Public Access
Take a rotated vault's contents onto the new key as well
Rotating a vault re-keyed the vault and not its contents, which was the deal struck last time: everything already stored stayed sealed under the generation it was written with, every remaining member kept the older keys, and the guarantee was narrowed to "nothing written from now on". That left one gap worth closing — somebody who walked off with the old key could still open old ciphertext they later got hold of — and the reason it was safe to defer is the reason it was cheap to add. A vault at mixed generations reads perfectly well, so the pass that moves items across can stop half way and be run again. VaultResealer walks the vault and rewrites each item as an ordinary upsert against the version the server holds. It never decodes the plaintext: an item is opened and the same bytes are sealed again under a fresh data key, so an item written by a newer client crosses a rotation untouched rather than being re-encoded through this build's codec and quietly losing the fields this build has no concept of. It also means nothing in the pass knows what an item is, which is why one loop covers every type including the ones added after it. A conflict is counted and skipped rather than merged — there is nothing to merge, since no content changes — and the next pass picks the item up at the version the other client left. The half that a pass over stored items cannot see is a change queued before the rotation and pushed after it, which would put a brand-new item into the vault under the key the person who just left still holds. So the push path re-seals a stale payload as it dispatches it, writing the revision back to the outbox first so that a retry sends the same bytes rather than a fresh envelope. Between the two, nothing reaches the server under a superseded generation at all. Queued items are therefore deliberately left alone by the pass: rewriting one there would overwrite the user's unpushed work with the version the server holds, which is the one thing a re-keying pass must never do. Removal runs it last, after a sync — a mirror that is behind produces a batch of conflicts instead of a re-sealed vault — and the status line distinguishes the two guarantees, because they are not the same: a vault fully re-sealed is closed to the person who left, and one with items outstanding is closed only to what happens next. Six tests, and three mutations run against them: making the re-seal return the payload unchanged fails five of the six, making the push path skip re-sealing fails the queued-edit test and only that one, and counting conflicts as applied fails the write-elsewhere test. One of the six was wrong before it was right — it modelled a third-party write by re-pushing an existing payload at a bumped version, which no real client would do, and it took reading the AAD to see that the test was lying rather than the code.
This commit is contained in:
@@ -350,13 +350,16 @@ public sealed class SyncEngine
|
||||
|
||||
foreach (var operation in pending)
|
||||
{
|
||||
var payload = await CurrentAsync(vaultId, operation, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
operations.Add(new SyncPushOperation(
|
||||
operation.OperationId,
|
||||
operation.EntityType,
|
||||
operation.EntityId,
|
||||
operation.Operation,
|
||||
operation.ExpectedVersion,
|
||||
operation.Payload,
|
||||
payload,
|
||||
operation.Fields));
|
||||
|
||||
byOperationId[operation.OperationId] = operation;
|
||||
@@ -393,6 +396,68 @@ public sealed class SyncEngine
|
||||
pending.Count, conflicted, pending.Count == options.MaxOperationsPerPush);
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The payload to send, re-sealed under the current key if it was queued before a rotation.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// <b>Nothing may reach the server under a superseded generation, and this is where that is
|
||||
/// enforced.</b> A change queued offline is sealed under whatever key was current when it was made,
|
||||
/// and a rotation can land in between — so sending it as it stands would store a brand-new item
|
||||
/// under the key the person who was just removed still holds. The vault's own re-sealing pass cannot
|
||||
/// help: it runs over what the server holds, and this has not been sent yet.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// The revised payload is written back to the outbox before it goes, so a push whose answer is lost
|
||||
/// is retried as the same bytes. Re-sealing on each attempt instead would produce a different
|
||||
/// envelope every time, which is harmless on the wire and would leave the queued row disagreeing
|
||||
/// with what the server may already have accepted.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
private async Task<EncryptedPayload?> CurrentAsync(
|
||||
Guid vaultId,
|
||||
PendingOperation operation,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
if (operation.Payload is not { } payload
|
||||
|| !keyring.TryGet(vaultId, out _, out var generation)
|
||||
|| payload.KeyGeneration >= generation)
|
||||
{
|
||||
return operation.Payload;
|
||||
}
|
||||
|
||||
var version = SyncVersions.NextVersion(operation.ExpectedVersion);
|
||||
|
||||
var resealed = PayloadReseal.TryReseal(
|
||||
keyring,
|
||||
vaultId,
|
||||
operation.EntityType,
|
||||
operation.EntityId,
|
||||
payload,
|
||||
openAtVersion: version,
|
||||
sealAtVersion: version);
|
||||
|
||||
if (resealed is null)
|
||||
{
|
||||
// The generation this change was queued under is one this session no longer holds. It goes
|
||||
// as it stands: the server takes it either way, and a queued edit that cannot be re-sealed
|
||||
// is still the user's work.
