1  /*
   2   * Copyright (c) 2011-2014 Apple Inc. All Rights Reserved.
   3   *
   4   * @APPLE_LICENSE_HEADER_START@
   5   * 
   6   * This file contains Original Code and/or Modifications of Original Code
   7   * as defined in and that are subject to the Apple Public Source License
   8   * Version 2.0 (the 'License'). You may not use this file except in
   9   * compliance with the License. Please obtain a copy of the License at
  10   * http://www.opensource.apple.com/apsl/ and read it before using this
  11   * file.
  12   * 
  13   * The Original Code and all software distributed under the License are
  14   * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15   * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16   * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17   * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18   * Please see the License for the specific language governing rights and
  19   * limitations under the License.
  20   * 
  21   * @APPLE_LICENSE_HEADER_END@
  22   */
  23  
  24  
  25  #include <stdint.h>
  26  #include <sys/types.h>
  27  #include <CoreFoundation/CFDate.h>
  28  
  29  #include "SecOTRSession.h"
  30  
  31  #include "SecOTRMath.h"
  32  #include "SecOTRDHKey.h"
  33  #include "SecOTRSessionPriv.h"
  34  #include "SecOTRPackets.h"
  35  #include "SecOTRPacketData.h"
  36  #include "SecOTRIdentityPriv.h"
  37  
  38  #include <utilities/SecCFWrappers.h>
  39  
  40  #include <CoreFoundation/CFRuntime.h>
  41  #include <CoreFoundation/CFString.h>
  42  
  43  #include <Security/SecBasePriv.h>
  44  #include <Security/SecRandom.h>
  45  #include <Security/SecBase64.h>
  46  #include <Security/SecKeyPriv.h>
  47  
  48  #include <Security/SecureObjectSync/SOSPeerInfo.h>
  49  #include "keychain/SecureObjectSync/SOSCircle.h"
  50  #include <Security/SecureObjectSync/SOSCloudCircle.h>
  51  #include "keychain/SecureObjectSync/SOSInternal.h"
  52  #include "keychain/SecureObjectSync/SOSUserKeygen.h"
  53  
  54  #include <AssertMacros.h>
  55  
  56  #include <corecrypto/cchmac.h>
  57  #include <corecrypto/ccsha2.h>
  58  #include <corecrypto/ccsha1.h>
  59  
  60  #include <string.h>
  61  #include <stdlib.h>
  62  
  63  #include <syslog.h>
  64  #include <os/activity.h>
  65  
  66  #include <utilities/array_size.h>
  67  
  68  #include <ipc/securityd_client.h>
  69  #include <Security/SecuritydXPC.h>
  70  
  71  CFGiblisFor(SecOTRSession);
  72  
  73  static uint64_t setup_defaults_settings(){
  74      
  75      Boolean keyExistsAndHasValue = false;
  76      uint64_t seconds;
  77      seconds = CFPreferencesGetAppIntegerValue(CFSTR("OTR"), CFSTR("com.apple.security"), &keyExistsAndHasValue);
  78      secdebug("OTR", "Retrieving OTR default settings was success? %d value retrieved: %llu", keyExistsAndHasValue, seconds);
  79      return keyExistsAndHasValue ? seconds : (kSecondsPerMinute * 15); //15 minutes by default
  80  }
  81  
  82  static uint64_t SecOTRGetDefaultsWriteSeconds(void) {
  83      static dispatch_once_t sdOnceToken;
  84      static uint64_t seconds;
  85      
  86      dispatch_once(&sdOnceToken, ^{
  87          seconds = setup_defaults_settings();
  88      });
  89      
  90      return seconds;
  91  }
  92  
  93  static void SecOTRSEnableTimeToRoll(SecOTRSessionRef session){
  94      CFAbsoluteTime now = CFAbsoluteTimeGetCurrent();
  95      CFAbsoluteTime nextTimeToRoll = now + session->_stallSeconds;
  96      
  97      if(session->_timeToRoll == 0 || session->_timeToRoll > nextTimeToRoll){
  98          session->_timeToRoll = nextTimeToRoll;
  99      }
 100  }
 101  
 102  static void SecOTRSExpireCachedKeysForFullKey(SecOTRSessionRef session, SecOTRFullDHKeyRef myKey)
 103  {
 104      for(int i = 0; i < kOTRKeyCacheSize; ++i)
 105      {
 106          if (0 == timingsafe_bcmp(session->_keyCache[i]._fullKeyHash, SecFDHKGetHash(myKey), CCSHA1_OUTPUT_SIZE)) {
 107              CFDataAppendBytes(session->_macKeysToExpose, session->_keyCache[i]._receiveMacKey, sizeof(session->_keyCache[i]._receiveMacKey));
 108              bzero(&session->_keyCache[i], sizeof(session->_keyCache[i]));
 109          }
 110      }
 111  }
 112  
 113  static void SecOTRSExpireCachedKeysForPublicKey(SecOTRSessionRef session, SecOTRPublicDHKeyRef theirKey)
 114  {
 115      for(int i = 0; i < kOTRKeyCacheSize; ++i)
 116      {
 117          if (0 == timingsafe_bcmp(session->_keyCache[i]._publicKeyHash, SecPDHKGetHash(theirKey), CCSHA1_OUTPUT_SIZE)) {
 118              CFDataAppendBytes(session->_macKeysToExpose, session->_keyCache[i]._receiveMacKey, sizeof(session->_keyCache[i]._receiveMacKey));
 119              
 120              bzero(&session->_keyCache[i], sizeof(session->_keyCache[i]));
 121          }
 122      }
 123  }
 124  
 125  static OSStatus SecOTRGenerateNewProposedKey(SecOTRSessionRef session)
 126  {
 127      SecOTRSExpireCachedKeysForFullKey(session, session->_myKey);
 128      
 129      // Swap the keys so we know the current key.
 130      {
 131          SecOTRFullDHKeyRef oldKey = session->_myKey;
 132          session->_myKey = session->_myNextKey;
 133          session->_myNextKey = oldKey;
 134      }
 135      
 136      // Derive a new next key by regenerating over the old key.
 137      OSStatus ret = SecFDHKNewKey(session->_myNextKey);
 138      
 139      session->_keyID += 1;
 140  
 141      return ret;
 142  }
 143  
 144  
 145  static void SecOTRSHandleProposalAcknowledge(SecOTRSessionRef session){
 146      if(session->_missedAck){
 147          SecOTRGenerateNewProposedKey(session);
 148          session->_missedAck = false;
 149      }
 150      else{
 151          session->_receivedAck = true;
 152          SecOTRSEnableTimeToRoll(session);
 153      }
 154  }
 155  
 156  static void SecOTRSRollIfTime(SecOTRSessionRef session){
 157      
 158      CFAbsoluteTime now = CFAbsoluteTimeGetCurrent();
 159      CFAbsoluteTime longestTimeToRoll = now + session->_stallSeconds;
 160      
 161      //in case time to roll becomes too large we're going to roll now!
