomId];
|
|
if (!encryptor) {
|
|
throw new Error(`Cannot encrypt event in unconfigured room ${roomId}`);
|
|
}
|
|
await encryptor.encryptEvent(event, this.globalBlacklistUnverifiedDevices, this.deviceIsolationMode);
|
|
}
|
|
async decryptEvent(event) {
|
|
const roomId = event.getRoomId();
|
|
if (!roomId) {
|
|
// presumably, a to-device message. These are normally decrypted in preprocessToDeviceMessages
|
|
// so the fact it has come back here suggests that decryption failed.
|
|
//
|
|
// once we drop support for the libolm crypto implementation, we can stop passing to-device messages
|
|
// through decryptEvent and hence get rid of this case.
|
|
throw new Error("to-device event was not decrypted in preprocessToDeviceMessages");
|
|
}
|
|
return await this.eventDecryptor.attemptEventDecryption(event, this.deviceIsolationMode);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoBackend#getBackupDecryptor}.
|
|
*/
|
|
async getBackupDecryptor(backupInfo, privKey) {
|
|
if (!(privKey instanceof Uint8Array)) {
|
|
throw new Error(`getBackupDecryptor: expects Uint8Array`);
|
|
}
|
|
if (backupInfo.algorithm != "m.megolm_backup.v1.curve25519-aes-sha2") {
|
|
throw new Error(`getBackupDecryptor: Unsupported algorithm ${backupInfo.algorithm}`);
|
|
}
|
|
const backupDecryptionKey = RustSdkCryptoJs.BackupDecryptionKey.fromBase64(encodeBase64(privKey));
|
|
if (!decryptionKeyMatchesKeyBackupInfo(backupDecryptionKey, backupInfo)) {
|
|
throw new Error(`getBackupDecryptor: key backup on server does not match the decryption key`);
|
|
}
|
|
return this.backupManager.createBackupDecryptor(backupDecryptionKey);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoBackend#importBackedUpRoomKeys}.
|
|
*/
|
|
async importBackedUpRoomKeys(keys, backupVersion, opts) {
|
|
return await this.backupManager.importBackedUpRoomKeys(keys, backupVersion, opts);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoBackend.maybeAcceptKeyBundle}.
|
|
*/
|
|
async maybeAcceptKeyBundle(roomId, inviter) {
|
|
// TODO: retry this if it gets interrupted or it fails. (https://github.com/matrix-org/matrix-rust-sdk/issues/5112)
|
|
// TODO: do this in the background.
|
|
|
|
const logger = new LogSpan(this.logger, `maybeAcceptKeyBundle(${roomId}, ${inviter})`);
|
|
|
|
// Make sure we have an up-to-date idea of the inviter's cross-signing keys, so that we can check if the
|
|
// device that sent us the bundle data was correctly cross-signed.
|
|
//
|
|
// TODO: it would be nice to skip this step if we have an up-to-date copy of the inviter's cross-signing keys,
|
|
// but we don't have an easy way to check that. Possibly the rust side could trigger a key request and then
|
|
// block until it happens.
|
|
logger.info(`Checking inviter cross-signing keys`);
|
|
const request = this.olmMachine.queryKeysForUsers([new RustSdkCryptoJs.UserId(inviter)]);
|
|
await this.outgoingRequestProcessor.makeOutgoingRequest(request);
|
|
const bundleData = await this.olmMachine.getReceivedRoomKeyBundleData(new RustSdkCryptoJs.RoomId(roomId), new RustSdkCryptoJs.UserId(inviter));
|
|
if (!bundleData) {
|
|
logger.info("No key bundle found for user");
|
|
return false;
|
|
}
|
|
logger.info(`Fetching key bundle ${bundleData.url}`);
|
|
const url = getHttpUriForMxc(this.http.opts.baseUrl, bundleData.url, undefined, undefined, undefined, /* allowDirectLinks */false, /* allowRedirects */true, /* useAuthentication */true);
|
|
let encryptedBundle;
|
|
try {
|
|
const bundleUrl = new URL(url);
|
|
const encryptedBundleBlob = await this.http.authedRequest(Method.Get, bundleUrl.pathname + bundleUrl.search, {}, undefined, {
|
|
rawResponseBody: true,
|
|
prefix: ""
|
|
});
|
|
logger.info(`Received blob of length ${encryptedBundleBlob.size}`);
|
|
encryptedBundle = new Uint8Array(await encryptedBundleBlob.arrayBuffer());
|
|
} catch (err) {
|
|
logger.warn(`Error downloading encrypted bundle from ${url}:`, err);
|
|
throw err;
|
|
}
|
|
try {
|
|
await this.olmMachine.receiveRoomKeyBundle(bundleData, encryptedBundle);
|
|
} catch (err) {
|
|
logger.warn(`Error receiving encrypted bundle:`, err);
|
|
throw err;
|
|
} finally {
|
|
// Even if we were unable to import the bundle, we still clear the flag that indicates that we
|
|
// are waiting for the bundle to be received. The only reason this can happen is that the bundle was
|
|
// malformed somehow, so we don't want to keep retrying it.
|
|
await this.olmMachine.clearRoomPendingKeyBundle(new RustSdkCryptoJs.RoomId(roomId));
|
|
}
|
|
return true;
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoBackend.markRoomAsPendingKeyBundle}.
|
|
*/
|
|
async markRoomAsPendingKeyBundle(roomId, inviter) {
|
|
await this.olmMachine.storeRoomPendingKeyBundle(new RustSdkCryptoJs.RoomId(roomId), new RustSdkCryptoJs.UserId(inviter));
|
|
}
|
|
/**
|
|
* Implementation of {@link CryptoApi#getVersion}.
|
|
*/
|
|
getVersion() {
|
|
const versions = RustSdkCryptoJs.getVersions();
|
|
return `Rust SDK ${versions.matrix_sdk_crypto} (${versions.git_sha}), Vodozemac ${versions.vodozemac}`;
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#setDeviceIsolationMode}.
|
|
*/
|
|
setDeviceIsolationMode(isolationMode) {
|
|
this.deviceIsolationMode = isolationMode;
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#isEncryptionEnabledInRoom}.
|
|
*/
|
|
async isEncryptionEnabledInRoom(roomId) {
|
|
const roomSettings = await this.olmMachine.getRoomSettings(new RustSdkCryptoJs.RoomId(roomId));
|
|
return Boolean(roomSettings?.algorithm);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#isStateEncryptionEnabledInRoom}.
|
|
*/
|
|
async isStateEncryptionEnabledInRoom(roomId) {
|
|
const roomSettings = await this.olmMachine.getRoomSettings(new RustSdkCryptoJs.RoomId(roomId));
|
|
return Boolean(roomSettings?.encryptStateEvents);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#getOwnDeviceKeys}.
|
|
*/
|
|
async getOwnDeviceKeys() {
|
|
const keys = this.olmMachine.identityKeys;
|
|
return {
|
|
ed25519: keys.ed25519.toBase64(),
|
|
curve25519: keys.curve25519.toBase64()
|
|
};
|
|
}
|
|
prepareToEncrypt(room) {
|
|
const encryptor = this.roomEncryptors[room.roomId];
|
|
if (encryptor) {
|
|
encryptor.prepareForEncryption(this.globalBlacklistUnverifiedDevices, this.deviceIsolationMode);
|
|
}
|
|
}
|
|
forceDiscardSession(roomId) {
|
|
return this.roomEncryptors[roomId]?.forceDiscardSession();
|
|
}
|
|
async exportRoomKeys() {
|
|
const raw = await this.olmMachine.exportRoomKeys(() => true);
|
|
return JSON.parse(raw);
|
|
}
|
|
async exportRoomKeysAsJson() {
|
|
return await this.olmMachine.exportRoomKeys(() => true);
|
|
}
|
|
async importRoomKeys(keys, opts) {
|
|
return await this.backupManager.importRoomKeys(keys, opts);
|
|
}
|
|
async importRoomKeysAsJson(keys, opts) {
|
|
return await this.backupManager.importRoomKeysAsJson(keys, opts);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi.userHasCrossSigningKeys}.
|
|
*/
|
|
async userHasCrossSigningKeys(userId = this.userId, downloadUncached = false) {
|
|
// TODO: could probably do with a more efficient way of doing this than returning the whole set and searching
|
|
const rustTrackedUsers = await this.olmMachine.trackedUsers();
|
|
let rustTrackedUser;
|
|
for (const u of rustTrackedUsers) {
|
|
if (userId === u.toString()) {
|
|
rustTrackedUser = u;
|
|
break;
|
|
}
|
|
}
|
|
if (rustTrackedUser !== undefined) {
|
|
if (userId === this.userId) {
|
|
/* make sure we have an *up-to-date* idea of the user's cross-signing keys. This is important, because if we
|
|
* return "false" here, we will end up generating new cross-signing keys and replacing the existing ones.
|
|
*/
|
|
const request = this.olmMachine.queryKeysForUsers(
|
|
// clone as rust layer will take ownership and it's reused later
|
|
[rustTrackedUser.clone()]);
|
|
await this.outgoingRequestProcessor.makeOutgoingRequest(request);
|
|
}
|
|
const userIdentity = await this.olmMachine.getIdentity(rustTrackedUser);
|
|
userIdentity?.free();
|
|
return userIdentity !== undefined;
|
|
} else if (downloadUncached) {
|
|
// Download the cross signing keys and check if the master key is available
|
|
const keyResult = await this.downloadDeviceList(new Set([userId]));
|
|
const keys = keyResult.master_keys?.[userId];
|
|
|
|
// No master key
|
|
if (!keys) return false;
|
|
|
|
// `keys` is an object with { [`ed25519:${pubKey}`]: pubKey }
|
|
// We assume only a single key, and we want the bare form without type
|
|
// prefix, so we select the values.
|
|
return Boolean(Object.values(keys.keys)[0]);
|
|
} else {
|
|
return false;
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Get the device information for the given list of users.
|
|
*
|
|
* @param userIds - The users to fetch.
|
|
* @param downloadUncached - If true, download the device list for users whose device list we are not
|
|
* currently tracking. Defaults to false, in which case such users will not appear at all in the result map.
|
|
*
|
|
* @returns A map `{@link DeviceMap}`.
|
|
*/
|
|
async getUserDeviceInfo(userIds, downloadUncached = false) {
|
|
const deviceMapByUserId = new Map();
|
|
const rustTrackedUsers = await this.getOlmMachineOrThrow().trackedUsers();
|
|
|
|
// Convert RustSdkCryptoJs.UserId to a `Set<string>`
|
|
const trackedUsers = new Set();
|
|
rustTrackedUsers.forEach(rustUserId => trackedUsers.add(rustUserId.toString()));
|
|
|
|
// Keep untracked user to download their keys after
|
|
const untrackedUsers = new Set();
|
|
for (const userId of userIds) {
|
|
// if this is a tracked user, we can just fetch the device list from the rust-sdk
|
|
// (NB: this is probably ok even if we race with a leave event such that we stop tracking the user's
|
|
// devices: the rust-sdk will return the last-known device list, which will be good enough.)
|
|
if (trackedUsers.has(userId)) {
|
|
deviceMapByUserId.set(userId, await this.getUserDevices(userId));
|
|
} else {
|
|
untrackedUsers.add(userId);
|
|
}
|
|
}
|
|
|
|
// for any users whose device lists we are not tracking, fall back to downloading the device list
|
|
// over HTTP.
