[lib] fix creating Tunnelbroker socket
ClosedPublic
Actions

// @flow		// @flow

import olm from '@commapp/olm';		import olm from '@commapp/olm';
import type { EncryptResult } from '@commapp/olm';		import type { EncryptResult } from '@commapp/olm';
import invariant from 'invariant';		import invariant from 'invariant';
import localforage from 'localforage';		import localforage from 'localforage';
import uuid from 'uuid';		import uuid from 'uuid';

import {		import {
olmEncryptedMessageTypes,		olmEncryptedMessageTypes,
type NotificationsOlmDataType,		type NotificationsOlmDataType,
type PickledOLMAccount,		type PickledOLMAccount,
} from 'lib/types/crypto-types.js';		} from 'lib/types/crypto-types.js';
import type {		import type {
PlainTextWebNotification,		PlainTextWebNotification,
EncryptedWebNotification,		EncryptedWebNotification,
		SenderDeviceDescriptor,
} from 'lib/types/notif-types.js';		} from 'lib/types/notif-types.js';
import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js';		import { getCookieIDFromCookie } from 'lib/utils/cookie-utils.js';
import { getMessageForException } from 'lib/utils/errors.js';		import { getMessageForException } from 'lib/utils/errors.js';
import { promiseAll } from 'lib/utils/promises.js';		import { promiseAll } from 'lib/utils/promises.js';
import { assertWithValidator } from 'lib/utils/validation-utils.js';		import { assertWithValidator } from 'lib/utils/validation-utils.js';

import {		import {
		fetchAuthMetadata,
		getNotifsInboundKeysForDeviceID,
		} from './services-client.js';
		import {
type EncryptedData,		type EncryptedData,
decryptData,		decryptData,
encryptData,		encryptData,
importJWKKey,		importJWKKey,
exportKeyToJWK,		exportKeyToJWK,
generateCryptoKey,		generateCryptoKey,
encryptedAESDataValidator,		encryptedAESDataValidator,
extendedCryptoKeyValidator,		extendedCryptoKeyValidator,
▲ Show 20 Lines • Show All 55 Lines • ▼ Show 20 Lines	async function deserializeEncryptedData<T>(
encryptedData: EncryptedData,		encryptedData: EncryptedData,
encryptionKey: CryptoKey,		encryptionKey: CryptoKey,
): Promise<T> {		): Promise<T> {
const serializedData = await decryptData(encryptedData, encryptionKey);		const serializedData = await decryptData(encryptedData, encryptionKey);
const data: T = JSON.parse(new TextDecoder().decode(serializedData));		const data: T = JSON.parse(new TextDecoder().decode(serializedData));
return data;		return data;
}		}

		async function deserializeEncryptedDataOptional<T>(
		encryptedData: ?EncryptedData,
		encryptionKey: ?CryptoKey,
		): Promise<?T> {
		if (!encryptedData \|\| !encryptionKey) {
		return undefined;
		}
		return deserializeEncryptedData<T>(encryptedData, encryptionKey);
		}

async function serializeUnencryptedData<T>(		async function serializeUnencryptedData<T>(
data: T,		data: T,
encryptionKey: CryptoKey,		encryptionKey: CryptoKey,
): Promise<EncryptedData> {		): Promise<EncryptedData> {
const dataAsString = JSON.stringify(data);		const dataAsString = JSON.stringify(data);
invariant(		invariant(
dataAsString,		dataAsString,
'Attempt to serialize null or undefined is forbidden',		'Attempt to serialize null or undefined is forbidden',
);		);
return await encryptData(		return await encryptData(
new TextEncoder().encode(dataAsString),		new TextEncoder().encode(dataAsString),
encryptionKey,		encryptionKey,
);		);
}		}