 162      if(session->_timeToRoll < now || session->_timeToRoll > longestTimeToRoll){
 163          SOSOTRSRoll(session);
 164          session->_timeToRoll = 0;
 165      }
 166  }
 167  
 168  
 169  static OTRMessageType SecOTRSGetMessageType(CFDataRef message)
 170  {
 171      OTRMessageType type = kInvalidMessage;
 172  
 173      CFDataRef decodedBytes = SecOTRCopyIncomingBytes(message);
 174  
 175      const uint8_t *bytes = CFDataGetBytePtr(decodedBytes);
 176      size_t size = CFDataGetLength(decodedBytes);
 177  
 178      if (noErr != ReadHeader(&bytes, &size, &type)) {
 179          uint8_t firstByte = *CFDataGetBytePtr(decodedBytes);
 180          switch (firstByte) {
 181              case kOddCompactDataMessage:
 182              case kEvenCompactDataMessage:
 183              case kOddCompactDataMessageWithHashes:
 184              case kEvenCompactDataMessageWithHashes:
 185                  type = firstByte;
 186                  break;
 187                  
 188              default:
 189                  break;
 190          }
 191      }
 192  
 193      CFReleaseNull(decodedBytes);
 194  
 195      return type;
 196  }
 197  
 198  #if DEBUG
 199  
 200  static CFStringRef SecOTRCacheElementCopyDescription(SecOTRCacheElement *keyCache){
 201      __block CFStringRef description = NULL;
 202      BufferPerformWithHexString(keyCache->_fullKeyHash, sizeof(keyCache->_fullKeyHash), ^(CFStringRef fullKeyHashString) {
 203          BufferPerformWithHexString(keyCache->_publicKeyHash,sizeof(keyCache->_publicKeyHash), ^(CFStringRef publicKeyHashString) {
 204              description = CFStringCreateWithFormat(kCFAllocatorDefault, NULL, CFSTR("fkh: [%@], pkh: [%@], c: %llu tc: %llu"), fullKeyHashString, publicKeyHashString, keyCache->_counter, keyCache->_theirCounter);
 205          });
 206      });
 207      return description;
 208  }
 209  
 210  #endif
 211  const char *SecOTRPacketTypeString(CFDataRef message)
 212  {
 213      if (!message) return "NoMessage";
 214      switch (SecOTRSGetMessageType(message)) {
 215          case kDHMessage:                        return "DHMessage (0x02)";
 216          case kDataMessage:                      return "DataMessage (0x03)";
 217          case kDHKeyMessage:                     return "DHKeyMessage (0x0A)";
 218          case kRevealSignatureMessage:           return "RevealSignatureMessage (0x11)";
 219          case kSignatureMessage:                 return "SignatureMessage (0x12)";
 220          case kEvenCompactDataMessage:           return "kEvenCompactDatamessage (0x20)";
 221          case kOddCompactDataMessage:            return "kOddCompactDataMessage (0x21)";
 222          case kEvenCompactDataMessageWithHashes: return "kEvenCompactDatamessage (0x30)";
 223          case kOddCompactDataMessageWithHashes:  return "kOddCompactDataMessage (0x31)";
 224          case kInvalidMessage:                   return "InvalidMessage (0xFF)";
 225          default:                                return "UnknownMessage";
 226      }
 227  }
 228  
 229  static const char *SecOTRAuthStateString(SecOTRAuthState authState)
 230  {
 231      switch (authState) {
 232          case kIdle:                     return "Idle";
 233          case kAwaitingDHKey:            return "AwaitingDHKey";
 234          case kAwaitingRevealSignature:  return "AwaitingRevealSignature";
 235          case kAwaitingSignature:        return "AwaitingSignature";
 236          case kDone:                     return "Done";
 237          default:                        return "InvalidState";
 238      }
 239  }
 240  
 241  static CF_RETURNS_RETAINED CFStringRef SecOTRSessionCopyFormatDescription(CFTypeRef cf, CFDictionaryRef formatOptions) {
 242      SecOTRSessionRef session = (SecOTRSessionRef)cf;
 243      
 244      CFAbsoluteTime now = CFAbsoluteTimeGetCurrent();
 245      
 246      return CFStringCreateWithFormat(kCFAllocatorDefault,NULL,CFSTR("<%s %s %s %s%s%s%s %d:%d %s%s %llu %s%s%s%s>"),
 247                                      SecOTRAuthStateString(session->_state),
 248                                      session->_compactAppleMessages ? "C" :"c",
 249                                      session->_includeHashes ? "I" : "i",
 250                                      session->_me ? "F" : "f",
 251                                      session->_them ? "P" : "p",
 252                                      session->_receivedDHMessage ? "D" : "d",
 253                                      session->_receivedDHKeyMessage ? "K" : "k",
 254                                      session->_keyID,
 255                                      session->_theirKeyID,
 256                                      session->_theirPreviousKey ? "P" : "p",
 257                                      session->_theirKey ? "T" : "t",
 258                                      session->_stallSeconds,
 259                                      session->_missedAck ? "M" : "m",
 260                                      session->_receivedAck ? "R" : "r",
 261                                      session->_stallingTheirRoll ? "S" : "s",
 262                                      (session->_timeToRoll > now && session->_timeToRoll != 0) ? "E" : "e");
 263  }
 264  
 265  static void SecOTRSessionDestroy(CFTypeRef cf) {
 266      SecOTRSessionRef session = (SecOTRSessionRef)cf;
 267  
 268      CFReleaseNull(session->_receivedDHMessage);
 269      CFReleaseNull(session->_receivedDHKeyMessage);
 270  
 271      CFReleaseNull(session->_me);
 272      CFReleaseNull(session->_myKey);
 273      CFReleaseNull(session->_myNextKey);
 274  
 275      CFReleaseNull(session->_them);
 276      CFReleaseNull(session->_theirKey);
 277      CFReleaseNull(session->_theirPreviousKey);
 278  
 279      CFReleaseNull(session->_macKeysToExpose);
 280  
 281      dispatch_release(session->_queue);
 282  }
 283  
 284  static void SecOTRSessionResetInternal(SecOTRSessionRef session)
 285  {
 286      session->_state = kIdle;
 287      
 288      CFReleaseNull(session->_receivedDHMessage);
 289      CFReleaseNull(session->_receivedDHKeyMessage);
 290  
 291      session->_keyID = 0;
 292      CFReleaseNull(session->_myKey);
 293      CFReleaseNull(session->_myNextKey);
 294      //session->_myNextKey = SecOTRFullDHKCreate(kCFAllocatorDefault);
 295      session->_theirKeyID = 0;
 296      CFReleaseNull(session->_theirKey);
 297      CFReleaseNull(session->_theirPreviousKey);
 298      CFReleaseNull(session->_macKeysToExpose);
 299      session->_macKeysToExpose = CFDataCreateMutable(kCFAllocatorDefault, 0);
 300  
 301      bzero(session->_keyCache, sizeof(session->_keyCache));
 302  }
 303  
 304  int SecOTRSGetKeyID(SecOTRSessionRef session){
 305      return session->_keyID;
 306  }
 307  
 308  int SecOTRSGetTheirKeyID(SecOTRSessionRef session){
 309      return session->_theirKeyID;
 310  }
 311  
 312  void SecOTRSessionReset(SecOTRSessionRef session)
 313  {
 314      dispatch_sync_f(session->_queue, session, (dispatch_function_t) SecOTRSessionResetInternal);
 315  }
 316  
 317  
 318  static void SecOTRPIPerformWithSerializationString(SecOTRPublicIdentityRef id, void (^action)(CFStringRef string)) {
 319      CFMutableDataRef idData = CFDataCreateMutable(kCFAllocatorDefault, 0);
 320      SecOTRPIAppendSerialization(id, idData, NULL);
 321      CFDataPerformWithHexString(idData, action);
 322      CFReleaseNull(idData);
 323  }
 324  
 325  SecOTRSessionRef SecOTRSessionCreateFromID(CFAllocatorRef allocator,
 326                                             SecOTRFullIdentityRef myID,
 327                                             SecOTRPublicIdentityRef theirID)
 328  {
 329      SecOTRSessionRef newID = CFTypeAllocate(SecOTRSession, struct _SecOTRSession, allocator);
 330  
 331      (void)SecOTRGetDefaultsWriteSeconds();
 332      newID->_queue = dispatch_queue_create("OTRSession", DISPATCH_QUEUE_SERIAL);
 333  
 334      newID->_me = CFRetainSafe(myID);
 335      newID->_them = CFRetainSafe(theirID);
 336      newID->_receivedDHMessage = NULL;
 337      newID->_receivedDHKeyMessage = NULL;
 338      newID->_myKey = NULL;
