Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: validate of Lifetime in KeyPackages only for senders #85

Merged
merged 1 commit into from
Feb 21, 2024
Merged

fix: validate of Lifetime in KeyPackages only for senders #85

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions openmls/src/framing/mls_auth_content_in.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,6 +54,7 @@ impl AuthenticatedContentIn {
sender_context: Option<SenderContext>,
protocol_version: ProtocolVersion,
group: &PublicGroup,
sender: bool,
) -> Result<AuthenticatedContent, ValidationError> {
Ok(AuthenticatedContent {
wire_format: self.wire_format,
Expand All @@ -65,6 +66,7 @@ impl AuthenticatedContentIn {
sender_context,
protocol_version,
group,
sender,
)
.await?,
auth: self.auth,
Expand Down
5 changes: 5 additions & 0 deletions openmls/src/framing/mls_content_in.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ impl FramedContentIn {
sender_context: Option<SenderContext>,
protocol_version: ProtocolVersion,
group: &PublicGroup,
sender: bool,
) -> Result<FramedContent, ValidationError> {
Ok(FramedContent {
group_id: self.group_id,
Expand All @@ -71,6 +72,7 @@ impl FramedContentIn {
sender_context,
protocol_version,
group,
sender,
)
.await?,
})
Expand Down Expand Up @@ -145,6 +147,7 @@ impl FramedContentBodyIn {
sender_context: Option<SenderContext>,
protocol_version: ProtocolVersion,
group: &PublicGroup,
sender: bool,
) -> Result<FramedContentBody, ValidationError> {
Ok(match self {
FramedContentBodyIn::Application(bytes) => FramedContentBody::Application(bytes),
Expand All @@ -156,6 +159,7 @@ impl FramedContentBodyIn {
sender_context,
protocol_version,
group,
sender,
)
.await?,
),
Expand All @@ -170,6 +174,7 @@ impl FramedContentBodyIn {
sender_context,
protocol_version,
group,
sender,
)
.await?,
)
Expand Down
1 change: 1 addition & 0 deletions openmls/src/framing/validation.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -322,6 +322,7 @@ impl UnverifiedMessage {
self.sender_context,
protocol_version,
group,
false,
)
.await?;
Ok((content, self.credential))
Expand Down
1 change: 1 addition & 0 deletions openmls/src/group/core_group/new_from_external_init.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,7 @@ impl CoreGroup {
verifiable_group_info,
// Existing proposals are discarded when joining by external commit.
ProposalStore::new(),
true,
)
.await?;
let group_context = public_group.group_context();
Expand Down
3 changes: 2 additions & 1 deletion openmls/src/group/core_group/new_from_welcome.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,11 +151,12 @@ impl CoreGroup {
ratchet_tree,
verifiable_group_info,
ProposalStore::new(),
false,
)
.await?;

KeyPackageIn::from(key_package.clone())
.validate(backend, ProtocolVersion::Mls10, &public_group)
.validate(backend, ProtocolVersion::Mls10, &public_group, false)
.await?;

// Find our own leaf in the tree.
Expand Down
4 changes: 2 additions & 2 deletions openmls/src/group/core_group/test_proposals.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ async fn proposal_queue_functions(ciphersuite: Ciphersuite, backend: &impl OpenM
let kpi = KeyPackageIn::from(alice_update_key_package.clone());

assert!(kpi
.standalone_validate(backend, ProtocolVersion::Mls10)
.standalone_validate(backend, ProtocolVersion::Mls10, true)
.await
.is_ok());

Expand Down Expand Up @@ -197,7 +197,7 @@ async fn proposal_queue_order(ciphersuite: Ciphersuite, backend: &impl OpenMlsCr
let kpi = KeyPackageIn::from(alice_update_key_package.clone());

assert!(kpi
.standalone_validate(backend, ProtocolVersion::Mls10)
.standalone_validate(backend, ProtocolVersion::Mls10, true)
.await
.is_ok());

