mirror of
https://github.com/permissionlesstech/bitchat.git
synced 2026-07-26 16:25:23 +00:00
Bridge dedup: content-derived stable mesh message ID (#1419)
* Bridge dedup keys on a content-derived stable mesh message ID Public mesh messages carry no message ID on the BLE wire, so every non-origin device minted a fresh UUID and the bridge's m-tag dedup only matched on the origin device: duplicate bridged rows, misattributed "across the bridge" counts, redundant downlink rebroadcasts, and an m-tag spoof vector (an attacker could claim a victim's message ID). Every device now derives the same stable ID from the signed wire fields (sender ID + ms timestamp + trimmed content, SHA256/32 hex) via the new MeshMessageIdentity — zero BLE wire change. The bridge event's m tag carries the origin coordinates ["m", senderIDHex, timestampMs] and receivers recompute the key from those plus the event's own content instead of trusting a claimed ID; old-format/absent tags fall back to the event ID as before. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Fix mixed-version message loss: m tag leads with the derived stable ID The previous layout (["m", senderIDHex, timestampMs]) broke v1.7.0 receivers: their parser takes m[1] unconditionally as the timeline dedup key whenever the tag has >= 2 elements, so every bridged message from a new-version sender keyed on the CONSTANT sender hex and inject-dedup dropped all but the first. The tag is now ["m", <derived stable ID>, senderIDHex, timestampMs]: old parsers get a per-message-unique m[1] (exactly today's semantics), while the new parser recomputes the ID from elements 2-3 plus the event's own content and never trusts element 1, keeping the recompute-don't-trust property. Also: - Soften the overstated security claim in MeshMessageIdentity and the BridgeService classify comment: forging a chosen ID onto different content is infeasible, but all three hash inputs are cleartext on the radio, so identical-content front-running by a radio-local attacker remains possible (no worse than the unbridged mesh). - Fix the stale archivedEchoKeys rationale: re-synced copies of others' messages now carry the derived stable ID (insert-by-ID catches them); the content key remains for echo--prefixed archive rows + self echoes. - Tests: old-parser semantics on the new tag (m[1] per-message-unique and equal to the derived ID) and a forged-m[1] event that cannot pre-poison a genuine message's dedup slot. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: jack <jackjackbits@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
jack
co-authored by
jack
Claude Opus 4.8
jack
Claude Opus 4.8
parent
dd6b624cae
commit
84d315e62d
@@ -264,22 +264,33 @@ struct NostrProtocol {
|
||||
|
||||
/// Create a mesh-bridge public message (kind 20000) for a geohash-cell
|
||||
/// rendezvous. The distinct `r` tag keeps bridge traffic out of geohash
|
||||
/// channel subscriptions (which filter on `#g`); `m` carries the original
|
||||
/// mesh message ID so receivers dedup the bridged copy against the radio
|
||||
/// copy by timeline ID.
|
||||
/// channel subscriptions (which filter on `#g`); `m` is
|
||||
/// `[stable ID, mesh sender ID, wire timestamp in ms]`. Element 1 is the
|
||||
/// content-stable mesh message ID (`MeshMessageIdentity`) for v1.7.0
|
||||
/// parsers, which key their dedup on `m[1]` unconditionally and need it
|
||||
/// per-message-unique; current parsers ignore it and recompute the ID
|
||||
/// from the origin coordinates (elements 2-3) plus the event's own
|
||||
/// content to dedup the bridged copy against the radio copy by
|
||||
/// timeline ID.
|
||||
static func createBridgeMeshEvent(
|
||||
content: String,
|
||||
cell: String,
|
||||
senderIdentity: NostrIdentity,
|
||||
nickname: String? = nil,
|
||||
meshMessageID: String? = nil
|
||||
meshSenderID: String? = nil,
|
||||
meshTimestampMs: UInt64? = nil
|
||||
) throws -> NostrEvent {
|
||||
var tags = [["r", cell]]
|
||||
if let nickname = nickname?.trimmedOrNilIfEmpty {
|
||||
tags.append(["n", nickname])
|
||||
}
|
||||
if let meshMessageID = meshMessageID?.trimmedOrNilIfEmpty {
|
||||
tags.append(["m", meshMessageID])
|
||||
if let meshSenderID = meshSenderID?.trimmedOrNilIfEmpty, let meshTimestampMs {
|
||||
let stableID = MeshMessageIdentity.stableID(
|
||||
senderIDHex: meshSenderID,
|
||||
timestampMs: meshTimestampMs,
|
||||
content: content
|
||||
)
|
||||
tags.append(["m", stableID, meshSenderID, String(meshTimestampMs)])
|
||||
}
|
||||
let event = NostrEvent(
|
||||
pubkey: senderIdentity.publicKeyHex,
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
//
|
||||
// MeshMessageIdentity.swift
|
||||
// bitchat
|
||||
//
|
||||
// This is free and unencumbered software released into the public domain.