 339      newID->_myNextKey = NULL;
 340      newID->_theirKey = NULL;
 341      newID->_theirPreviousKey = NULL;
 342      newID->_macKeysToExpose = NULL;
 343      newID->_textOutput = false;
 344      newID->_compactAppleMessages = false;
 345      newID->_includeHashes = false;
 346      
 347      newID->_timeToRoll =  0;
 348      newID->_stallingTheirRoll = false;
 349      newID->_stallSeconds = 0;
 350      newID->_missedAck = true;
 351      newID->_receivedAck = false;
 352      
 353      SecOTRSessionResetInternal(newID);
 354  
 355      {
 356          SecOTRPublicIdentityRef myPublicID = SecOTRPublicIdentityCopyFromPrivate(kCFAllocatorDefault, newID->_me, NULL);
 357          SecOTRPIPerformWithSerializationString(myPublicID, ^(CFStringRef myIDString) {
 358              SecOTRPIPerformWithSerializationString(newID->_them, ^(CFStringRef theirIDString) {
 359                  secnotice("otr", "%@ Creating with M: %@, T: %@", newID, myIDString, theirIDString);
 360              });
 361          });
 362          CFReleaseNull(myPublicID);
 363      }
 364  
 365      return newID;
 366  }
 367  
 368  SecOTRSessionRef SecOTRSessionCreateFromIDAndFlags(CFAllocatorRef allocator,
 369                                             SecOTRFullIdentityRef myID,
 370                                             SecOTRPublicIdentityRef theirID,
 371                                             uint32_t flags)
 372  {
 373      
 374      uint64_t seconds = SecOTRGetDefaultsWriteSeconds();
 375      
 376      SecOTRSessionRef newID = SecOTRSessionCreateFromID(allocator, myID, theirID);
 377      if (flags & kSecOTRSendTextMessages) {
 378          newID->_textOutput = true;
 379      }
 380      if (flags & kSecOTRUseAppleCustomMessageFormat) {
 381          newID->_compactAppleMessages = true;
 382      }
 383      if(flags & kSecOTRIncludeHashesInMessages)
 384      {
 385          newID->_includeHashes = true;
 386      }
 387      if(flags & kSecOTRSlowRoll)
 388      {
 389          newID->_stallSeconds = seconds;
 390      }
 391      
 392      return newID;
 393  }
 394  
 395  static uint64_t constant_zero = 0;
 396  
 397  static bool hashIsZero(uint8_t hash[CCSHA1_OUTPUT_SIZE])
 398  {
 399      bool isZero = true;
 400      for(size_t byte = 0; isZero && byte < CCSHA1_OUTPUT_SIZE; ++byte)
 401          isZero = (0 == hash[byte]);
 402      
 403      return isZero;
 404  }
 405  
 406  static bool SOSOTRSCacheEntryIsEmpty(SecOTRCacheElement *element)
 407  {
 408      return hashIsZero(element->_fullKeyHash) && hashIsZero(element->_publicKeyHash);
 409  }
 410  
 411  #if DEBUG
 412  
 413  static void WithCacheDescription(SecOTRSessionRef session, void (^operation)(CFStringRef cacheDescription)) {
 414      CFStringRef description = NULL;
 415      
 416      CFStringRef keyCache0Description = SecOTRCacheElementCopyDescription(&session->_keyCache[0]);
 417      CFStringRef keyCache1Description = SecOTRCacheElementCopyDescription(&session->_keyCache[1]);
 418      CFStringRef keyCache2Description = SecOTRCacheElementCopyDescription(&session->_keyCache[2]);
 419      CFStringRef keyCache3Description = SecOTRCacheElementCopyDescription(&session->_keyCache[3]);
 420      
 421      description = CFStringCreateWithFormat(kCFAllocatorDefault, NULL, CFSTR("{%@, %@, %@, %@}"), keyCache0Description, keyCache1Description, keyCache2Description, keyCache3Description);
 422      
 423      operation(description);
 424      
 425      CFReleaseNull(keyCache0Description);
 426      CFReleaseNull(keyCache1Description);
 427      CFReleaseNull(keyCache2Description);
 428      CFReleaseNull(keyCache3Description);
 429      CFReleaseNull(description);
 430  }
 431  
 432  #endif
 433  
 434  static void SecOTRSFindKeysForMessage(SecOTRSessionRef session,
 435                                        SecOTRFullDHKeyRef myKey,
 436                                        SecOTRPublicDHKeyRef theirKey,
 437                                        bool sending,
 438                                        uint8_t** messageKey, uint8_t** macKey, uint64_t **counter)
 439  {
 440      SecOTRCacheElement* emptyKeys = NULL;
 441      SecOTRCacheElement* cachedKeys = NULL;
 442  #if DEBUG
 443      int emptyPosition = kOTRKeyCacheSize;
 444  #endif
 445  
 446      if ((NULL == myKey) || (NULL == theirKey)) {
 447          if (messageKey)
 448              *messageKey = NULL;
 449          if (macKey)
 450              *macKey = NULL;
 451          if (counter)
 452              *counter = &constant_zero;
 453              
 454          return;
 455      }
 456      
 457      for(int i = 0; i < kOTRKeyCacheSize; ++i)
 458      {
 459          if (0 == timingsafe_bcmp(session->_keyCache[i]._fullKeyHash, SecFDHKGetHash(myKey), CCSHA1_OUTPUT_SIZE)
 460           && (0 == timingsafe_bcmp(session->_keyCache[i]._publicKeyHash, SecPDHKGetHash(theirKey), CCSHA1_OUTPUT_SIZE))) {
 461              cachedKeys = &session->_keyCache[i];
 462  #if DEBUG
 463              secdebug("OTR","session@[%p] found key match: mk: %@, tk: %@", session, myKey, theirKey);
 464  #endif
 465              break;
 466          }
 467  
 468          if (emptyKeys == NULL && SOSOTRSCacheEntryIsEmpty(&(session->_keyCache[i]))) {
 469  #if DEBUG
 470              emptyPosition = i;
 471  #endif
 472  
 473              emptyKeys = &session->_keyCache[i];
 474          }
 475      }
 476  
 477      if (cachedKeys == NULL) {
 478          if (emptyKeys == NULL) {
 479  #if DEBUG
 480              WithCacheDescription(session, ^(CFStringRef cacheDescription) {
 481                  secdebug("OTR","session@[%p] Cache miss, spooky for mk: %@, tk: %@ cache: %@", session, myKey, theirKey, cacheDescription);
 482              });
 483              emptyPosition = 0;
 484  #endif
 485  
 486              emptyKeys = &session->_keyCache[0];
 487  
 488          }
 489          assert(emptyKeys);
 490  
 491          // Fill in the entry.
 492          memcpy(emptyKeys->_fullKeyHash, SecFDHKGetHash(myKey), CCSHA1_OUTPUT_SIZE);
 493          memcpy(emptyKeys->_publicKeyHash, SecPDHKGetHash(theirKey), CCSHA1_OUTPUT_SIZE);
 494          
 495          emptyKeys->_counter = 0;
 496          emptyKeys->_theirCounter = 0;
 497  
 498          SecOTRDHKGenerateOTRKeys(myKey, theirKey,
 499                                emptyKeys->_sendEncryptionKey, emptyKeys->_sendMacKey,
 500                                emptyKeys->_receiveEncryptionKey, emptyKeys->_receiveMacKey);
 501  
 502          cachedKeys = emptyKeys;
 503  #if DEBUG
 504          WithCacheDescription(session, ^(CFStringRef cacheDescription) {
 505              secdebug("OTR","mk %@, th: %@ session@[%p] new key cache state added key@[%d]: %@", myKey, theirKey, session, emptyPosition, cacheDescription);
 506          });
 507  #endif
 508  
 509      }
 510      
 511      if (messageKey)
 512          *messageKey = sending ? cachedKeys->_sendEncryptionKey : cachedKeys->_receiveEncryptionKey;
 513      if (macKey)
 514          *macKey = sending ? cachedKeys->_sendMacKey : cachedKeys->_receiveMacKey;
 515      if (counter)
 516          *counter = sending ? &cachedKeys->_counter : &cachedKeys->_theirCounter;
 517  }
 518  
 519  SecOTRSessionRef SecOTRSessionCreateFromData(CFAllocatorRef allocator, CFDataRef data)
 520  {
 521      if (data == NULL)
 522          return NULL;
 523  
 524      SecOTRSessionRef result = NULL;
 525      SecOTRSessionRef session = CFTypeAllocate(SecOTRSession, struct _SecOTRSession, allocator);
 526  
 527      uint8_t numberOfKeys;
 528      uint64_t timeToRoll;
 529      
 530      const uint8_t *bytes = CFDataGetBytePtr(data);
 531      size_t size = (size_t)CFDataGetLength(data);
 532      
 533      (void)SecOTRGetDefaultsWriteSeconds();
 534      
 535      session->_queue = dispatch_queue_create("OTRSession", DISPATCH_QUEUE_SERIAL);
 536  
 537      session->_me = NULL;
 538      session->_them = NULL;
 539      session->_myKey = NULL;
 540      session->_myNextKey = NULL;
 541      session->_theirKey = NULL;
 542      session->_theirPreviousKey = NULL;
 543      session->_receivedDHMessage = NULL;
