whalibmob 5.14.16 → 5.14.18

package/lib/Client.js

@@ -2327,6 +2327,56 @@ class WhalibmobClient extends EventEmitter {
     return out;
   }
 
+  // Every address a group participant might be filed under.
+  //
+  // Deliberately not _signalJidCandidates: that one starts from the stanza's
+  // `from`, which in a group is the group itself and is not a Signal address at
+  // all. Here the sender is the only subject, under both of the names the same
+  // person answers to.
+  _senderAddressCandidates(senderJid, senderPn) {
+    const out = [];
+    const add = (jid) => {
+      if (!jid) return;
+      const str = String(jid);
+      if (str && !out.includes(str)) out.push(str);
+    };
+    add(senderJid);
+    add(this._counterpartJid(senderJid));
+    add(senderPn);
+    add(this._counterpartJid(senderPn));
+    return out;
+  }
+
+  // The sender key for a group message, under whichever name it was filed.
+  //
+  // A SenderKeyName keeps the user and the device and drops the domain, so the
+  // LID form and the phone form of one person are two different names for one
+  // key. Which of them a message arrives under is the server's choice and it
+  // varies, so a key stored under the name one stanza used is invisible to the
+  // next stanza that names the other. That is the whole of "No session found to
+  // decrypt message" on a group we have only just joined.
+  async _senderKeyDecryptWithCandidates(groupJid, candidates, cipherBuf, id) {
+    let firstErr = null;
+    for (let i = 0; i < candidates.length; i++) {
+      try {
+        const plaintext = await this._signal.senderKeyDecrypt(groupJid, candidates[i], cipherBuf);
+        if (i > 0) {
+          _whaDbg('[DBG] GROUP_DECRYPT id=' + id + ' recovered under ' + candidates[i] +
+            ' after ' + candidates[0] + ' held no sender key');
+        }
+        return plaintext;
+      } catch (err) {
+        if (!firstErr) firstErr = err;
+        // Only "we hold nothing under this name" is worth asking another name
+        // about. A record that exists and refuses the message is a different
+        // problem, and the answer to that is a retry receipt, not another
+        // lookup.
+        if (!/no session found|no senderkeyrecord/i.test(String(err && err.message))) break;
+      }
+    }
+    throw firstErr || new Error('senderKeyDecrypt: no address to try');
+  }
+
   // Try each address in turn and return the first plaintext.
   //
   // A failed attempt leaves nothing behind — libsignal either returns the
@@ -2347,10 +2397,21 @@ class WhalibmobClient extends EventEmitter {
         return plaintext;
       } catch (err) {
         if (!firstErr) firstErr = err;
-        // Only a missing session is worth asking a different address about.
-        // A session that exists and refuses the ciphertext is a different
-        // problem, and the answer is a retry receipt, not another lookup.
-        if (!/no matching sessions|no session/i.test(String(err && err.message))) break;
+        // Only "this is not where the session lives" is worth asking a
+        // different address about. A session that exists and refuses the
+        // ciphertext is a different problem, and the answer to that is a retry
+        // receipt, not another lookup.
+        //
+        // "Invalid PreKey ID" belongs in the first group, which is not obvious.
+        // A sender keeps sending pkmsg until it hears back, and every one of
+        // them names the same pre-key — so once the first has been opened, that
+        // pre-key is spent. Meeting one under an address that holds no session
+        // is therefore not a mismatched key: it is this address having no
+        // record of the session the pre-key was already spent on, which is
+        // exactly the case for looking under the other name. Without it the
+        // search stopped at the first address and a group we had just joined
+        // stayed unreadable — which is how this was found.
+        if (!/no matching sessions|no session|invalid prekey/i.test(String(err && err.message))) break;
       }
     }
 
@@ -2458,8 +2519,13 @@ class WhalibmobClient extends EventEmitter {
       ? skmsgNode.content
       : Buffer.from(skmsgNode.content || '');
 
+    const senderCandidates = this._senderAddressCandidates(participant);
+    _whaDbg('[DBG] GROUP_DECRYPT id=' + id + ' group=' + from + ' sender=' + participant +
+      (senderCandidates.length > 1 ? ' alts=' + senderCandidates.slice(1).join(',') : '') +
+      ' cipherLen=' + cipherBuf.length);
+
     // Returned for the same reason as the direct-message path above.
-    return this._signal.senderKeyDecrypt(from, participant, cipherBuf)
+    return this._senderKeyDecryptWithCandidates(from, senderCandidates, cipherBuf, id)
       .then(plaintext => {
         this._resolveRetry(id);
         const decoded = this._decodeMsg(plaintext);
@@ -2525,19 +2591,43 @@ class WhalibmobClient extends EventEmitter {
       const encType   = enc.attrs && enc.attrs.type;
       const cipherBuf = Buffer.isBuffer(enc.content) ? enc.content : Buffer.from(enc.content || '');
 
