Hello community,
here is the log from the commit of package lime for openSUSE:Factory checked in
at 2020-08-03 14:14:46
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/lime (Old)
and /work/SRC/openSUSE:Factory/.lime.new.3592 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "lime"
Mon Aug 3 14:14:46 2020 rev:2 rq:823434 version:4.4.0
Changes:
--------
--- /work/SRC/openSUSE:Factory/lime/lime.changes 2020-06-10
00:41:37.541904845 +0200
+++ /work/SRC/openSUSE:Factory/.lime.new.3592/lime.changes 2020-08-03
14:15:33.740509696 +0200
@@ -1,0 +2,6 @@
+Wed Jul 29 14:46:36 UTC 2020 - Alexei Sorokin <sor.ale...@meowr.ru>
+
+- Update to version 4.4.0:
+ * Manage server resource limit error response.
+
+-------------------------------------------------------------------
Old:
----
lime-4.3.1.tar.bz2
New:
----
lime-4.4.0.tar.bz2
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ lime.spec ++++++
--- /var/tmp/diff_new_pack.CHLHt3/_old 2020-08-03 14:15:35.080511040 +0200
+++ /var/tmp/diff_new_pack.CHLHt3/_new 2020-08-03 14:15:35.084511044 +0200
@@ -18,7 +18,7 @@
%define sover 0
Name: lime
-Version: 4.3.1
+Version: 4.4.0
Release: 0
Summary: Instant Message End-to-End Encryption Library
License: GPL-3.0-or-later
@@ -29,8 +29,8 @@
BuildRequires: pkgconfig
BuildRequires: soci-devel
BuildRequires: soci-sqlite3-devel
-BuildRequires: pkgconfig(bctoolbox) >= 4.3.0
-BuildRequires: pkgconfig(belle-sip) >= 4.3.0
+BuildRequires: pkgconfig(bctoolbox) >= 4.4.0
+BuildRequires: pkgconfig(belle-sip) >= 4.4.0
%description
LIME is an encryption library for one-to-one and group instant
++++++ lime-4.3.1.tar.bz2 -> lime-4.4.0.tar.bz2 ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lime-4.3.1/CMakeLists.txt
new/lime-4.4.0/CMakeLists.txt
--- old/lime-4.3.1/CMakeLists.txt 2019-12-13 16:18:59.000000000 +0100
+++ new/lime-4.4.0/CMakeLists.txt 2020-05-11 19:05:34.000000000 +0200
@@ -46,7 +46,7 @@
set (LANGUAGES_LIST ${LANGUAGES_LIST} Java)
endif()
-project(lime VERSION 4.3.0 LANGUAGES ${LANGUAGES_LIST})
+project(lime VERSION 4.4.0 LANGUAGES ${LANGUAGES_LIST})
set(LIME_SO_VERSION "0")
set(LIME_VERSION ${PROJECT_VERSION})
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lime-4.3.1/src/lime_x3dh_protocol.cpp
new/lime-4.4.0/src/lime_x3dh_protocol.cpp
--- old/lime-4.3.1/src/lime_x3dh_protocol.cpp 2019-12-13 16:18:59.000000000
+0100
+++ new/lime-4.4.0/src/lime_x3dh_protocol.cpp 2020-05-11 19:05:34.000000000
+0200
@@ -110,6 +110,9 @@
user_not_found=0x06,
db_error=0x07,
bad_request=0x08,
+ server_failure=0x09,
+
resource_limit_reached=0x0a,
+ unknown_error_code=0xfe,
unset_error_code=0xff};
/* X3DH protocol messages builds */
/**
@@ -420,6 +423,7 @@
if (body.size()<X3DH_headerSize) {
LIME_LOGE<<"Got an invalid response from X3DH
server"<<endl<< message_trace.str()<<endl<<" Invalid Incoming X3DH message";
if (callback)
callback(lime::CallbackReturn::fail, "Got an invalid response from X3DH
server");
+ LIME_LOGE<<message_trace.str()<<endl;
return false;
}
@@ -427,6 +431,7 @@
if (body[0] !=
static_cast<uint8_t>(X3DH_protocolVersion)) {
LIME_LOGE<<"X3DH server runs an other version
of X3DH protocol(server "<<static_cast<unsigned int>(body[0])<<" - local
"<<static_cast<unsigned
int>(X3DH_protocolVersion)<<")"<<endl<<message_trace.str()<<endl<<" Invalid
Incoming X3DH message";
if (callback)
callback(lime::CallbackReturn::fail, "X3DH server and client protocol version
mismatch");
+ LIME_LOGE<<message_trace.str()<<endl;
return false;
}
@@ -490,6 +495,7 @@
// retrieve the error code if needed
if (message_type == x3dh_message_type::error) {