 544      session->_receivedDHKeyMessage = NULL;
 545      session->_textOutput = false;
 546      session->_compactAppleMessages = false;
 547      session->_timeToRoll =  0;
 548      session->_stallingTheirRoll = false;
 549      session->_stallSeconds = 0;
 550      session->_missedAck = true;
 551      session->_receivedAck = false;
 552      
 553      bzero(session->_keyCache, sizeof(session->_keyCache));
 554  
 555      uint8_t version;
 556      require_noerr(ReadByte(&bytes, &size, &version), fail);
 557      require(version <= 6, fail);
 558  
 559      require_noerr(ReadLong(&bytes, &size, &session->_state), fail);
 560      session->_me = SecOTRFullIdentityCreateFromBytes(kCFAllocatorDefault, &bytes, &size, NULL);
 561      require(session->_me != NULL, fail);
 562      session->_them = SecOTRPublicIdentityCreateFromBytes(kCFAllocatorDefault, &bytes, &size, NULL);
 563      require(session->_them != NULL, fail);
 564      
 565      require(size > sizeof(session->_r), fail);
 566      memcpy(session->_r, bytes, sizeof(session->_r));
 567      bytes += sizeof(session->_r);
 568      size -= sizeof(session->_r);
 569  
 570      {
 571          uint8_t hasMessage = false;
 572          ReadByte(&bytes, &size, &hasMessage);
 573          if (hasMessage) {
 574              session->_receivedDHMessage = CFDataCreateMutableFromOTRDATA(kCFAllocatorDefault, &bytes, &size);
 575          }
 576      }
 577  
 578      if (version >= 2) {
 579          uint8_t hasMessage = false;
 580          ReadByte(&bytes, &size, &hasMessage);
 581          if (hasMessage) {
 582              session->_receivedDHKeyMessage = CFDataCreateMutableFromOTRDATA(kCFAllocatorDefault, &bytes, &size);
 583          }
 584      }
 585      
 586      if (version < 3) {
 587          uint8_t ready;
 588          require_noerr(ReadByte(&bytes, &size, &ready), fail);
 589          if (ready && session->_state == kIdle)
 590              session->_state = kDone;
 591      }
 592      
 593      
 594      require_noerr(ReadLong(&bytes, &size, &session->_keyID), fail);
 595      if (session->_keyID > 0) {
 596          session->_myKey = SecOTRFullDHKCreateFromBytes(kCFAllocatorDefault, &bytes, &size);
 597          require(session->_myKey != NULL, fail);
 598          session->_myNextKey = SecOTRFullDHKCreateFromBytes(kCFAllocatorDefault, &bytes, &size);
 599          require(session->_myNextKey != NULL, fail);
 600      }
 601      
 602      
 603      require_noerr(ReadByte(&bytes, &size, &numberOfKeys), fail);
 604      
 605      require_noerr(ReadLong(&bytes, &size, &session->_theirKeyID), fail);
 606      if (version < 5) {
 607          if (session->_theirKeyID > 0) {
 608              if (session->_theirKeyID > 1) {
 609                  session->_theirPreviousKey = SecOTRPublicDHKCreateFromSerialization(kCFAllocatorDefault, &bytes, &size);
 610                  require(session->_theirPreviousKey != NULL, fail);
 611              }
 612              session->_theirKey = SecOTRPublicDHKCreateFromSerialization(kCFAllocatorDefault, &bytes, &size);
 613              require(session->_theirKey != NULL, fail);
 614          }
 615      }
 616      else {
 617          if(numberOfKeys >= 1){
 618              if (numberOfKeys >= 2) {
 619                  session->_theirPreviousKey = SecOTRPublicDHKCreateFromSerialization(kCFAllocatorDefault, &bytes, &size);
 620                  require(session->_theirPreviousKey != NULL, fail);
 621              }
 622              session->_theirKey = SecOTRPublicDHKCreateFromSerialization(kCFAllocatorDefault, &bytes, &size);
 623              require(session->_theirKey != NULL, fail);
 624          }
 625      }
 626      
 627      
 628      uint64_t *counter;
 629      SecOTRSFindKeysForMessage(session, session->_myKey, session->_theirKey, false, NULL, NULL, &counter);
 630      require_noerr(ReadLongLong(&bytes, &size, counter), fail);
 631      SecOTRSFindKeysForMessage(session, session->_myKey, session->_theirKey, true, NULL, NULL, &counter);
 632      require_noerr(ReadLongLong(&bytes, &size, counter), fail);
 633      SecOTRSFindKeysForMessage(session, session->_myKey, session->_theirPreviousKey, false, NULL, NULL, &counter);
 634      require_noerr(ReadLongLong(&bytes, &size, counter), fail);
 635      SecOTRSFindKeysForMessage(session, session->_myKey, session->_theirPreviousKey, true, NULL, NULL, &counter);
 636      require_noerr(ReadLongLong(&bytes, &size, counter), fail);
 637      SecOTRSFindKeysForMessage(session, session->_myNextKey, session->_theirKey, false, NULL, NULL, &counter);
 638      require_noerr(ReadLongLong(&bytes, &size, counter), fail);
 639      SecOTRSFindKeysForMessage(session, session->_myNextKey, session->_theirKey, true, NULL, NULL, &counter);
 640      require_noerr(ReadLongLong(&bytes, &size, counter), fail);
 641      SecOTRSFindKeysForMessage(session, session->_myNextKey, session->_theirPreviousKey, false, NULL, NULL, &counter);
 642      require_noerr(ReadLongLong(&bytes, &size, counter), fail);
 643      SecOTRSFindKeysForMessage(session, session->_myNextKey, session->_theirPreviousKey, true, NULL, NULL, &counter);
 644      require_noerr(ReadLongLong(&bytes, &size, counter), fail);
 645      
 646      session->_macKeysToExpose = CFDataCreateMutableFromOTRDATA(kCFAllocatorDefault, &bytes, &size);
 647      require(session->_macKeysToExpose != NULL, fail);
 648      
 649      require_noerr(ReadByteAsBool(&bytes, &size, &session->_textOutput), fail);
 650  
 651      if (version >= 4) {
 652          require_noerr(ReadByteAsBool(&bytes, &size, &session->_compactAppleMessages), fail);
 653      }
 654      if (version >= 5) {
 655          require_noerr(ReadByteAsBool(&bytes, &size, &session->_includeHashes), fail);
 656      }
 657      if (version >= 6) {
 658          require_noerr(ReadLongLong(&bytes, &size, &session->_stallSeconds), fail);
 659          require_noerr(ReadByteAsBool(&bytes, &size, &session->_stallingTheirRoll), fail);
 660          require_noerr(ReadLongLong(&bytes, &size, &timeToRoll), fail);
 661          require_noerr(ReadByteAsBool(&bytes, &size, &session->_missedAck), fail);
 662          require_noerr(ReadByteAsBool(&bytes, &size, &session->_receivedAck), fail);
 663          session->_timeToRoll = timeToRoll;
 664      }
 665      result = session;
 666      session = NULL;
 667  
 668  fail:
 669      CFReleaseNull(session);
 670      return result;
 671  }
 672  
 673  
 674  OSStatus SecOTRSAppendSerialization(SecOTRSessionRef session, CFMutableDataRef serializeInto)
 675  {
 676      __block OSStatus result  = errSecParam;
 677  
 678      require(session, abort);
 679      require(serializeInto, abort);
 680  
 681      CFIndex start = CFDataGetLength(serializeInto);
 682      
 683      dispatch_sync(session->_queue, ^{
 684          const uint8_t version = 6;
 685          uint8_t numberOfKeys = 0;
 686          CFDataAppendBytes(serializeInto, &version, sizeof(version));
 687  
 688          AppendLong(serializeInto, session->_state);
 689  
 690          result = (SecOTRFIAppendSerialization(session->_me, serializeInto, NULL)) ? errSecSuccess : errSecParam;
 691      
 692          if (result == errSecSuccess) {
 693              result = (SecOTRPIAppendSerialization(session->_them, serializeInto, NULL)) ? errSecSuccess : errSecParam;
 694          }
 695      
 696          if (result == errSecSuccess) {
 697              CFDataAppendBytes(serializeInto, session->_r, sizeof(session->_r));
 698  
 699              if (session->_receivedDHMessage == NULL) {
 700                  AppendByte(serializeInto, 0);
 701              } else {
 702                  AppendByte(serializeInto, 1);
 703                  AppendCFDataAsDATA(serializeInto, session->_receivedDHMessage);
 704              }
 705              
 706              if (session->_receivedDHKeyMessage == NULL) {
 707                  AppendByte(serializeInto, 0);
 708              } else {
 709                  AppendByte(serializeInto, 1);
 710                  AppendCFDataAsDATA(serializeInto, session->_receivedDHKeyMessage);
 711              }
 712              