|
||||
return payload;
|
||||
}
|
||||
|
||||
await outbox.ReviseAsync(
|
||||
operation.Sequence,
|
||||
operation.Operation,
|
||||
operation.ExpectedVersion,
|
||||
resealed,
|
||||
operation.Fields,
|
||||
operation.Ancestor,
|
||||
cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
return resealed;
|
||||
}
|
||||
|
||||
/// <returns>Whether this answer warrants another push round.</returns>
|
||||
private async Task<bool> HandleAsync(
|
||||
Guid vaultId,
|
||||
|
||||
@@ -0,0 +1,414 @@
|
||||
using System.Security.Cryptography;
|
||||
using DodoSSH.Client.Api;
|
||||
using DodoSSH.Client.Storage;
|
||||
using DodoSSH.Contracts;
|
||||
using DodoSSH.Crypto;
|
||||
|
||||
namespace DodoSSH.Client.Sync;
|
||||
|
||||
/// <summary>What one re-sealing pass did.</summary>
|
||||
/// <param name="VaultId">The vault.</param>
|
||||
/// <param name="KeyGeneration">The generation everything was moved to.</param>
|
||||
/// <param name="Resealed">Items now sealed under the current key.</param>
|
||||
/// <param name="Deferred">
|
||||
/// Items left alone because a local edit is queued for them. Not a failure: a queued change is re-sealed
|
||||
/// as it is pushed, so these arrive at the current generation by another route.
|
||||
/// </param>
|
||||
/// <param name="Unreadable">
|
||||
/// Items whose own generation this session holds no key for. They stay where they are — the alternative
|
||||
/// is discarding an item nobody can read yet, which is the one outcome that cannot be undone.
|
||||
/// </param>
|
||||
/// <param name="Contested">
|
||||
/// Items somebody else wrote while this pass was running. The server refused the version, and the next
|
||||
/// pass picks them up against the version it left behind.
|
||||
/// </param>
|
||||
public sealed record ResealReport(
|
||||
Guid VaultId,
|
||||
uint KeyGeneration,
|
||||
int Resealed,
|
||||
int Deferred,
|
||||
int Unreadable,
|
||||
int Contested)
|
||||
{
|
||||
/// <summary>Whether every item in the vault is now sealed under its current key.</summary>
|
||||
/// <remarks>
|
||||
/// Deferred items count as finished. They are queued changes, and a queued change cannot reach the
|
||||
/// server under a superseded key — <see cref="SyncEngine"/> re-seals it on the way out.
|
||||
/// </remarks>
|
||||
public bool Complete => Unreadable == 0 && Contested == 0;
|
||||
|
||||
/// <summary>Whether anything moved.</summary>
|
||||
public bool MovedAnything => Resealed > 0;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Moves a rotated vault's stored items onto its current key.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// <b>What a rotation on its own does not do.</b> Advancing a vault's generation re-keys the vault and
|
||||
/// not its contents: every item stays sealed under the generation it was written with, readable by
|
||||
/// anybody holding that generation's grant. That is what keeps a rotation cheap and safe — see
|
||||
/// ADR 0010 — and it leaves one gap, which is this pass. Somebody who left with a copy of the old key
|
||||
/// could still open old ciphertext they later got hold of. Once this has run, they cannot: every item
|
||||
/// is sealed under a key issued after they went.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>The plaintext is never decoded.</b> An item is opened, and the same bytes are sealed again under
|
||||
/// a fresh data key — no codec, no merge, no schema version. So an item written by a newer client
|
||||
/// survives this untouched, where re-encoding it through this build's codec would silently drop the
|
||||
/// fields this build has no concept of. It also means nothing here needs to know what an item *is*,
|
||||
/// which is why one pass covers every type including the ones added later.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// <b>Resumable by construction, because a vault at mixed generations is readable.</b> Each item is one
|
||||
/// ordinary upsert against the version the server holds, so a pass that dies half way leaves a working
|
||||
/// vault, and running it again picks up what is left. Nothing here is a transaction and nothing needs
|
||||
