mirror of
https://github.com/permissionlesstech/bitchat-android.git
synced 2026-07-25 02:45:20 +00:00
callebtc
3384cce51d
- BluetoothConnectionManager.kt: keep main version, rename sendToPeer -> sendPacketToPeer and add overload; remove conflict markers - BluetoothMeshService.kt: keep main, ensure delegate uses sendPacketToPeer - BinaryProtocol.kt: keep main version with v2 payload length support Refactor: rename all sendToPeer usages to sendPacketToPeer across codebase - PacketRelayManager + interface - PacketProcessor + interface - BluetoothPacketBroadcaster targeted send method remains sendPacketToPeer - Update tests accordingly Build fixes
47 lines
2.5 KiB
Plaintext
47 lines
2.5 KiB
Plaintext
# security encryption file-transfer noise-protocol critical-fix
|
|
**CRITICAL SECURITY VULNERABILITY FIXED: Private File Transfers Now Properly Noise Encrypted**
|
|
|
|
**Problem**: Audio messages, images, and files sent in private chats were being sent as unencrypted FILE_TRANSFER packets, exposing private file content to the entire mesh network.
|
|
|
|
**Root Cause**: The sendFilePrivate() method in BluetoothMeshService.kt was creating FILE_TRANSFER packets with the raw TLV payload, not encrypting them through the Noise protocol like text messages.
|
|
|
|
**Security Impact**:
|
|
- Private images were visible to all mesh participants
|
|
- Private voice recordings were audible to all mesh participants
|
|
- Private file contents were readable by all mesh participants
|
|
- Only the filename/metadata was somewhat obscured by TLV encoding
|
|
|
|
**Fix Applied**:
|
|
|
|
1. **Updated NoisePayloadType enum** (NoiseEncrypted.kt):
|
|
- Added FILE_TRANSFER(0x04u) payload type for encrypted file transfers
|
|
|
|
2. **Fixed sendFilePrivate()** (BluetoothMeshService.kt):
|
|
- Now wraps file TLV in NoisePayload with FILE_TRANSFER type
|
|
- Encrypts through encryptionService.encrypt() like text messages
|
|
- Sends as NOISE_ENCRYPTED packet (not FILE_TRANSFER packet)
|
|
- Requires established Noise session; initiates handshake if missing
|
|
- Maintains same fragmentation and progress tracking
|
|
|
|
3. **Enhanced handleNoiseEncrypted()** (MessageHandler.kt):
|
|
- Added NoisePayloadType.FILE_TRANSFER case
|
|
- Decrypts file payload and processes like unencrypted files
|
|
- Maintains same MIME-based classification (image/audio/file)
|
|
- Sends delivery ACK for encrypted file transfers
|
|
|
|
**Technical Details**:
|
|
- **Broadcast files**: Still unencrypted FILE_TRANSFER (public by design)
|
|
- **Private files**: Now encrypted via NOISE_ENCRYPTED with FILE_TRANSFER NoisePayload
|
|
- **Backward compatibility**: Mixed mesh will work (new private sends encrypted, old broadcast path unchanged)
|
|
- **iOS compatibility**: Uses same NoisePayload system as iOS implementation
|
|
|
|
**Files Modified**:
|
|
- app/src/main/java/com/bitchat/android/model/NoiseEncrypted.kt - Added FILE_TRANSFER payload type
|
|
- app/src/main/java/com/bitchat/android/mesh/BluetoothMeshService.kt - Fixed sendFilePrivate() encryption
|
|
- app/src/main/java/com/bitchat/android/mesh/MessageHandler.kt - Added encrypted file receive handling
|
|
|
|
**Build Status**: ✅ Successful compilation
|
|
|
|
**Result**: Private file transfers (images, audio, generic files) are now properly end-to-end encrypted and only visible to the intended recipient, matching the security model of private text messages.
|
|
|