 713              AppendLong(serializeInto, session->_keyID);
 714              if (session->_keyID > 0) {
 715                  SecFDHKAppendSerialization(session->_myKey, serializeInto);
 716                  SecFDHKAppendSerialization(session->_myNextKey, serializeInto);
 717              }
 718              
 719              if(session->_theirPreviousKey != NULL)
 720                  numberOfKeys++;
 721              if(session->_theirKey != NULL)
 722                  numberOfKeys++;
 723              
 724              AppendByte(serializeInto, numberOfKeys);
 725              
 726              AppendLong(serializeInto, session->_theirKeyID);
 727              
 728              if (session->_theirPreviousKey != NULL)
 729                  SecPDHKAppendSerialization(session->_theirPreviousKey, serializeInto);
 730              
 731              if (session->_theirKey != NULL )
 732                  SecPDHKAppendSerialization(session->_theirKey, serializeInto);
 733              
 734              
 735              uint64_t *counter;
 736              SecOTRSFindKeysForMessage(session, session->_myKey, session->_theirKey, false, NULL, NULL, &counter);
 737              AppendLongLong(serializeInto, *counter);
 738              SecOTRSFindKeysForMessage(session, session->_myKey, session->_theirKey, true, NULL, NULL, &counter);
 739              AppendLongLong(serializeInto, *counter);
 740              SecOTRSFindKeysForMessage(session, session->_myKey, session->_theirPreviousKey, false, NULL, NULL, &counter);
 741              AppendLongLong(serializeInto, *counter);
 742              SecOTRSFindKeysForMessage(session, session->_myKey, session->_theirPreviousKey, true, NULL, NULL, &counter);
 743              AppendLongLong(serializeInto, *counter);
 744              SecOTRSFindKeysForMessage(session, session->_myNextKey, session->_theirKey, false, NULL, NULL, &counter);
 745              AppendLongLong(serializeInto, *counter);
 746              SecOTRSFindKeysForMessage(session, session->_myNextKey, session->_theirKey, true, NULL, NULL, &counter);
 747              AppendLongLong(serializeInto, *counter);
 748              SecOTRSFindKeysForMessage(session, session->_myNextKey, session->_theirPreviousKey, false, NULL, NULL, &counter);
 749              AppendLongLong(serializeInto, *counter);
 750              SecOTRSFindKeysForMessage(session, session->_myNextKey, session->_theirPreviousKey, true, NULL, NULL, &counter);
 751              AppendLongLong(serializeInto, *counter);
 752  
 753              AppendCFDataAsDATA(serializeInto, session->_macKeysToExpose);
 754              
 755              AppendByte(serializeInto, session->_textOutput ? 1 : 0);
 756              AppendByte(serializeInto, session->_compactAppleMessages ? 1 : 0);
 757              AppendByte(serializeInto, session->_includeHashes ? 1 : 0);
 758      
 759              AppendLongLong(serializeInto, session->_stallSeconds ? session->_stallSeconds : constant_zero);
 760              
 761              AppendByte(serializeInto, session->_stallingTheirRoll ? 1 : 0);
 762              AppendLongLong(serializeInto, (uint64_t)session->_timeToRoll);
 763              AppendByte(serializeInto, session->_missedAck ? 1 : 0);
 764              AppendByte(serializeInto, session->_receivedAck ? 1 : 0);
 765  
 766          }
 767      });
 768  
 769      if (result != errSecSuccess)
 770          CFDataSetLength(serializeInto, start);
 771  
 772  abort:
 773      return result;
 774  }
 775  
 776  
 777  bool SecOTRSIsForKeys(SecOTRSessionRef session, SecKeyRef myPublic, SecKeyRef theirPublic)
 778  {
 779      __block bool isForKeys = false;
 780  
 781      dispatch_sync(session->_queue, ^{
 782          isForKeys = SecOTRFICompareToPublicKey(session->_me, myPublic) &&
 783                      SecOTRPICompareToPublicKey(session->_them, theirPublic);
 784      });
 785  
 786      return isForKeys;
 787  }
 788  
 789  bool SecOTRSGetIsReadyForMessages(SecOTRSessionRef session)
 790  {
 791      __block bool result;
 792  
 793      dispatch_sync(session->_queue, ^{ result = session->_state == kDone; });
 794  
 795      return result;
 796  }
 797  
 798  bool SecOTRSGetIsIdle(SecOTRSessionRef session)
 799  {
 800      __block bool result;
 801      
 802      dispatch_sync(session->_queue, ^{ result = session->_state == kIdle; });
 803      
 804      return result;
 805  }
 806  
 807  static void SecOTRSPrecalculateForPair(SecOTRSessionRef session,
 808                                         SecOTRFullDHKeyRef myKey,
 809                                         SecOTRPublicDHKeyRef theirKey)
 810  {
 811      if (myKey == NULL || theirKey == NULL)
 812          return;
 813  
 814      SecOTRSFindKeysForMessage(session, myKey, theirKey, true, NULL, NULL, NULL);
 815      SecOTRSFindKeysForMessage(session, myKey, theirKey, false, NULL, NULL, NULL);
 816  }
 817  
 818  static void SecOTRSPrecalculateKeysInternal(SecOTRSessionRef session)
 819  {
 820      SecOTRSPrecalculateForPair(session, session->_myKey, session->_theirKey);
 821      SecOTRSPrecalculateForPair(session, session->_myNextKey, session->_theirKey);
 822      SecOTRSPrecalculateForPair(session, session->_myKey, session->_theirPreviousKey);
 823      SecOTRSPrecalculateForPair(session, session->_myNextKey, session->_theirPreviousKey);
 824  }
 825  
 826  static void SecOTRSPrecalculateNextKeysInternal(SecOTRSessionRef session)
 827  {
 828      SecOTRSPrecalculateForPair(session, session->_myKey, session->_theirKey);
 829  }
 830  
 831  void SecOTRSPrecalculateKeys(SecOTRSessionRef session)
 832  {
 833      dispatch_sync_f(session->_queue, session, (dispatch_function_t) SecOTRSPrecalculateKeysInternal);
 834  }
 835  
 836  enum SecOTRSMessageKind SecOTRSGetMessageKind(SecOTRSessionRef session, CFDataRef message)
 837  {
 838      OTRMessageType type = SecOTRSGetMessageType(message);
 839  
 840      enum SecOTRSMessageKind kind;
 841  
 842      switch (type) {
 843          case kDataMessage:
 844          case kEvenCompactDataMessage:
 845          case kOddCompactDataMessage:
 846          case kEvenCompactDataMessageWithHashes:
 847          case kOddCompactDataMessageWithHashes:
 848              kind = kOTRDataPacket;
 849              break;
 850          case kDHMessage:
 851          case kDHKeyMessage:
 852          case kRevealSignatureMessage:
 853          case kSignatureMessage:
 854              kind = kOTRNegotiationPacket;
 855              break;
 856          case kInvalidMessage:
 857          default:
 858              kind = kOTRUnknownPacket;
 859              break;
 860      }
 861  
 862      return kind;
 863  }
 864  
 865  static OSStatus SecOTRSSignAndProtectRaw_locked(SecOTRSessionRef session,
 866                                                  CFDataRef sourceMessage, CFMutableDataRef destinationMessage,
 867                                                  uint8_t* messageKey, uint8_t* macKey, uint64_t* counter, uint32_t theirKeyID,  SecOTRPublicDHKeyRef theirKey)
 868  {
 869      CFIndex start = CFDataGetLength(destinationMessage);
 870  
 871      AppendHeader(destinationMessage, kDataMessage);
 872      AppendByte(destinationMessage, 0); // Flags, all zero
 873  
 874      AppendLong(destinationMessage, session->_keyID);
 875      AppendLong(destinationMessage, theirKeyID);
 876      SecFDHKAppendPublicSerialization(session->_myNextKey, destinationMessage);
 877      AppendLongLong(destinationMessage, ++*counter);
 878  
 879      CFIndex sourceSize = CFDataGetLength(sourceMessage);
 880      assert(((unsigned long)sourceSize)<=UINT32_MAX); /* this is correct as long as CFIndex is a signed long */
 881      AppendLong(destinationMessage, (uint32_t)sourceSize);
 882      uint8_t* encryptedDataPointer = CFDataIncreaseLengthAndGetMutableBytes(destinationMessage, sourceSize);
 883      AES_CTR_HighHalf_Transform(kOTRMessageKeyBytes, messageKey,
 884                                 *counter,
 885                                 (size_t)sourceSize, CFDataGetBytePtr(sourceMessage),
 886                                 encryptedDataPointer);
 887  