async function validateCryptoKey(		async function validateCryptoKey(
cryptoKey: CryptoKey \| SubtleCrypto$JsonWebKey,		cryptoKey: CryptoKey \| SubtleCrypto$JsonWebKey,
): Promise<CryptoKey> {		): Promise<CryptoKey> {
if (!isDesktopSafari) {		if (!isDesktopSafari) {
return ((cryptoKey: any): CryptoKey);		return ((cryptoKey: any): CryptoKey);
}		}
return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey));		return await importJWKKey(((cryptoKey: any): SubtleCrypto$JsonWebKey));
}		}

		async function validateCryptoKeyOptional(
		cryptoKey: ?CryptoKey \| ?SubtleCrypto$JsonWebKey,
		): Promise<?CryptoKey> {
		if (!cryptoKey) {
		return undefined;
		}
		return validateCryptoKey(cryptoKey);
		}

async function getCryptoKeyPersistentForm(		async function getCryptoKeyPersistentForm(
cryptoKey: CryptoKey,		cryptoKey: CryptoKey,
): Promise<CryptoKey \| SubtleCrypto$JsonWebKey> {		): Promise<CryptoKey \| SubtleCrypto$JsonWebKey> {
if (!isDesktopSafari) {		if (!isDesktopSafari) {
return cryptoKey;		return cryptoKey;
}		}

// Safari doesn't support structured clone algorithm in service		// Safari doesn't support structured clone algorithm in service
// worker context so we have to store CryptoKey as JSON		// worker context so we have to store CryptoKey as JSON
return await exportKeyToJWK(cryptoKey);		return await exportKeyToJWK(cryptoKey);
}		}

		async function getNotifsAccountWithOlmData(
		senderDeviceDescriptor: SenderDeviceDescriptor,
		): Promise<{
		+encryptedOlmData: ?EncryptedData,
		+encryptionKey: ?CryptoKey,
		+olmDataKey: string,
		+encryptionKeyDBLabel: string,
		+encryptedOlmAccount: ?EncryptedData,
		+accountEncryptionKey: ?CryptoKey,
		+synchronizationValue: ?string,
		}> {
		let olmDataKey;
		let olmDataEncryptionKeyDBLabel;
		const { keyserverID, senderDeviceID } = senderDeviceDescriptor;

		if (keyserverID) {
		const olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID);
		const { olmDataKey: fetchedOlmDataKey, encryptionKeyDBKey } = olmDBKeys;
		olmDataKey = fetchedOlmDataKey;
		olmDataEncryptionKeyDBLabel = encryptionKeyDBKey;
		} else {
		invariant(
		senderDeviceID,
		'keyserverID or SenderDeviceID must be present to decrypt a notif',
		);
		olmDataKey = getOlmDataKeyForDeviceID(senderDeviceID);
		olmDataEncryptionKeyDBLabel =
		getOlmEncryptionKeyDBLabelForDeviceID(senderDeviceID);
		}

		const queryResult = await localforage.getMultipleItems<{
		notificationAccount: ?EncryptedData,
		notificationAccountEncryptionKey: ?CryptoKey,
		synchronizationValue: ?number,
		[string]: ?EncryptedData \| ?CryptoKey \| ?SubtleCrypto$JsonWebKey,
		}>(
		[
		INDEXED_DB_NOTIFS_ACCOUNT_KEY,
		INDEXED_DB_NOTIFS_ACCOUNT_ENCRYPTION_KEY_DB_LABEL,
		olmDataEncryptionKeyDBLabel,
		olmDataKey,
		],
		INDEXED_DB_NOTIFS_SYNC_KEY,
		);

		const {
		values: {
		notificationAccount,
		notificationAccountEncryptionKey,
		[olmDataKey]: maybeEncryptedOlmData,
		[olmDataEncryptionKeyDBLabel]: maybeOlmDataEncryptionKey,
		},
		synchronizationValue,
		} = queryResult;

		if (!notificationAccount \|\| !notificationAccountEncryptionKey) {
		throw new Error(
		'Attempt to decrypt notification but olm account not initialized.',
		);
		}