|
|
if (downloadUncached && untrackedUsers.size >= 1) {
|
|
const queryResult = await this.downloadDeviceList(untrackedUsers);
|
|
Object.entries(queryResult.device_keys).forEach(([userId, deviceKeys]) => deviceMapByUserId.set(userId, deviceKeysToDeviceMap(deviceKeys)));
|
|
}
|
|
return deviceMapByUserId;
|
|
}
|
|
|
|
/**
|
|
* Get the device list for the given user from the olm machine
|
|
* @param userId - Rust SDK UserId
|
|
*/
|
|
async getUserDevices(userId) {
|
|
const rustUserId = new RustSdkCryptoJs.UserId(userId);
|
|
|
|
// For reasons I don't really understand, the Javascript FinalizationRegistry doesn't seem to run the
|
|
// registered callbacks when `userDevices` goes out of scope, nor when the individual devices in the array
|
|
// returned by `userDevices.devices` do so.
|
|
//
|
|
// This is particularly problematic, because each of those structures holds a reference to the
|
|
// VerificationMachine, which in turn holds a reference to the IndexeddbCryptoStore. Hence, we end up leaking
|
|
// open connections to the crypto store, which means the store can't be deleted on logout.
|
|
//
|
|
// To fix this, we explicitly call `.free` on each of the objects, which tells the rust code to drop the
|
|
// allocated memory and decrement the refcounts for the crypto store.
|
|
|
|
// Wait for up to a second for any in-flight device list requests to complete.
|
|
// The reason for this isn't so much to avoid races (some level of raciness is
|
|
// inevitable for this method) but to make testing easier.
|
|
const userDevices = await this.olmMachine.getUserDevices(rustUserId, 1);
|
|
try {
|
|
const deviceArray = userDevices.devices();
|
|
try {
|
|
return new Map(deviceArray.map(device => [device.deviceId.toString(), rustDeviceToJsDevice(device, rustUserId)]));
|
|
} finally {
|
|
deviceArray.forEach(d => d.free());
|
|
}
|
|
} finally {
|
|
userDevices.free();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Download the given user keys by calling `/keys/query` request
|
|
* @param untrackedUsers - download keys of these users
|
|
*/
|
|
async downloadDeviceList(untrackedUsers) {
|
|
const queryBody = {
|
|
device_keys: {}
|
|
};
|
|
untrackedUsers.forEach(user => queryBody.device_keys[user] = []);
|
|
return await this.http.authedRequest(Method.Post, "/_matrix/client/v3/keys/query", undefined, queryBody, {
|
|
prefix: ""
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#getTrustCrossSignedDevices}.
|
|
*/
|
|
getTrustCrossSignedDevices() {
|
|
return this._trustCrossSignedDevices;
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#setTrustCrossSignedDevices}.
|
|
*/
|
|
setTrustCrossSignedDevices(val) {
|
|
this._trustCrossSignedDevices = val;
|
|
// TODO: legacy crypto goes through the list of known devices and emits DeviceVerificationChanged
|
|
// events. Maybe we need to do the same?
|
|
}
|
|
|
|
/**
|
|
* Mark the given device as locally verified.
|
|
*
|
|
* Implementation of {@link CryptoApi#setDeviceVerified}.
|
|
*/
|
|
async setDeviceVerified(userId, deviceId, verified = true) {
|
|
const device = await this.olmMachine.getDevice(new RustSdkCryptoJs.UserId(userId), new RustSdkCryptoJs.DeviceId(deviceId));
|
|
if (!device) {
|
|
throw new Error(`Unknown device ${userId}|${deviceId}`);
|
|
}
|
|
try {
|
|
await device.setLocalTrust(verified ? RustSdkCryptoJs.LocalTrust.Verified : RustSdkCryptoJs.LocalTrust.Unset);
|
|
} finally {
|
|
device.free();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Blindly cross-sign one of our other devices.
|
|
*
|
|
* Implementation of {@link CryptoApi#crossSignDevice}.
|
|
*/
|
|
async crossSignDevice(deviceId) {
|
|
const device = await this.olmMachine.getDevice(new RustSdkCryptoJs.UserId(this.userId), new RustSdkCryptoJs.DeviceId(deviceId));
|
|
if (!device) {
|
|
throw new Error(`Unknown device ${deviceId}`);
|
|
}
|
|
try {
|
|
const outgoingRequest = await device.verify();
|
|
await this.outgoingRequestProcessor.makeOutgoingRequest(outgoingRequest);
|
|
} finally {
|
|
device.free();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#getDeviceVerificationStatus}.
|
|
*/
|
|
async getDeviceVerificationStatus(userId, deviceId) {
|
|
const device = await this.olmMachine.getDevice(new RustSdkCryptoJs.UserId(userId), new RustSdkCryptoJs.DeviceId(deviceId));
|
|
if (!device) return null;
|
|
try {
|
|
return new DeviceVerificationStatus({
|
|
signedByOwner: device.isCrossSignedByOwner(),
|
|
crossSigningVerified: device.isCrossSigningTrusted(),
|
|
localVerified: device.isLocallyTrusted(),
|
|
trustCrossSignedDevices: this._trustCrossSignedDevices
|
|
});
|
|
} finally {
|
|
device.free();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#getUserVerificationStatus}.
|
|
*/
|
|
async getUserVerificationStatus(userId) {
|
|
const userIdentity = await this.getOlmMachineOrThrow().getIdentity(new RustSdkCryptoJs.UserId(userId));
|
|
if (userIdentity === undefined) {
|
|
return new UserVerificationStatus(false, false, false);
|
|
}
|
|
const verified = userIdentity.isVerified();
|
|
const wasVerified = userIdentity.wasPreviouslyVerified();
|
|
const needsUserApproval = userIdentity instanceof RustSdkCryptoJs.OtherUserIdentity ? userIdentity.identityNeedsUserApproval() : false;
|
|
userIdentity.free();
|
|
return new UserVerificationStatus(verified, wasVerified, true, needsUserApproval);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#pinCurrentUserIdentity}.
|
|
*/
|
|
async pinCurrentUserIdentity(userId) {
|
|
const userIdentity = await this.getOlmMachineOrThrow().getIdentity(new RustSdkCryptoJs.UserId(userId));
|
|
if (userIdentity === undefined) {
|
|
throw new Error("Cannot pin identity of unknown user");
|
|
}
|
|
if (userIdentity instanceof RustSdkCryptoJs.OwnUserIdentity) {
|
|
throw new Error("Cannot pin identity of own user");
|
|
}
|
|
await userIdentity.pinCurrentMasterKey();
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#withdrawVerificationRequirement}.
|
|
*/
|
|
async withdrawVerificationRequirement(userId) {
|
|
const userIdentity = await this.getOlmMachineOrThrow().getIdentity(new RustSdkCryptoJs.UserId(userId));
|
|
if (userIdentity === undefined) {
|
|
throw new Error("Cannot withdraw verification of unknown user");
|
|
}
|
|
await userIdentity.withdrawVerification();
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#getUserCrossSigningKeys}.
|
|
*/
|
|
async getUserCrossSigningKeys(userId) {
|
|
const userIdentity = await this.getOlmMachineOrThrow().getIdentity(new RustSdkCryptoJs.UserId(userId));
|
|
if (!userIdentity) {
|
|
return null;
|
|
}
|
|
const result = {
|
|
master_key: JSON.parse(userIdentity.masterKey),
|
|
self_signing_key: JSON.parse(userIdentity.selfSigningKey)
|
|
};
|
|
|
|
// The USK is only visible for our own identity
|
|
if ("userSigningKey" in userIdentity) {
|
|
result.user_signing_key = JSON.parse(userIdentity.userSigningKey);
|
|
}
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#isCrossSigningReady}
|
|
*/
|
|
async isCrossSigningReady() {
|
|
const {
|
|
privateKeysInSecretStorage,
|
|
privateKeysCachedLocally
|
|
} = await this.getCrossSigningStatus();
|
|
const hasKeysInCache = Boolean(privateKeysCachedLocally.masterKey) && Boolean(privateKeysCachedLocally.selfSigningKey) && Boolean(privateKeysCachedLocally.userSigningKey);
|
|
const identity = await this.getOwnIdentity();
|
|
|
|
// Cross-signing is ready if the public identity is trusted, and the private keys
|
|
// are either cached, or accessible via secret-storage.
|
|
return !!identity?.isVerified() && (hasKeysInCache || privateKeysInSecretStorage);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#getCrossSigningKeyId}
|
|
*/
|
|
async getCrossSigningKeyId(type = CrossSigningKey.Master) {
|
|
const userIdentity = await this.getOwnIdentity();
|
|
if (!userIdentity) {
|
|
// The public keys are not available on this device
|
|
return null;
|
|
}
|
|
try {
|
|
const crossSigningStatus = await this.olmMachine.crossSigningStatus();
|
|
const privateKeysOnDevice = crossSigningStatus.hasMaster && crossSigningStatus.hasUserSigning && crossSigningStatus.hasSelfSigning;
|
|
if (!privateKeysOnDevice) {
|
|
// The private keys are not available on this device
|
|
return null;
|
|
}
|
|
if (!userIdentity.isVerified()) {
|
|
// We have both public and private keys, but they don't match!
|
|
return null;
|
|
}
|
|
let key;
|
|
switch (type) {
|
|
case CrossSigningKey.Master:
|
|
key = userIdentity.masterKey;
|
|
break;
|
|
case CrossSigningKey.SelfSigning:
|
|
key = userIdentity.selfSigningKey;
|
|
break;
|
|
case CrossSigningKey.UserSigning:
|
|
key = userIdentity.userSigningKey;
|
|
break;
|
|
default:
|
|
// Unknown type
|
|
return null;
|
|
}
|
|
const parsedKey = JSON.parse(key);
|
|
// `keys` is an object with { [`ed25519:${pubKey}`]: pubKey }
|
|
// We assume only a single key, and we want the bare form without type
|
|
// prefix, so we select the values.
