inbound_group_session.c 10.3 KB
Newer Older
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
/* Copyright 2016 OpenMarket Ltd
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include "olm/inbound_group_session.h"

#include <string.h>

#include "olm/base64.h"
#include "olm/cipher.h"
Richard van der Hoff's avatar
Richard van der Hoff committed
22
#include "olm/crypto.h"
23
24
#include "olm/error.h"
#include "olm/megolm.h"
25
#include "olm/memory.h"
26
#include "olm/message.h"
27
28
29
#include "olm/pickle.h"
#include "olm/pickle_encoding.h"

30
31

#define OLM_PROTOCOL_VERSION     3
32
#define PICKLE_VERSION           1
Richard van der Hoff's avatar
Richard van der Hoff committed
33
#define SESSION_KEY_VERSION      1
34
35
36
37
38
39
40
41

struct OlmInboundGroupSession {
    /** our earliest known ratchet value */
    Megolm initial_ratchet;

    /** The most recent ratchet value */
    Megolm latest_ratchet;

Richard van der Hoff's avatar
Richard van der Hoff committed
42
43
44
    /** The ed25519 signing key */
    struct _olm_ed25519_public_key signing_key;

45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
    enum OlmErrorCode last_error;
};

size_t olm_inbound_group_session_size() {
    return sizeof(OlmInboundGroupSession);
}

OlmInboundGroupSession * olm_inbound_group_session(
    void *memory
) {
    OlmInboundGroupSession *session = memory;
    olm_clear_inbound_group_session(session);
    return session;
}

const char *olm_inbound_group_session_last_error(
    const OlmInboundGroupSession *session
) {
    return _olm_error_to_string(session->last_error);
}

size_t olm_clear_inbound_group_session(
    OlmInboundGroupSession *session
) {
69
    _olm_unset(session, sizeof(OlmInboundGroupSession));
70
71
72
    return sizeof(OlmInboundGroupSession);
}

Richard van der Hoff's avatar
Richard van der Hoff committed
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
#define SESSION_KEY_RAW_LENGTH \
    (1 + MEGOLM_RATCHET_LENGTH + ED25519_PUBLIC_KEY_LENGTH)

/** init the session keys from the un-base64-ed session keys */
static size_t _init_group_session_keys(
    OlmInboundGroupSession *session,
    uint32_t message_index,
    const uint8_t *key_buf
) {
    const uint8_t *ptr = key_buf;
    size_t version = *ptr++;

    if (version != SESSION_KEY_VERSION) {
        session->last_error = OLM_BAD_SESSION_KEY;
        return (size_t)-1;
    }

    megolm_init(&session->initial_ratchet, ptr, message_index);
    megolm_init(&session->latest_ratchet, ptr, message_index);
    ptr += MEGOLM_RATCHET_LENGTH;
    memcpy(
        session->signing_key.public_key, ptr, ED25519_PUBLIC_KEY_LENGTH
    );
    ptr += ED25519_PUBLIC_KEY_LENGTH;
    return 0;
}

100
101
102
103
104
size_t olm_init_inbound_group_session(
    OlmInboundGroupSession *session,
    uint32_t message_index,
    const uint8_t * session_key, size_t session_key_length
) {
Richard van der Hoff's avatar
Richard van der Hoff committed
105
    uint8_t key_buf[SESSION_KEY_RAW_LENGTH];
106
    size_t raw_length = _olm_decode_base64_length(session_key_length);
Richard van der Hoff's avatar
Richard van der Hoff committed
107
    size_t result;
108
109
110
111
112
113

    if (raw_length == (size_t)-1) {
        session->last_error = OLM_INVALID_BASE64;
        return (size_t)-1;
    }

Richard van der Hoff's avatar
Richard van der Hoff committed
114
    if (raw_length != SESSION_KEY_RAW_LENGTH) {
115
        session->last_error = OLM_BAD_SESSION_KEY;
116
117
118
119
        return (size_t)-1;
    }

    _olm_decode_base64(session_key, session_key_length, key_buf);
Richard van der Hoff's avatar
Richard van der Hoff committed
120
121
122
    result = _init_group_session_keys(session, message_index, key_buf);
    _olm_unset(key_buf, SESSION_KEY_RAW_LENGTH);
    return result;
123
124
}

