Rotate per-participant keys when a member leaves (#3833)

* WIP refactor for removing m.call events * Always remember rtcsessions since we need to only have one instance * Fix tests * Fix import loop * Fix more cyclic imports & tests * Test session joining * Attempt to make tests happy * Always leave calls in the tests to clean up * comment + desperate attempt to work out what's failing * More test debugging * Okay, so these ones are fine? * Stop more timers and hopefully have happy tests * Test no rejoin * Test malformed m.call.member events * Test event emitting and also move some code to a more sensible place in the file * Test getActiveFoci() * Test event emitting (and also fix it) * Test membership updating & pruning on join * Test getOldestMembership() * Test member event renewal * Don't start the rtc manager until the client has synced Then we can initialise from the state once it's completed. * Fix type * Remove listeners added in constructor * Stop the client here too * Stop the client here also also * ARGH. Disable tests to work out which one is causing the exception * Disable everything * Re-jig to avoid setting listeners in the constructor and re-enable tests * No need to rename this anymore * argh, remove the right listener * Is it this test??? * Re-enable some tests * Try mocking getRooms to return something valid * Re-enable other tests * Give up trying to get the tests to work sensibly and deal with getRooms() returning nothing * Oops, don't enable the ones that were skipped before * One more try at the sensible way * Didn't work, go back to the hack way. * Log when we manage to send the member event update * Support `getOpenIdToken()` in embedded mode (#3676) * Call `sendContentLoaded()` (#3677) * Start MatrixRTC in embedded mode (#3679) * Reschedule the membership event check * Bump widget api version * Add mock for sendContentLoaded() * Embeded mode pre-requisites Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Embeded mode E2EE Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Encryption condition Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Revert "Embeded mode pre-requisites" This reverts commit 8cd73702052609c995ad754e31f85d0da0be4aa9. * Get back event type Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> fds Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Change embedded E2EE implementation Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * More log detail * Fix tests and also better assert because the tests were passing undefined which was considered fine because we were only checking for null. * Simplify updateCallMembershipEvent a bit * Split up updateCallMembershipEvent some more * Use `crypto.getRandomValues()` Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Rename to `membershipToUserAndDeviceId()` Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Better error Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Add log line Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Add comment Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Send call ID in enc events (also a small refactor) Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Revert making `joinRoomSession()` async Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Make `client` `private` again Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Just use `toString()` Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Fix `callId` check Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Fix map Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Fix map compare Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Fix emitting Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Explicit logging Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Refactor Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Make `updateEncryptionKeyEvent()` public Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Only update keys based on others Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Fix call order Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Improve logging Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Avoid races Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Revert "Avoid races" This reverts commit f65ed72d6e. * Add try-catch Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Make `updateEncryptionKeyEvent()` private Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Handle indices and throttling Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Fix merge mistakes Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Mort post-merge fixes Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> * Split out key generation from key sending And send all keys in a key event (changes the format of the key event) rather than just the one we just generated. * Remember and clear the timeout for the send key event So we don't schedule more key updates if one is already pending. Also don't update the last sent time when we didn't actually send the keys. * Make key event resends more robust * Attempt to make tests pass * crypto wasn't defined at all * Hopefully get interface right * Fix key format on the wire to base64 * Add comment * More standard method order * Rename encryptMedia The js-sdk doesn't do media and therefore doesn't do media encryption * Stop logging encryption keys now * Use regular base64 It's not going in a URL, so no need * Re-add base64url randomstring was using it. Also give it a test. * Add tests for randomstring * Switch between either browser or node crypto Let's see if this will work... * Obviously crypto has already solved this * Some tests for MatrixRTCSession key stuff * Test keys object contents * Change keys event format To move away from m. keys * Test key event retries * Test onCallEncryption * Test event sending & spam prevention * Test event cancelation * Test onCallEncryption called * Better before/after member comparison Only trigger for when members actually join, and just generally make it a bit more understandable. * Rotate per-participant keys when a member leaves With a delay borth before making a new key, to try to batch up multiple people leaving into a single key change, and a delay before actually using the new key to allow time for it to arrive. This increasingly feels like storing our own sender key in the same set is suboptimal because we're starting to have to treat it more & more specially. * Some errors didn't have data * Fix binary key comparison & add log line * Fix compare function with undefined values * Test key rotation * Test caught a merge bug! * The missing word was, 'delay' * More input validation --------- Signed-off-by: Šimon Brandner <simon.bra.ag@gmail.com> Co-authored-by: Šimon Brandner <simon.bra.ag@gmail.com>
2025-11-25 05:23:13 +03:00 · 2023-11-07 11:12:11 +00:00
parent 84bd8ab81f
commit 036fd943ac
3 changed files with 160 additions and 20 deletions
--- a/src/matrixrtc/MatrixRTCSession.ts
+++ b/src/matrixrtc/MatrixRTCSession.ts
@@ -26,13 +26,21 @@ import { MatrixError, MatrixEvent } from "../matrix";
 import { randomString, secureRandomBase64Url } from "../randomstring";
 import { EncryptionKeysEventContent } from "./types";
 import { decodeBase64, encodeUnpaddedBase64 } from "../base64";
-import { isNumber } from "../utils";