Expand Down
7 changes: 6 additions & 1 deletion openmls/src/group/mls_group/membership.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,12 @@ impl MlsGroup {
let mut inline_proposals = Vec::with_capacity(key_packages.len());
for key_package in key_packages.into_iter() {
let key_package = key_package
.validate(backend, ProtocolVersion::Mls10, self.group().public_group())
.validate(
backend,
ProtocolVersion::Mls10,
self.group().public_group(),
true,
)
.await?;
inline_proposals.push(Proposal::Add(AddProposal { key_package }));
}
Expand Down
14 changes: 12 additions & 2 deletions openmls/src/group/mls_group/proposal.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,12 @@ impl MlsGroup {
self.is_operational()?;

let key_package = joiner_key_package
.validate(backend, ProtocolVersion::Mls10, self.group().public_group())
.validate(
backend,
ProtocolVersion::Mls10,
self.group().public_group(),
true,
)
.await?;
let proposal =
self.group
Expand Down Expand Up @@ -247,7 +252,12 @@ impl MlsGroup {
self.is_operational()?;

let key_package = joiner_key_package
.validate(backend, ProtocolVersion::Mls10, self.group().public_group())
.validate(
backend,
ProtocolVersion::Mls10,
self.group().public_group(),
true,
)
.await?;
let add_proposal =
self.group
Expand Down
4 changes: 2 additions & 2 deletions openmls/src/group/mls_group/updates.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,7 +189,7 @@ impl MlsGroup {
.into());
};
let own_leaf = own_leaf
.validate(self.group().public_group(), backend)
.validate(self.group().public_group(), backend, true)
.await?;

let update_proposal = self.group.create_update_proposal(
Expand Down Expand Up @@ -272,7 +272,7 @@ impl MlsGroup {
.into());
};
let own_leaf = own_leaf
.validate(self.group().public_group(), backend)
.validate(self.group().public_group(), backend, true)
.await?;

let update_proposal = self.group.create_update_proposal(
Expand Down
4 changes: 3 additions & 1 deletion openmls/src/group/public_group/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,7 @@ impl PublicGroup {
ratchet_tree: RatchetTreeIn,
verifiable_group_info: VerifiableGroupInfo,
proposal_store: ProposalStore,
sender: bool,
) -> Result<(Self, GroupInfo), CreationFromExternalError> {
let ciphersuite = verifiable_group_info.ciphersuite();

Expand All @@ -123,7 +124,8 @@ impl PublicGroup {
// verifying the group info, since we need to find the Credential to verify the
// signature against.
let treesync =
TreeSync::from_ratchet_tree(backend, ciphersuite, ratchet_tree, group_id, true).await?;
TreeSync::from_ratchet_tree(backend, ciphersuite, ratchet_tree, group_id, true, sender)
.await?;

let group_info: GroupInfo = {
let signer_signature_key = treesync
Expand Down
1 change: 1 addition & 0 deletions openmls/src/group/public_group/tests.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ async fn public_group(ciphersuite: Ciphersuite, backend: &impl OpenMlsCryptoProv
ratchet_tree.into(),
verifiable_group_info,
ProposalStore::new(),
true,
)
.await
.unwrap();
Expand Down
2 changes: 1 addition & 1 deletion openmls/src/group/tests/test_proposal_validation.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1084,7 +1084,7 @@ async fn test_valsem105(ciphersuite: Ciphersuite, backend: &impl OpenMlsCryptoPr
.await;

let kpi: KeyPackageIn = charlie_key_package.clone().into();
kpi.standalone_validate(backend, ProtocolVersion::Mls10)
kpi.standalone_validate(backend, ProtocolVersion::Mls10, true)
.await
.unwrap();

Expand Down
13 changes: 9 additions & 4 deletions openmls/src/key_packages/key_package_in.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,24 +119,29 @@ impl KeyPackageIn {
backend: &impl OpenMlsCryptoProvider,
protocol_version: ProtocolVersion,
group: &PublicGroup,
sender: bool,
) -> Result<KeyPackage, KeyPackageVerifyError> {
self._validate(backend, protocol_version, Some(group)).await
self._validate(backend, protocol_version, Some(group), sender)
.await
}