|
||||
// For more information, see <https://unlicense.org>
|
||||
//
|
||||
|
||||
import BitFoundation
|
||||
import Foundation
|
||||
|
||||
/// Content-derived identity for public mesh messages.
|
||||
///
|
||||
/// The BLE wire carries no message ID for public broadcasts, so every device
|
||||
/// recomputes the same stable ID from the signed wire fields (sender ID,
|
||||
/// millisecond timestamp, content). That gives the mesh bridge a
|
||||
/// cross-device-consistent dedup/attribution key with zero wire change — and
|
||||
/// because receivers derive the key themselves instead of trusting a claimed
|
||||
/// ID, forging a bridge tag that binds a chosen ID to *different* content is
|
||||
/// infeasible. The inputs are cleartext on the radio, though: an attacker in
|
||||
/// radio range can re-sign the identical sender/timestamp/content under
|
||||
/// their own Nostr key and win first-wins injection on remote islands —
|
||||
/// duplicate-content spoofing the unbridged mesh already permits, so no
|
||||
/// worse than before.
|
||||
enum MeshMessageIdentity {
|
||||
/// Matches the wire truncation in `BLEService.sendMessage`.
|
||||
static func millisecondTimestamp(_ date: Date) -> UInt64 {
|
||||
UInt64(date.timeIntervalSince1970 * 1000)
|
||||
}
|
||||
|
||||
static func stableID(senderIDHex: String, timestampMs: UInt64, content: String) -> String {
|
||||
let input = senderIDHex.lowercased() + "|" + String(timestampMs) + "|" + content.trimmed
|
||||
return String(Data(input.utf8).sha256Hex().prefix(32))
|
||||
}
|
||||
}
|
||||
@@ -122,10 +122,18 @@ final class BLEPublicMessageHandler {
|
||||
SecureLogger.debug("💬 [\(senderNickname)] TTL:\(packet.ttl) (\(pathTag)) chars=\(content.count) bytes=\(packet.payload.count)", category: .session)
|
||||
|
||||
let ts = Date(timeIntervalSince1970: Double(packet.timestamp) / 1000)
|
||||
var resolvedSelfMessageID: String? = nil
|
||||
let messageID: String?
|
||||
if peerID == env.localPeerID() {
|
||||
resolvedSelfMessageID = env.takeSelfBroadcastMessageID(packet)
|
||||
messageID = env.takeSelfBroadcastMessageID(packet)
|
||||
} else {
|
||||
// The wire carries no message ID; derive the stable one every
|
||||
// device agrees on so bridged copies dedup against the radio copy.
|
||||
messageID = MeshMessageIdentity.stableID(
|
||||
senderIDHex: peerID.id,
|
||||
timestampMs: packet.timestamp,
|
||||
content: content
|
||||
)
|
||||
}
|
||||
env.deliverPublicMessage(peerID, senderNickname, content, ts, resolvedSelfMessageID)
|
||||
env.deliverPublicMessage(peerID, senderNickname, content, ts, messageID)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -47,9 +47,11 @@ import Foundation
|
||||
/// already holds the radio copy (`isMessageSeenLocally` on the event's
|
||||
/// mesh message ID) — remote islands' traffic is the only thing worth
|
||||
/// airtime.
|
||||
/// Receivers additionally dedup by timeline message ID: a bridged copy
|
||||
/// carries the original mesh message ID in its `m` tag, so the store's
|
||||
/// insert-by-ID absorbs radio/bridge duplicates in either arrival order.
|
||||
/// Receivers additionally dedup by timeline message ID: the wire carries no
|
||||
/// public message ID, so every device derives the same content-stable one
|
||||
/// (`MeshMessageIdentity`) from the origin coordinates in the event's `m`
|
||||
/// tag — recomputed locally, never trusted — and the store's insert-by-ID
|
||||
/// absorbs radio/bridge duplicates in either arrival order.
|
||||
///
|
||||
/// All dependencies are closure-injected (repo convention) so the policy
|
||||
/// layer is unit-testable without relays, radios, or CoreLocation.
|
||||
@@ -292,22 +294,32 @@ final class BridgeService: ObservableObject {
|
||||
/// Composes and ships the bridged copy of an outgoing public mesh
|
||||
/// message. Call after the radio send; no-op when the bridge is off,
|
||||
/// no cell is known, or the message was flagged nearby-only upstream.
|
||||
func bridgeOutgoing(content: String, messageID: String) {
|
||||
/// `senderPeerID`/`timestamp` are the origin coordinates of the radio
|
||||
/// send — they (with the content) derive the cross-device-stable mesh
|
||||
/// message ID that receivers dedup on.