 const MEMBERSHIP_EXPIRY_TIME = 60 * 60 * 1000;
 const MEMBER_EVENT_CHECK_PERIOD = 2 * 60 * 1000; // How often we check to see if we need to re-send our member event
 const CALL_MEMBER_EVENT_RETRY_DELAY_MIN = 3000;
 const UPDATE_ENCRYPTION_KEY_THROTTLE = 3000;

+// A delay after a member leaves before we create and publish a new key, because people
+// tend to leave calls at the same time
+const MAKE_KEY_DELAY = 3000;
+// The delay between creating and sending a new key and starting to encrypt with it. This gives others
+// a chance to receive the new key to minimise the chance they don't get media they can't decrypt.
+// The total time between a member leaving and the call switching to new keys is therefore
+// MAKE_KEY_DELAY + SEND_KEY_DELAY
+const USE_KEY_DELAY = 5000;
+
 const getParticipantId = (userId: string, deviceId: string): string => `${userId}:${deviceId}`;
 const getParticipantIdFromMembership = (m: CallMembership): string => getParticipantId(m.sender!, m.deviceId);

@@ -85,6 +93,8 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
    private memberEventTimeout?: ReturnType<typeof setTimeout>;
    private expiryTimeout?: ReturnType<typeof setTimeout>;
    private keysEventUpdateTimeout?: ReturnType<typeof setTimeout>;
+    private makeNewKeyTimeout?: ReturnType<typeof setTimeout>;
+    private setNewKeyTimeouts = new Set<ReturnType<typeof setTimeout>>();

    private activeFoci: Focus[] | undefined;

@@ -253,6 +263,15 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
        // as they may still be using the same ones.
        this.encryptionKeys.set(getParticipantId(userId, deviceId), []);

+        if (this.makeNewKeyTimeout !== undefined) {
+            clearTimeout(this.makeNewKeyTimeout);
+            this.makeNewKeyTimeout = undefined;
+        }
+        for (const t of this.setNewKeyTimeouts) {
+            clearTimeout(t);
+        }
+        this.setNewKeyTimeouts.clear();
+
        logger.info(`Leaving call session in room ${this.room.roomId}`);
        this.relativeExpiry = undefined;
        this.activeFoci = undefined;
@@ -297,11 +316,24 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
        return (this.getKeysForParticipant(userId, deviceId)?.length ?? 0) % 16;
    }

+    /**
+     * Sets an encryption key at a specified index for a participant.
+     * The encryption keys for the local participanmt are also stored here under the
+     * user and device ID of the local participant.
+     * @param userId - The user ID of the participant
+     * @param deviceId - Device ID of the participant
+     * @param encryptionKeyIndex - The index of the key to set
+     * @param encryptionKeyString - The string represenation of the key to set in base64
+     * @param delayBeforeuse - If true, delay before emitting a key changed event. Useful when setting
+     *                         encryption keys for the local participant to allow time for the key to
+     *                         be distributed.
+     */
    private setEncryptionKey(
        userId: string,
        deviceId: string,
        encryptionKeyIndex: number,
        encryptionKeyString: string,
+        delayBeforeuse = false,
    ): void {
        const keyBin = decodeBase64(encryptionKeyString);

@@ -312,13 +344,24 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M

        encryptionKeys[encryptionKeyIndex] = keyBin;
        this.encryptionKeys.set(participantId, encryptionKeys);
-        this.emit(MatrixRTCSessionEvent.EncryptionKeyChanged, keyBin, encryptionKeyIndex, participantId);
+        if (delayBeforeuse) {
+            const useKeyTimeout = setTimeout(() => {
+                this.setNewKeyTimeouts.delete(useKeyTimeout);
+                logger.info(`Delayed-emitting key changed event for ${participantId} idx ${encryptionKeyIndex}`);
+                this.emit(MatrixRTCSessionEvent.EncryptionKeyChanged, keyBin, encryptionKeyIndex, participantId);
+            }, USE_KEY_DELAY);
+            this.setNewKeyTimeouts.add(useKeyTimeout);
+        } else {
+            this.emit(MatrixRTCSessionEvent.EncryptionKeyChanged, keyBin, encryptionKeyIndex, participantId);
+        }
    }