if (body.size()<X3DH_headerSize+1) { // error
message contains at least 1 byte of error code + possible message
+ LIME_LOGE<<message_trace.str()<<endl;
return false;
}
@@ -527,8 +533,15 @@
case
static_cast<uint8_t>(x3dh_error_code::bad_request):
error_code =
x3dh_error_code::bad_request;
break;
- default: // unknown error code: invalid
packet
- return false;
+ case
static_cast<uint8_t>(x3dh_error_code::server_failure):
+ error_code =
x3dh_error_code::server_failure;
+ break;
+ case
static_cast<uint8_t>(x3dh_error_code::resource_limit_reached):
+ error_code =
x3dh_error_code::resource_limit_reached;
+ break;
+ default: // unknown error code - could
be an updated server
+ LIME_LOGW<<"Receive unknown
error code in X3DH message"<< static_cast<uint8_t>(body[X3DH_headerSize]);
+ error_code =
x3dh_error_code::unknown_error_code;
}
}
LIME_LOGD<<message_trace.str()<<endl<<" Valid
Incoming X3DH message";
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lime-4.3.1/tester/lime_lime-tester.cpp
new/lime-4.4.0/tester/lime_lime-tester.cpp
--- old/lime-4.3.1/tester/lime_lime-tester.cpp 2019-12-13 16:18:59.000000000
+0100
+++ new/lime-4.4.0/tester/lime_lime-tester.cpp 2020-05-11 19:05:34.000000000
+0200
@@ -3986,6 +3986,89 @@
}
}
+/**
+ * Scenario: Server is set to accept 200 OPks per device
+ * - Create user alice with 500 OPks -> it shall fail
+ * - Create user alice with 100 OPks -> it shall pass
+ * - Add 100 OPks to alice -> it shall pass
+ * - Add 100 OPks to alice -> is shall fail
+ */
+static void lime_server_resource_limit_reached_test(const lime::CurveId curve,
const std::string &dbBaseFilename, const std::string &x3dh_server_url) {
+ // create DB
+ std::string dbFilenameAlice{dbBaseFilename};
+
dbFilenameAlice.append(".alice.").append((curve==CurveId::c25519)?"C25519":"C448").append(".sqlite3");
+
+ remove(dbFilenameAlice.data()); // delete the database file if already
exists
+
+ lime_tester::events_counters_t counters={};
+ int expected_success=0;
+ int expected_failure=0;
+
+ limeCallback callback([&counters](lime::CallbackReturn returnCode,
std::string anythingToSay) {
+ if (returnCode ==
lime::CallbackReturn::success) {
+ counters.operation_success++;
+ } else {
+ counters.operation_failed++;
+ LIME_LOGE<<"Lime operation
failed : "<<anythingToSay;
+ }
+ });
+ try {
+ // create Manager and device for alice
+ auto aliceManager = std::unique_ptr<LimeManager>(new
LimeManager(dbFilenameAlice, X3DHServerPost));
+ auto aliceDeviceId =
lime_tester::makeRandomDeviceName("alice.");
+ aliceManager->create_user(*aliceDeviceId, x3dh_server_url,
curve, 500, callback);
+
BC_ASSERT_TRUE(lime_tester::wait_for(bc_stack,&counters.operation_failed,
++expected_failure,lime_tester::wait_for_timeout));
+
+ // Try again to create the device, with 100 OPks, it shall pass
+ aliceManager->create_user(*aliceDeviceId, x3dh_server_url,
curve, 100, callback);
+
BC_ASSERT_TRUE(lime_tester::wait_for(bc_stack,&counters.operation_success,
++expected_success,lime_tester::wait_for_timeout));
+
+ // call the update, set the serverLimit 200 and upload an other
100
+ aliceManager->update(callback, 200, 100);
+
BC_ASSERT_TRUE(lime_tester::wait_for(bc_stack,&counters.operation_success,
++expected_success,lime_tester::wait_for_timeout));
+ BC_ASSERT_EQUAL((int)lime_tester::get_OPks(dbFilenameAlice,
*aliceDeviceId), 200, int, "%d");
+
+ // call the update, set the serverLimit 300 and upload an other
100 -> it shall fail but we have 300 OPks in DB
+ aliceManager->update(callback, 300, 100);
+