 888      CFIndex macedContentsSize = CFDataGetLength(destinationMessage) - start;
 889      CFIndex macSize = CCSHA1_OUTPUT_SIZE;
 890      uint8_t* macDataPointer = CFDataIncreaseLengthAndGetMutableBytes(destinationMessage, macSize);
 891  
 892      cchmac(ccsha1_di(),
 893             kOTRMessageMacKeyBytes, macKey,
 894             macedContentsSize, CFDataGetBytePtr(destinationMessage) + start,
 895             macDataPointer);
 896  
 897      CFDataAppend(destinationMessage, session->_macKeysToExpose);
 898  
 899      return errSecSuccess;
 900  }
 901  
 902  const size_t kCompactMessageMACSize = 16;
 903  
 904  static OSStatus SecOTRSSignAndProtectCompact_locked(SecOTRSessionRef session,
 905                                                      CFDataRef sourceMessage, CFMutableDataRef destinationMessage,
 906                                                      uint8_t* messageKey, uint8_t* macKey, uint64_t* counter, uint32_t theirKeyID, SecOTRPublicDHKeyRef theirKey)
 907  {
 908      CFIndex start = CFDataGetLength(destinationMessage);
 909      bool sendHashes = session->_includeHashes;
 910      
 911      const uint8_t messageType = sendHashes ? ((theirKeyID & 0x1) ? kOddCompactDataMessageWithHashes : kEvenCompactDataMessageWithHashes)
 912                                             : ((theirKeyID & 0x1) ? kOddCompactDataMessage           : kEvenCompactDataMessage);
 913  
 914      AppendByte(destinationMessage, messageType);
 915  
 916      SecFDHKAppendCompactPublicSerialization(session->_myNextKey, destinationMessage);
 917      AppendLongLongCompact(destinationMessage, ++*counter);
 918  
 919      CFIndex sourceSize = CFDataGetLength(sourceMessage);
 920      assert(((unsigned long)sourceSize)<=UINT32_MAX); /* this is correct as long as CFIndex is a signed long */
 921      uint8_t* encryptedDataPointer = CFDataIncreaseLengthAndGetMutableBytes(destinationMessage, sourceSize);
 922      AES_CTR_HighHalf_Transform(kOTRMessageKeyBytes, messageKey,
 923                                 *counter,
 924                                 (size_t)sourceSize, CFDataGetBytePtr(sourceMessage),
 925                                 encryptedDataPointer);
 926  
 927      if (sendHashes) {
 928          uint8_t *senderHashPtr = CFDataIncreaseLengthAndGetMutableBytes(destinationMessage, kSecDHKHashSize);
 929          
 930          memcpy(senderHashPtr, SecFDHKGetHash(session->_myKey), kSecDHKHashSize);
 931          
 932          uint8_t *receiverHashPtr = CFDataIncreaseLengthAndGetMutableBytes(destinationMessage, kSecDHKHashSize);
 933          
 934          memcpy(receiverHashPtr, SecPDHKGetHash(theirKey), kSecDHKHashSize);
 935      }
 936      
 937      
 938      CFIndex macedContentsSize = CFDataGetLength(destinationMessage) - start;
 939      CFIndex macSize = CCSHA1_OUTPUT_SIZE;
 940      uint8_t mac[macSize];
 941      cchmac(ccsha1_di(),
 942             kOTRMessageMacKeyBytes, macKey,
 943             macedContentsSize, CFDataGetBytePtr(destinationMessage) + start,
 944             mac);
 945  
 946      CFDataAppendBytes(destinationMessage, mac, kCompactMessageMACSize);
 947  
 948      return errSecSuccess;
 949  }
 950  
 951  OSStatus SecOTRSSignAndProtectMessage(SecOTRSessionRef session,
 952                                        CFDataRef sourceMessage,
 953                                        CFMutableDataRef protectedMessage)
 954  {
 955      __block OSStatus result = errSecParam;
 956  
 957      require(session, abort);
 958      require(sourceMessage, abort);
 959      require(protectedMessage, abort);
 960      
 961      if(session->_state != kDone){
 962          secdebug("OTR", "Cannot sign and protect messages, we are not done negotiating sesion[%p]", session);
 963          require_quiet( session->_state == kDone, abort);
 964      }
 965      
 966      dispatch_sync(session->_queue, ^{
 967          if (session->_myKey == NULL ||
 968              session->_theirKey == NULL) {
 969              return;
 970          }
 971          
 972          uint8_t *messageKey;
 973          uint8_t *macKey;
 974          uint64_t *counter;
 975          uint32_t theirKeyID = session->_theirKeyID;
 976          
 977          SecOTRPublicDHKeyRef theirKeyToUse = session->_theirKey;
 978          
 979          SecOTRSRollIfTime(session);
 980          
 981          if(session->_stallingTheirRoll && session->_theirPreviousKey){
 982              theirKeyToUse = session->_theirPreviousKey;
 983              theirKeyID = session->_theirKeyID - 1;
 984          }
 985          
 986          SecOTRSFindKeysForMessage(session, session->_myKey, theirKeyToUse,
 987                                    true,
 988                                    &messageKey, &macKey, &counter);
 989          // The || !protectedMessage below is only here to shut the static analyzer up, the require(protectedMessage, abort) outside the block already ensures this new term is never true.
 990          CFMutableDataRef destinationMessage = session->_textOutput || !protectedMessage ? CFDataCreateMutable(kCFAllocatorDefault, 0) : CFRetainSafe(protectedMessage);
 991          
 992          result = session->_compactAppleMessages ? SecOTRSSignAndProtectCompact_locked(session, sourceMessage, destinationMessage, messageKey, macKey, counter, theirKeyID, theirKeyToUse)
 993          : SecOTRSSignAndProtectRaw_locked(session, sourceMessage, destinationMessage, messageKey, macKey, counter, theirKeyID, theirKeyToUse);
 994          
 995          if (result == errSecSuccess) {
 996              if (session->_textOutput) {
 997                  SecOTRPrepareOutgoingBytes(destinationMessage, protectedMessage);
 998              }
 999  
1000              CFDataSetLength(session->_macKeysToExpose, 0);
1001          }
1002  
1003          CFReleaseSafe(destinationMessage);
1004  
1005          result = errSecSuccess;
1006      });
1007  
1008  abort:
1009      return result;
1010  }
1011  
1012  void SecOTRSKickTimeToRoll(SecOTRSessionRef session){
1013  	session->_timeToRoll = CFAbsoluteTimeGetCurrent();
1014  }
1015  
1016  static void SecOTRAcceptNewRemoteKey(SecOTRSessionRef session, SecOTRPublicDHKeyRef newKey)
1017  {
1018      if (session->_theirPreviousKey) {
1019          SecOTRSExpireCachedKeysForPublicKey(session, session->_theirPreviousKey);
1020      }
1021  
1022      CFReleaseNull(session->_theirPreviousKey);
1023      session->_theirPreviousKey = session->_theirKey;
1024      session->_theirKey = CFRetainSafe(newKey);
1025      session->_stallingTheirRoll = true;
1026  
1027      session->_theirKeyID += 1;
1028  
1029      SecOTRSEnableTimeToRoll(session);
1030  }
1031  
1032  OSStatus SecOTRSetupInitialRemoteKey(SecOTRSessionRef session, SecOTRPublicDHKeyRef CF_CONSUMED initialKey) {
1033     
1034      bzero(session->_keyCache, sizeof(session->_keyCache));
1035      
1036      CFReleaseNull(session->_theirPreviousKey);
1037      CFAssignRetained(session->_theirKey, initialKey);
1038      session->_theirKeyID = 1;
1039      
1040      return errSecSuccess;
1041  }
1042  
1043  ///
1044  /// MARK: SLOW ROLLING
1045  ///
1046  
1047  void SOSOTRSRoll(SecOTRSessionRef session){
1048      
1049      session->_stallingTheirRoll = false;
1050      
1051      //receiving side roll
1052      if(session->_receivedAck){
1053          SecOTRGenerateNewProposedKey(session);
1054          session->_missedAck = false;
1055          session->_receivedAck = false;
1056      }
1057      else{
1058          session->_missedAck = true;
1059      }
1060  }
1061  
1062  static OSStatus SecOTRVerifyAndExposeRaw_locked(SecOTRSessionRef session,
1063                                                  CFDataRef decodedBytes,
1064                                                  CFMutableDataRef exposedMessageContents)
1065  {
1066      OSStatus result = errSecDecode;
1067      
1068      SecOTRPublicDHKeyRef newKey = NULL;
1069      const uint8_t* bytes;
1070      size_t  size;
1071      SecOTRFullDHKeyRef myKeyForMessage = NULL;
1072      SecOTRPublicDHKeyRef theirKeyForMessage = NULL;
1073      bytes = CFDataGetBytePtr(decodedBytes);
1074      size = CFDataGetLength(decodedBytes);