    /**
     * Generate a new sender key and add it at the next available index
+     * @param delayBeforeUse - If true, wait for a short period before settign the key for the
+     *                         media encryptor to use. If false, set the key immediately.
     */
-    private makeNewSenderKey(): void {
+    private makeNewSenderKey(delayBeforeUse = false): void {
        const userId = this.client.getUserId();
        const deviceId = this.client.getDeviceId();

@@ -328,7 +371,7 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
        const encryptionKey = secureRandomBase64Url(16);
        const encryptionKeyIndex = this.getNewEncryptionKeyIndex();
        logger.info("Generated new key at index " + encryptionKeyIndex);
-        this.setEncryptionKey(userId, deviceId, encryptionKeyIndex, encryptionKey);
+        this.setEncryptionKey(userId, deviceId, encryptionKeyIndex, encryptionKey, delayBeforeUse);
    }

    /**
@@ -393,6 +436,7 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M

            logger.debug(
                `Embedded-E2EE-LOG updateEncryptionKeyEvent participantId=${userId}:${deviceId} numSent=${myKeys.length}`,
+                this.encryptionKeys,
            );
        } catch (error) {
            const matrixError = error as MatrixError;
@@ -462,9 +506,17 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
            return;
        }

+        if (userId === this.client.getUserId() && deviceId === this.client.getDeviceId()) {
+            // We store our own sender key in the same set along with keys from others, so it's
+            // important we don't allow our own keys to be set by one of these events (apart from
+            // the fact that we don't need it anyway because we already know our own keys).
+            logger.info("Ignoring our own keys event");
+            return;
+        }
+
        for (const key of content.keys) {
-            if (!key.key || !isNumber(key.index)) {
-                logger.warn(`Received m.call.encryption_keys with invalid entry: callId=${callId}`);
+            if (!key) {
+                logger.info("Ignoring false-y key in keys event");
                continue;
            }

@@ -510,20 +562,25 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M

        const isMyMembership = (m: CallMembership): boolean =>
            m.sender === this.client.getUserId() && m.deviceId === this.client.getDeviceId();
-        const callMembersChanged =
-            oldMemberships
-                .filter((m) => !isMyMembership(m))
-                .map(getParticipantIdFromMembership)
-                .sort()
-                .join() !==
-            this.memberships
-                .filter((m) => !isMyMembership(m))
-                .map(getParticipantIdFromMembership)
-                .sort()
-                .join();

-        if (callMembersChanged && this.isJoined()) {
-            this.requestKeyEventSend();
+        if (this.isJoined() && this.makeNewKeyTimeout === undefined) {
+            const oldMebershipIds = new Set(
+                oldMemberships.filter((m) => !isMyMembership(m)).map(getParticipantIdFromMembership),
+            );
+            const newMebershipIds = new Set(
+                this.memberships.filter((m) => !isMyMembership(m)).map(getParticipantIdFromMembership),
+            );
+
+            const anyLeft = Array.from(oldMebershipIds).some((x) => !newMebershipIds.has(x));
+            const anyJoined = Array.from(newMebershipIds).some((x) => !oldMebershipIds.has(x));
+
+            if (anyLeft) {
+                logger.debug(`Member(s) have left: queueing sender key rotation`);
+                this.makeNewKeyTimeout = setTimeout(this.onRotateKeyTimeout, MAKE_KEY_DELAY);
+            } else if (anyJoined) {
+                logger.debug(`New member(s) have joined: re-sending keys`);
+                this.requestKeyEventSend();
+            }
        }

        this.setExpiryTimer();
@@ -708,4 +765,13 @@ export class MatrixRTCSession extends TypedEventEmitter<MatrixRTCSessionEvent, M
            await this.triggerCallMembershipEventUpdate();
        }
    }
+
+    private onRotateKeyTimeout = (): void => {
+        this.makeNewKeyTimeout = undefined;
+        logger.info("Making new sender key for key rotation");
+        this.makeNewSenderKey(true);
+        // send immediately: if we're about to start sending with a new key, it's
+        // important we get it out to others as soon as we can.
+        this.sendEncryptionKeysEvent();
+    };
 }