/// to be.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
public sealed class VaultResealer
|
||||
{
|
||||
private readonly ISyncApi api;
|
||||
private readonly ItemStore items;
|
||||
private readonly OutboxStore outbox;
|
||||
private readonly VaultKeyring keyring;
|
||||
private readonly TimeProvider clock;
|
||||
private readonly SyncOptions options;
|
||||
|
||||
/// <summary>Creates the pass.</summary>
|
||||
public VaultResealer(
|
||||
ISyncApi api,
|
||||
ItemStore items,
|
||||
OutboxStore outbox,
|
||||
VaultKeyring keyring,
|
||||
TimeProvider clock,
|
||||
SyncOptions? options = null)
|
||||
{
|
||||
ArgumentNullException.ThrowIfNull(api);
|
||||
ArgumentNullException.ThrowIfNull(items);
|
||||
ArgumentNullException.ThrowIfNull(outbox);
|
||||
ArgumentNullException.ThrowIfNull(keyring);
|
||||
ArgumentNullException.ThrowIfNull(clock);
|
||||
|
||||
this.api = api;
|
||||
this.items = items;
|
||||
this.outbox = outbox;
|
||||
this.keyring = keyring;
|
||||
this.clock = clock;
|
||||
this.options = options ?? SyncOptions.Default;
|
||||
}
|
||||
|
||||
/// <summary>Re-seals everything in one vault that is not already on its current key.</summary>
|
||||
/// <param name="vaultId">The vault.</param>
|
||||
/// <param name="cancellationToken">Cancellation token.</param>
|
||||
/// <remarks>
|
||||
/// Answers with a report of zero for a vault this session cannot write to, rather than throwing.
|
||||
/// Being rotated past and not yet re-wrapped is the ordinary state for a member between somebody
|
||||
/// else's rotation and their own re-grant, and it is not this pass's business to complain about it.
|
||||
/// </remarks>
|
||||
public async Task<ResealReport> ResealAsync(Guid vaultId, CancellationToken cancellationToken)
|
||||
{
|
||||
if (!keyring.TryGet(vaultId, out _, out var generation))
|
||||
{
|
||||
return new ResealReport(vaultId, KeyGeneration: 0, 0, 0, 0, 0);
|
||||
}
|
||||
|
||||
var queued = await QueuedAsync(vaultId, cancellationToken).ConfigureAwait(false);
|
||||
|
||||
var tally = new Tally();
|
||||
var batch = new List<Pending>(options.MaxOperationsPerPush);
|
||||
|
||||
foreach (var entityType in ItemKinds.SyncedTypes)
|
||||
{
|
||||
var stored = await items
|
||||
.ListAsync(vaultId, entityType, includeDeleted: false, cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
foreach (var item in stored.Where(item => Behind(item, generation)))
|
||||
{
|
||||
if (queued.Contains((entityType, item.EntityId)))
|
||||
{
|
||||
tally.Deferred++;
|
||||
continue;
|
||||
}
|
||||
|
||||
if (Move(vaultId, item) is not { } moved)
|
||||
{
|
||||
tally.Unreadable++;
|
||||
continue;
|
||||
}
|
||||
|
||||
batch.Add(moved);
|
||||
|
||||
if (batch.Count == options.MaxOperationsPerPush)
|
||||
{
|
||||
await SendAsync(vaultId, batch, tally, cancellationToken).ConfigureAwait(false);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
await SendAsync(vaultId, batch, tally, cancellationToken).ConfigureAwait(false);
|
||||
|
||||
return new ResealReport(
|
||||
vaultId, generation, tally.Resealed, tally.Deferred, tally.Unreadable, tally.Contested);
|
||||
}
|
||||
|
||||
/// <summary>Whether an item is still sealed under a key the vault has moved past.</summary>
|
||||
private static bool Behind(StoredItem item, uint generation) =>
|
||||
item.Payload is { } payload && payload.KeyGeneration < generation;
|
||||
|
||||
/// <summary>Re-seals one item, or answers null when this session cannot open it.</summary>
|
||||
private Pending? Move(Guid vaultId, StoredItem item)
|
||||
{
|
||||
var version = SyncVersions.NextVersion(item.Version);
|
||||
|
||||
var payload = PayloadReseal.TryReseal(
|
||||
keyring, vaultId, item.EntityType, item.EntityId, item.Payload!, item.Version, version);
|
||||
|
||||
return payload is null ? null : new Pending(item, payload, version);
|
||||
}
|
||||
|
||||
/// <summary>Sends a batch if there is one, and empties it.</summary>
|
||||
private async Task SendAsync(
|
||||
Guid vaultId,
|
||||
List<Pending> batch,
|
||||
Tally tally,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
if (batch.Count == 0)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
