noxleys 0.0.1-security → 1.0.0

package/lib/Utils/noise-handler.js

@@ -0,0 +1,157 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const { Boom: Boom } = require("@hapi/boom");
+const { proto: proto } = require("../../WAProto");
+const {
+    NOISE_MODE: NOISE_MODE,
+    WA_CERT_DETAILS: WA_CERT_DETAILS,
+} = require("../Defaults/constants");
+const { decodeBinaryNode: decodeBinaryNode } = require("../WABinary");
+const {
+    aesDecryptGCM: aesDecryptGCM,
+    aesEncryptGCM: aesEncryptGCM,
+    Curve: Curve,
+    hkdf: hkdf,
+    sha256: sha256,
+} = require("./crypto");
+const generateIV = (counter) => {
+    const iv = new ArrayBuffer(12);
+    new DataView(iv).setUint32(8, counter);
+    return new Uint8Array(iv);
+};
+const makeNoiseHandler = ({
+    keyPair: { private: privateKey, public: publicKey },
+    NOISE_HEADER: NOISE_HEADER,
+    logger: logger,
+    routingInfo: routingInfo,
+}) => {
+    logger = logger.child({ class: "ns" });
+    const authenticate = (data) => {
+        if (!isFinished) {
+            hash = sha256(Buffer.concat([hash, data]));
+        }
+    };
+    const encrypt = (plaintext) => {
+        const result = aesEncryptGCM(plaintext, encKey, generateIV(writeCounter), hash);
+        writeCounter += 1;
+        authenticate(result);
+        return result;
+    };
+    const decrypt = (ciphertext) => {
+        const iv = generateIV(isFinished ? readCounter : writeCounter);
+        const result = aesDecryptGCM(ciphertext, decKey, iv, hash);
+        if (isFinished) {
+            readCounter += 1;
+        } else {
+            writeCounter += 1;
+        }
+        authenticate(ciphertext);
+        return result;
+    };
+    const localHKDF = async (data) => {
+        const key = await hkdf(Buffer.from(data), 64, { salt: salt, info: "" });
+        return [key.slice(0, 32), key.slice(32)];
+    };
+    const mixIntoKey = async (data) => {
+        const [write, read] = await localHKDF(data);
+        salt = write;
+        encKey = read;
+        decKey = read;
+        readCounter = 0;
+        writeCounter = 0;
+    };
+    const finishInit = async () => {
+        const [write, read] = await localHKDF(new Uint8Array(0));
+        encKey = write;
+        decKey = read;
+        hash = Buffer.from([]);
+        readCounter = 0;
+        writeCounter = 0;
+        isFinished = true;
+    };
+    const data = Buffer.from(NOISE_MODE);
+    let hash = data.byteLength === 32 ? data : sha256(data);
+    let salt = hash;
+    let encKey = hash;
+    let decKey = hash;
+    let readCounter = 0;
+    let writeCounter = 0;
+    let isFinished = false;
+    let sentIntro = false;
+    let inBytes = Buffer.alloc(0);
+    authenticate(NOISE_HEADER);
+    authenticate(publicKey);
+    return {
+        encrypt: encrypt,
+        decrypt: decrypt,
+        authenticate: authenticate,
+        mixIntoKey: mixIntoKey,
+        finishInit: finishInit,
+        processHandshake: async ({ serverHello: serverHello }, noiseKey) => {
+            authenticate(serverHello.ephemeral);
+            await mixIntoKey(Curve.sharedKey(privateKey, serverHello.ephemeral));
+            const decStaticContent = decrypt(serverHello.static);
+            await mixIntoKey(Curve.sharedKey(privateKey, decStaticContent));
+            const certDecoded = decrypt(serverHello.payload);
+            const { intermediate: certIntermediate } = proto.CertChain.decode(certDecoded);
+            const { issuerSerial: issuerSerial } = proto.CertChain.NoiseCertificate.Details.decode(
+                certIntermediate.details
+            );
+            if (issuerSerial !== WA_CERT_DETAILS.SERIAL) {
+                throw new Boom("certification match failed", { statusCode: 400 });
+            }
+            const keyEnc = encrypt(noiseKey.public);
+            await mixIntoKey(Curve.sharedKey(noiseKey.private, serverHello.ephemeral));
+            return keyEnc;
+        },
+        encodeFrame: (data) => {
+            if (isFinished) {
+                data = encrypt(data);
+            }
+            let header;
+            if (routingInfo) {
+                header = Buffer.alloc(7);
+                header.write("ED", 0, "utf8");
+                header.writeUint8(0, 2);
+                header.writeUint8(1, 3);
+                header.writeUint8(routingInfo.byteLength >> 16, 4);
+                header.writeUint16BE(routingInfo.byteLength & 65535, 5);
+                header = Buffer.concat([header, routingInfo, NOISE_HEADER]);
+            } else {
+                header = Buffer.from(NOISE_HEADER);
+            }
+            const introSize = sentIntro ? 0 : header.length;
+            const frame = Buffer.alloc(introSize + 3 + data.byteLength);
+            if (!sentIntro) {
+                frame.set(header);
+                sentIntro = true;
+            }
+            frame.writeUInt8(data.byteLength >> 16, introSize);
+            frame.writeUInt16BE(65535 & data.byteLength, introSize + 1);
+            frame.set(data, introSize + 3);
+            return frame;
+        },
+        decodeFrame: async (newData, onFrame) => {
+            const getBytesSize = () => {
+                if (inBytes.length >= 3) {
+                    return (inBytes.readUInt8() << 16) | inBytes.readUInt16BE(1);
+                }
+            };
+            inBytes = Buffer.concat([inBytes, newData]);
+            logger.trace(`recv ${newData.length} bytes, total recv ${inBytes.length} bytes`);
+            let size = getBytesSize();
+            while (size && inBytes.length >= size + 3) {
+                let frame = inBytes.slice(3, size + 3);
+                inBytes = inBytes.slice(size + 3);
+                if (isFinished) {
+                    const result = decrypt(frame);
+                    frame = await decodeBinaryNode(result);
+                }
+                logger.trace({ msg: frame?.attrs?.id }, "recv frame");
+                onFrame(frame);
+                size = getBytesSize();
+            }
+        },
+    };
+};
+module.exports = { makeNoiseHandler: makeNoiseHandler };