|
|
return Object.values(parsedKey.keys)[0];
|
|
} finally {
|
|
userIdentity.free();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#bootstrapCrossSigning}
|
|
*/
|
|
async bootstrapCrossSigning(opts) {
|
|
await this.crossSigningIdentity.bootstrapCrossSigning(opts);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#isSecretStorageReady}
|
|
*/
|
|
async isSecretStorageReady() {
|
|
return (await this.getSecretStorageStatus()).ready;
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#getSecretStorageStatus}
|
|
*/
|
|
async getSecretStorageStatus() {
|
|
// make sure that the cross-signing keys are stored
|
|
const secretsToCheck = ["m.cross_signing.master", "m.cross_signing.user_signing", "m.cross_signing.self_signing"];
|
|
|
|
// If key backup is active, we also need to check that the backup decryption key is stored
|
|
const keyBackupEnabled = (await this.backupManager.getActiveBackupVersion()) != null;
|
|
if (keyBackupEnabled) {
|
|
secretsToCheck.push("m.megolm_backup.v1");
|
|
}
|
|
const defaultKeyId = await this.secretStorage.getDefaultKeyId();
|
|
const result = {
|
|
// Assume we have all secrets until proven otherwise
|
|
ready: true,
|
|
defaultKeyId,
|
|
secretStorageKeyValidityMap: {}
|
|
};
|
|
for (const secretName of secretsToCheck) {
|
|
// Check which keys this particular secret is encrypted with
|
|
const record = (await this.secretStorage.isStored(secretName)) || {};
|
|
|
|
// If it's encrypted with the right key, it is valid
|
|
const secretStored = !!defaultKeyId && defaultKeyId in record;
|
|
result.secretStorageKeyValidityMap[secretName] = secretStored;
|
|
result.ready = result.ready && secretStored;
|
|
}
|
|
return result;
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#bootstrapSecretStorage}
|
|
*/
|
|
async bootstrapSecretStorage({
|
|
createSecretStorageKey,
|
|
setupNewSecretStorage,
|
|
setupNewKeyBackup
|
|
} = {}) {
|
|
// If an AES Key is already stored in the secret storage and setupNewSecretStorage is not set
|
|
// we don't want to create a new key
|
|
const isNewSecretStorageKeyNeeded = setupNewSecretStorage || !(await this.secretStorageHasAESKey());
|
|
if (isNewSecretStorageKeyNeeded) {
|
|
if (!createSecretStorageKey) {
|
|
throw new Error("unable to create a new secret storage key, createSecretStorageKey is not set");
|
|
}
|
|
|
|
// Create a new storage key and add it to secret storage
|
|
this.logger.info("bootstrapSecretStorage: creating new secret storage key");
|
|
const recoveryKey = await createSecretStorageKey();
|
|
if (!recoveryKey) {
|
|
throw new Error("createSecretStorageKey() callback did not return a secret storage key");
|
|
}
|
|
await this.addSecretStorageKeyToSecretStorage(recoveryKey);
|
|
}
|
|
const crossSigningPrivateKeys = await this.olmMachine.exportCrossSigningKeys();
|
|
const hasPrivateKeys = crossSigningPrivateKeys && crossSigningPrivateKeys.masterKey !== undefined && crossSigningPrivateKeys.self_signing_key !== undefined && crossSigningPrivateKeys.userSigningKey !== undefined;
|
|
|
|
// If we have cross-signing private keys cached, store them in secret
|
|
// storage if they are not there already.
|
|
if (hasPrivateKeys && (isNewSecretStorageKeyNeeded || !(await secretStorageContainsCrossSigningKeys(this.secretStorage)))) {
|
|
this.logger.info("bootstrapSecretStorage: cross-signing keys not yet exported; doing so now.");
|
|
await this.secretStorage.store("m.cross_signing.master", crossSigningPrivateKeys.masterKey);
|
|
await this.secretStorage.store("m.cross_signing.user_signing", crossSigningPrivateKeys.userSigningKey);
|
|
await this.secretStorage.store("m.cross_signing.self_signing", crossSigningPrivateKeys.self_signing_key);
|
|
}
|
|
|
|
// likewise with the key backup key: if we have one, store it in secret storage (if it's not already there)
|
|
// also don't bother storing it if we're about to set up a new backup
|
|
if (!setupNewKeyBackup) {
|
|
await this.saveBackupKeyToStorage();
|
|
} else {
|
|
await this.resetKeyBackup();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* If we have a backup key for the current, trusted backup in cache,
|
|
* save it to secret storage.
|
|
*/
|
|
async saveBackupKeyToStorage() {
|
|
const keyBackupInfo = await this.backupManager.getServerBackupInfo();
|
|
if (!keyBackupInfo || !keyBackupInfo.version) {
|
|
this.logger.info("Not saving backup key to secret storage: no backup info");
|
|
return;
|
|
}
|
|
const backupKeys = await this.olmMachine.getBackupKeys();
|
|
if (!backupKeys.decryptionKey) {
|
|
this.logger.info("Not saving backup key to secret storage: no backup key");
|
|
return;
|
|
}
|
|
if (!decryptionKeyMatchesKeyBackupInfo(backupKeys.decryptionKey, keyBackupInfo)) {
|
|
this.logger.info("Not saving backup key to secret storage: decryption key does not match backup info");
|
|
return;
|
|
}
|
|
const backupKeyBase64 = backupKeys.decryptionKey.toBase64();
|
|
await this.secretStorage.store("m.megolm_backup.v1", backupKeyBase64);
|
|
}
|
|
|
|
/**
|
|
* Add the secretStorage key to the secret storage
|
|
* - The secret storage key must have the `keyInfo` field filled
|
|
* - The secret storage key is set as the default key of the secret storage
|
|
* - Call `cryptoCallbacks.cacheSecretStorageKey` when done
|
|
*
|
|
* @param secretStorageKey - The secret storage key to add in the secret storage.
|
|
*/
|
|
async addSecretStorageKeyToSecretStorage(secretStorageKey) {
|
|
const secretStorageKeyObject = await this.secretStorage.addKey(SECRET_STORAGE_ALGORITHM_V1_AES, {
|
|
passphrase: secretStorageKey.keyInfo?.passphrase,
|
|
name: secretStorageKey.keyInfo?.name,
|
|
key: secretStorageKey.privateKey
|
|
});
|
|
await this.secretStorage.setDefaultKeyId(secretStorageKeyObject.keyId);
|
|
this.cryptoCallbacks.cacheSecretStorageKey?.(secretStorageKeyObject.keyId, secretStorageKeyObject.keyInfo, secretStorageKey.privateKey);
|
|
}
|
|
|
|
/**
|
|
* Check if a secret storage AES Key is already added in secret storage
|
|
*
|
|
* @returns True if an AES key is in the secret storage
|
|
*/
|
|
async secretStorageHasAESKey() {
|
|
// See if we already have an AES secret-storage key.
|
|
const secretStorageKeyTuple = await this.secretStorage.getKey();
|
|
if (!secretStorageKeyTuple) return false;
|
|
const [, keyInfo] = secretStorageKeyTuple;
|
|
|
|
// Check if the key is an AES key
|
|
return keyInfo.algorithm === SECRET_STORAGE_ALGORITHM_V1_AES;
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#getCrossSigningStatus}
|
|
*/
|
|
async getCrossSigningStatus() {
|
|
const userIdentity = await this.getOwnIdentity();
|
|
const publicKeysOnDevice = Boolean(userIdentity?.masterKey) && Boolean(userIdentity?.selfSigningKey) && Boolean(userIdentity?.userSigningKey);
|
|
userIdentity?.free();
|
|
const privateKeysInSecretStorage = await secretStorageContainsCrossSigningKeys(this.secretStorage);
|
|
const crossSigningStatus = await this.getOlmMachineOrThrow().crossSigningStatus();
|
|
return {
|
|
publicKeysOnDevice,
|
|
privateKeysInSecretStorage,
|
|
privateKeysCachedLocally: {
|
|
masterKey: Boolean(crossSigningStatus?.hasMaster),
|
|
userSigningKey: Boolean(crossSigningStatus?.hasUserSigning),
|
|
selfSigningKey: Boolean(crossSigningStatus?.hasSelfSigning)
|
|
}
|
|
};
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#createRecoveryKeyFromPassphrase}
|
|
*/
|
|
async createRecoveryKeyFromPassphrase(password) {
|
|
if (password) {
|
|
// Generate the key from the passphrase
|
|
// first we generate a random salt
|
|
const salt = secureRandomString(32);
|
|
// then we derive the key from the passphrase
|
|
const recoveryKey = await deriveRecoveryKeyFromPassphrase(password, salt, this.RECOVERY_KEY_DERIVATION_ITERATIONS);
|
|
return {
|
|
keyInfo: {
|
|
passphrase: {
|
|
algorithm: "m.pbkdf2",
|
|
iterations: this.RECOVERY_KEY_DERIVATION_ITERATIONS,
|
|
salt
|
|
}
|
|
},
|
|
privateKey: recoveryKey,
|
|
encodedPrivateKey: encodeRecoveryKey(recoveryKey)
|
|
};
|
|
} else {
|
|
// Using the navigator crypto API to generate the private key
|
|
const key = new Uint8Array(32);
|
|
globalThis.crypto.getRandomValues(key);
|
|
return {
|
|
privateKey: key,
|
|
encodedPrivateKey: encodeRecoveryKey(key)
|
|
};
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#getEncryptionInfoForEvent}.
|
|
*/
|
|
async getEncryptionInfoForEvent(event) {
|
|
return this.eventDecryptor.getEncryptionInfoForEvent(event);
|
|
}
|
|
|
|
/**
|
|
* Returns to-device verification requests that are already in progress for the given user id.
|
|
*
|
|
* Implementation of {@link CryptoApi#getVerificationRequestsToDeviceInProgress}
|
|
*
|
|
* @param userId - the ID of the user to query
|
|
*
|
|
* @returns the VerificationRequests that are in progress
|
|
*/
|
|
getVerificationRequestsToDeviceInProgress(userId) {
|
|
const requests = this.olmMachine.getVerificationRequests(new RustSdkCryptoJs.UserId(userId));
|
|
return requests.filter(request => request.roomId === undefined && !request.isCancelled()).map(request => this.makeVerificationRequest(request));
|
|
}
|
|
|
|
/**
|
|
* Finds a DM verification request that is already in progress for the given room id
|
|
*
|
|
* Implementation of {@link CryptoApi#findVerificationRequestDMInProgress}
|
|
*
|
|
* @param roomId - the room to use for verification
|
|
* @param userId - search the verification request for the given user
|
|
*
|
|
* @returns the VerificationRequest that is in progress, if any
|
|
*
|
|
*/
|
|
findVerificationRequestDMInProgress(roomId, userId) {
|
|
if (!userId) throw new Error("missing userId");
|
|
const requests = this.olmMachine.getVerificationRequests(new RustSdkCryptoJs.UserId(userId));
|
|
|
|
// Search for the verification request for the given room id
|
|
const request = requests.find(request => request.roomId?.toString() === roomId && !request.isCancelled());
|
|
if (request) {
|
|
return this.makeVerificationRequest(request);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#requestVerificationDM}
|
|
*/
|
|
async requestVerificationDM(userId, roomId) {
|
|
const userIdentity = await this.olmMachine.getIdentity(new RustSdkCryptoJs.UserId(userId));
|
|
if (!userIdentity) throw new Error(`unknown userId ${userId}`);
|
|
try {
|
|
// Transform the verification methods into rust objects
|
|
const methods = this._supportedVerificationMethods.map(method => verificationMethodIdentifierToMethod(method));
|
|
// Get the request content to send to the DM room
|
|
const verCont = userIdentity.verificationRequestContent(methods);
|
|
|
|
// TODO: due to https://github.com/matrix-org/matrix-rust-sdk/issues/5643, we need to fix up the verification request content to include `msgtype`.
|
|
const verContObj = JSON.parse(verCont);
|
|
verContObj["msgtype"] = "m.key.verification.request";
|
|
const verificationEventContent = JSON.stringify(verContObj);
|
|
|
|
// Send the request content to send to the DM room
|
|
const eventId = await this.sendVerificationRequestContent(roomId, verificationEventContent);
|
|
|
|
// Get a verification request
|
|
const request = userIdentity.requestVerification(new RustSdkCryptoJs.RoomId(roomId), new RustSdkCryptoJs.EventId(eventId), methods);
|
|
return this.makeVerificationRequest(request);
|
|
} finally {
|
|
userIdentity.free();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Send the verification content to a room
|
|
* See https://spec.matrix.org/v1.7/client-server-api/#put_matrixclientv3roomsroomidsendeventtypetxnid
|
|
*
|
|
* Prefer to use {@link OutgoingRequestProcessor.makeOutgoingRequest} when dealing with {@link RustSdkCryptoJs.RoomMessageRequest}
|
|
*
|
|
* @param roomId - the targeted room
|
|
* @param verificationEventContent - the request body.