		const encryptedOlmData: ?EncryptedData = maybeEncryptedOlmData
		? assertWithValidator(maybeEncryptedOlmData, encryptedAESDataValidator)
		: undefined;

		const olmDataEncryptionKey: ?CryptoKey \| ?SubtleCrypto$JsonWebKey =
		maybeOlmDataEncryptionKey
		? assertWithValidator(
		maybeOlmDataEncryptionKey,
		extendedCryptoKeyValidator,
		)
		: undefined;

		const [encryptionKey, accountEncryptionKey] = await Promise.all([
		validateCryptoKeyOptional(olmDataEncryptionKey),
		validateCryptoKey(notificationAccountEncryptionKey),
		]);

		return {
		encryptedOlmData,
		encryptionKey,
		encryptionKeyDBLabel: olmDataEncryptionKeyDBLabel,
		encryptedOlmAccount: notificationAccount,
		olmDataKey,
		accountEncryptionKey,
		synchronizationValue,
		};
		}

async function persistNotifsAccountWithOlmData(input: {		async function persistNotifsAccountWithOlmData(input: {
+olmDataKey?: string,		+olmDataKey?: string,
+olmEncryptionKeyDBLabel?: string,		+olmEncryptionKeyDBLabel?: string,
+olmData?: ?NotificationsOlmDataType,		+olmData?: ?NotificationsOlmDataType,
+encryptionKey?: ?CryptoKey,		+encryptionKey?: ?CryptoKey,
+accountEncryptionKey?: ?CryptoKey,		+accountEncryptionKey?: ?CryptoKey,
+accountWithPicklingKey?: PickledOLMAccount,		+accountWithPicklingKey?: PickledOLMAccount,
+synchronizationValue: ?string,		+synchronizationValue: ?string,
▲ Show 20 Lines • Show All 79 Lines • ▼ Show 20 Lines	try {
// likely shared worker persisted its own data		// likely shared worker persisted its own data
console.log(e);		console.log(e);
}		}
}		}

async function decryptWebNotification(		async function decryptWebNotification(
encryptedNotification: EncryptedWebNotification,		encryptedNotification: EncryptedWebNotification,
): Promise<PlainTextWebNotification \| WebNotifDecryptionError> {		): Promise<PlainTextWebNotification \| WebNotifDecryptionError> {
const { id, keyserverID, encryptedPayload } = encryptedNotification;		const {
invariant(keyserverID, 'KeyserverID must be present to decrypt a notif');		id,
		encryptedPayload,
		type: messageType,
		...rest
		} = encryptedNotification;
		const senderDeviceDescriptor: SenderDeviceDescriptor = rest;

const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>(		const utilsData = await localforage.getItem<WebNotifsServiceUtilsData>(
WEB_NOTIFS_SERVICE_UTILS_KEY,		WEB_NOTIFS_SERVICE_UTILS_KEY,
);		);

if (!utilsData) {		if (!utilsData) {
return { id, error: 'Necessary data not found in IndexedDB' };		return { id, error: 'Necessary data not found in IndexedDB' };
}		}
const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData);		const { olmWasmPath, staffCanSee } = (utilsData: WebNotifsServiceUtilsData);

let olmDBKeys;		let notifsAccountWithOlmData;
try {		try {
olmDBKeys = await getNotifsOlmSessionDBKeys(keyserverID);		notifsAccountWithOlmData = await getNotifsAccountWithOlmData(
		senderDeviceDescriptor,
		);
} catch (e) {		} catch (e) {
return {		return {
id,		id,
error: e.message,		error: e.message,
displayErrorMessage: staffCanSee,		displayErrorMessage: staffCanSee,
};		};
}		}
const { olmDataKey, encryptionKeyDBKey } = olmDBKeys;
const [encryptedOlmData, encryptionKey] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey),
retrieveEncryptionKey(encryptionKeyDBKey),
]);