1075  
1076      const uint8_t* macDataStart = bytes;
1077  
1078      uint32_t theirID;
1079      uint32_t myID;
1080  
1081      require_noerr_quiet(result = ReadAndVerifyHeader(&bytes, &size, kDataMessage), fail);
1082      require_action_quiet(size > 0, fail, result = errSecDecode);
1083  
1084      require_noerr_quiet(result = ReadAndVerifyByte(&bytes, &size, 0), fail); // Flags, always zero
1085  
1086      require_noerr_quiet(result = ReadLong(&bytes, &size, &theirID), fail);
1087  
1088      require_action_quiet(theirID == session->_theirKeyID || (theirID == (session->_theirKeyID - 1) && session->_theirPreviousKey != NULL),
1089                           fail,
1090                           result = ((theirID + 1) < session->_theirKeyID) ? errSecOTRTooOld : errSecOTRIDTooNew);
1091  
1092      require_noerr_quiet(result = ReadLong(&bytes, &size, &myID), fail);
1093  
1094      require_action_quiet(myID == session->_keyID || (myID == session->_keyID + 1 && session->_myNextKey != NULL),
1095                           fail,
1096                           result = (myID < session->_keyID) ? errSecOTRTooOld : errSecOTRIDTooNew);
1097  
1098  
1099      // Choose appripriate keys for message:
1100      {
1101          uint8_t *messageKey;
1102          uint8_t *macKey;
1103          uint64_t *theirCounter;
1104  
1105          myKeyForMessage = (myID == session->_keyID) ? session->_myKey : session->_myNextKey;
1106          theirKeyForMessage = (theirID == session->_theirKeyID) ? session->_theirKey : session->_theirPreviousKey;
1107  
1108          SecOTRSFindKeysForMessage(session, myKeyForMessage, theirKeyForMessage, false,
1109                                    &messageKey, &macKey, &theirCounter);
1110  
1111          size_t nextKeyMPISize;
1112          const uint8_t* nextKeyMPIBytes;
1113          require_noerr_quiet(result = SizeAndSkipMPI(&bytes, &size, &nextKeyMPIBytes, &nextKeyMPISize), fail);
1114  
1115          uint64_t counter;
1116          require_noerr_quiet(result = ReadLongLong(&bytes, &size, &counter), fail);
1117          require_action_quiet(counter > *theirCounter, fail, result = errSecOTRTooOld);
1118  
1119          size_t messageSize;
1120          const uint8_t* messageStart;
1121          require_noerr_quiet(result = SizeAndSkipDATA(&bytes, &size, &messageStart, &messageSize), fail);
1122  
1123          size_t macDataSize = (bytes - macDataStart) ? (size_t)(bytes - macDataStart) : 0;
1124          uint8_t mac[CCSHA1_OUTPUT_SIZE];
1125          require_action_quiet(sizeof(mac) <= size, fail, result = errSecDecode);
1126  
1127          cchmac(ccsha1_di(),
1128                 kOTRMessageMacKeyBytes, macKey,
1129                 macDataSize, macDataStart,
1130                 mac);
1131  
1132          require_noerr_action_quiet(timingsafe_bcmp(mac, bytes, sizeof(mac)), fail, result = errSecAuthFailed);
1133  
1134          uint8_t* dataSpace = CFDataIncreaseLengthAndGetMutableBytes(exposedMessageContents, (CFIndex)messageSize);
1135  
1136          AES_CTR_HighHalf_Transform(kOTRMessageKeyBytes, messageKey,
1137                                     counter,
1138                                     messageSize, messageStart,
1139                                     dataSpace);
1140  
1141          // Everything is good, accept the meta data.
1142          *theirCounter = counter;
1143  
1144          newKey = SecOTRPublicDHKCreateFromBytes(kCFAllocatorDefault, &nextKeyMPIBytes, &nextKeyMPISize);
1145      }
1146  
1147      bool acceptTheirNewKey = newKey != NULL && theirID == session->_theirKeyID;
1148  
1149      if (acceptTheirNewKey) {
1150          SecOTRAcceptNewRemoteKey(session, newKey);
1151      }
1152  
1153      if (myID == (session->_keyID + 1)) {
1154          SecOTRSHandleProposalAcknowledge(session);
1155      }
1156  
1157      SecOTRSRollIfTime(session);
1158      
1159      SecOTRSPrecalculateNextKeysInternal(session);
1160  
1161  fail:
1162      if(result != errSecSuccess){
1163          CFDataPerformWithHexString(decodedBytes, ^(CFStringRef decodedBytesString) {
1164              SecOTRPublicIdentityRef myPublicID = SecOTRPublicIdentityCopyFromPrivate(kCFAllocatorDefault, session->_me, NULL);
1165              SecOTRPIPerformWithSerializationString(myPublicID, ^(CFStringRef myIDString) {
1166                  SecOTRPIPerformWithSerializationString(session->_them, ^(CFStringRef theirIDString) {
1167              secnotice("OTR","session[%p] failed to decrypt, session: %@, mk: %@, mpk: %@, tpk: %@, tk: %@, chose tktu: %@", session, session,
1168                       session->_myKey, session->_myNextKey, session->_theirPreviousKey, session->_theirKey, theirKeyForMessage);
1169              secnotice("OTR","session[%p] failed to decrypt, mktu: %@, mpi: %@, tpi: %@, m: %@", session, myKeyForMessage, myIDString, theirIDString, decodedBytesString);
1170                  });
1171              });
1172              CFReleaseNull(myPublicID);
1173          });
1174      }
1175      CFReleaseNull(newKey);
1176      return result;
1177  }
1178  
1179  static OSStatus SecOTRVerifyAndExposeRawCompact_locked(SecOTRSessionRef session,
1180                                                  CFDataRef decodedBytes,
1181                                                  CFMutableDataRef exposedMessageContents)
1182  {
1183      SecOTRPublicDHKeyRef theirProposal = NULL;
1184      OSStatus result = errSecDecode;
1185      const uint8_t* bytes;
1186      size_t  size;
1187      SecOTRPublicDHKeyRef theirKeyForMessage = NULL;
1188      bytes = CFDataGetBytePtr(decodedBytes);
1189      size = CFDataGetLength(decodedBytes);
1190      SecOTRFullDHKeyRef myKeyForMessage = NULL;
1191      const uint8_t* macDataStart = bytes;
1192      bool useEvenKey = false;
1193      bool useCurrentKey = false;
1194      bool sentHashes = false;
1195      uint64_t counter = 0;
1196  
1197      uint8_t type_byte = 0;
1198      require_noerr_quiet(result = ReadByte(&bytes, &size, &type_byte), fail);
1199      require_action_quiet(type_byte == kOddCompactDataMessage || type_byte == kEvenCompactDataMessage
1200                           || type_byte == kOddCompactDataMessageWithHashes || type_byte == kEvenCompactDataMessageWithHashes, fail, result = errSecDecode);
1201  
1202      useEvenKey = (type_byte == kEvenCompactDataMessage || type_byte == kEvenCompactDataMessageWithHashes);
1203      sentHashes = (type_byte == kOddCompactDataMessageWithHashes || type_byte == kEvenCompactDataMessageWithHashes);
1204  
1205      useCurrentKey = useEvenKey ^ (session->_keyID & 1);
1206      myKeyForMessage = useCurrentKey ? session->_myKey : session->_myNextKey;
1207      
1208      require_action_quiet(myKeyForMessage, fail, result = errSecDecode);
1209  
1210      theirProposal = SecOTRPublicDHKCreateFromCompactSerialization(kCFAllocatorDefault, &bytes, &size);
1211      
1212      require_action_quiet(theirProposal, fail, result = errSecDecode);
1213      
1214      bool proposalIsNew = !CFEqualSafe(theirProposal, session->_theirKey);
1215      theirKeyForMessage = proposalIsNew ? session->_theirKey : session->_theirPreviousKey;
1216      
1217      require_action_quiet(theirKeyForMessage, fail, result = errSecDecode);
1218      
1219      uint8_t *messageKey;
1220      uint8_t *macKey;
1221      uint64_t *theirCounter;
1222  
1223  
1224      SecOTRSFindKeysForMessage(session, myKeyForMessage, theirKeyForMessage, false, &messageKey, &macKey, &theirCounter);
1225  
1226      require_noerr_quiet(result = ReadLongLongCompact(&bytes, &size, &counter), fail);
1227      require_action_quiet(counter > *theirCounter, fail, result = errSecOTRTooOld);
1228  
1229      size_t messageSize = size - kCompactMessageMACSize - (sentHashes ? 2 * kSecDHKHashSize : 0); // It's all message except for the MAC and maybe hashes
1230      const uint8_t* messageStart = bytes;
1231  
1232      bytes += messageSize;
1233      size -= messageSize;
1234      
1235      if (sentHashes) {
1236          // Sender then receiver keys
1237  
1238          if (memcmp(SecPDHKGetHash(theirKeyForMessage), bytes, kSecDHKHashSize) != 0) {
1239              // Wrong sender key WTF.