|
|
*
|
|
* @returns the event id
|
|
*/
|
|
async sendVerificationRequestContent(roomId, verificationEventContent) {
|
|
const txId = secureRandomString(32);
|
|
// Send the verification request content to the DM room
|
|
const {
|
|
event_id: eventId
|
|
} = await this.http.authedRequest(Method.Put, `/_matrix/client/v3/rooms/${encodeURIComponent(roomId)}/send/m.room.message/${encodeURIComponent(txId)}`, undefined, verificationEventContent, {
|
|
prefix: ""
|
|
});
|
|
return eventId;
|
|
}
|
|
/**
|
|
* Set the verification methods we offer to the other side during an interactive verification.
|
|
*
|
|
* If `undefined`, we will offer all the methods supported by the Rust SDK.
|
|
*/
|
|
setSupportedVerificationMethods(methods) {
|
|
// by default, the Rust SDK does not offer `m.qr_code.scan.v1`, but we do want to offer that.
|
|
this._supportedVerificationMethods = methods ?? ALL_VERIFICATION_METHODS;
|
|
}
|
|
|
|
/**
|
|
* Send a verification request to our other devices.
|
|
*
|
|
* If a verification is already in flight, returns it. Otherwise, initiates a new one.
|
|
*
|
|
* Implementation of {@link CryptoApi#requestOwnUserVerification}.
|
|
*
|
|
* @returns a VerificationRequest when the request has been sent to the other party.
|
|
*/
|
|
async requestOwnUserVerification() {
|
|
const userIdentity = await this.getOwnIdentity();
|
|
if (userIdentity === undefined) {
|
|
throw new Error("cannot request verification for this device when there is no existing cross-signing key");
|
|
}
|
|
try {
|
|
const [request, outgoingRequest] = await userIdentity.requestVerification(this._supportedVerificationMethods.map(verificationMethodIdentifierToMethod));
|
|
await this.outgoingRequestProcessor.makeOutgoingRequest(outgoingRequest);
|
|
return this.makeVerificationRequest(request);
|
|
} finally {
|
|
userIdentity.free();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Request an interactive verification with the given device.
|
|
*
|
|
* If a verification is already in flight, returns it. Otherwise, initiates a new one.
|
|
*
|
|
* Implementation of {@link CryptoApi#requestDeviceVerification}.
|
|
*
|
|
* @param userId - ID of the owner of the device to verify
|
|
* @param deviceId - ID of the device to verify
|
|
*
|
|
* @returns a VerificationRequest when the request has been sent to the other party.
|
|
*/
|
|
async requestDeviceVerification(userId, deviceId) {
|
|
const device = await this.olmMachine.getDevice(new RustSdkCryptoJs.UserId(userId), new RustSdkCryptoJs.DeviceId(deviceId));
|
|
if (!device) {
|
|
throw new Error("Not a known device");
|
|
}
|
|
try {
|
|
const [request, outgoingRequest] = device.requestVerification(this._supportedVerificationMethods.map(verificationMethodIdentifierToMethod));
|
|
await this.outgoingRequestProcessor.makeOutgoingRequest(outgoingRequest);
|
|
return this.makeVerificationRequest(request);
|
|
} finally {
|
|
device.free();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Fetch the backup decryption key we have saved in our store.
|
|
*
|
|
* Implementation of {@link CryptoApi#getSessionBackupPrivateKey}.
|
|
*
|
|
* @returns the key, if any, or null
|
|
*/
|
|
async getSessionBackupPrivateKey() {
|
|
const backupKeys = await this.olmMachine.getBackupKeys();
|
|
if (!backupKeys.decryptionKey) return null;
|
|
return decodeBase64(backupKeys.decryptionKey.toBase64());
|
|
}
|
|
|
|
/**
|
|
* Store the backup decryption key.
|
|
*
|
|
* Implementation of {@link CryptoApi#storeSessionBackupPrivateKey}.
|
|
*
|
|
* @param key - the backup decryption key
|
|
* @param version - the backup version for this key.
|
|
*/
|
|
async storeSessionBackupPrivateKey(key, version) {
|
|
const base64Key = encodeBase64(key);
|
|
if (!version) {
|
|
throw new Error("storeSessionBackupPrivateKey: version is required");
|
|
}
|
|
await this.backupManager.saveBackupDecryptionKey(RustSdkCryptoJs.BackupDecryptionKey.fromBase64(base64Key), version);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#loadSessionBackupPrivateKeyFromSecretStorage}.
|
|
*/
|
|
async loadSessionBackupPrivateKeyFromSecretStorage() {
|
|
const backupKey = await this.secretStorage.get("m.megolm_backup.v1");
|
|
if (!backupKey) {
|
|
throw new Error("loadSessionBackupPrivateKeyFromSecretStorage: missing decryption key in secret storage");
|
|
}
|
|
const keyBackupInfo = await this.backupManager.getServerBackupInfo();
|
|
if (!keyBackupInfo || !keyBackupInfo.version) {
|
|
throw new Error("loadSessionBackupPrivateKeyFromSecretStorage: unable to get backup version");
|
|
}
|
|
const backupDecryptionKey = RustSdkCryptoJs.BackupDecryptionKey.fromBase64(backupKey);
|
|
if (!decryptionKeyMatchesKeyBackupInfo(backupDecryptionKey, keyBackupInfo)) {
|
|
throw new DecryptionKeyDoesNotMatchError("loadSessionBackupPrivateKeyFromSecretStorage: decryption key does not match backup info");
|
|
}
|
|
await this.backupManager.saveBackupDecryptionKey(backupDecryptionKey, keyBackupInfo.version);
|
|
}
|
|
|
|
/**
|
|
* Get the current status of key backup.
|
|
*
|
|
* Implementation of {@link CryptoApi#getActiveSessionBackupVersion}.
|
|
*/
|
|
async getActiveSessionBackupVersion() {
|
|
return await this.backupManager.getActiveBackupVersion();
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#getKeyBackupInfo}.
|
|
*/
|
|
async getKeyBackupInfo() {
|
|
return (await this.backupManager.getServerBackupInfo()) || null;
|
|
}
|
|
|
|
/**
|
|
* Determine if a key backup can be trusted.
|
|
*
|
|
* Implementation of {@link CryptoApi#isKeyBackupTrusted}.
|
|
*/
|
|
async isKeyBackupTrusted(info) {
|
|
return await this.backupManager.isKeyBackupTrusted(info);
|
|
}
|
|
|
|
/**
|
|
* Force a re-check of the key backup and enable/disable it as appropriate.
|
|
*
|
|
* Implementation of {@link CryptoApi#checkKeyBackupAndEnable}.
|
|
*/
|
|
async checkKeyBackupAndEnable() {
|
|
return await this.backupManager.checkKeyBackupAndEnable(true);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#deleteKeyBackupVersion}.
|
|
*/
|
|
async deleteKeyBackupVersion(version) {
|
|
await this.backupManager.deleteKeyBackupVersion(version);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#resetKeyBackup}.
|
|
*/
|
|
async resetKeyBackup() {
|
|
const backupInfo = await this.backupManager.setupKeyBackup(o => this.signObject(o));
|
|
await this.pushSecretToVerifiedDevices("m.megolm_backup.v1");
|
|
|
|
// we want to store the private key in 4S
|
|
// need to check if 4S is set up?
|
|
if (await this.secretStorageHasAESKey()) {
|
|
await this.secretStorage.store("m.megolm_backup.v1", backupInfo.decryptionKey.toBase64());
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#disableKeyStorage}.
|
|
*/
|
|
async disableKeyStorage() {
|
|
// Get the key backup version we're using
|
|
const info = await this.getKeyBackupInfo();
|
|
if (info?.version) {
|
|
await this.deleteKeyBackupVersion(info.version);
|
|
} else {
|
|
this.logger.error("Can't delete key backup version: no version available");
|
|
}
|
|
|
|
// also turn off 4S, since this is also storing keys on the server.
|
|
await this.deleteSecretStorage();
|
|
await this.dehydratedDeviceManager.delete();
|
|
}
|
|
|
|
/**
|
|
* Signs the given object with the current device and current identity (if available).
|
|
* As defined in {@link https://spec.matrix.org/v1.8/appendices/#signing-json | Signing JSON}.
|
|
*
|
|
* Helper for {@link RustCrypto#resetKeyBackup}.
|
|
*
|
|
* @param obj - The object to sign
|
|
*/
|
|
async signObject(obj) {
|
|
const sigs = new Map(Object.entries(obj.signatures || {}));
|
|
const unsigned = obj.unsigned;
|
|
delete obj.signatures;
|
|
delete obj.unsigned;
|
|
const userSignatures = sigs.get(this.userId) || {};
|
|
const canonalizedJson = anotherjson.stringify(obj);
|
|
const signatures = await this.olmMachine.sign(canonalizedJson);
|
|
const map = JSON.parse(signatures.asJSON());
|
|
sigs.set(this.userId, _objectSpread(_objectSpread({}, userSignatures), map[this.userId]));
|
|
if (unsigned !== undefined) obj.unsigned = unsigned;
|
|
obj.signatures = Object.fromEntries(sigs.entries());
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#restoreKeyBackupWithPassphrase}.
|
|
*/
|
|
async restoreKeyBackupWithPassphrase(passphrase, opts) {
|
|
const backupInfo = await this.backupManager.getServerBackupInfo();
|
|
if (!backupInfo?.version) {
|
|
throw new Error("No backup info available");
|
|
}
|
|
const privateKey = await keyFromAuthData(backupInfo.auth_data, passphrase);
|
|
|
|
// Cache the key
|
|
await this.storeSessionBackupPrivateKey(privateKey, backupInfo.version);
|
|
return this.restoreKeyBackup(opts);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#restoreKeyBackup}.
|
|
*/
|
|
async restoreKeyBackup(opts) {
|
|
// Get the decryption key from the crypto store
|
|
const backupKeys = await this.olmMachine.getBackupKeys();
|
|
const {
|
|
decryptionKey,
|
|
backupVersion
|
|
} = backupKeys;
|
|
if (!decryptionKey || !backupVersion) throw new Error("No decryption key found in crypto store");
|
|
const decodedDecryptionKey = decodeBase64(decryptionKey.toBase64());
|
|
const backupInfo = await this.backupManager.requestKeyBackupVersion(backupVersion);
|
|
if (!backupInfo) throw new Error(`Backup version to restore ${backupVersion} not found on server`);
|
|
const backupDecryptor = await this.getBackupDecryptor(backupInfo, decodedDecryptionKey);
|
|
try {
|
|
opts?.progressCallback?.({
|
|
stage: ImportRoomKeyStage.Fetch
|
|
});
|
|
return await this.backupManager.restoreKeyBackup(backupVersion, backupDecryptor, opts);
|
|
} finally {
|
|
// Free to avoid to keep in memory the decryption key stored in it. To avoid to exposing it to an attacker.
|
|
backupDecryptor.free();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#isDehydrationSupported}.
|
|
*/
|
|
async isDehydrationSupported() {
|
|
return await this.dehydratedDeviceManager.isSupported();
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#startDehydration}.
|
|
*/
|
|
async startDehydration(opts = {}) {
|
|
if (!(await this.isCrossSigningReady()) || !(await this.isSecretStorageReady())) {
|
|
throw new Error("Device dehydration requires cross-signing and secret storage to be set up");
|
|
}
|
|
return await this.dehydratedDeviceManager.start(opts || {});
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#importSecretsBundle}.