BC_ASSERT_TRUE(lime_tester::wait_for(bc_stack,&counters.operation_failed,
++expected_failure,lime_tester::wait_for_timeout));
+ BC_ASSERT_EQUAL((int)lime_tester::get_OPks(dbFilenameAlice,
*aliceDeviceId), 300, int, "%d");
+
+ // update again, with correct values, server already holds 200
keys, so the only effect would be to set the failed 100 OPks status to
dispatched as they are not on server
+ aliceManager->update(callback, 125, 25);
+
BC_ASSERT_TRUE(lime_tester::wait_for(bc_stack,&counters.operation_success,
++expected_success,lime_tester::wait_for_timeout));
+ BC_ASSERT_EQUAL((int)lime_tester::get_OPks(dbFilenameAlice,
*aliceDeviceId), 300, int, "%d");
+
+ // forward time by OPK_limboTime_days
+ aliceManager=nullptr; // destroy manager before modifying DB
+ lime_tester::forwardTime(dbFilenameAlice,
lime::settings::OPk_limboTime_days+1);
+ aliceManager = std::unique_ptr<LimeManager>(new
LimeManager(dbFilenameAlice, X3DHServerPost));
+
+ // update one last time, with correct values, server already
holds 200 keys
+ // so the only effect would be to remove the OPk keys status
was set to dispatch before we forward the time
+ // We now hold 200 keys
+ aliceManager->update(callback, 125, 25);
+
BC_ASSERT_TRUE(lime_tester::wait_for(bc_stack,&counters.operation_success,
++expected_success,lime_tester::wait_for_timeout));
+ BC_ASSERT_EQUAL((int)lime_tester::get_OPks(dbFilenameAlice,
*aliceDeviceId), 200, int, "%d");
+
+ if (cleanDatabase) {
+ aliceManager->delete_user(*aliceDeviceId, callback);
+
BC_ASSERT_TRUE(lime_tester::wait_for(bc_stack,&counters.operation_success,++expected_success,lime_tester::wait_for_timeout));
+ remove(dbFilenameAlice.data());
+ }
+ } catch (BctbxException &e) {
+ LIME_LOGE << e;
+ BC_FAIL("");
+ }
+}
+
+static void lime_server_resource_limit_reached() {
+#ifdef EC25519_ENABLED
+ lime_server_resource_limit_reached_test(lime::CurveId::c25519,
"lime_server_resource_limit_reached",
std::string("https://";).append(lime_tester::test_x3dh_server_url).append(":").append(lime_tester::test_x3dh_c25519_server_port).data());
+#endif
+#ifdef EC448_ENABLED
+ lime_server_resource_limit_reached_test(lime::CurveId::c448,
"lime_server_resource_limit_reached",
std::string("https://";).append(lime_tester::test_x3dh_server_url).append(":").append(lime_tester::test_x3dh_c448_server_port).data());
+#endif
+}
static test_t tests[] = {
TEST_NO_TAG("Basic", x3dh_basic),
@@ -4008,7 +4091,8 @@
TEST_NO_TAG("Encryption Policy", lime_encryptionPolicy),
TEST_NO_TAG("Encryption Policy Error", lime_encryptionPolicyError),
TEST_NO_TAG("Identity theft", lime_identity_theft),
- TEST_NO_TAG("Multithread", lime_multithread)
+ TEST_NO_TAG("Multithread", lime_multithread),
+ TEST_NO_TAG("Server resource limit reached",
lime_server_resource_limit_reached)
};
test_suite_t lime_lime_test_suite = {
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lime-4.3.1/tester/server/nodejs/package.json
new/lime-4.4.0/tester/server/nodejs/package.json
--- old/lime-4.3.1/tester/server/nodejs/package.json 2019-12-13
16:18:59.000000000 +0100
+++ new/lime-4.4.0/tester/server/nodejs/package.json 2020-05-11
19:05:34.000000000 +0200
@@ -5,8 +5,8 @@
"main": "x3dh.js",
"dependencies": {
"rwlock": "^5.0.0",
- "sqlite3": "^4.0.2",
- "yargs": "^9.0.1"
+ "sqlite3": "^4.2.0",
+ "yargs": "^15.3.1"
},
"devDependencies": {},
"scripts": {
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/lime-4.3.1/tester/server/nodejs/x3dh.js
new/lime-4.4.0/tester/server/nodejs/x3dh.js
--- old/lime-4.3.1/tester/server/nodejs/x3dh.js 2019-12-13 16:18:59.000000000
