give Android the relay initiator it never had, and assign the role per peer so two phones cannot both wait: an extension is always dialled by, and between phones the lower long-term key opens the room (v2.5.2)

@@ -0,0 +1,74 @@1+package com.peachpasswords.sync2+3+import org.json.JSONObject4+5+/**6+ * One relayed reconnect session where WE speak first — the mirror of7+ * [runCloudRelayResponderSession], and the half Android never had.8+ *9+ * Until this existed the phone could only ever wait, which was fine against a10+ * browser extension (it can only dial) and a deadlock against another phone:11+ * two waiters in the same room, nobody opening. See [weDialPeer] for how the12+ * role is assigned.13+ *14+ * The wire is the extension's, byte for byte: an unencrypted `PEACH_RECONNECT`15+ * selector naming the room, then Noise KK, then a padded PAIR_IDENTITY each16+ * way, then the sync exchange.17+ */18+internal suspend fun runCloudRelayInitiatorSession(19+    socket: RelayBinarySocket,20+    known: PairedDevice,21+    rendezvousId: String,22+    ourStaticPrivateKey: ByteArray,23+    ourStaticPublicKey: ByteArray,24+    localIdentity: LocalChirpIdentity,25+    vaultFactory: () -> ChirpSyncVaultAdapter?,26+    onSyncComplete: () -> Unit,27+) {28+    val responderKeyHex = known.longTermPublicKeyHex29+        ?: throw IllegalArgumentException("known peer missing static key")30+    val responderKey = hexToPubkey(responderKeyHex)31+32+    // The capability names the room only; it grants no trust. KK proves both33+    // private keys immediately after, and a wrong room is refused there.34+    socket.send(35+        JSONObject()36+            .put("type", "PEACH_RECONNECT")37+            .put("rendezvous_id", rendezvousId)38+            .toString()39+            .toByteArray(Charsets.UTF_8),40+    )41+    val session = noiseKKInitiator(42+        ourStaticPrivateKey,43+        ourStaticPublicKey,44+        responderKey,45+        socket::send,46+        socket::receive,47+    )48+    try {49+        socket.send(session.encrypt(SyncPadding.pad(encodePairIdentityFrame(localIdentity))))50+        val theirIdentity = parsePairIdentityFrame(51+            SyncPadding.unpad(session.decrypt(socket.receive())),52+        )53+        require(identityMatchesAuthenticatedPeer(known, theirIdentity, responderKey)) {54+            "peer identity does not match authenticated KK key"55+        }56+57+        val vault = vaultFactory() ?: return58+        vault.bindAuthenticatedPeer(known)59+        val outcome = runChirpSyncInitiator(60+            ChirpSyncSession(61+                remoteStaticPublicKey = responderKey.copyOf(),62+                send = { plaintext -> socket.send(session.encrypt(SyncPadding.pad(plaintext))) },63+                receive = { SyncPadding.unpad(session.decrypt(socket.receive())) },64+                close = { socket.close() },65+            ),66+            vault,67+        )68+        if (outcome.status == SyncOutcomeStatus.COMPLETED) {69+            onSyncComplete()70+        }71+    } finally {72+        session.close()73+    }74+}

@@ -0,0 +1,30 @@1+package com.peachpasswords.sync2+3+/**4+ * Who speaks first in a relay room.5+ *6+ * The relay is a two-party splice with no buffering and no "peer joined"7+ * signal, so exactly one side must open with `PEACH_RECONNECT` and the other8+ * must wait for it. Both sides derive the same room id from the shared pair9+ * secret, so the role has to be derivable from state both already hold —10+ * there is nothing on the wire to negotiate it with.11+ *12+ * Two rules, in order:13+ *14+ *  1. A browser extension can never hold a room open, so it always dials.15+ *     Toward an extension peer we therefore always wait.16+ *  2. Otherwise — phone to phone, phone to tablet — the lower long-term public17+ *     key dials. Comparing the keys is symmetric by construction: each side18+ *     compares the same two values and reaches the opposite conclusion, so the19+ *     roles can never collide (both dialling, or both waiting, which is what20+ *     left phone-to-phone with nobody dialling).21+ *22+ * The keys are hex of the same length, so an ordinary lexicographic compare is23+ * a total order over them. Ties are impossible: two devices sharing a static24+ * key are the same device.25+ */26+internal fun weDialPeer(ourLongTermPublicKeyHex: String, peer: PairedDevice): Boolean {27+    if (peer.deviceType == "extension") return false28+    val theirs = peer.longTermPublicKeyHex ?: return false29+    return ourLongTermPublicKeyHex.compareTo(theirs) < 030+}