|
|
*/
|
|
async importSecretsBundle(secrets) {
|
|
const secretsBundle = RustSdkCryptoJs.SecretsBundle.from_json(secrets);
|
|
await this.getOlmMachineOrThrow().importSecretsBundle(secretsBundle); // this method frees the SecretsBundle
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#exportSecretsBundle}.
|
|
*/
|
|
async exportSecretsBundle() {
|
|
const secretsBundle = await this.getOlmMachineOrThrow().exportSecretsBundle();
|
|
const secrets = secretsBundle.to_json();
|
|
secretsBundle.free();
|
|
return secrets;
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#encryptToDeviceMessages}.
|
|
*/
|
|
async encryptToDeviceMessages(eventType, devices, payload) {
|
|
const logger = new LogSpan(this.logger, "encryptToDeviceMessages");
|
|
const uniqueUsers = new Set(devices.map(({
|
|
userId
|
|
}) => userId));
|
|
|
|
// This will ensure we have Olm sessions for all of the users' devices.
|
|
// However, we only care about some of the devices.
|
|
// So, perhaps we can optimise this later on.
|
|
await this.keyClaimManager.ensureSessionsForUsers(logger, Array.from(uniqueUsers).map(userId => new RustSdkCryptoJs.UserId(userId)));
|
|
const batch = {
|
|
batch: [],
|
|
eventType: EventType.RoomMessageEncrypted
|
|
};
|
|
await Promise.all(devices.map(async ({
|
|
userId,
|
|
deviceId
|
|
}) => {
|
|
const device = await this.olmMachine.getDevice(new RustSdkCryptoJs.UserId(userId), new RustSdkCryptoJs.DeviceId(deviceId));
|
|
if (device) {
|
|
const encryptedPayload = JSON.parse(await device.encryptToDeviceEvent(eventType, payload));
|
|
batch.batch.push({
|
|
deviceId,
|
|
userId,
|
|
payload: encryptedPayload
|
|
});
|
|
} else {
|
|
this.logger.warn(`encryptToDeviceMessages: unknown device ${userId}:${deviceId}`);
|
|
}
|
|
}));
|
|
return batch;
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#resetEncryption}.
|
|
*/
|
|
async resetEncryption(authUploadDeviceSigningKeys) {
|
|
this.logger.debug("resetEncryption: resetting encryption");
|
|
|
|
// Delete the dehydrated device, since any existing one will be signed
|
|
// by the wrong cross-signing key
|
|
void this.dehydratedDeviceManager.delete();
|
|
|
|
// Disable backup, and delete all the backups from the server
|
|
await this.backupManager.deleteAllKeyBackupVersions();
|
|
await this.deleteSecretStorage();
|
|
|
|
// Reset the cross-signing keys
|
|
await this.crossSigningIdentity.bootstrapCrossSigning({
|
|
setupNewCrossSigning: true,
|
|
authUploadDeviceSigningKeys
|
|
});
|
|
|
|
// Create a new key backup
|
|
await this.resetKeyBackup();
|
|
this.logger.debug("resetEncryption: ended");
|
|
}
|
|
|
|
/**
|
|
* Removes the secret storage key, default key pointer and all (known) secret storage data
|
|
* from the user's account data
|
|
*/
|
|
async deleteSecretStorage() {
|
|
// Remove the stored secrets in the secret storage
|
|
await this.secretStorage.store("m.cross_signing.master", null);
|
|
await this.secretStorage.store("m.cross_signing.self_signing", null);
|
|
await this.secretStorage.store("m.cross_signing.user_signing", null);
|
|
await this.secretStorage.store("m.megolm_backup.v1", null);
|
|
|
|
// Remove the recovery key
|
|
const defaultKeyId = await this.secretStorage.getDefaultKeyId();
|
|
if (defaultKeyId) await this.secretStorage.store(`m.secret_storage.key.${defaultKeyId}`, null);
|
|
// Disable the recovery key and the secret storage
|
|
await this.secretStorage.setDefaultKeyId(null);
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#shareRoomHistoryWithUser}.
|
|
*/
|
|
async shareRoomHistoryWithUser(roomId, userId) {
|
|
const logger = new LogSpan(this.logger, `shareRoomHistoryWithUser(${roomId}, ${userId})`);
|
|
|
|
// 0. We can only share room history if our user has set up cross-signing.
|
|
const identity = await this.getOwnIdentity();
|
|
if (!identity?.isVerified()) {
|
|
logger.warn("Not sharing message history as the current device is not verified by our cross-signing identity");
|
|
return;
|
|
}
|
|
logger.info("Sharing message history");
|
|
|
|
// 1. Download keys from backup.
|
|
if (!(await this.getOlmMachineOrThrow().hasDownloadedAllRoomKeys(new RustSdkCryptoJs.RoomId(roomId)))) {
|
|
await this.backupManager.downloadLatestRoomKeyBackup(roomId);
|
|
await this.getOlmMachineOrThrow().setHasDownloadedAllRoomKeys(new RustSdkCryptoJs.RoomId(roomId));
|
|
}
|
|
|
|
// 2. Construct the key bundle
|
|
const bundle = await this.getOlmMachineOrThrow().buildRoomKeyBundle(new RustSdkCryptoJs.RoomId(roomId));
|
|
if (!bundle) {
|
|
logger.info("No keys to share");
|
|
return;
|
|
}
|
|
|
|
// 3. Upload the encrypted bundle to the server
|
|
const uploadResponse = await this.http.uploadContent(bundle.encryptedData);
|
|
logger.info(`Uploaded encrypted key blob: ${JSON.stringify(uploadResponse)}`);
|
|
|
|
// 4. We may not share a room with the user, so get a fresh list of devices for the invited user.
|
|
const req = this.getOlmMachineOrThrow().queryKeysForUsers([new RustSdkCryptoJs.UserId(userId)]);
|
|
await this.outgoingRequestProcessor.makeOutgoingRequest(req);
|
|
|
|
// 5. Establish Olm sessions with all of the recipient's devices.
|
|
await this.keyClaimManager.ensureSessionsForUsers(logger, [new RustSdkCryptoJs.UserId(userId)]);
|
|
|
|
// 6. Send to-device messages to the recipient to share the keys.
|
|
const requests = await this.getOlmMachineOrThrow().shareRoomKeyBundleData(new RustSdkCryptoJs.UserId(userId), new RustSdkCryptoJs.RoomId(roomId), uploadResponse.content_uri, bundle.mediaEncryptionInfo, RustSdkCryptoJs.CollectStrategy.identityBasedStrategy());
|
|
for (const req of requests) {
|
|
await this.outgoingRequestProcessor.makeOutgoingRequest(req);
|
|
}
|
|
}
|
|
|
|
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
//
|
|
// SyncCryptoCallbacks implementation
|
|
//
|
|
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
|
|
/**
|
|
* Apply sync changes to the olm machine
|
|
* @param events - the received to-device messages
|
|
* @param oneTimeKeysCounts - the received one time key counts
|
|
* @param unusedFallbackKeys - the received unused fallback keys
|
|
* @param devices - the received device list updates
|
|
* @returns A list of processed to-device messages.
|
|
*/
|
|
async receiveSyncChanges({
|
|
events,
|
|
oneTimeKeysCounts = new Map(),
|
|
unusedFallbackKeys,
|
|
devices = new RustSdkCryptoJs.DeviceLists()
|
|
}) {
|
|
return await this.olmMachine.receiveSyncChanges(events ? JSON.stringify(events) : "[]", devices, oneTimeKeysCounts, unusedFallbackKeys);
|
|
}
|
|
|
|
/** called by the sync loop to preprocess incoming to-device messages
|
|
*
|
|
* @param events - the received to-device messages
|
|
* @returns A list of preprocessed to-device messages.
|
|
*/
|
|
async preprocessToDeviceMessages(events) {
|
|
// send the received to-device messages into receiveSyncChanges. We have no info on device-list changes,
|
|
// one-time-keys, or fallback keys, so just pass empty data.
|
|
const processed = await this.receiveSyncChanges({
|
|
events
|
|
});
|
|
const received = [];
|
|
for (const message of processed) {
|
|
const parsedMessage = JSON.parse(message.rawEvent);
|
|
|
|
// look for interesting to-device messages
|
|
if (parsedMessage.type === EventType.KeyVerificationRequest) {
|
|
const sender = parsedMessage.sender;
|
|
const transactionId = parsedMessage.content.transaction_id;
|
|
if (transactionId && sender) {
|
|
this.onIncomingKeyVerificationRequest(sender, transactionId);
|
|
}
|
|
}
|
|
switch (message.type) {
|
|
case RustSdkCryptoJs.ProcessedToDeviceEventType.Decrypted:
|
|
{
|
|
const encryptionInfo = message.encryptionInfo;
|
|
received.push({
|
|
message: parsedMessage,
|
|
encryptionInfo: {
|
|
sender: encryptionInfo.sender.toString(),
|
|
senderDevice: encryptionInfo.senderDevice?.toString(),
|
|
senderCurve25519KeyBase64: encryptionInfo.senderCurve25519Key,
|
|
senderVerified: encryptionInfo.isSenderVerified()
|
|
}
|
|
});
|
|
|
|
// If we have received a room key bundle message, and have recently joined the room in question,
|
|
// tell the Rust SDK to try and accept the key bundle.
|
|
//
|
|
// We don't actually need to validate the contents of the bundle message, or do
|
|
// anything with its contents at all. We simply want to inform the Rust SDK we have
|
|
// received a new room key bundle that we might be able to download.
|
|
if (isRoomKeyBundleMessage(parsedMessage)) {
|
|
const roomId = parsedMessage.content.room_id;
|
|
const pendingDetails = await this.olmMachine.getPendingKeyBundleDetailsForRoom(new RustSdkCryptoJs.RoomId(roomId));
|
|
// Only accept the key bundle if we joined the room less than 24 hours ago.
|
|
if (!pendingDetails) {
|
|
this.logger.debug(`Not yet accepting key bundle for room where we are not awaiting a bundle: ${roomId}`);
|
|
} else if (Date.now() - pendingDetails.inviteAcceptedAtMillis > MAX_INVITE_ACCEPTANCE_MS_FOR_KEY_BUNDLE) {
|
|
this.logger.info(`Ignoring key bundle for room we joined too long ago: ${roomId}, joining time: ${new Date(pendingDetails.inviteAcceptedAtMillis).toISOString()}`);
|
|
} else {
|
|
this.logger.info(`Considering key bundle for recently-joined room ${roomId}`);
|
|
// Don't block for the import to happen, here, as this is called from inside the `/sync` loop.