if (!encryptionKey \|\| !encryptedOlmData) {		const {
return {		encryptionKey,
id,		encryptedOlmData,
error: 'Received encrypted notification but olm session was not created',		olmDataKey,
displayErrorMessage: staffCanSee,		encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
};		accountEncryptionKey,
}		encryptedOlmAccount,
		synchronizationValue,
		} = notifsAccountWithOlmData;

try {		try {
await olm.init({ locateFile: () => olmWasmPath });		const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
		deserializeEncryptedDataOptional<NotificationsOlmDataType>(
const decryptedNotification = await commonDecrypt<PlainTextWebNotification>(
encryptedOlmData,		encryptedOlmData,
olmDataKey,
encryptionKey,		encryptionKey,
		),
		deserializeEncryptedDataOptional<PickledOLMAccount>(
		encryptedOlmAccount,
		accountEncryptionKey,
		),
		olm.init({ locateFile: () => olmWasmPath }),
		]);

		let decryptedNotification;
		let updatedOlmData;
		let updatedNotifsAccount;

		const { senderDeviceID, keyserverID } = senderDeviceDescriptor;

		if (keyserverID) {
		invariant(
		notificationsOlmData && encryptionKey,
		'Received encrypted notification but keyserver olm session was not created',
		);

		const {
		decryptedNotification: resultDecryptedNotification,
		updatedOlmData: resultUpdatedOlmData,
		} = await commonDecrypt<PlainTextWebNotification>(
		notificationsOlmData,
encryptedPayload,		encryptedPayload,
);		);

		decryptedNotification = resultDecryptedNotification;
		updatedOlmData = resultUpdatedOlmData;
const { unreadCount } = decryptedNotification;		const { unreadCount } = decryptedNotification;

invariant(keyserverID, 'Keyserver ID must be set to update badge counts');		invariant(keyserverID, 'Keyserver ID must be set to update badge counts');
await updateNotifsUnreadCountStorage({		await Promise.all([
		persistNotifsAccountWithOlmData({
		olmDataKey,
		olmData: updatedOlmData,
		olmEncryptionKeyDBLabel,
		encryptionKey,
		forceWrite: false,
		synchronizationValue,
		}),
		updateNotifsUnreadCountStorage({
[keyserverID]: unreadCount,		[keyserverID]: unreadCount,
		}),
		]);

		return { id, ...decryptedNotification };
		} else {
		invariant(
		senderDeviceID,
		'keyserverID or SenderDeviceID must be present to decrypt a notif',
		);
		invariant(
		accountWithPicklingKey,
		'Received encrypted notification but notifs olm account not created',
		);

		const {
		decryptedNotification: resultDecryptedNotification,
		updatedOlmData: resultUpdatedOlmData,
		updatedNotifsAccount: resultUpdatedNotifsAccount,
		} = await commonPeerDecrypt<PlainTextWebNotification>(
		senderDeviceID,
		notificationsOlmData,
		accountWithPicklingKey,
		messageType,
		encryptedPayload,
		);

		decryptedNotification = resultDecryptedNotification;
		updatedOlmData = resultUpdatedOlmData;
		updatedNotifsAccount = resultUpdatedNotifsAccount;

		await persistNotifsAccountWithOlmData({
		accountWithPicklingKey: updatedNotifsAccount,
		accountEncryptionKey,
		encryptionKey,
		olmData: updatedOlmData,
		olmDataKey,
		olmEncryptionKeyDBLabel,
		synchronizationValue,
		forceWrite: false,
});		});

return { id, ...decryptedNotification };		return { id, ...decryptedNotification };
		}
} catch (e) {		} catch (e) {
return {		return {
id,		id,
error: e.message,		error: e.message,
displayErrorMessage: staffCanSee,		displayErrorMessage: staffCanSee,
};		};
}		}
}		}