125
126
127
128
129
130
131
static size_t raw_pickle_length(
    const OlmInboundGroupSession *session
) {
    size_t length = 0;
    length += _olm_pickle_uint32_length(PICKLE_VERSION);
    length += megolm_pickle_length(&session->initial_ratchet);
    length += megolm_pickle_length(&session->latest_ratchet);
Richard van der Hoff's avatar
Richard van der Hoff committed
132
    length += _olm_pickle_ed25519_public_key_length(&session->signing_key);
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
    return length;
}

size_t olm_pickle_inbound_group_session_length(
    const OlmInboundGroupSession *session
) {
    return _olm_enc_output_length(raw_pickle_length(session));
}

size_t olm_pickle_inbound_group_session(
    OlmInboundGroupSession *session,
    void const * key, size_t key_length,
    void * pickled, size_t pickled_length
) {
    size_t raw_length = raw_pickle_length(session);
    uint8_t *pos;

    if (pickled_length < _olm_enc_output_length(raw_length)) {
        session->last_error = OLM_OUTPUT_BUFFER_TOO_SMALL;
        return (size_t)-1;
    }

    pos = _olm_enc_output_pos(pickled, raw_length);
    pos = _olm_pickle_uint32(pos, PICKLE_VERSION);
    pos = megolm_pickle(&session->initial_ratchet, pos);
    pos = megolm_pickle(&session->latest_ratchet, pos);
Richard van der Hoff's avatar
Richard van der Hoff committed
159
    pos = _olm_pickle_ed25519_public_key(pos, &session->signing_key);
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188

    return _olm_enc_output(key, key_length, pickled, raw_length);
}

size_t olm_unpickle_inbound_group_session(
    OlmInboundGroupSession *session,
    void const * key, size_t key_length,
    void * pickled, size_t pickled_length
) {
    const uint8_t *pos;
    const uint8_t *end;
    uint32_t pickle_version;

    size_t raw_length = _olm_enc_input(
        key, key_length, pickled, pickled_length, &(session->last_error)
    );
    if (raw_length == (size_t)-1) {
        return raw_length;
    }

    pos = pickled;
    end = pos + raw_length;
    pos = _olm_unpickle_uint32(pos, end, &pickle_version);
    if (pickle_version != PICKLE_VERSION) {
        session->last_error = OLM_UNKNOWN_PICKLE_VERSION;
        return (size_t)-1;
    }
    pos = megolm_unpickle(&session->initial_ratchet, pos, end);
    pos = megolm_unpickle(&session->latest_ratchet, pos, end);
Richard van der Hoff's avatar
Richard van der Hoff committed
189
    pos = _olm_unpickle_ed25519_public_key(pos, end, &session->signing_key);
190
191
192
193
194
195
196
197
198
199

    if (end != pos) {
        /* We had the wrong number of bytes in the input. */
        session->last_error = OLM_CORRUPTED_PICKLE;
        return (size_t)-1;
    }

    return pickled_length;
}

200
201
202
203
/**
 * get the max plaintext length in an un-base64-ed message
 */
static size_t _decrypt_max_plaintext_length(
204
205
206
207
208
209
210
    OlmInboundGroupSession *session,
    uint8_t * message, size_t message_length
) {
    struct _OlmDecodeGroupMessageResults decoded_results;

    _olm_decode_group_message(
        message, message_length,
211
        megolm_cipher->ops->mac_length(megolm_cipher),
Richard van der Hoff's avatar
Richard van der Hoff committed
212
        ED25519_SIGNATURE_LENGTH,
213
214
215
216
217
218
219
220
221
222
223
224
        &decoded_results);

    if (decoded_results.version != OLM_PROTOCOL_VERSION) {
        session->last_error = OLM_BAD_MESSAGE_VERSION;
        return (size_t)-1;
    }

    if (!decoded_results.ciphertext) {
        session->last_error = OLM_BAD_MESSAGE_FORMAT;
        return (size_t)-1;
    }

225
226
    return megolm_cipher->ops->decrypt_max_plaintext_length(
        megolm_cipher, decoded_results.ciphertext_length);
227
228
}

229
230
231
232
233
size_t olm_group_decrypt_max_plaintext_length(
    OlmInboundGroupSession *session,
    uint8_t * message, size_t message_length
) {
    size_t raw_length;
234

235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
    raw_length = _olm_decode_base64(message, message_length, message);
    if (raw_length == (size_t)-1) {
        session->last_error = OLM_INVALID_BASE64;
        return (size_t)-1;
    }

    return _decrypt_max_plaintext_length(
        session, message, raw_length
    );
}