|
|
this.maybeAcceptKeyBundle(roomId, pendingDetails.inviterId.toString()).catch(err => {
|
|
this.logger.error(`Error attempting to download key bundle for room ${roomId}`);
|
|
this.logger.error(err);
|
|
});
|
|
}
|
|
}
|
|
break;
|
|
}
|
|
case RustSdkCryptoJs.ProcessedToDeviceEventType.PlainText:
|
|
{
|
|
received.push({
|
|
message: parsedMessage,
|
|
encryptionInfo: null
|
|
});
|
|
break;
|
|
}
|
|
case RustSdkCryptoJs.ProcessedToDeviceEventType.UnableToDecrypt:
|
|
// ignore messages we cannot decrypt
|
|
break;
|
|
case RustSdkCryptoJs.ProcessedToDeviceEventType.Invalid:
|
|
// ignore invalid messages
|
|
break;
|
|
}
|
|
}
|
|
return received;
|
|
}
|
|
|
|
/** called by the sync loop to process one time key counts and unused fallback keys
|
|
*
|
|
* @param oneTimeKeysCounts - the received one time key counts
|
|
* @param unusedFallbackKeys - the received unused fallback keys
|
|
*/
|
|
async processKeyCounts(oneTimeKeysCounts, unusedFallbackKeys) {
|
|
const mapOneTimeKeysCount = oneTimeKeysCounts && new Map(Object.entries(oneTimeKeysCounts));
|
|
const setUnusedFallbackKeys = unusedFallbackKeys && new Set(unusedFallbackKeys);
|
|
if (mapOneTimeKeysCount !== undefined || setUnusedFallbackKeys !== undefined) {
|
|
await this.receiveSyncChanges({
|
|
oneTimeKeysCounts: mapOneTimeKeysCount,
|
|
unusedFallbackKeys: setUnusedFallbackKeys
|
|
});
|
|
}
|
|
}
|
|
|
|
/** called by the sync loop to process the notification that device lists have
|
|
* been changed.
|
|
*
|
|
* @param deviceLists - device_lists field from /sync
|
|
*/
|
|
async processDeviceLists(deviceLists) {
|
|
const devices = new RustSdkCryptoJs.DeviceLists(deviceLists.changed?.map(userId => new RustSdkCryptoJs.UserId(userId)), deviceLists.left?.map(userId => new RustSdkCryptoJs.UserId(userId)));
|
|
await this.receiveSyncChanges({
|
|
devices
|
|
});
|
|
}
|
|
|
|
/** called by the sync loop on m.room.encryption events
|
|
*
|
|
* @param room - in which the event was received
|
|
* @param event - encryption event to be processed
|
|
*/
|
|
async onCryptoEvent(room, event) {
|
|
const config = event.getContent();
|
|
const settings = new RustSdkCryptoJs.RoomSettings();
|
|
if (config.algorithm === "m.megolm.v1.aes-sha2") {
|
|
settings.algorithm = RustSdkCryptoJs.EncryptionAlgorithm.MegolmV1AesSha2;
|
|
} else {
|
|
// Among other situations, this happens if the crypto state event is redacted.
|
|
this.logger.warn(`Room ${room.roomId}: ignoring crypto event with invalid algorithm ${config.algorithm}`);
|
|
return;
|
|
}
|
|
if (config["io.element.msc4362.encrypt_state_events"] && this.enableEncryptedStateEvents) {
|
|
this.logger.info("crypto Enabling state event encryption...");
|
|
settings.encryptStateEvents = true;
|
|
}
|
|
try {
|
|
settings.sessionRotationPeriodMs = config.rotation_period_ms;
|
|
settings.sessionRotationPeriodMessages = config.rotation_period_msgs;
|
|
await this.olmMachine.setRoomSettings(new RustSdkCryptoJs.RoomId(room.roomId), settings);
|
|
} catch (e) {
|
|
this.logger.warn(`Room ${room.roomId}: ignoring crypto event which caused error: ${e}`);
|
|
return;
|
|
}
|
|
|
|
// If we got this far, the SDK found the event acceptable.
|
|
// We need to either create or update the active RoomEncryptor.
|
|
const existingEncryptor = this.roomEncryptors[room.roomId];
|
|
if (existingEncryptor) {
|
|
existingEncryptor.onCryptoEvent(config);
|
|
} else {
|
|
this.roomEncryptors[room.roomId] = new RoomEncryptor(this.logger.getChild(`[${room.roomId} encryption]`), this.olmMachine, this.keyClaimManager, this.outgoingRequestsManager, room, config);
|
|
}
|
|
}
|
|
|
|
/** called by the sync loop after processing each sync.
|
|
*
|
|
*
|
|
* @param syncState - information on the completed sync.
|
|
*/
|
|
onSyncCompleted(syncState) {
|
|
// Processing the /sync may have produced new outgoing requests which need sending, so kick off the outgoing
|
|
// request loop, if it's not already running.
|
|
this.outgoingRequestsManager.doProcessOutgoingRequests().catch(e => {
|
|
this.logger.warn("onSyncCompleted: Error processing outgoing requests", e);
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Implementation of {@link CryptoApi#markAllTrackedUsersAsDirty}.
|
|
*/
|
|
async markAllTrackedUsersAsDirty() {
|
|
await this.olmMachine.markAllTrackedUsersAsDirty();
|
|
}
|
|
|
|
/**
|
|
* Handle an incoming m.key.verification.request event, received either in-room or in a to-device message.
|
|
*
|
|
* @param sender - the sender of the event
|
|
* @param transactionId - the transaction ID for the verification. For to-device messages, this comes from the
|
|
* content of the message; for in-room messages it is the event ID.
|
|
*/
|
|
onIncomingKeyVerificationRequest(sender, transactionId) {
|
|
const request = this.olmMachine.getVerificationRequest(new RustSdkCryptoJs.UserId(sender), transactionId);
|
|
if (request) {
|
|
this.emit(CryptoEvent.VerificationRequestReceived, this.makeVerificationRequest(request));
|
|
} else {
|
|
// There are multiple reasons this can happen; probably the most likely is that the event is an
|
|
// in-room event which is too old.
|
|
this.logger.info(`Ignoring just-received verification request ${transactionId} which did not start a rust-side verification`);
|
|
}
|
|
}
|
|
|
|
/** Utility function to wrap a rust `VerificationRequest` with our own {@link VerificationRequest}. */
|
|
makeVerificationRequest(request) {
|
|
return new RustVerificationRequest(this.logger, this.olmMachine, request, this.outgoingRequestProcessor, this._supportedVerificationMethods);
|
|
}
|
|
|
|
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
//
|
|
// Other public functions
|
|
//
|
|
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////
|
|
|
|
/** called by the MatrixClient on a room membership event
|
|
*
|
|
* @param event - The matrix event which caused this event to fire.
|
|
* @param member - The member whose RoomMember.membership changed.
|
|
* @param oldMembership - The previous membership state. Null if it's a new member.
|
|
*/
|
|
onRoomMembership(event, member, oldMembership) {
|
|
const roomId = event.getRoomId();
|
|
|
|
// If it's our own membership, and we are no longer joined, clear any indication that we are waiting for a key
|
|
// bundle.
|
|
if (oldMembership === KnownMembership.Join && member.membership !== KnownMembership.Join && member.userId === this.olmMachine.userId.toString()) {
|
|
this.olmMachine.clearRoomPendingKeyBundle(new RustSdkCryptoJs.RoomId(roomId)).catch(e => {
|
|
this.logger.error(`Error clearing room pending key bundle indicator for ${roomId}: ${e}`);
|
|
});
|
|
}
|
|
const enc = this.roomEncryptors[roomId];
|
|
if (!enc) {
|
|
// not encrypting in this room
|
|
return;
|
|
}
|
|
enc.onRoomMembership(member);
|
|
}
|
|
|
|
/**
|
|
* Previously, it was sufficient to check if we need to rotate the room key
|
|
* prior to sending a message. However, the history sharing feature
|
|
* (MSC4268) breaks this logic:
|
|
*
|
|
* 1. Alice sends a message M1 in room X;
|
|
* 2. Bob invites Charlie, who joins and immediately leaves the room;
|
|
* 3. Alice sends another message M2 in room X.
|
|
*
|
|
* Under the old logic, Alice would not rotate her key after Charlie
|
|
* leaves, resulting in M2 being encrypted with the same session as M1.
|
|
* This would allow Charlie to decrypt M2 if he ever gains access to
|
|
* the event.
|
|
*
|
|
* To counter this, we proactively discard any active outgoing Megolm
|
|
* session when we see an event indicating the user left.
|
|
*
|
|
* Note that we have to do this in `onRoomStateEvent` rather than
|
|
* `onRoomMembership`, because `onRoomMembership` is only called when we see
|
|
* a *change* in membership. In the case of a gappy sync, we might miss
|
|
* Charlie's invite and join, and only see the final `leave` event (so his
|
|
* membership goes from `leave` to `leave`).
|
|
*/
|
|
onRoomStateEvent(event, _state, _prevEvent) {
|
|
if (event.getType() != EventType.RoomMember) {
|
|
// Ignore all events that aren't member updates.
|
|
return;
|
|
}
|
|
if (event.getStateKey() !== this.olmMachine.userId.toString() && event.getContent().membership !== KnownMembership.Join) {
|
|
this.logger.info(`Rotating session for room ${event.getRoomId()} due to member leaving the room`);
|
|
void this.forceDiscardSession(event.getRoomId());
|
|
}
|
|
}
|
|
|
|
/** Callback for OlmMachine.registerRoomKeyUpdatedCallback
|
|
*
|
|
* Called by the rust-sdk whenever there is an update to (megolm) room keys. We
|
|
* check if we have any events waiting for the given keys, and schedule them for
|
|
* a decryption retry if so.
|
|
*
|
|
* @param keys - details of the updated keys
|
|
*/
|
|
async onRoomKeysUpdated(keys) {
|
|
for (const key of keys) {
|
|
this.onRoomKeyUpdated(key);
|
|
}
|
|
void this.backupManager.maybeUploadKey();
|
|
}
|
|
onRoomKeyUpdated(key) {
|
|
if (this.stopped) return;
|
|
this.logger.debug(`Got update for session ${key.sessionId} from sender ${key.senderKey.toBase64()} in ${key.roomId.toString()}`);
|
|
const pendingList = this.eventDecryptor.getEventsPendingRoomKey(key.roomId.toString(), key.sessionId);
|
|
if (pendingList.length === 0) return;
|
|
this.logger.debug("Retrying decryption on events:", pendingList.map(e => `${e.getId()}`));
|
|
|
|
// Have another go at decrypting events with this key.
|
|
//
|
|
// We don't want to end up blocking the callback from Rust, which could otherwise end up dropping updates,
|
|
// so we don't wait for the decryption to complete. In any case, there is no need to wait:
|
|
// MatrixEvent.attemptDecryption ensures that there is only one decryption attempt happening at once,
|
|
// and deduplicates repeated attempts for the same event.
|
|
for (const ev of pendingList) {
|
|
ev.attemptDecryption(this, {
|
|
isRetry: true
|
|
}).catch(_e => {
|
|
this.logger.info(`Still unable to decrypt event ${ev.getId()} after receiving key`);
|
|
});
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Callback for `OlmMachine.registerRoomKeyWithheldCallback`.
|
|
*
|
|
* Called by the rust sdk whenever we are told that a key has been withheld. We see if we had any events that
|
|
* failed to decrypt for the given session, and update their status if so.
|
|
*
|
|
* @param withheld - Details of the withheld sessions.
|
|
*/
|
|
async onRoomKeysWithheld(withheld) {
|
|
for (const session of withheld) {
|
|
this.logger.debug(`Got withheld message for session ${session.sessionId} in ${session.roomId.toString()}`);
|
|
const pendingList = this.eventDecryptor.getEventsPendingRoomKey(session.roomId.toString(), session.sessionId);
|
|
if (pendingList.length === 0) return;
|
|
|
|
// The easiest way to update the status of the event is to have another go at decrypting it.
