go-ricochet/ricochet.go

package goricochet

import (
	"errors"
	"github.com/golang/protobuf/proto"
	"github.com/s-rah/go-ricochet/auth"
	"github.com/s-rah/go-ricochet/chat"
	"github.com/s-rah/go-ricochet/contact"
	"github.com/s-rah/go-ricochet/control"
	"github.com/s-rah/go-ricochet/utils"
	"log"
	"net"
	"strconv"
)

// Ricochet is a protocol to conducting anonymous IM.
type Ricochet struct {
	newconns        chan *OpenConnection
	networkResolver utils.NetworkResolver
	rni             utils.RicochetNetworkInterface
}

// Init sets up the Ricochet object.
func (r *Ricochet) Init() {
	r.newconns = make(chan *OpenConnection)
	r.networkResolver = utils.NetworkResolver{}
	r.rni = new(utils.RicochetNetwork)
}

// Connect sets up a client ricochet connection to host e.g. qn6uo4cmsrfv4kzq.onion. If this
// function finished successfully then the connection can be assumed to
// be open and authenticated.
// To specify a local port using the format "127.0.0.1:[port]|ricochet-id".
func (r *Ricochet) Connect(host string) (*OpenConnection, error) {
	var err error
	conn, host, err := r.networkResolver.Resolve(host)

	if err != nil {
		return nil, err
	}

	return r.ConnectOpen(conn, host)
}

func (r *Ricochet) ConnectOpen(conn net.Conn, host string) (*OpenConnection, error) {
	oc, err := r.negotiateVersion(conn, true)
	if err != nil {
		return nil, err
	}
	oc.OtherHostname = host
	r.newconns <- oc
	return oc, nil
}

// Server launches a new server listening on port
func (r *Ricochet) Server(service RicochetService, port int) {
	ln, err := net.Listen("tcp", "127.0.0.1:"+strconv.Itoa(port))
	if err != nil {
		log.Printf("Cannot Listen on Port %v", port)
		return
	}

	r.ServeListener(service, ln)
}

func (r *Ricochet) ServeListener(service RicochetService, ln net.Listener) {
	go r.ProcessMessages(service)
	service.OnReady()
	for {
		// accept connection on port
		conn, err := ln.Accept()
		if err != nil {
			return
		}
		go r.processNewConnection(conn, service)
	}
}

// processNewConnection sets up a new connection
func (r *Ricochet) processNewConnection(conn net.Conn, service RicochetService) {
	oc, err := r.negotiateVersion(conn, false)
	if err == nil {
		r.newconns <- oc
		service.OnConnect(oc)
	}
}

// ProcessMessages is intended to be a background thread listening for all messages
// a client will send. The given RicochetService will be used to respond to messages.
// Prerequisites:
//             * Must have previously issued a successful Connect()
func (r *Ricochet) ProcessMessages(service RicochetService) {
	for {
		oc := <-r.newconns
		go r.processConnection(oc, service)
	}
}

// ProcessConnection starts a blocking process loop which continually waits for
// new messages to arrive from the connection and uses the given RicochetService
// to process them.
func (r *Ricochet) processConnection(oc *OpenConnection, service RicochetService) {
	service.OnConnect(oc)
	defer service.OnDisconnect(oc)

	for {
		if oc.Closed {
			return
		}

		packets, err := r.rni.RecvRicochetPackets(oc.conn)

		if err != nil {
			return
		}

		for _, packet := range packets {

			if len(packet.Data) == 0 {
				service.OnChannelClosed(oc, packet.Channel)
				continue
			}

			if packet.Channel == 0 {

				res := new(Protocol_Data_Control.Packet)
				err := proto.Unmarshal(packet.Data[:], res)

				if err != nil {
					service.OnGenericError(oc, packet.Channel)
					continue
				}

				if res.GetOpenChannel() != nil {
					opm := res.GetOpenChannel()

					if oc.GetChannelType(opm.GetChannelIdentifier()) != "none" {
						// Channel is already in use.
						service.OnBadUsageError(oc, opm.GetChannelIdentifier())
						continue
					}

					// If I am a Client, the server can only open even numbered channels
					if oc.Client && opm.GetChannelIdentifier()%2 != 0 {
						service.OnBadUsageError(oc, opm.GetChannelIdentifier())
						continue
					}