package/lib/Utils/pre-key-manager.js

@@ -0,0 +1,86 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const { default: PQueue } = require("p-queue");
+class PreKeyManager {
+    constructor(store, logger) {
+        this.store = store;
+        this.logger = logger;
+        this.queues = new Map();
+    }
+    getQueue(keyType) {
+        if (!this.queues.has(keyType)) {
+            this.queues.set(keyType, new PQueue({ concurrency: 1 }));
+        }
+        return this.queues.get(keyType);
+    }
+    async processOperations(data, keyType, transactionCache, mutations, isInTransaction) {
+        const keyData = data[keyType];
+        if (!keyData) return;
+        return this.getQueue(keyType).add(async () => {
+            transactionCache[keyType] = transactionCache[keyType] || {};
+            mutations[keyType] = mutations[keyType] || {};
+            const deletions = [];
+            const updates = {};
+            for (const keyId in keyData) {
+                if (keyData[keyId] === null) {
+                    deletions.push(keyId);
+                } else {
+                    updates[keyId] = keyData[keyId];
+                }
+            }
+            if (Object.keys(updates).length > 0) {
+                Object.assign(transactionCache[keyType], updates);
+                Object.assign(mutations[keyType], updates);
+            }
+            if (deletions.length > 0) {
+                await this.processDeletions(
+                    keyType,
+                    deletions,
+                    transactionCache,
+                    mutations,
+                    isInTransaction
+                );
+            }
+        });
+    }
+    async processDeletions(keyType, ids, transactionCache, mutations, isInTransaction) {
+        if (isInTransaction) {
+            for (const keyId of ids) {
+                if (transactionCache[keyType]?.[keyId]) {
+                    transactionCache[keyType][keyId] = null;
+                    mutations[keyType][keyId] = null;
+                } else {
+                    this.logger.warn(
+                        `Skipping deletion of non-existent ${keyType} in transaction: ${keyId}`
+                    );
+                }
+            }
+        } else {
+            const existingKeys = await this.store.get(keyType, ids);
+            for (const keyId of ids) {
+                if (existingKeys[keyId]) {
+                    transactionCache[keyType][keyId] = null;
+                    mutations[keyType][keyId] = null;
+                } else {
+                    this.logger.warn(`Skipping deletion of non-existent ${keyType}: ${keyId}`);
+                }
+            }
+        }
+    }
+    async validateDeletions(data, keyType) {
+        const keyData = data[keyType];
+        if (!keyData) return;
+        return this.getQueue(keyType).add(async () => {
+            const deletionIds = Object.keys(keyData).filter((id) => keyData[id] === null);
+            if (deletionIds.length === 0) return;
+            const existingKeys = await this.store.get(keyType, deletionIds);
+            for (const keyId of deletionIds) {
+                if (!existingKeys[keyId]) {
+                    this.logger.warn(`Skipping deletion of non-existent ${keyType}: ${keyId}`);
+                    delete data[keyType][keyId];
+                }
+            }
+        });
+    }
+}
+module.exports = { PreKeyManager: PreKeyManager };