|
|
this.logger.debug("Retrying decryption on events:", pendingList.map(e => `${e.getId()}`));
|
|
for (const ev of pendingList) {
|
|
ev.attemptDecryption(this, {
|
|
isRetry: true
|
|
}).catch(_e => {
|
|
// It's somewhat expected that we still can't decrypt here.
|
|
});
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Callback for `OlmMachine.registerUserIdentityUpdatedCallback`
|
|
*
|
|
* Called by the rust-sdk whenever there is an update to any user's cross-signing status. We re-check their trust
|
|
* status and emit a `UserTrustStatusChanged` event, as well as a `KeysChanged` if it is our own identity that changed.
|
|
*
|
|
* @param userId - the user with the updated identity
|
|
*/
|
|
async onUserIdentityUpdated(userId) {
|
|
const newVerification = await this.getUserVerificationStatus(userId.toString());
|
|
this.emit(CryptoEvent.UserTrustStatusChanged, userId.toString(), newVerification);
|
|
|
|
// If our own user identity has changed, we may now trust the key backup where we did not before.
|
|
// So, re-check the key backup status and enable it if available.
|
|
if (userId.toString() === this.userId) {
|
|
this.emit(CryptoEvent.KeysChanged, {});
|
|
await this.checkKeyBackupAndEnable();
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Callback for `OlmMachine.registerDevicesUpdatedCallback`
|
|
*
|
|
* Called when users' devices have updated. Emits `WillUpdateDevices` and `DevicesUpdated`. In the JavaScript
|
|
* crypto backend, these events are called at separate times, with `WillUpdateDevices` being emitted just before
|
|
* the devices are saved, and `DevicesUpdated` being emitted just after. But the OlmMachine only gives us
|
|
* one event, so we emit both events here.
|
|
*
|
|
* @param userIds - an array of user IDs of users whose devices have updated.
|
|
*/
|
|
async onDevicesUpdated(userIds) {
|
|
this.emit(CryptoEvent.WillUpdateDevices, userIds, false);
|
|
this.emit(CryptoEvent.DevicesUpdated, userIds, false);
|
|
}
|
|
|
|
/**
|
|
* Handles secret received from the rust secret inbox.
|
|
*
|
|
* The gossipped secrets are received using the `m.secret.send` or
|
|
* `io.element.msc4385.secret.push` event types and are guaranteed to have
|
|
* been received over a 1-to-1 Olm Session from a verified device.
|
|
*
|
|
* The only secret currently handled in this way is `m.megolm_backup.v1`.
|
|
*
|
|
* @param name - the secret name
|
|
* @param value - the secret value
|
|
*/
|
|
async handleSecretReceived(name, value) {
|
|
this.logger.debug(`onReceiveSecret: Received secret ${name}`);
|
|
if (name === "m.megolm_backup.v1") {
|
|
return await this.backupManager.handleBackupSecretReceived(value);
|
|
// XXX at this point we should probably try to download the backup and import the keys,
|
|
// or at least retry for the current decryption failures?
|
|
// Maybe add some signaling when a new secret is received, and let clients handle it?
|
|
// as it's where the restore from backup APIs are exposed.
|
|
}
|
|
return false;
|
|
}
|
|
|
|
/**
|
|
* Called when a new secret is received in the rust secret inbox.
|
|
*
|
|
* Will poll the secret inbox and handle the secrets received.
|
|
*
|
|
* @param name - The name of the secret received.
|
|
*/
|
|
async checkSecrets(name) {
|
|
const pendingValues = await this.olmMachine.getSecretsFromInbox(name);
|
|
for (const value of pendingValues) {
|
|
if (await this.handleSecretReceived(name, value)) {
|
|
// If we have a valid secret for that name there is no point of processing the other secrets values.
|
|
// It's probably the same secret shared by another device.
|
|
break;
|
|
}
|
|
}
|
|
|
|
// Important to call this after handling the secrets as good hygiene.
|
|
await this.olmMachine.deleteSecretsFromInbox(name);
|
|
}
|
|
|
|
/**
|
|
* Handle a live event received via /sync.
|
|
* See {@link ClientEventHandlerMap#event}
|
|
*
|
|
* @param event - live event
|
|
*/
|
|
async onLiveEventFromSync(event) {
|
|
// Ignore state event or remote echo
|
|
// transaction_id is provided in case of remote echo {@link https://spec.matrix.org/v1.7/client-server-api/#local-echo}
|
|
if (event.isState() || !!event.getUnsigned().transaction_id) return;
|
|
const processEvent = async evt => {
|
|
// Process only verification event
|
|
if (isVerificationEvent(event)) {
|
|
await this.onKeyVerificationEvent(evt);
|
|
}
|
|
};
|
|
|
|
// If the event is encrypted of in failure, we wait for decryption
|
|
if (event.isDecryptionFailure() || event.isEncrypted()) {
|
|
// 5 mins
|
|
const TIMEOUT_DELAY = 5 * 60 * 1000;
|
|
|
|
// After 5mins, we are not expecting the event to be decrypted
|
|
const timeoutId = setTimeout(() => event.off(MatrixEventEvent.Decrypted, onDecrypted), TIMEOUT_DELAY);
|
|
const onDecrypted = (decryptedEvent, error) => {
|
|
if (error) return;
|
|
clearTimeout(timeoutId);
|
|
event.off(MatrixEventEvent.Decrypted, onDecrypted);
|
|
void processEvent(decryptedEvent);
|
|
};
|
|
event.on(MatrixEventEvent.Decrypted, onDecrypted);
|
|
} else {
|
|
await processEvent(event);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Handle an in-room key verification event.
|
|
*
|
|
* @param event - a key validation request event.
|
|
*/
|
|
async onKeyVerificationEvent(event) {
|
|
const roomId = event.getRoomId();
|
|
const senderId = event.getSender();
|
|
if (!roomId) {
|
|
throw new Error("missing roomId in the event");
|
|
}
|
|
if (!senderId) {
|
|
throw new Error("missing sender in the event");
|
|
}
|
|
this.logger.debug(`Incoming verification event ${event.getId()} type ${event.getType()} from ${event.getSender()}`);
|
|
const isRoomVerificationRequest = event.getType() === EventType.RoomMessage && event.getContent().msgtype === MsgType.KeyVerificationRequest;
|
|
if (isRoomVerificationRequest) {
|
|
// Before processing an in-room verification request, we need to
|
|
// make sure we have the sender's device information - otherwise we
|
|
// will immediately abort verification. So we explicitly fetch it
|
|
// from /keys/query and wait for that request to complete before we
|
|
// call receiveVerificationEvent.
|
|
const req = this.getOlmMachineOrThrow().queryKeysForUsers([new RustSdkCryptoJs.UserId(senderId)]);
|
|
await this.outgoingRequestProcessor.makeOutgoingRequest(req);
|
|
}
|
|
await this.getOlmMachineOrThrow().receiveVerificationEvent(JSON.stringify({
|
|
event_id: event.getId(),
|
|
type: event.getType(),
|
|
sender: senderId,
|
|
state_key: event.getStateKey(),
|
|
content: event.getContent(),
|
|
origin_server_ts: event.getTs()
|
|
}), new RustSdkCryptoJs.RoomId(roomId));
|
|
if (isRoomVerificationRequest) {
|
|
this.onIncomingKeyVerificationRequest(senderId, event.getId());
|
|
}
|
|
|
|
// that may have caused us to queue up outgoing requests, so make sure we send them.
|
|
this.outgoingRequestsManager.doProcessOutgoingRequests().catch(e => {
|
|
this.logger.warn("onKeyVerificationRequest: Error processing outgoing requests", e);
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Returns the cross-signing user identity of the current user.
|
|
*
|
|
* Not part of the public crypto-api interface.
|
|
* Used during migration from legacy js-crypto to update local trust if needed.
|
|
*/
|
|
async getOwnIdentity() {
|
|
const identity = await this.getOlmMachineOrThrow().getIdentity(new RustSdkCryptoJs.UserId(this.userId));
|
|
return identity;
|
|
}
|
|
|
|
/**
|
|
* Push a secret to all of the current user's verified devices.
|
|
*/
|
|
async pushSecretToVerifiedDevices(name) {
|
|
const logger = new LogSpan(this.logger, "pushSecretToVerifiedDevices");
|
|
await this.keyClaimManager.ensureSessionsForUsers(logger, [new RustSdkCryptoJs.UserId(this.userId)]);
|
|
await this.olmMachine.pushSecretToVerifiedDevices(name);
|
|
this.outgoingRequestsManager.doProcessOutgoingRequests().catch(e => {
|
|
logger.warn("pushSecretToVerifiedDevices: Error processing outgoing requests", e);
|
|
});
|
|
}
|
|
}
|
|
class EventDecryptor {
|
|
constructor(logger, olmMachine, perSessionBackupDownloader) {
|
|
/**
|
|
* Events which we couldn't decrypt due to unknown sessions / indexes.
|
|
*
|
|
* Map from roomId to sessionId to Set of MatrixEvents
|
|
*/
|
|
_defineProperty(this, "eventsPendingKey", new MapWithDefault(() => new MapWithDefault(() => new Set())));
|
|
this.logger = logger;
|
|
this.olmMachine = olmMachine;
|
|
this.perSessionBackupDownloader = perSessionBackupDownloader;
|
|
}
|
|
async attemptEventDecryption(event, isolationMode) {
|
|
// add the event to the pending list *before* attempting to decrypt.
|
|
// then, if the key turns up while decryption is in progress (and
|
|
// decryption fails), we will schedule a retry.
|
|
// (fixes https://github.com/vector-im/element-web/issues/5001)
|
|
this.addEventToPendingList(event);
|
|
let trustRequirement;
|
|
switch (isolationMode.kind) {
|
|
case DeviceIsolationModeKind.AllDevicesIsolationMode:
|
|
trustRequirement = RustSdkCryptoJs.TrustRequirement.Untrusted;
|
|
break;
|
|
case DeviceIsolationModeKind.OnlySignedDevicesIsolationMode:
|
|
trustRequirement = RustSdkCryptoJs.TrustRequirement.CrossSignedOrLegacy;
|
|
break;
|
|
}
|
|
try {
|
|
const res = await this.olmMachine.decryptRoomEvent(stringifyEvent(event), new RustSdkCryptoJs.RoomId(event.getRoomId()), new RustSdkCryptoJs.DecryptionSettings(trustRequirement));
|
|
|
|
// Success. We can remove the event from the pending list, if
|
|
// that hasn't already happened.
|
|
this.removeEventFromPendingList(event);
|
|
return {
|
|
clearEvent: JSON.parse(res.event),
|
|
claimedEd25519Key: res.senderClaimedEd25519Key,
|
|
senderCurve25519Key: res.senderCurve25519Key,
|
|
keyForwardedBy: res.forwarder?.toString()
|
|
};
|
|
} catch (err) {
|
|
if (err instanceof RustSdkCryptoJs.MegolmDecryptionError) {
|
|
this.onMegolmDecryptionError(event, err, await this.perSessionBackupDownloader.getServerBackupInfo());
|
|
} else {
|
|
throw new DecryptionError(DecryptionFailureCode.UNKNOWN_ERROR, "Unknown error");
|
|
}
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Handle a `MegolmDecryptionError` returned by the rust SDK.
|
|
*
|
|
* Fires off a request to the `perSessionBackupDownloader`, if appropriate, and then throws a `DecryptionError`.
|
|
*
|
|
* @param event - The event which could not be decrypted.
|
|
* @param err - The error from the Rust SDK.