+      // The sender key rides inside a 1-to-1 message, so opening it needs the
+      // session with that participant — and the session may be filed under the
+      // other name they answer to. Addressing only the name this stanza used is
+      // how joining a group ended with every message failing: the distribution
+      // could not be opened, so no sender key was ever stored, so every skmsg
+      // after it had nothing to decrypt with.
+      const senderCandidates = this._senderAddressCandidates(senderJid);
+
       tasks.push(
-        this._signal.decrypt(senderJid, encType, cipherBuf)
+        this._decryptWithCandidates(senderCandidates, encType, cipherBuf, 'skdm')
           .then(async decrypted => {
             const decoded = this._decodeMsg(decrypted);
+            // Filed under the name this stanza used, which is the name the
+            // group message that follows will look it up under.
             if (decoded && decoded.type === 'senderKeyDistribution' &&
                 decoded.groupId && decoded.axolotlBytes) {
               await this._signal.processSKDM(decoded.groupId, senderJid, decoded.axolotlBytes);
+              _whaDbg('[DBG] SKDM_DIST_STORED group=' + decoded.groupId + ' sender=' + senderJid);
             } else if (decoded && decoded.skdm &&
                        decoded.skdm.groupId && decoded.skdm.axolotlBytes) {
               await this._signal.processSKDM(decoded.skdm.groupId, senderJid, decoded.skdm.axolotlBytes);
+              _whaDbg('[DBG] SKDM_DIST_STORED group=' + decoded.skdm.groupId + ' sender=' + senderJid);
+            } else {
+              _whaDbg('[DBG] SKDM_DIST_NONE sender=' + senderJid +
+                ' — the <to> entry for us carried no distribution');
             }
           })
-          .catch(() => {})
+          // Said out loud rather than swallowed. This failing is the reason the
+          // group messages that follow cannot be read, and it used to leave no
+          // trace at all — only the downstream failures were visible, which
+          // pointed at the wrong thing.
+          .catch(err => {
+            _whaDbg('[DBG] SKDM_DIST_ERR sender=' + senderJid +
+              ' tried=[' + senderCandidates.join(',') + ']' +
+              ' err=' + (err && err.message));
+            this.emit('skdm_error', { group: groupJid, sender: senderJid, err });
+          })
       );
     }
 

package/lib/signal/SenderKey.js

@@ -95,6 +95,15 @@ class SenderKeyStore {
     this._dirty     = false;
     this._rev       = 0;
     this._saveTimer = null;
+    // Same three as in SignalStore, for the same reason. The debounced write
+    // here was never cancelled or awaited either, so a synchronous flush could
+    // be overtaken by an older one still in flight — and this file is where the
+    // group sender keys live, including the record of who has already been sent
+    // ours. _writtenRev is what the file holds; _writing keeps the async writes
+    // to one at a time; _writeAgain remembers one that came due mid-write.
+    this._writtenRev = 0;
+    this._writing    = false;
+    this._writeAgain = false;
 
     // Detachable, for the same reason as in SignalStore: a replaced store must
     // not keep three process listeners alive for the rest of the run.
@@ -115,7 +124,14 @@ class SenderKeyStore {
       process.removeListener('SIGTERM', this._onSigTerm);
       process.removeListener('SIGINT',  this._onSigInt);
     } catch (_) {}
-    this._filePath = null;
+    // Clearing the path also tells a write still in flight to stand down — it
+    // checks the path it started with before renaming. The caller detaches in
+    // order to move these files, so leave nothing of ours in the directory it
+    // is about to rename.
+    const stale = this._filePath ? [this._tmpPath(true), this._tmpPath(false)] : [];
+    this._filePath   = null;
+    this._writeAgain = false;
+    for (const f of stale) { try { fs.unlinkSync(f); } catch (_) {} }
   }
 
