Page MenuHomePhabricator

[Keyserver] Use olm identity key for tunnelbroker connection
AbandonedPublic

Authored by jon on Jun 1 2023, 7:09 AM.
Tags
None
Referenced Files
Unknown Object (File)
Tue, Apr 16, 3:23 AM
Unknown Object (File)
Tue, Apr 16, 12:45 AM
Unknown Object (File)
Sat, Apr 13, 8:31 AM
Unknown Object (File)
Sat, Apr 13, 4:50 AM
Unknown Object (File)
Thu, Apr 11, 8:23 AM
Unknown Object (File)
Wed, Apr 10, 1:15 AM
Unknown Object (File)
Tue, Apr 9, 4:35 AM
Unknown Object (File)
Sun, Apr 7, 5:15 PM
Subscribers

Details

Reviewers
ashoat
Summary

Instead of using fake values, recall the real
identity key.

Depends on D7702

Test Plan
# Run tunnelbroker with RUST_LOG=debug

(cd keyserver && yarn dev)
# There should be a console log from keyserver showing the
# real identity key, and tunnelbroker should log it received
# a connection request with the same ID

Diff Detail

Repository
rCOMM Comm
Branch
jonringer/keyserver-tunnelbroker (branched from master)
Lint
No Lint Coverage
Unit
No Test Coverage

Event Timeline

ashoat requested changes to this revision.Jun 1 2023, 8:41 AM

Curious for your thoughts on the inline comments. I think it might be good to move await getDeviceID out so it's not called on every Websocket initialization

keyserver/src/socket/tunnelbroker.js
14

I was wondering whether we really need to fetch the deviceID on every Tunnelbroker connection, so I spent some time thinking about what scenarios might lead to a reconnect I came up with two scenarios:

  1. If the deviceID changes for some reason
  2. If a connection error forces a reconnection

Since we'll need some code to handle the first case anyways (forcing a disconnect and reconnecting to Tunnelbroker with the new device ID), I wonder if we can avoid having to fetchOlmAccount on every connection. Here's what I'm thinking:

  1. We have some function like createAndMaintainTunnelbrokerSocket that takes deviceID as input. This function internally handles reconnecting in the case of an error or a disconnect
  2. When the keyserver starts, we fetch the deviceID (just once) and call createAndMaintainTunnelbrokerSocket
  3. Separately, we'll add code to every place that might change the deviceID in the database, and make sure it forces a reconnection with the updated deviceID
    • We'll need some way to kill the existing createAndMaintainTunnelbrokerSocket instance... either the function can return some sort of handle, or we can use a class instead of a function

What do you think?

18

Promise.all isn't doing anything here

This revision now requires changes to proceed.Jun 1 2023, 8:41 AM
keyserver/src/socket/tunnelbroker.js
11

Aren't we using the signing key (ed25519) for the "device ID", or did I get this wrong? Isn't that the key that is signing the rest of the keys, so it should be considered the "root of trust"?

jon marked 2 inline comments as done.
jon added inline comments.
keyserver/src/socket/tunnelbroker.js
11

no, you're right. Got confused

14

Yea, sounds good, I'll refactor this.

18

I intended to extend this with grabbing the user_id and access token as well.

I'll refactor this to have the local fetching done before attempting the session.

jon marked 2 inline comments as done.

squashed this into D7691 because of rebase work