var outcome = await PushAsync(vaultId, batch, cancellationToken).ConfigureAwait(false);
|
||||
|
||||
tally.Resealed += outcome.Applied;
|
||||
tally.Contested += outcome.Contested;
|
||||
|
||||
batch.Clear();
|
||||
}
|
||||
|
||||
/// <summary>The running counts, so the loop above stays one screen long.</summary>
|
||||
private sealed class Tally
|
||||
{
|
||||
internal int Resealed { get; set; }
|
||||
|
||||
internal int Deferred { get; set; }
|
||||
|
||||
internal int Unreadable { get; set; }
|
||||
|
||||
internal int Contested { get; set; }
|
||||
}
|
||||
|
||||
/// <summary>One item, re-sealed and waiting to be sent.</summary>
|
||||
private sealed record Pending(StoredItem Item, EncryptedPayload Payload, int Version)
|
||||
{
|
||||
internal Guid OperationId { get; } = Guid.CreateVersion7();
|
||||
}
|
||||
|
||||
/// <summary>What one batch achieved.</summary>
|
||||
[System.Runtime.InteropServices.StructLayout(System.Runtime.InteropServices.LayoutKind.Auto)]
|
||||
private readonly record struct PushOutcome(int Applied, int Contested);
|
||||
|
||||
/// <summary>
|
||||
/// Sends one batch and mirrors what the server accepted.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The mirror is written here rather than left to the next pull, so that a pass followed immediately
|
||||
/// by another does not re-seal everything a second time. It is the same row with the same plaintext
|
||||
/// under a new key, so there is nothing for a reader to notice.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// A conflict is counted and skipped. There is nothing to merge — this pass changes no content — and
|
||||
/// re-reading the item at the version the other client left is exactly what the next pass does.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
private async Task<PushOutcome> PushAsync(
|
||||
Guid vaultId,
|
||||
List<Pending> batch,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var operations = batch
|
||||
.Select(pending => new SyncPushOperation(
|
||||
pending.OperationId,
|
||||
pending.Item.EntityType,
|
||||
pending.Item.EntityId,
|
||||
SyncOperation.Upsert,
|
||||
pending.Item.Version,
|
||||
pending.Payload,
|
||||
pending.Item.Fields))
|
||||
.ToList();
|
||||
|
||||
var response = await api
|
||||
.SyncPushAsync(vaultId, new SyncPushRequest(operations), cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
|
||||
var applied = 0;
|
||||
var contested = 0;
|
||||
|
||||
foreach (var result in response.Results)
|
||||
{
|
||||
if (batch.Find(pending => pending.OperationId == result.OperationId) is not { } sent)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
|
||||
if (result.Status is not (SyncOperationStatus.Applied or SyncOperationStatus.Duplicate))
|
||||
{
|
||||
contested++;
|
||||
continue;
|
||||
}
|
||||
|
||||
applied++;
|
||||
|
||||
await items.SaveAsync(
|
||||
sent.Item with
|
||||
{
|
||||
Version = result.Version ?? sent.Version,
|
||||
ChangeSequence = result.ChangeSequence ?? sent.Item.ChangeSequence,
|
||||
Payload = sent.Payload,
|
||||
UpdatedAt = clock.GetUtcNow(),
|
||||
},
|
||||
cancellationToken)
|
||||
.ConfigureAwait(false);
|
||||
}
|
||||
|
||||
return new PushOutcome(applied, contested);
|
||||
}
|
||||
|
||||
/// <summary>The items a local edit is already queued for.</summary>
|
||||
private async Task<HashSet<(SyncEntityType Type, Guid EntityId)>> QueuedAsync(
|
||||
Guid vaultId,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
var pending = await outbox.ListAllAsync(vaultId, cancellationToken).ConfigureAwait(false);
|
||||
|
||||
return [.. pending.Select(operation => (operation.EntityType, operation.EntityId))];
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Moving one payload from the key it was sealed under to the one in force now.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Used from two places, and both of them matter: the pass above, which walks a rotated vault, and the
|
||||
/// push path, which cannot be allowed to send a change queued before a rotation under the key it was
|
||||
/// queued with. Between them they are the guarantee that nothing reaches the server under a superseded
|
||||
/// generation.