					// If I am a Server, the client can only open odd numbered channels
					if !oc.Client && opm.GetChannelIdentifier()%2 != 1 {
						service.OnBadUsageError(oc, opm.GetChannelIdentifier())
						continue
					}

					switch opm.GetChannelType() {
					case "im.ricochet.auth.hidden-service":
						if oc.Client {
							// Servers are authed by default and can't auth with hidden-service
							service.OnBadUsageError(oc, opm.GetChannelIdentifier())
						} else if oc.IsAuthed {
							// Can't auth if already authed
							service.OnBadUsageError(oc, opm.GetChannelIdentifier())
						} else if oc.HasChannel("im.ricochet.auth.hidden-service") {
							// Can't open more than 1 auth channel
							service.OnBadUsageError(oc, opm.GetChannelIdentifier())
						} else {
							clientCookie, err := proto.GetExtension(opm, Protocol_Data_AuthHiddenService.E_ClientCookie)
							if err == nil {
								clientCookieB := [16]byte{}
								copy(clientCookieB[:], clientCookie.([]byte)[:])
								service.OnAuthenticationRequest(oc, opm.GetChannelIdentifier(), clientCookieB)
							} else {
								// Must include Client Cookie
								service.OnBadUsageError(oc, opm.GetChannelIdentifier())
							}
						}
					case "im.ricochet.chat":
						if !oc.IsAuthed {
							// Can't open chat channel if not authorized
							service.OnUnauthorizedError(oc, opm.GetChannelIdentifier())
						} else if !service.IsKnownContact(oc.OtherHostname) {
							// Can't open chat channel if not a known contact
							service.OnUnauthorizedError(oc, opm.GetChannelIdentifier())
						} else {
							service.OnOpenChannelRequest(oc, opm.GetChannelIdentifier(), "im.ricochet.chat")
						}
					case "im.ricochet.contact.request":
						if oc.Client {
							// Servers are not allowed to send contact requests
							service.OnBadUsageError(oc, opm.GetChannelIdentifier())
						} else if !oc.IsAuthed {
							// Can't open a contact channel if not authed
							service.OnUnauthorizedError(oc, opm.GetChannelIdentifier())
						} else if oc.HasChannel("im.ricochet.contact.request") {
							// Only 1 contact channel is allowed to be open at a time
							service.OnBadUsageError(oc, opm.GetChannelIdentifier())
						} else {
							contactRequestI, err := proto.GetExtension(opm, Protocol_Data_ContactRequest.E_ContactRequest)
							if err == nil {
								contactRequest, check := contactRequestI.(*Protocol_Data_ContactRequest.ContactRequest)
								if check {
									service.OnContactRequest(oc, opm.GetChannelIdentifier(), contactRequest.GetNickname(), contactRequest.GetMessageText())
									break
								}
							}
							service.OnBadUsageError(oc, opm.GetChannelIdentifier())
						}
					default:
						service.OnUnknownTypeError(oc, opm.GetChannelIdentifier())
					}
				} else if res.GetChannelResult() != nil {
					crm := res.GetChannelResult()
					if crm.GetOpened() {
						switch oc.GetChannelType(crm.GetChannelIdentifier()) {
						case "im.ricochet.auth.hidden-service":
							serverCookie, err := proto.GetExtension(crm, Protocol_Data_AuthHiddenService.E_ServerCookie)
							if err == nil {
								serverCookieB := [16]byte{}
								copy(serverCookieB[:], serverCookie.([]byte)[:])
								service.OnAuthenticationChallenge(oc, crm.GetChannelIdentifier(), serverCookieB)
							} else {
								service.OnBadUsageError(oc, crm.GetChannelIdentifier())
							}
						case "im.ricochet.chat":
							service.OnOpenChannelRequestSuccess(oc, crm.GetChannelIdentifier())
						case "im.ricochet.contact.request":
							responseI, err := proto.GetExtension(res.GetChannelResult(), Protocol_Data_ContactRequest.E_Response)
							if err == nil {
								response, check := responseI.(*Protocol_Data_ContactRequest.Response)
								if check {
									service.OnContactRequestAck(oc, crm.GetChannelIdentifier(), response.GetStatus().String())
									break
								}
							}
							service.OnBadUsageError(oc, crm.GetChannelIdentifier())
						default:
							service.OnBadUsageError(oc, crm.GetChannelIdentifier())
						}
					} else {
						if oc.GetChannelType(crm.GetChannelIdentifier()) != "none" {
							service.OnFailedChannelOpen(oc, crm.GetChannelIdentifier(), crm.GetCommonError().String())
						} else {
							oc.CloseChannel(crm.GetChannelIdentifier())
						}
					}
				} else {
					// Unknown Message
					oc.CloseChannel(packet.Channel)
				}
			} else if oc.GetChannelType(packet.Channel) == "im.ricochet.auth.hidden-service" {
				res := new(Protocol_Data_AuthHiddenService.Packet)
				err := proto.Unmarshal(packet.Data[:], res)