1240  #if DEBUG
1241              BufferPerformWithHexString(bytes, kSecDHKHashSize, ^(CFStringRef dataString) {
1242                  secdebug("OTR","session[%p] Sender key hash doesn't match: %@ != %@", session, theirKeyForMessage, dataString);
1243              });
1244  #endif
1245          }
1246          
1247          bytes += kSecDHKHashSize;
1248          size -= kSecDHKHashSize;
1249          
1250          if (memcmp(SecFDHKGetHash(myKeyForMessage), bytes, kSecDHKHashSize) != 0) {
1251              // Wrong sender key WTF.
1252  #if DEBUG
1253              BufferPerformWithHexString(bytes, kSecDHKHashSize, ^(CFStringRef dataString) {
1254                  secdebug("OTR","session[%p] Receiver key hash doesn't match: %@ != %@", session, myKeyForMessage, dataString);
1255              });
1256  #endif
1257          }
1258          
1259          bytes += kSecDHKHashSize;
1260          size -= kSecDHKHashSize;
1261          
1262      }
1263      
1264      uint8_t mac[CCSHA1_OUTPUT_SIZE];
1265      require_action_quiet(kCompactMessageMACSize == size, fail, result = errSecDecode); // require space for the mac and some bytes
1266  
1267      size_t macDataSize = (size_t)(bytes - macDataStart);
1268  
1269      cchmac(ccsha1_di(),
1270             kOTRMessageMacKeyBytes, macKey,
1271             macDataSize, macDataStart,
1272             mac);
1273  
1274      require_noerr_action_quiet(timingsafe_bcmp(mac, bytes, kCompactMessageMACSize), fail, result = errSecAuthFailed);
1275  
1276      uint8_t* dataSpace = CFDataIncreaseLengthAndGetMutableBytes(exposedMessageContents, (CFIndex)messageSize);
1277  
1278      AES_CTR_HighHalf_Transform(kOTRMessageKeyBytes, messageKey,
1279                                 counter,
1280                                 messageSize, messageStart,
1281                                 dataSpace);
1282  
1283      // Everything is good, accept the meta data.
1284      *theirCounter = counter;
1285  
1286      if (proposalIsNew) {
1287          SecOTRAcceptNewRemoteKey(session, theirProposal);
1288      }
1289      
1290      if (!useCurrentKey) {
1291          SecOTRSHandleProposalAcknowledge(session);
1292      }
1293      SecOTRSRollIfTime(session);
1294      
1295      SecOTRSPrecalculateNextKeysInternal(session);
1296  
1297  fail:
1298      if(result != errSecSuccess){
1299          CFDataPerformWithHexString(decodedBytes, ^(CFStringRef decodedBytesString) {
1300              SecOTRPublicIdentityRef myPublicID = SecOTRPublicIdentityCopyFromPrivate(kCFAllocatorDefault, session->_me, NULL);
1301              SecOTRPIPerformWithSerializationString(myPublicID, ^(CFStringRef myIDString) {
1302                  SecOTRPIPerformWithSerializationString(session->_them, ^(CFStringRef theirIDString) {
1303              secnotice("OTR","session[%p] failed to decrypt, session: %@, mk: %@, mpk: %@, tpk: %@, tk: %@, chose tktu: %@", session, session,
1304                       session->_myKey, session->_myNextKey, session->_theirPreviousKey, session->_theirKey, theirKeyForMessage);
1305              secnotice("OTR","session[%p] failed to decrypt, mktu: %@, mpi: %@, tpi: %@, m: %@, tP: %@, tb: %hhx", session, myKeyForMessage, myIDString, theirIDString, decodedBytesString, theirProposal, type_byte);
1306                  });
1307              });
1308              CFReleaseNull(myPublicID);
1309          });
1310      }
1311      CFReleaseNull(theirProposal);
1312      return result;
1313  }
1314  
1315  
1316  OSStatus SecOTRSVerifyAndExposeMessage(SecOTRSessionRef session,
1317                                         CFDataRef incomingMessage,
1318                                         CFMutableDataRef exposedMessageContents)
1319  {
1320      __block OSStatus result = errSecParam;
1321  
1322      
1323      require(session, abort);
1324      require(incomingMessage, abort);
1325      require(exposedMessageContents, abort);
1326      
1327      if(session->_state == kDone){
1328          dispatch_sync(session->_queue, ^{
1329              CFDataRef decodedBytes = SecOTRCopyIncomingBytes(incomingMessage);
1330              
1331              OTRMessageType messageType = SecOTRSGetMessageType(decodedBytes);
1332              
1333              switch (messageType) {
1334                  case kDataMessage:
1335                      result = SecOTRVerifyAndExposeRaw_locked(session, decodedBytes, exposedMessageContents);
1336                      break;
1337                      
1338                  case kOddCompactDataMessage:
1339                  case kEvenCompactDataMessage:
1340                  case kOddCompactDataMessageWithHashes:
1341                  case kEvenCompactDataMessageWithHashes:
1342                      result = SecOTRVerifyAndExposeRawCompact_locked(session, decodedBytes, exposedMessageContents);
1343                      break;
1344                      
1345                  default:
1346                      result = errSecUnsupportedFormat;
1347                      break;
1348              }
1349              
1350              CFReleaseSafe(decodedBytes);
1351          });
1352      }
1353      else{
1354          secnotice("OTR", "session[%p]Cannot process message:%@, session is not done negotiating, session state: %@", session, incomingMessage, session);
1355          result = errSecOTRNotReady;
1356      }
1357  abort:
1358      return result;
1359  }
1360  
1361  
1362  static CFDataRef data_to_data_error_request(enum SecXPCOperation op, CFDataRef publicPeerId, CFErrorRef *error) {
1363      __block CFDataRef result = NULL;
1364      securityd_send_sync_and_do(op, error, ^bool(xpc_object_t message, CFErrorRef *error) {
1365          return SecXPCDictionarySetDataOptional(message, kSecXPCPublicPeerId, publicPeerId, error);
1366      }, ^bool(xpc_object_t response, CFErrorRef *error) {
1367          return (result = SecXPCDictionaryCopyData(response, kSecXPCKeyResult, error));
1368      });
1369      return result;
1370  }
1371  
1372  static bool data_data_to_data_data_bool_error_request(enum SecXPCOperation op, CFDataRef sessionData, CFDataRef inputPacket, CFDataRef* outputSessionData, CFDataRef* outputPacket, bool *readyForMessages, CFErrorRef *error) {
1373      __block CFDataRef tempOutputSessionData = NULL;
1374      __block CFDataRef tempOutputPacket = NULL;
1375      __block bool tempReadyForMessages = false;
1376      
1377      bool result = securityd_send_sync_and_do(op, error, ^bool(xpc_object_t message, CFErrorRef *error) {
1378          return SecXPCDictionarySetDataOptional(message, kSecXPCOTRSession, sessionData, error)
1379          && SecXPCDictionarySetDataOptional(message, kSecXPCData, inputPacket, error);
1380      }, ^bool(xpc_object_t response, CFErrorRef *error) {
1381          if (xpc_dictionary_get_bool(response, kSecXPCKeyResult)) {
1382              tempOutputSessionData = SecXPCDictionaryCopyData(response, kSecXPCOTRSession, error);
1383              tempOutputPacket = SecXPCDictionaryCopyData(response, kSecXPCData, error);
1384              tempReadyForMessages = xpc_dictionary_get_bool(response, kSecXPCOTRReady);
1385              return true;
1386          } else {
1387              return false;
1388          }
1389          
1390      });
1391      
1392      *outputSessionData = tempOutputSessionData;
1393      *outputPacket = tempOutputPacket;
1394      *readyForMessages = tempReadyForMessages;
1395      
1396      return result;
1397  }
1398  
1399  
1400  CFDataRef SecOTRSessionCreateRemote(CFDataRef publicPeerId, CFErrorRef *error) {
1401      __block CFDataRef result;
1402      os_activity_initiate("SecOTRSessionCreateRemote", OS_ACTIVITY_FLAG_DEFAULT, ^{
1403          (void)SecOTRGetDefaultsWriteSeconds();
1404          result = SECURITYD_XPC(sec_otr_session_create_remote, data_to_data_error_request, publicPeerId, error);
1405      });
1406      return result;
1407  }
1408  
1409  bool SecOTRSessionProcessPacketRemote(CFDataRef sessionData, CFDataRef inputPacket, CFDataRef* outputSessionData, CFDataRef* outputPacket, bool *readyForMessages, CFErrorRef *error) {
1410      __block bool result;
1411      os_activity_initiate("SecOTRSessionProcessPacketRemote", OS_ACTIVITY_FLAG_DEFAULT, ^{
1412          result = SECURITYD_XPC(sec_otr_session_process_packet_remote, data_data_to_data_data_bool_error_request, sessionData, inputPacket, outputSessionData, outputPacket, readyForMessages, error);
1413      });
1414      return result;
1415  }
1416