|
||||
/// </remarks>
|
||||
internal static class PayloadReseal
|
||||
{
|
||||
/// <summary>
|
||||
/// Re-seals a payload under the vault's current key.
|
||||
/// </summary>
|
||||
/// <param name="keyring">The open keyring.</param>
|
||||
/// <param name="vaultId">The vault.</param>
|
||||
/// <param name="entityType">What kind of item this is; the AAD binds its resource type.</param>
|
||||
/// <param name="entityId">The item.</param>
|
||||
/// <param name="payload">The payload as it stands, sealed under an earlier generation.</param>
|
||||
/// <param name="openAtVersion">The item version <paramref name="payload"/> is bound to.</param>
|
||||
/// <param name="sealAtVersion">The version the result will be bound to.</param>
|
||||
/// <returns>
|
||||
/// The re-sealed payload, or <see langword="null"/> when this session cannot open the original —
|
||||
/// which means one item stays where it is, and says nothing about the rest of the vault.
|
||||
/// </returns>
|
||||
/// <remarks>
|
||||
/// A fresh data key, not the original one re-wrapped. The two cost the same here, because the AAD
|
||||
/// binds the generation into the payload as well as into the key wrap and the envelope has to be
|
||||
/// re-made either way — and a new key per version is the rule the whole item format is built on.
|
||||
/// </remarks>
|
||||
internal static EncryptedPayload? TryReseal(
|
||||
VaultKeyring keyring,
|
||||
Guid vaultId,
|
||||
SyncEntityType entityType,
|
||||
Guid entityId,
|
||||
EncryptedPayload payload,
|
||||
int openAtVersion,
|
||||
int sealAtVersion)
|
||||
{
|
||||
if (!keyring.TryGetAt(vaultId, payload.KeyGeneration, out var previous)
|
||||
|| !keyring.TryGet(vaultId, out var current, out var generation))
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
var resource = AadResourceTypes.For(entityType);
|
||||
|
||||
var dataKey = ItemKeys.TryUnwrapDataKey(
|
||||
previous.Span,
|
||||
payload.WrappedDataKey,
|
||||
resource,
|
||||
entityId,
|
||||
payload.KeyGeneration,
|
||||
(uint)openAtVersion);
|
||||
|
||||
if (dataKey is null)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
var plaintext = ItemKeys.TryOpenPayload(
|
||||
dataKey,
|
||||
payload.Envelope,
|
||||
resource,
|
||||
entityId,
|
||||
payload.DataKeyId,
|
||||
payload.KeyGeneration,
|
||||
(uint)openAtVersion);
|
||||
|
||||
if (plaintext is null)
|
||||
{
|
||||
return null;
|
||||
}
|
||||
|
||||
try
|
||||
{
|
||||
return Seal(
|
||||
plaintext, current.Span, resource, entityId, generation, (uint)sealAtVersion);
|
||||
}
|
||||
finally
|
||||
{
|
||||
// The one place in this file that holds an item's plaintext, and it holds every kind of
|
||||
// item there is — a private key, a password, a snippet with a token pasted into it.
|
||||
CryptographicOperations.ZeroMemory(plaintext);
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
CryptographicOperations.ZeroMemory(dataKey);
|
||||
}
|
||||
}
|
||||
|
||||
private static EncryptedPayload Seal(
|
||||
ReadOnlySpan<byte> plaintext,
|
||||
ReadOnlySpan<byte> vaultKey,
|
||||
CryptoSpec.AadResourceType resource,
|
||||
Guid entityId,
|
||||
uint keyGeneration,
|
||||
uint itemVersion)
|
||||
{
|
||||
var dataKey = ItemKeys.CreateDataKey();
|
||||
|
||||
try
|
||||
{
|
||||
var dataKeyId = Guid.CreateVersion7();
|
||||
|
||||
var envelope = ItemKeys.SealPayload(
|
||||
dataKey, plaintext, resource, entityId, dataKeyId, keyGeneration, itemVersion);
|
||||
|
||||
var wrapped = ItemKeys.WrapDataKey(
|
||||
dataKey, vaultKey, resource, entityId, keyGeneration, itemVersion);
|
||||
|
||||
return new EncryptedPayload(
|
||||
envelope, wrapped, dataKeyId, keyGeneration, CryptoSpec.CurrentAadVersion);
|
||||
}
|
||||
finally
|
||||
{
|
||||
CryptographicOperations.ZeroMemory(dataKey);
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user