				if err != nil {
					oc.CloseChannel(packet.Channel)
					continue
				}

				if res.GetProof() != nil && !oc.Client { // Only Clients Send Proofs
					service.OnAuthenticationProof(oc, packet.Channel, res.GetProof().GetPublicKey(), res.GetProof().GetSignature(), service.IsKnownContact(oc.OtherHostname))
				} else if res.GetResult() != nil && oc.Client { // Only Servers Send Results
					service.OnAuthenticationResult(oc, packet.Channel, res.GetResult().GetAccepted(), res.GetResult().GetIsKnownContact())
				} else {
					// If neither of the above are satisfied we just close the connection
					oc.Close()
				}

			} else if oc.GetChannelType(packet.Channel) == "im.ricochet.chat" {

				// NOTE: These auth checks should be redundant, however they
				// are included here for defense-in-depth if for some reason
				// a previously authed connection becomes untrusted / not known and
				// the state is not cleaned up.
				if !oc.IsAuthed {
					// Can't send chat messages if not authorized
					service.OnUnauthorizedError(oc, packet.Channel)
				} else if !service.IsKnownContact(oc.OtherHostname) {
					// Can't send chat message if not a known contact
					service.OnUnauthorizedError(oc, packet.Channel)
				} else {
					res := new(Protocol_Data_Chat.Packet)
					err := proto.Unmarshal(packet.Data[:], res)

					if err != nil {
						oc.CloseChannel(packet.Channel)
						continue
					}

					if res.GetChatMessage() != nil {
						service.OnChatMessage(oc, packet.Channel, int32(res.GetChatMessage().GetMessageId()), res.GetChatMessage().GetMessageText())
					} else if res.GetChatAcknowledge() != nil {
						service.OnChatMessageAck(oc, packet.Channel, int32(res.GetChatMessage().GetMessageId()))
					} else {
						// If neither of the above are satisfied we just close the connection
						oc.Close()
					}
				}
			} else if oc.GetChannelType(packet.Channel) == "im.ricochet.contact.request" {

				// NOTE: These auth checks should be redundant, however they
				// are included here for defense-in-depth if for some reason
				// a previously authed connection becomes untrusted / not known and
				// the state is not cleaned up.
				if !oc.Client {
					// Clients are not allowed to send contact request responses
					service.OnBadUsageError(oc, packet.Channel)
				} else if !oc.IsAuthed {
					// Can't send a contact request if not authed
					service.OnBadUsageError(oc, packet.Channel)
				} else {
					res := new(Protocol_Data_ContactRequest.Response)
					err := proto.Unmarshal(packet.Data[:], res)
					log.Printf("%v", res)
					if err != nil {
						oc.CloseChannel(packet.Channel)
						continue
					}
					service.OnContactRequestAck(oc, packet.Channel, res.GetStatus().String())
				}
			} else if oc.GetChannelType(packet.Channel) == "none" {
				// Invalid Channel Assignment
				oc.CloseChannel(packet.Channel)
			} else {
				oc.Close()
			}
		}
	}
}

// negotiateVersion Perform version negotiation with the connected host.
func (r *Ricochet) negotiateVersion(conn net.Conn, outbound bool) (*OpenConnection, error) {
	version := make([]byte, 4)
	version[0] = 0x49
	version[1] = 0x4D
	version[2] = 0x01
	version[3] = 0x01

	// If this was initiated by us then we need to initiate the version info.
	if outbound {
		// Send Version String

		conn.Write(version)
		res, err := r.rni.Recv(conn)

		if len(res) != 1 || err != nil {
			return nil, errors.New("Failed Version Negotiating")
		}

		if res[0] != 1 {
			return nil, errors.New("Failed Version Negotiating - Invalid Version ")
		}
	} else {
		// Do Version Negotiation

		buf := make([]byte, 10)
		n, err := conn.Read(buf)
		if err != nil && n >= 4 {
			return nil, err
		}

		if buf[0] == version[0] && buf[1] == version[1] {
			foundVersion := false
			if buf[2] >= 1 {
				for i := 3; i < n; i++ {
					if buf[i] == 0x01 {
						conn.Write([]byte{0x01})
						foundVersion = true
					}
				}
			}
			if !foundVersion {
				return nil, errors.New("Failed Version Negotiating - No Available Version")
			}
		} else {
			return nil, errors.New("Failed Version Negotiating - Invalid Version Header")
		}
	}

	oc := new(OpenConnection)
	oc.Init(outbound, conn)
	return oc, nil
}