/// Verify that this key package is valid disregarding the group it is supposed to be used with.
pub async fn standalone_validate(
self,
backend: &impl OpenMlsCryptoProvider,
protocol_version: ProtocolVersion,
sender: bool,
) -> Result<KeyPackage, KeyPackageVerifyError> {
self._validate(backend, protocol_version, None).await
self._validate(backend, protocol_version, None, sender)
.await
}

async fn _validate(
self,
backend: &impl OpenMlsCryptoProvider,
protocol_version: ProtocolVersion,
group: Option<&PublicGroup>,
sender: bool,
) -> Result<KeyPackage, KeyPackageVerifyError> {
// We first need to verify the LeafNode inside the KeyPackage

Expand All @@ -154,10 +159,10 @@ impl KeyPackageIn {
let leaf_node = match verifiable_leaf_node {
VerifiableLeafNode::KeyPackage(leaf_node) => {
if let Some(group) = group {
leaf_node.validate(group, backend).await?
leaf_node.validate(group, backend, sender).await?
} else {
leaf_node
.standalone_validate(backend, signature_scheme)
.standalone_validate(backend, signature_scheme, sender)
.await?
}
}
Expand Down
8 changes: 4 additions & 4 deletions openmls/src/key_packages/test_key_packages.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ async fn generate_key_package(ciphersuite: Ciphersuite, backend: &impl OpenMlsCr

let kpi = KeyPackageIn::from(key_package);
assert!(kpi
.standalone_validate(backend, ProtocolVersion::Mls10)
.standalone_validate(backend, ProtocolVersion::Mls10, true)
.await
.is_ok());
}
Expand Down Expand Up @@ -101,7 +101,7 @@ async fn application_id_extension(ciphersuite: Ciphersuite, backend: &impl OpenM

let kpi = KeyPackageIn::from(key_package.clone());
assert!(kpi
.standalone_validate(backend, ProtocolVersion::Mls10)
.standalone_validate(backend, ProtocolVersion::Mls10, true)
.await
.is_ok());

Expand Down Expand Up @@ -138,7 +138,7 @@ async fn key_package_validation(ciphersuite: Ciphersuite, backend: &impl OpenMls
let kpi = KeyPackageIn::tls_deserialize(&mut encoded.as_slice()).unwrap();

let err = kpi
.standalone_validate(backend, ProtocolVersion::Mls10)
.standalone_validate(backend, ProtocolVersion::Mls10, true)
.await
.unwrap_err();
// Expect an invalid protocol version error
Expand All @@ -158,7 +158,7 @@ async fn key_package_validation(ciphersuite: Ciphersuite, backend: &impl OpenMls
let kpi = KeyPackageIn::tls_deserialize(&mut encoded.as_slice()).unwrap();

let err = kpi
.standalone_validate(backend, ProtocolVersion::Mls10)
.standalone_validate(backend, ProtocolVersion::Mls10, true)
.await
.unwrap_err();
// Expect an invalid init/encryption key error
Expand Down
4 changes: 3 additions & 1 deletion openmls/src/messages/group_info.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,6 +123,7 @@ impl VerifiableGroupInfo {
pub async fn take_ratchet_tree(
mut self,
backend: &impl OpenMlsCryptoProvider,
sender: bool,
) -> Result<RatchetTree, GroupInfoError> {
let cs = self.ciphersuite();