@@ -0,0 +1,241 @@1+package com.peachpasswords.sync2+3+import kotlinx.coroutines.Dispatchers4+import kotlinx.coroutines.async5+import kotlinx.coroutines.channels.Channel6+import kotlinx.coroutines.runBlocking7+import org.bouncycastle.crypto.params.X25519PrivateKeyParameters8+import org.junit.Assert.assertEquals9+import org.junit.Assert.assertFalse10+import org.junit.Assert.assertNotEquals11+import org.junit.Assert.assertTrue12+import org.junit.Test13+import java.security.SecureRandom14+15+/**16+ * Phone-to-phone: the case that had no initiator at all. Both halves here are17+ * this app's own code, so a passing test means two Peach phones can complete18+ * the reconnect wire against each other — not that one of them can talk to a19+ * stand-in for the extension.20+ */21+class CloudRelayDialerTest {22+    private data class KeyPair(val publicKey: ByteArray, val privateKey: ByteArray)23+24+    private fun keys(): KeyPair {25+        val privateKey = X25519PrivateKeyParameters(SecureRandom())26+        return KeyPair(privateKey.generatePublicKey().encoded, privateKey.encoded)27+    }28+29+    private fun socketPair(): Pair<RelayBinarySocket, RelayBinarySocket> {30+        val leftInbox = Channel<ByteArray>(Channel.UNLIMITED)31+        val rightInbox = Channel<ByteArray>(Channel.UNLIMITED)32+        fun socket(inbox: Channel<ByteArray>, peer: Channel<ByteArray>) =33+            object : RelayBinarySocket {34+                override fun send(frame: ByteArray) {35+                    check(peer.trySend(frame.copyOf()).isSuccess)36+                }37+38+                override suspend fun receive(): ByteArray = inbox.receive()39+40+                override fun close(code: Int, reason: String) {41+                    inbox.close()42+                }43+            }44+        return socket(leftInbox, rightInbox) to socket(rightInbox, leftInbox)45+    }46+47+    private fun identity(id: String, name: String, publicKeyHex: String) = LocalChirpIdentity(48+        deviceId = id,49+        deviceName = name,50+        deviceType = DeviceType.ANDROID,51+        longTermPublicKeyHex = publicKeyHex,52+        signingPublicKeyHex = "33".repeat(32),53+    )54+55+    @Test56+    fun `two phones complete the reconnect wire, one dialling and one waiting`() = runBlocking {57+        val dialerKeys = keys()58+        val waiterKeys = keys()59+        val secretHex = "71".repeat(32)60+        val secret = Rendezvous.secretFromHex(secretHex)61+        val now = System.currentTimeMillis() / 1000L62+        // Both sides derive the same room from the shared pair secret.63+        val rendezvousId = Rendezvous.waitingIds(secret, now).first()64+        assertTrue(rendezvousId in Rendezvous.dialingIds(secret, now))65+66+        val dialerIdentity = identity("dialer", "Fold", pubkeyToHex(dialerKeys.publicKey))67+        val waiterIdentity = identity("waiter", "Tablet", pubkeyToHex(waiterKeys.publicKey))68+        val dialerAsSeenByWaiter = PairedDevice(69+            deviceId = "dialer",70+            deviceName = "Fold",71+            deviceType = "android",72+            longTermPublicKeyHex = pubkeyToHex(dialerKeys.publicKey),73+            rendezvousSecretHex = secretHex,74+            pairedAt = 1L,75+        )76+        val waiterAsSeenByDialer = PairedDevice(77+            deviceId = "waiter",78+            deviceName = "Tablet",79+            deviceType = "android",80+            longTermPublicKeyHex = pubkeyToHex(waiterKeys.publicKey),81+            rendezvousSecretHex = secretHex,82+            pairedAt = 1L,83+        )84+85+        val (dialerSocket, waiterSocket) = socketPair()86+        var dialerSynced = false87+        var waiterSynced = false88+89+        val waiter = async(Dispatchers.Default) {90+            runCloudRelayResponderSession(91+                socket = waiterSocket,92+                known = dialerAsSeenByWaiter,93+                registeredRendezvousId = rendezvousId,94+                ourStaticPrivateKey = waiterKeys.privateKey,95+                ourStaticPublicKey = waiterKeys.publicKey,96+                localIdentity = waiterIdentity,97+                vaultFactory = { null },98+                onSyncComplete = { waiterSynced = true },99+            )100+        }101+        val dialer = async(Dispatchers.Default) {102+            runCloudRelayInitiatorSession(103+                socket = dialerSocket,104+                known = waiterAsSeenByDialer,105+                rendezvousId = rendezvousId,106+                ourStaticPrivateKey = dialerKeys.privateKey,107+                ourStaticPublicKey = dialerKeys.publicKey,108+                localIdentity = dialerIdentity,109+                vaultFactory = { null },110+                onSyncComplete = { dialerSynced = true },111+            )112+        }113+114+        waiter.await()115+        dialer.await()116+        // No vault adapter on either side, so the handshake completes and the117+        // sync exchange is skipped — the wire is what is under test here.118+        assertFalse(dialerSynced)119+        assertFalse(waiterSynced)120+    }121+122+    @Test123+    fun `a peer presenting a different