async function decryptDesktopNotification(		async function decryptDesktopNotification(
encryptedPayload: string,		encryptedPayload: string,
		messageType: string,
staffCanSee: boolean,		staffCanSee: boolean,
keyserverID?: string,		senderDeviceDescriptor: SenderDeviceDescriptor,
): Promise<{ +[string]: mixed }> {		): Promise<{ +[string]: mixed }> {
let encryptedOlmData, encryptionKey, olmDataKey;		const { keyserverID, senderDeviceID } = senderDeviceDescriptor;
try {
const { olmDataKey: olmDataKeyValue, encryptionKeyDBKey } =
await getNotifsOlmSessionDBKeys(keyserverID);

olmDataKey = olmDataKeyValue;		let notifsAccountWithOlmData;
		try {
[encryptedOlmData, encryptionKey] = await Promise.all([		[notifsAccountWithOlmData] = await Promise.all([
localforage.getItem<EncryptedData>(olmDataKey),		getNotifsAccountWithOlmData(senderDeviceDescriptor),
retrieveEncryptionKey(encryptionKeyDBKey),
initOlm(),		initOlm(),
]);		]);
} catch (e) {		} catch (e) {
return {		return {
error: e.message,		error: e.message,
displayErrorMessage: staffCanSee,		displayErrorMessage: staffCanSee,
};		};
}		}

if (!encryptionKey \|\| !encryptedOlmData) {		const {
return {		encryptionKey,
error: 'Received encrypted notification but olm session was not created',		encryptedOlmData,
displayErrorMessage: staffCanSee,		olmDataKey,
};		encryptionKeyDBLabel: olmEncryptionKeyDBLabel,
}		accountEncryptionKey,
		encryptedOlmAccount,
		synchronizationValue,
		} = notifsAccountWithOlmData;

let decryptedNotification;
try {		try {
decryptedNotification = await commonDecrypt<{ +[string]: mixed }>(		const [notificationsOlmData, accountWithPicklingKey] = await Promise.all([
		deserializeEncryptedDataOptional<NotificationsOlmDataType>(
encryptedOlmData,		encryptedOlmData,
olmDataKey,
encryptionKey,		encryptionKey,
encryptedPayload,		),
		deserializeEncryptedDataOptional<PickledOLMAccount>(
		encryptedOlmAccount,
		accountEncryptionKey,
		),
		]);

		if (keyserverID) {
		invariant(
		notificationsOlmData && encryptionKey,
		'Received encrypted notification but keyserver olm session was not created',
);		);
} catch (e) {
return {
error: e.message,
staffCanSee,
};
}

if (!keyserverID) {		const { decryptedNotification, updatedOlmData } = await commonDecrypt<{
return decryptedNotification;		+[string]: mixed,
}		}>(notificationsOlmData, encryptedPayload);

		const updatedOlmDataPersistencePromise = persistNotifsAccountWithOlmData({
		olmDataKey,
		olmData: updatedOlmData,
		olmEncryptionKeyDBLabel,
		encryptionKey,
		forceWrite: false,
		synchronizationValue,
		});

// iOS notifications require that unread count is set under		// iOS notifications require that unread count is set under
// `badge` key. Since MacOS notifications are created by the		// `badge` key. Since MacOS notifications are created by the
// same function the unread count is also set under `badge` key		// same function the unread count is also set under `badge` key
const { badge } = decryptedNotification;		const { badge } = decryptedNotification;
if (typeof badge === 'number') {		if (typeof badge === 'number') {
await updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge });		await Promise.all([
		updateNotifsUnreadCountStorage({ [(keyserverID: string)]: badge }),
		updatedOlmDataPersistencePromise,
		]);
return decryptedNotification;		return decryptedNotification;
}		}

const { unreadCount } = decryptedNotification;		const { unreadCount } = decryptedNotification;
if (typeof unreadCount === 'number') {		if (typeof unreadCount === 'number') {
await updateNotifsUnreadCountStorage({		await Promise.all([
		updateNotifsUnreadCountStorage({
[(keyserverID: string)]: unreadCount,		[(keyserverID: string)]: unreadCount,
});		}),
		updatedOlmDataPersistencePromise,
		]);
}		}