+0100
+++ new/lime-4.4.0/tester/server/nodejs/x3dh.js 2020-05-11 19:05:34.000000000
+0200
@@ -86,6 +86,14 @@
CURVE448 : 2
};
+// Resource abuse protection
+// Setting to 0 disable the function
+//lime_max_device_per_user does not apply to this test server as it is used to
test the lime lib only and device id are not gruub in the tests
+// Do not set this value too low, it shall not be lower than the
server_low_limit+batch_size used by client - default is 100+25
+const lime_max_opk_per_device = 200;
+
+
+
var curveId = enum_curveId.CURVE25519;
const X3DH_protocolVersion = 0x01;
@@ -114,7 +122,9 @@
user_already_in : 0x05,
user_not_found : 0x06,
db_error : 0x07,
- bad_request : 0x08
+ bad_request : 0x08,
+ server_failure : 0x09,
+ resource_limit_reached : 0x0a
};
const enum_keyBundleFlag = {
@@ -317,6 +327,10 @@
// Now get the OPk count
var bufferIndex = X3DH_headerSize;
var OPk_number =
body.readUInt16BE(bufferIndex+x3dh_expectedSize-2);
+ if ((lime_max_opk_per_device > 0) &&
(OPk_number > lime_max_opk_per_device)) { // too much OPk, reject registration
+
returnError(enum_errorCodes.resource_limit_reached, userId+" is trying to
register itself with "+OPk_number+" OPks but server has a limit of
"+lime_max_opk_per_device);
+ return;
+ }
// And check again the size with OPks
x3dh_expectedSize +=
OPk_number*(keySizes[curveId]['X_pub'] + 4);
if (body.length<X3DH_headerSize +
x3dh_expectedSize) {
@@ -482,6 +496,11 @@
console.log("It contains "+OPk_number+" keys");
+ if ((lime_max_opk_per_device > 0) &&
(OPk_number > lime_max_opk_per_device)) { // too much OPk, reject registration
+
returnError(enum_errorCodes.resource_limit_reached, userId+" is trying to
insert "+OPk_number+" OPks but server has a limit of "+lime_max_opk_per_device);
+ return;
+ }
+
// check we have a matching user in DB
lock.writeLock(function (release) {
db.get("SELECT Uid FROM Users WHERE
UserId = ?;", userId , function (err, row) {
@@ -490,43 +509,107 @@
returnError(enum_errorCodes.user_not_found, "Post OPks but "+userId+" not found
in db");
} else {
var Uid =
row['Uid'];
- // parse all
OPks to be inserted
- var OPks_param
= [];
- for (let i = 0;
i < OPk_number; i++) {
- var OPk
= body.slice(bufferIndex, bufferIndex + keySizes[curveId]['X_pub']);
-
bufferIndex += keySizes[curveId]['X_pub'];
- var
OPk_id = body.readUInt32BE(bufferIndex); // SPk id is a 32 bits unsigned
integer in Big endian
-
bufferIndex += 4;
-
OPks_param.push([Uid, OPk, OPk_id]);
- }
- // bulk insert
of OPks
- var stmt_ran =
0;
- var
stmt_success = 0;
- var
stmt_err_message = '';
- db.run("begin
transaction");
- var stmt =
db.prepare("INSERT INTO OPk(Uid, OPk, OPk_id) VALUES(?,?,?);")
- for (let i=0;
i<OPks_param.length; i++) {
- param =
OPks_param[i];
-
stmt.run(param, function(stmt_err, stmt_res){ // callback is called for each
insertion, so we shall count errors and success
-
stmt_ran++;
-
if (stmt_err) {
-
stmt_err_message +=' ## '+stmt_err;
-
} else {
-
stmt_success++;
+ // Check we
won't get over the maximum OPks allowed
+ if
(lime_max_opk_per_device > 0) {
+
db.get("SELECT COUNT(OPK_id) as OPk_count FROM Users as u INNER JOIN OPk as o
ON u.Uid=o.Uid WHERE UserId = ?;", userId, function (err, row) {
+
if (err) {
+
release();
+
returnError(enum_errorCodes.db_error, " Database error in postOPks by
"+userId+" : "+err2);
+
return;
}
-
if (stmt_ran == OPk_number) { // and react only when we reach correct count
-
if (stmt_ran != stmt_success) {
-
db.run("rollback")
-
release();
-
returnError(enum_errorCodes.db_error, "Error while trying to