/**
 * decrypt an un-base64-ed message
 */
static size_t _decrypt(
250
251
252
253
254
    OlmInboundGroupSession *session,
    uint8_t * message, size_t message_length,
    uint8_t * plaintext, size_t max_plaintext_length
) {
    struct _OlmDecodeGroupMessageResults decoded_results;
255
    size_t max_length, r;
256
257
258
259
    Megolm *megolm;
    Megolm tmp_megolm;

    _olm_decode_group_message(
260
        message, message_length,
261
        megolm_cipher->ops->mac_length(megolm_cipher),
Richard van der Hoff's avatar
Richard van der Hoff committed
262
        ED25519_SIGNATURE_LENGTH,
263
264
265
266
267
268
269
        &decoded_results);

    if (decoded_results.version != OLM_PROTOCOL_VERSION) {
        session->last_error = OLM_BAD_MESSAGE_VERSION;
        return (size_t)-1;
    }

Richard van der Hoff's avatar
Richard van der Hoff committed
270
    if (!decoded_results.has_message_index || !decoded_results.ciphertext) {
271
272
273
274
        session->last_error = OLM_BAD_MESSAGE_FORMAT;
        return (size_t)-1;
    }

Richard van der Hoff's avatar
Richard van der Hoff committed
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
    /* verify the signature. We could do this before decoding the message, but
     * we allow for the possibility of future protocol versions which use a
     * different signing mechanism; we would rather throw "BAD_MESSAGE_VERSION"
     * than "BAD_SIGNATURE" in this case.
     */
    message_length -= ED25519_SIGNATURE_LENGTH;
    r = _olm_crypto_ed25519_verify(
        &session->signing_key,
        message, message_length,
        message + message_length
    );
    if (!r) {
        session->last_error = OLM_BAD_SIGNATURE;
        return (size_t)-1;
    }


292
293
    max_length = megolm_cipher->ops->decrypt_max_plaintext_length(
        megolm_cipher,
294
295
296
297
298
299
300
301
302
        decoded_results.ciphertext_length
    );
    if (max_plaintext_length < max_length) {
        session->last_error = OLM_OUTPUT_BUFFER_TOO_SMALL;
        return (size_t)-1;
    }

    /* pick a megolm instance to use. If we're at or beyond the latest ratchet
     * value, use that */
303
    if ((decoded_results.message_index - session->latest_ratchet.counter) < (1U << 31)) {
304
        megolm = &session->latest_ratchet;
305
    } else if ((decoded_results.message_index - session->initial_ratchet.counter) >= (1U << 31)) {
306
        /* the counter is before our intial ratchet - we can't decode this. */
307
        session->last_error = OLM_UNKNOWN_MESSAGE_INDEX;
308
309
310
311
312
313
314
315
        return (size_t)-1;
    } else {
        /* otherwise, start from the initial megolm. Take a copy so that we
         * don't overwrite the initial megolm */
        tmp_megolm = session->initial_ratchet;
        megolm = &tmp_megolm;
    }

316
    megolm_advance_to(megolm, decoded_results.message_index);
317
318

    /* now try checking the mac, and decrypting */
319
320
    r = megolm_cipher->ops->decrypt(
        megolm_cipher,
321
        megolm_get_data(megolm), MEGOLM_RATCHET_LENGTH,
322
        message, message_length,
323
324
325
326
        decoded_results.ciphertext, decoded_results.ciphertext_length,
        plaintext, max_plaintext_length
    );

327
    _olm_unset(&tmp_megolm, sizeof(tmp_megolm));
328
329
330
331
332
333
334
    if (r == (size_t)-1) {
        session->last_error = OLM_BAD_MESSAGE_MAC;
        return r;
    }

    return r;
}
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353

size_t olm_group_decrypt(
    OlmInboundGroupSession *session,
    uint8_t * message, size_t message_length,
    uint8_t * plaintext, size_t max_plaintext_length
) {
    size_t raw_message_length;

    raw_message_length = _olm_decode_base64(message, message_length, message);
    if (raw_message_length == (size_t)-1) {
        session->last_error = OLM_INVALID_BASE64;
        return (size_t)-1;
    }

    return _decrypt(
        session, message, raw_message_length,
        plaintext, max_plaintext_length
    );
}