		return decryptedNotification;
		} else {
		invariant(
		senderDeviceID,
		'keyserverID or SenderDeviceID must be present to decrypt a notif',
		);

		invariant(
		accountWithPicklingKey,
		'Received encrypted notification but notifs olm account not created',
		);

		const { decryptedNotification, updatedOlmData, updatedNotifsAccount } =
		await commonPeerDecrypt<{
		+[string]: mixed,
		}>(
		senderDeviceID,
		notificationsOlmData,
		accountWithPicklingKey,
		messageType,
		encryptedPayload,
		);

		await persistNotifsAccountWithOlmData({
		accountWithPicklingKey: updatedNotifsAccount,
		accountEncryptionKey,
		encryptionKey,
		olmData: updatedOlmData,
		olmDataKey,
		olmEncryptionKeyDBLabel,
		synchronizationValue,
		forceWrite: false,
		});

return decryptedNotification;		return decryptedNotification;
}		}
		} catch (e) {
		return {
		error: e.message,
		staffCanSee,
		};
		}
		}

async function commonDecrypt<T>(		async function commonDecrypt<T>(
encryptedOlmData: EncryptedData,		notificationsOlmData: NotificationsOlmDataType,
olmDataKey: string,
encryptionKey: CryptoKey,
encryptedPayload: string,		encryptedPayload: string,
): Promise<T> {		): Promise<{
const serializedOlmData = await decryptData(encryptedOlmData, encryptionKey);		+decryptedNotification: T,
		+updatedOlmData: NotificationsOlmDataType,
		}> {
const {		const {
mainSession,		mainSession,
picklingKey,		picklingKey,
pendingSessionUpdate,		pendingSessionUpdate,
updateCreationTimestamp,		updateCreationTimestamp,
}: NotificationsOlmDataType = JSON.parse(		} = notificationsOlmData;
new TextDecoder().decode(serializedOlmData),
);

let updatedOlmData: NotificationsOlmDataType;		let updatedOlmData: NotificationsOlmDataType;
let decryptedNotification: T;		let decryptedNotification: T;

const shouldUpdateMainSession =		const shouldUpdateMainSession =
Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME;		Date.now() - updateCreationTimestamp > SESSION_UPDATE_MAX_PENDING_TIME;

const decryptionWithPendingSessionResult = decryptWithPendingSession<T>(		const decryptionWithPendingSessionResult = decryptWithPendingSession<T>(
Show All 26 Lines	if (decryptionWithPendingSessionResult.decryptedNotification) {
updatedOlmData = {		updatedOlmData = {
mainSession: mainSession,		mainSession: mainSession,
pendingSessionUpdate,		pendingSessionUpdate,
updateCreationTimestamp: newUpdateCreationTimestamp,		updateCreationTimestamp: newUpdateCreationTimestamp,
picklingKey,		picklingKey,
};		};
}		}

const updatedEncryptedSession = await encryptData(		return { decryptedNotification, updatedOlmData };
new TextEncoder().encode(JSON.stringify(updatedOlmData)),		}
encryptionKey,
		async function commonPeerDecrypt<T>(
		senderDeviceID: string,
		notificationsOlmData: ?NotificationsOlmDataType,
		notificationAccount: PickledOLMAccount,
		messageType: string,
		encryptedPayload: string,
		): Promise<{
		+decryptedNotification: T,
		+updatedOlmData?: NotificationsOlmDataType,
		+updatedNotifsAccount?: PickledOLMAccount,
		}> {
		if (
		messageType !== olmEncryptedMessageTypes.PREKEY.toString() &&
		messageType !== olmEncryptedMessageTypes.TEXT.toString()
		) {
		throw new Error(
		`Received message of invalid type from device: ${senderDeviceID}`,
);		);
		}

await localforage.setItem(olmDataKey, updatedEncryptedSession);		let isSenderChainEmpty = true;
		let hasReceivedMessage = false;
		const sessionExists = !!notificationsOlmData;

return decryptedNotification;		if (notificationsOlmData) {
		const session = new olm.Session();
		session.unpickle(
		notificationsOlmData.picklingKey,
		notificationsOlmData.pendingSessionUpdate,
		);

		isSenderChainEmpty = session.is_sender_chain_empty();
		hasReceivedMessage = session.has_received_message();
		}