key than KK authenticated is refused`() = runBlocking {124+        val dialerKeys = keys()125+        val waiterKeys = keys()126+        val impostorKeys = keys()127+        val secretHex = "72".repeat(32)128+        val rendezvousId = Rendezvous.waitingIds(129+            Rendezvous.secretFromHex(secretHex),130+            System.currentTimeMillis() / 1000L,131+        ).first()132+        val (dialerSocket, waiterSocket) = socketPair()133+134+        // The waiter answers with an identity frame naming a key that is not135+        // the one KK proved. Nothing about the room can be trusted; only the136+        // authenticated key can, so the dialler must refuse.137+        val waiter = async(Dispatchers.Default) {138+            val selector = String(waiterSocket.receive(), Charsets.UTF_8)139+            assertTrue(selector.contains("PEACH_RECONNECT"))140+            val session = noiseKKResponder(141+                waiterKeys.privateKey,142+                waiterKeys.publicKey,143+                dialerKeys.publicKey,144+                waiterSocket::send,145+                waiterSocket::receive,146+            )147+            SyncPadding.unpad(session.decrypt(waiterSocket.receive()))148+            waiterSocket.send(149+                session.encrypt(150+                    SyncPadding.pad(151+                        encodePairIdentityFrame(152+                            identity("waiter", "Tablet", pubkeyToHex(impostorKeys.publicKey)),153+                        ),154+                    ),155+                ),156+            )157+        }158+159+        val failure = runCatching {160+            runCloudRelayInitiatorSession(161+                socket = dialerSocket,162+                known = PairedDevice(163+                    deviceId = "waiter",164+                    deviceType = "android",165+                    longTermPublicKeyHex = pubkeyToHex(waiterKeys.publicKey),166+                    rendezvousSecretHex = secretHex,167+                    pairedAt = 1L,168+                ),169+                rendezvousId = rendezvousId,170+                ourStaticPrivateKey = dialerKeys.privateKey,171+                ourStaticPublicKey = dialerKeys.publicKey,172+                localIdentity = identity("dialer", "Fold", pubkeyToHex(dialerKeys.publicKey)),173+                vaultFactory = { null },174+                onSyncComplete = {},175+            )176+        }.exceptionOrNull()177+        waiter.await()178+179+        assertTrue(180+            "expected identity mismatch, got $failure",181+            failure?.message?.contains("does not match authenticated KK key") == true,182+        )183+    }184+}185+186+class SyncPeerRoleTest {187+    private fun peer(type: String?, keyHex: String?) = PairedDevice(188+        deviceId = "peer",189+        deviceType = type,190+        longTermPublicKeyHex = keyHex,191+        pairedAt = 1L,192+    )193+194+    @Test195+    fun `we never dial a browser extension, whichever key is lower`() {196+        val low = "aa".repeat(32)197+        val high = "bb".repeat(32)198+        assertFalse(weDialPeer(low, peer("extension", high)))199+        assertFalse(weDialPeer(high, peer("extension", low)))200+    }201+202+    @Test203+    fun `phone to phone assigns exactly one dialler`() {204+        val ours = "aa".repeat(32)205+        val theirs = "bb".repeat(32)206+        // The same comparison run from each side must disagree — one dials,207+        // one waits. Two waiters was the phone-to-phone deadlock; two diallers208+        // would splice our own sockets together.209+        assertTrue(weDialPeer(ours, peer("android", theirs)))210+        assertFalse(weDialPeer(theirs, peer("android", ours)))211+        assertNotEquals(212+            weDialPeer(ours, peer("android", theirs)),213+            weDialPeer(theirs, peer("android", ours)),214+        )215+    }216+217+    @Test218+    fun `a tablet is a phone for this purpose, and an unknown type is too`() {219+        val low = "11".repeat(32)220+        val high = "ff".repeat(32)221+        assertTrue(weDialPeer(low, peer("ios", high)))222+        assertTrue(weDialPeer(low, peer(null, high)))223+        assertFalse(weDialPeer(high, peer(null, low)))224+    }225+226+    @Test227+    fun `a peer with no static key is never dialled`() {228+        assertFalse(weDialPeer("00".repeat(32), peer("android", null)))229+    }230+231+    @Test232+    fun `roles hold across many random pairs`() {233+        val random = SecureRandom()234+        repeat(200) {235+            val a = ByteArray(32).also(random::nextBytes).let(::pubkeyToHex)236+            val b = ByteArray(32).also(random::nextBytes).let(::pubkeyToHex)237+            if (a == b) return@repeat238+            assertNotEquals(weDialPeer(a, peer("android", b)), weDialPeer(b, peer("android", a)))239+        }240+    }241+}