   attachFile(filePath) {
@@ -150,14 +166,52 @@ class SenderKeyStore {
     }
   }
 
+  // Everything that is persisted, as it goes on disk.
+  _snapshot() {
+    return JSON.stringify(this._data, null, 2);
+  }
+
+  // Where a write assembles the file before it becomes the file. The sync and
+  // async writers get separate names so neither can find the other's
+  // half-written temp file under it.
+  _tmpPath(sync) {
+    return this._filePath + (sync ? '.stmp' : '.atmp');
+  }
+
+  // A rename replaces the file, so the one that lands carries the temp file's
+  // permissions and not the old file's. This holds group signing keys, and an
+  // operator who tightened its mode would find it loosened again by the next
+  // write — so carry across whatever the file already had.
+  _modeOf(file) {
+    try { return fs.statSync(file).mode & 0o777; } catch (_) { return null; }
+  }
+
   _flushSync() {
     if (!this._dirty || !this._filePath) return;
     if (this._saveTimer) { clearTimeout(this._saveTimer); this._saveTimer = null; }
+    const rev  = this._rev;
+    const file = this._filePath;
+    const tmp  = this._tmpPath(true);
     try {
-      fs.mkdirSync(path.dirname(this._filePath), { recursive: true });
-      fs.writeFileSync(this._filePath, JSON.stringify(this._data, null, 2));
-      this._dirty = false;
-    } catch (_) {}
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      const mode = this._modeOf(file);
+      fs.writeFileSync(tmp, this._snapshot(), mode !== null
+        ? { encoding: 'utf8', mode } : 'utf8');
+      if (mode !== null) fs.chmodSync(tmp, mode);
+      fs.renameSync(tmp, file);
+      // Take the async writer's temp file away from it. Its "have I been
+      // overtaken?" check runs on this thread, but the rename it authorises is
+      // carried out on a pool thread afterwards — and at exit the pool is
+      // usually busy, so that rename can still be queued now and execute during
+      // teardown, putting this snapshot back to an older one. Its callback
+      // never runs there, so nothing would notice. Removing the source makes
+      // that queued rename fail ENOENT instead.
+      try { fs.unlinkSync(this._tmpPath(false)); } catch (_) {}
+      this._writtenRev = rev;
+      this._dirty      = false;
+    } catch (_) {
+      try { fs.unlinkSync(tmp); } catch (_) {}
+    }
   }
 
   _save() {
@@ -167,18 +221,65 @@ class SenderKeyStore {
     if (this._saveTimer) clearTimeout(this._saveTimer);
     this._saveTimer = setTimeout(() => {
       this._saveTimer = null;
-      // The revision this write is a snapshot of.
-      const rev  = this._rev;
-      const data = JSON.stringify(this._data, null, 2);
-      fs.mkdirSync(path.dirname(this._filePath), { recursive: true });
-      // Only clear the flag when nothing changed while the write was running.
-      // A mutation that arrived after the snapshot is not in `data`, and its
-      // own debounce timer may never fire — clearing here would make the
-      // exit-time _flushSync() skip it and lose it.
-      fs.writeFile(this._filePath, data, 'utf8', () => {
+      this._writeAsync();
+    }, _SK_DEBOUNCE_MS);
+  }
+
+  // The debounced write itself: temp file, then rename into place, and only if
+  // nothing newer reached the disk in the meantime.
+  _writeAsync() {
+    if (!this._filePath || !this._dirty) return;
+    // Fold a write that comes due mid-write into the one already running rather
+    // than starting a second one over the same temp file.
+    if (this._writing) { this._writeAgain = true; return; }
+
+    // Read once, here: by the time the callbacks run either may have moved on,
+    // and that is exactly what they have to notice.
+    const rev  = this._rev;
+    const file = this._filePath;
+    const tmp  = this._tmpPath(false);
+
+    let data, mode;
+    try {
+      fs.mkdirSync(path.dirname(file), { recursive: true });
+      mode = this._modeOf(file);
+      data = this._snapshot();
+    } catch (_) { return; }
+
+    this._writing    = true;
+    this._writeAgain = false;
+
+    const finish = () => {
+      this._writing = false;
+      // A write came due while this one was running and was folded into it.
+      // Every other mutation armed its own debounce timer, which is still
+      // pending and will write what is current.
+      if (this._writeAgain && this._dirty && this._filePath) this._writeAsync();
+    };
+    const abandon = () => { fs.unlink(tmp, () => {}); finish(); };
+
+    // Created already tight rather than widening the window in which a file of
+    // signing keys sits at the umask default.
+    fs.writeFile(tmp, data, mode !== null ? { encoding: 'utf8', mode } : 'utf8', (err) => {
+      if (err) return abandon();
+      // detach() let the file go, or a synchronous flush wrote newer state
+      // while this one was running. Renaming now would put an older snapshot
+      // back and take every sender key written since with it.
+      if (file !== this._filePath || rev <= this._writtenRev) return abandon();
+      if (mode !== null) { try { fs.chmodSync(tmp, mode); } catch (_) {} }
+      fs.rename(tmp, file, (renameErr) => {
+        if (renameErr) return abandon();
+        // Never walk it backwards: a synchronous flush can land — and record a
+        // higher revision — between the check above and this callback.
+        if (rev > this._writtenRev) this._writtenRev = rev;
+        // Only clear the flag when nothing changed while the write was running.
+        // A mutation that arrived after the snapshot is not in `data`, and
+        // clearing here would make the exit-time _flushSync() skip it and lose
+        // it.
         if (this._rev === rev) this._dirty = false;
+        finish();
       });
-    }, _SK_DEBOUNCE_MS);
+    });
   }
 
   _key(groupId, senderId) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "whalibmob",
-  "version": "5.14.16",
+  "version": "5.14.18",
   "description": "WhatsApp library for interaction with WhatsApp Mobile API and web ",
   "author": "Kunboruto20",
   "main": "index.js",