Expand All @@ -144,7 +145,8 @@ impl VerifiableGroupInfo {
// although it clones the ratchet tree here...
let group_id = self.group_id();
let treesync =
TreeSync::from_ratchet_tree(backend, cs, ratchet_tree.clone(), group_id, true).await?;
TreeSync::from_ratchet_tree(backend, cs, ratchet_tree.clone(), group_id, true, sender)
.await?;

let signer_signature_key = treesync
.leaf(self.signer())
Expand Down
8 changes: 6 additions & 2 deletions openmls/src/messages/mod.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -196,12 +196,13 @@ impl CommitIn {
sender_context: SenderContext,
protocol_version: ProtocolVersion,
group: &PublicGroup,
sender: bool,
) -> Result<Commit, ValidationError> {
let mut proposals = Vec::with_capacity(self.proposals.len());
for proposal in self.proposals.into_iter() {
proposals.push(
proposal
.validate(backend, ciphersuite, protocol_version, group)
.validate(backend, ciphersuite, protocol_version, group, sender)
.await?,
);
}
Expand Down Expand Up @@ -237,7 +238,10 @@ impl CommitIn {
TreePosition::new(group_id, new_leaf_index)
}
};
Some(path.into_verified(backend, tree_position, group).await?)
Some(
path.into_verified(backend, tree_position, group, sender)
.await?,
)
} else {
None
};
Expand Down
20 changes: 15 additions & 5 deletions openmls/src/messages/proposals_in.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,16 +102,21 @@ impl ProposalIn {
sender_context: Option<SenderContext>,
protocol_version: ProtocolVersion,
group: &PublicGroup,
sender: bool,
) -> Result<Proposal, ValidationError> {
Ok(match self {
ProposalIn::Add(add) => Proposal::Add(
add.validate(backend, protocol_version, ciphersuite, group)
add.validate(backend, protocol_version, ciphersuite, group, sender)
.await?,
),
ProposalIn::Update(update) => {
let sender_context =
sender_context.ok_or(ValidationError::CommitterIncludedOwnUpdate)?;
Proposal::Update(update.validate(backend, sender_context, group).await?)
Proposal::Update(
update
.validate(backend, sender_context, group, sender)
.await?,
)
}
ProposalIn::Remove(remove) => Proposal::Remove(remove),
ProposalIn::PreSharedKey(psk) => Proposal::PreSharedKey(psk),
Expand Down Expand Up @@ -154,10 +159,11 @@ impl AddProposalIn {
protocol_version: ProtocolVersion,
ciphersuite: Ciphersuite,
group: &PublicGroup,
sender: bool,
) -> Result<AddProposal, ValidationError> {
let key_package = self
.key_package
.validate(backend, protocol_version, group)
.validate(backend, protocol_version, group, sender)
.await?;
// Verify that the ciphersuite is valid
if key_package.ciphersuite() != ciphersuite {
Expand Down Expand Up @@ -192,6 +198,7 @@ impl UpdateProposalIn {
backend: &impl OpenMlsCryptoProvider,
sender_context: SenderContext,
group: &PublicGroup,
sender: bool,
) -> Result<UpdateProposal, ValidationError> {
let tree_position = match sender_context {
SenderContext::Member((group_id, leaf_index)) => {
Expand All @@ -203,7 +210,9 @@ impl UpdateProposalIn {
.leaf_node
.try_into_verifiable_leaf_node(Some(tree_position))?;
let leaf_node = match verifiable_leaf_node {
VerifiableLeafNode::Update(leaf_node) => leaf_node.validate(group, backend).await?,
VerifiableLeafNode::Update(leaf_node) => {
leaf_node.validate(group, backend, sender).await?
}
_ => return Err(ValidationError::InvalidLeafNodeSourceType),
};

Expand Down Expand Up @@ -234,11 +243,12 @@ impl ProposalOrRefIn {
ciphersuite: Ciphersuite,
protocol_version: ProtocolVersion,
group: &PublicGroup,
sender: bool,
) -> Result<ProposalOrRef, ValidationError> {
Ok(match self {
ProposalOrRefIn::Proposal(proposal_in) => ProposalOrRef::Proposal(
proposal_in
.validate(backend, ciphersuite, None, protocol_version, group)
.validate(backend, ciphersuite, None, protocol_version, group, sender)
.await?,
),
ProposalOrRefIn::Reference(reference) => ProposalOrRef::Reference(reference),
Expand Down
Loading
Loading