|
|
* @param serverBackupInfo - Details about the current backup from the server. `null` if there is no backup.
|
|
* `undefined` if our attempt to check failed.
|
|
*/
|
|
onMegolmDecryptionError(event, err, serverBackupInfo) {
|
|
const content = event.getWireContent();
|
|
const errorDetails = {
|
|
sender_key: content.sender_key,
|
|
session_id: content.session_id
|
|
};
|
|
|
|
// If the error looks like it might be recoverable from backup, queue up a request to try that.
|
|
if (err.code === RustSdkCryptoJs.DecryptionErrorCode.MissingRoomKey || err.code === RustSdkCryptoJs.DecryptionErrorCode.UnknownMessageIndex) {
|
|
this.perSessionBackupDownloader.onDecryptionKeyMissingError(event.getRoomId(), content.session_id);
|
|
|
|
// If the server is telling us our membership at the time the event
|
|
// was sent, and it isn't "join", we use a different error code.
|
|
const membership = event.getMembershipAtEvent();
|
|
if (membership && membership !== KnownMembership.Join && membership !== KnownMembership.Invite) {
|
|
throw new DecryptionError(DecryptionFailureCode.HISTORICAL_MESSAGE_USER_NOT_JOINED, "This message was sent when we were not a member of the room.", errorDetails);
|
|
}
|
|
|
|
// If the event was sent before this device was created, we use some different error codes.
|
|
if (event.getTs() <= this.olmMachine.deviceCreationTimeMs) {
|
|
if (serverBackupInfo === null) {
|
|
throw new DecryptionError(DecryptionFailureCode.HISTORICAL_MESSAGE_NO_KEY_BACKUP, "This message was sent before this device logged in, and there is no key backup on the server.", errorDetails);
|
|
} else if (!this.perSessionBackupDownloader.isKeyBackupDownloadConfigured()) {
|
|
throw new DecryptionError(DecryptionFailureCode.HISTORICAL_MESSAGE_BACKUP_UNCONFIGURED, "This message was sent before this device logged in, and key backup is not working.", errorDetails);
|
|
} else {
|
|
throw new DecryptionError(DecryptionFailureCode.HISTORICAL_MESSAGE_WORKING_BACKUP, "This message was sent before this device logged in. Key backup is working, but we still do not (yet) have the key.", errorDetails);
|
|
}
|
|
}
|
|
}
|
|
|
|
// If we got a withheld code, expose that.
|
|
if (err.maybe_withheld) {
|
|
// Unfortunately the Rust SDK API doesn't let us distinguish between different withheld cases, other than
|
|
// by string-matching.
|
|
const failureCode = err.maybe_withheld === "The sender has disabled encrypting to unverified devices." ? DecryptionFailureCode.MEGOLM_KEY_WITHHELD_FOR_UNVERIFIED_DEVICE : DecryptionFailureCode.MEGOLM_KEY_WITHHELD;
|
|
throw new DecryptionError(failureCode, err.maybe_withheld, errorDetails);
|
|
}
|
|
switch (err.code) {
|
|
case RustSdkCryptoJs.DecryptionErrorCode.MissingRoomKey:
|
|
throw new DecryptionError(DecryptionFailureCode.MEGOLM_UNKNOWN_INBOUND_SESSION_ID, "The sender's device has not sent us the keys for this message.", errorDetails);
|
|
case RustSdkCryptoJs.DecryptionErrorCode.UnknownMessageIndex:
|
|
throw new DecryptionError(DecryptionFailureCode.OLM_UNKNOWN_MESSAGE_INDEX, "The sender's device has not sent us the keys for this message at this index.", errorDetails);
|
|
case RustSdkCryptoJs.DecryptionErrorCode.SenderIdentityVerificationViolation:
|
|
// We're refusing to decrypt due to not trusting the sender,
|
|
// rather than failing to decrypt due to lack of keys, so we
|
|
// don't need to keep it on the pending list.
|
|
this.removeEventFromPendingList(event);
|
|
throw new DecryptionError(DecryptionFailureCode.SENDER_IDENTITY_PREVIOUSLY_VERIFIED, "The sender identity is unverified, but was previously verified.");
|
|
case RustSdkCryptoJs.DecryptionErrorCode.UnknownSenderDevice:
|
|
// We're refusing to decrypt due to not trusting the sender,
|
|
// rather than failing to decrypt due to lack of keys, so we
|
|
// don't need to keep it on the pending list.
|
|
this.removeEventFromPendingList(event);
|
|
throw new DecryptionError(DecryptionFailureCode.UNKNOWN_SENDER_DEVICE, "The sender device is not known.");
|
|
case RustSdkCryptoJs.DecryptionErrorCode.UnsignedSenderDevice:
|
|
// We're refusing to decrypt due to not trusting the sender,
|
|
// rather than failing to decrypt due to lack of keys, so we
|
|
// don't need to keep it on the pending list.
|
|
this.removeEventFromPendingList(event);
|
|
throw new DecryptionError(DecryptionFailureCode.UNSIGNED_SENDER_DEVICE, "The sender identity is not cross-signed.");
|
|
|
|
// We don't map MismatchedIdentityKeys for now, as there is no equivalent in legacy.
|
|
// Just put it on the `UNKNOWN_ERROR` bucket.
|
|
default:
|
|
throw new DecryptionError(DecryptionFailureCode.UNKNOWN_ERROR, err.description, errorDetails);
|
|
}
|
|
}
|
|
async getEncryptionInfoForEvent(event) {
|
|
if (!event.getClearContent() || event.isDecryptionFailure()) {
|
|
// not successfully decrypted
|
|
return null;
|
|
}
|
|
|
|
// special-case outgoing events, which the rust crypto-sdk will barf on
|
|
if (event.status !== null) {
|
|
return {
|
|
shieldColour: EventShieldColour.NONE,
|
|
shieldReason: null
|
|
};
|
|
}
|
|
const encryptionInfo = await this.olmMachine.getRoomEventEncryptionInfo(stringifyEvent(event), new RustSdkCryptoJs.RoomId(event.getRoomId()));
|
|
return rustEncryptionInfoToJsEncryptionInfo(this.logger, encryptionInfo);
|
|
}
|
|
|
|
/**
|
|
* Look for events which are waiting for a given megolm session
|
|
*
|
|
* Returns a list of events which were encrypted by `session` and could not be decrypted
|
|
*/
|
|
getEventsPendingRoomKey(roomId, sessionId) {
|
|
const roomPendingEvents = this.eventsPendingKey.get(roomId);
|
|
if (!roomPendingEvents) return [];
|
|
const sessionPendingEvents = roomPendingEvents.get(sessionId);
|
|
if (!sessionPendingEvents) return [];
|
|
return [...sessionPendingEvents];
|
|
}
|
|
|
|
/**
|
|
* Add an event to the list of those awaiting their session keys.
|
|
*/
|
|
addEventToPendingList(event) {
|
|
const roomId = event.getRoomId();
|
|
// We shouldn't have events without a room id here.
|
|
if (!roomId) return;
|
|
const roomPendingEvents = this.eventsPendingKey.getOrCreate(roomId);
|
|
const sessionPendingEvents = roomPendingEvents.getOrCreate(event.getWireContent().session_id);
|
|
sessionPendingEvents.add(event);
|
|
}
|
|
|
|
/**
|
|
* Remove an event from the list of those awaiting their session keys.
|
|
*/
|
|
removeEventFromPendingList(event) {
|
|
const roomId = event.getRoomId();
|
|
if (!roomId) return;
|
|
const roomPendingEvents = this.eventsPendingKey.getOrCreate(roomId);
|
|
if (!roomPendingEvents) return;
|
|
const sessionPendingEvents = roomPendingEvents.get(event.getWireContent().session_id);
|
|
if (!sessionPendingEvents) return;
|
|
sessionPendingEvents.delete(event);
|
|
|
|
// also clean up the higher-level maps if they are now empty
|
|
if (sessionPendingEvents.size === 0) {
|
|
roomPendingEvents.delete(event.getWireContent().session_id);
|
|
if (roomPendingEvents.size === 0) {
|
|
this.eventsPendingKey.delete(roomId);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
function stringifyEvent(event) {
|
|
return JSON.stringify({
|
|
event_id: event.getId(),
|
|
type: event.getWireType(),
|
|
sender: event.getSender(),
|
|
state_key: event.getStateKey(),
|
|
content: event.getWireContent(),
|
|
origin_server_ts: event.getTs()
|
|
});
|
|
}
|
|
function rustEncryptionInfoToJsEncryptionInfo(logger, encryptionInfo) {
|
|
if (encryptionInfo === undefined) {
|
|
// not decrypted here
|
|
return null;
|
|
}
|
|
|
|
// TODO: use strict shield semantics.
|
|
const shieldState = encryptionInfo.shieldState(false);
|
|
let shieldColour;
|
|
switch (shieldState.color) {
|
|
case RustSdkCryptoJs.ShieldColor.Grey:
|
|
shieldColour = EventShieldColour.GREY;
|
|
break;
|
|
case RustSdkCryptoJs.ShieldColor.None:
|
|
shieldColour = EventShieldColour.NONE;
|
|
break;
|
|
default:
|
|
shieldColour = EventShieldColour.RED;
|
|
}
|
|
let shieldReason;
|
|
switch (shieldState.code) {
|
|
case undefined:
|
|
case null:
|
|
shieldReason = null;
|
|
break;
|
|
case RustSdkCryptoJs.ShieldStateCode.AuthenticityNotGuaranteed:
|
|
shieldReason = EventShieldReason.AUTHENTICITY_NOT_GUARANTEED;
|
|
break;
|
|
case RustSdkCryptoJs.ShieldStateCode.UnknownDevice:
|
|
shieldReason = EventShieldReason.UNKNOWN_DEVICE;
|
|
break;
|
|
case RustSdkCryptoJs.ShieldStateCode.UnsignedDevice:
|
|
shieldReason = EventShieldReason.UNSIGNED_DEVICE;
|
|
break;
|
|
case RustSdkCryptoJs.ShieldStateCode.UnverifiedIdentity:
|
|
shieldReason = EventShieldReason.UNVERIFIED_IDENTITY;
|
|
break;
|
|
case RustSdkCryptoJs.ShieldStateCode.VerificationViolation:
|
|
shieldReason = EventShieldReason.VERIFICATION_VIOLATION;
|
|
break;
|
|
case RustSdkCryptoJs.ShieldStateCode.MismatchedSender:
|
|
shieldReason = EventShieldReason.MISMATCHED_SENDER;
|
|
break;
|
|
default:
|
|
shieldReason = EventShieldReason.UNKNOWN;
|
|
break;
|
|
}
|
|
return {
|
|
shieldColour,
|
|
shieldReason
|
|
};
|
|
}
|
|
/**
|
|
* Determines if the given payload is a RoomKeyBundleMessage.
|
|
*
|
|
* A RoomKeyBundleMessage is identified by having a specific message type
|
|
* ("m.room_key_bundle") and a valid room_id in its content.
|
|
*
|
|
* @param message - The received to-device message to check.
|
|
* @returns True if the payload matches the RoomKeyBundleMessage structure, false otherwise.
|
|
*/
|
|
function isRoomKeyBundleMessage(message) {
|
|
return (message.type === "io.element.msc4268.room_key_bundle" || message.type === "m.room_key_bundle") && typeof message.content.room_id === "string";
|
|
}
|
|
//# sourceMappingURL=rust-crypto.js.map
|