insert OPk for user "+userId+". Backend says :"+stmt_err);
-
} else {
-
db.run("commit")
-
release();
-
returnOk(returnHeader);
-
}
+
+
var OPk_count = 0;
+
if (row != undefined) {
+
OPk_count = row['OPk_count'];
+
}
+
+
if (OPk_count+OPk_number > lime_max_opk_per_device) { // too much OPks
+
release();
+
returnError(enum_errorCodes.resource_limit_reached, userId+" is trying
to insert "+OPk_number+" OPks but server has a limit of
"+lime_max_opk_per_device+" and it already holds "+OPk_count);
+
return;
}
+
+
// parse all OPks to be inserted
+
var OPks_param = [];
+
for (let i = 0; i < OPk_number; i++) {
+
var OPk = body.slice(bufferIndex, bufferIndex +
keySizes[curveId]['X_pub']);
+
bufferIndex += keySizes[curveId]['X_pub'];
+
var OPk_id = body.readUInt32BE(bufferIndex); // OPk id is a 32 bits
unsigned integer in Big endian
+
bufferIndex += 4;
+
OPks_param.push([Uid, OPk, OPk_id]);
+
}
+
+
// bulk insert of OPks
+
var stmt_ran = 0;
+
var stmt_success = 0;
+
var stmt_err_message = '';
+
db.run("begin transaction");
+
var stmt = db.prepare("INSERT INTO OPk(Uid, OPk, OPk_id) VALUES(?,?,?);")
+
for (let i=0; i<OPks_param.length; i++) {
+
param = OPks_param[i];
+
stmt.run(param, function(stmt_err, stmt_res){ // callback is called for
each insertion, so we shall count errors and success
+
stmt_ran++;
+
if (stmt_err) {
+
stmt_err_message +=' ## '+stmt_err;
+
} else {
+
stmt_success++;
+
}
+
if (stmt_ran == OPk_number) { // and react only when we reach
correct count
+
if (stmt_ran != stmt_success) {
+
db.run("rollback")
+
release();
+
returnError(enum_errorCodes.db_error, "Error
while trying to insert OPk for user "+userId+". Backend says :"+stmt_err);
+
} else {
+
db.run("commit")
+
release();
+
returnOk(returnHeader);
+
}
+
}
+
});
+
}
+
return;
});
+ } else { //
Note : this code shall be factorized
+
+ //
parse all OPks to be inserted
+ var
OPks_param = [];
+ for
(let i = 0; i < OPk_number; i++) {
+
var OPk = body.slice(bufferIndex, bufferIndex + keySizes[curveId]['X_pub']);
+
bufferIndex += keySizes[curveId]['X_pub'];
+
var OPk_id = body.readUInt32BE(bufferIndex); // OPk id is a 32 bits unsigned
integer in Big endian
+
bufferIndex += 4;
+
OPks_param.push([Uid, OPk, OPk_id]);
+ }
+
+ // bulk
insert of OPks
+ var
stmt_ran = 0;
+ var
stmt_success = 0;
+ var
stmt_err_message = '';
+
db.run("begin transaction");
+ var
stmt = db.prepare("INSERT INTO OPk(Uid, OPk, OPk_id) VALUES(?,?,?);")
+ for
(let i=0; i<OPks_param.length; i++) {
+
param = OPks_param[i];
+
stmt.run(param, function(stmt_err, stmt_res){ // callback is called for each
insertion, so we shall count errors and success
+
stmt_ran++;
+
if (stmt_err) {
+
stmt_err_message +=' ## '+stmt_err;
+
} else {
+
stmt_success++;
+
}
+
if (stmt_ran == OPk_number) { // and react only when we reach correct
count
+
if (stmt_ran != stmt_success) {
+
db.run("rollback")
+
release();
+
returnError(enum_errorCodes.db_error, "Error while
trying to insert OPk for user "+userId+". Backend says :"+stmt_err);
+
} else {
+
db.run("commit")
+
release();
+
returnOk(returnHeader);
+
}
+
}
+
});
+ }
}
}
});
@@ -680,7 +763,7 @@
case enum_messageTypes.getSelfOPks:
console.log("Process a getSelfOPks Message from
"+userId);
// check we have a matching user in DB
- db.get("SELECT Uid FROM Users WHERE UserId =
?;", userId , function (errU, row) {
+ db.get("SELECT Uid FROM Users WHERE UserId =
?;", userId , function (err, row) {
if (row == undefined) { // user not
found in DB
returnError(enum_errorCodes.user_not_found, "Get Self OPks but "+userId+" not
found in db");
} else {