		// regular message
		const isRegularMessage =
		!!notificationsOlmData &&
		messageType === olmEncryptedMessageTypes.TEXT.toString();

		const isRegularPrekeyMessage =
		!!notificationsOlmData &&
		messageType === olmEncryptedMessageTypes.PREKEY.toString() &&
		isSenderChainEmpty &&
		hasReceivedMessage;

		if (!!notificationsOlmData && (isRegularMessage \|\| isRegularPrekeyMessage)) {
		return await commonDecrypt<T>(notificationsOlmData, encryptedPayload);
		}

		// At this point we either face race condition or session reset attempt or
		// session initialization attempt. For each of this scenario new inbound
		// session must be created in order to decrypt message
		const authMetadata = await fetchAuthMetadata();
		const notifInboundKeys = await getNotifsInboundKeysForDeviceID(
		senderDeviceID,
		authMetadata,
		);

		const account = new olm.Account();
		const session = new olm.Session();

		account.unpickle(
		notificationAccount.picklingKey,
		notificationAccount.pickledAccount,
		);

		if (notifInboundKeys.error) {
		throw new Error(notifInboundKeys.error);
		}

		invariant(
		notifInboundKeys.curve25519,
		'curve25519 must be present in notifs inbound keys',
		);

		session.create_inbound_from(
		account,
		notifInboundKeys.curve25519,
		encryptedPayload,
		);

		const decryptedNotification: T = JSON.parse(
		session.decrypt(Number(messageType), encryptedPayload),
		);

		// session reset attempt or session initialization - handled the same
		const sessionResetAttempt =
		sessionExists && !isSenderChainEmpty && hasReceivedMessage;

		// race condition
		const raceCondition =
		sessionExists && !isSenderChainEmpty && !hasReceivedMessage;
		const { deviceID: ourDeviceID } = authMetadata;
		invariant(ourDeviceID, 'Session creation attempt but no device id');

		const thisDeviceWinsRaceCondition = ourDeviceID > senderDeviceID;

		if (
		!sessionExists \|\|
		sessionResetAttempt \|\|
		(raceCondition && !thisDeviceWinsRaceCondition)
		) {
		const pickledOlmSession = session.pickle(notificationAccount.picklingKey);
		const updatedOlmData = {
		mainSession: pickledOlmSession,
		pendingSessionUpdate: pickledOlmSession,
		updateCreationTimestamp: Date.now(),
		picklingKey: notificationAccount.picklingKey,
		};
		const updatedNotifsAccount = {
		pickledAccount: account.pickle(notificationAccount.picklingKey),
		picklingKey: notificationAccount.picklingKey,
		};
		return {
		decryptedNotification,
		updatedOlmData,
		updatedNotifsAccount,
		};
		}

		// If there is a race condition but we win device id comparison
		// we return object that carries decrypted data but won't persist
		// any session state
		return { decryptedNotification };
}		}

function decryptWithSession<T>(		function decryptWithSession<T>(
pickledSession: string,		pickledSession: string,
picklingKey: string,		picklingKey: string,
encryptedPayload: string,		encryptedPayload: string,
): DecryptionResult<T> {		): DecryptionResult<T> {
const session = new olm.Session();		const session = new olm.Session();
▲ Show 20 Lines • Show All 472 Lines • Show Last 20 Lines

[lib] fix creating Tunnelbroker socketClosedPublicActions

Details

Diff Detail

Event Timeline

Revision ContentsChangeset List

Diff 37804

lib/tunnelbroker/tunnelbroker-context.js

[lib] fix creating Tunnelbroker socket
ClosedPublic
Actions

Revision Contents
Changeset List