|
||||
func bridgeOutgoing(content: String, senderPeerID: PeerID, timestamp: Date) {
|
||||
guard isEnabled, !nearbyOnly, let cell = activeCell ?? currentCell() else { return }
|
||||
guard content.utf8.count <= Limits.maxContentBytes else { return }
|
||||
let timestampMs = MeshMessageIdentity.millisecondTimestamp(timestamp)
|
||||
let stableID = MeshMessageIdentity.stableID(
|
||||
senderIDHex: senderPeerID.id,
|
||||
timestampMs: timestampMs,
|
||||
content: content
|
||||
)
|
||||
guard let identity = try? deriveIdentity?(cell),
|
||||
let event = try? NostrProtocol.createBridgeMeshEvent(
|
||||
content: content,
|
||||
cell: cell,
|
||||
senderIdentity: identity,
|
||||
nickname: myNickname?(),
|
||||
meshMessageID: messageID
|
||||
meshSenderID: senderPeerID.id,
|
||||
meshTimestampMs: timestampMs
|
||||
) else {
|
||||
SecureLogger.error("🌉 Bridge: failed to compose rendezvous event", category: .session)
|
||||
return
|
||||
}
|
||||
publishedEventIDs.insert(event.id)
|
||||
injectedMessageIDs.insert(messageID) // our own timeline already has it
|
||||
injectedMessageIDs.insert(stableID) // our own timeline already has it
|
||||
if relaysConnected?() ?? false {
|
||||
publishToRelays?(event, cell)
|
||||
} else if let carrier = NostrCarrierPacket(direction: .toBridge, geohash: cell, event: event),
|
||||
@@ -648,8 +660,25 @@ final class BridgeService: ObservableObject {
|
||||
let content = event.content
|
||||
guard !content.trimmed.isEmpty, content.utf8.count <= Limits.maxContentBytes else { return nil }
|
||||
let nickname = event.tags.first(where: { $0.count >= 2 && $0[0] == "n" })?[1]
|
||||
let meshID = event.tags.first(where: { $0.count >= 2 && $0[0] == "m" })?[1]
|
||||
let messageID = (meshID?.trimmedOrNilIfEmpty) ?? event.id
|
||||
// Recompute — never trust — the mesh message ID: the `m` tag is
|
||||
// `[stable ID, sender ID, wire timestamp ms]`. Element 1 exists
|
||||
// for v1.7.0 parsers; we ignore it and derive the ID from the
|
||||
// origin coordinates (elements 2-3) plus the event's own content,
|
||||
// so a forged tag cannot bind a chosen ID to different content
|
||||
// (see `MeshMessageIdentity` for the exact property and its
|
||||
// limits).
|
||||
let m = event.tags.first(where: { $0.count >= 2 && $0[0] == "m" })
|
||||
let messageID: String
|
||||
if let m, m.count >= 4, m[2].count == 16, m[2].allSatisfy(\.isHexDigit),
|
||||
let timestampMs = UInt64(m[3]) {
|
||||
messageID = MeshMessageIdentity.stableID(
|
||||
senderIDHex: m[2],
|
||||
timestampMs: timestampMs,
|
||||
content: content
|
||||
)
|
||||
} else {
|
||||
messageID = event.id // old-format or absent tag
|
||||
}
|
||||
return .message(InboundBridgeMessage(
|
||||
messageID: messageID,
|
||||
senderNickname: nickname?.trimmedOrNilIfEmpty ?? "anon#\(event.pubkey.suffix(4))",
|
||||
|
||||
@@ -44,7 +44,10 @@ protocol ChatOutgoingContext: AnyObject {
|
||||
func sendGeohash(context: ChatViewModel.GeoOutgoingContext)
|
||||
/// Ships the bridged (rendezvous) copy of a just-sent public mesh
|
||||
/// message; no-op when the bridge is off or the send is nearby-only.
|
||||
func bridgeOutgoingPublicMessage(_ content: String, messageID: String)
|
||||
/// Takes the origin coordinates (sender + wire timestamp) — the bridge
|
||||
/// derives the cross-device-stable mesh message ID from them, not from
|
||||
/// our local timeline UUID (which no other device can recompute).
|
||||
func bridgeOutgoingPublicMessage(_ content: String, senderPeerID: PeerID, timestamp: Date)
|
||||
|
||||
// MARK: Geohash identity (shared with the other contexts)
|
||||
func deriveNostrIdentity(forGeohash geohash: String) throws -> NostrIdentity
|
||||
@@ -66,8 +69,8 @@ extension ChatViewModel: ChatOutgoingContext {
|
||||
lastPublicActivityAt[key] = Date()
|
||||
}
|
||||
|
||||
func bridgeOutgoingPublicMessage(_ content: String, messageID: String) {
|
||||
BridgeService.shared.bridgeOutgoing(content: content, messageID: messageID)
|
||||
func bridgeOutgoingPublicMessage(_ content: String, senderPeerID: PeerID, timestamp: Date) {
|
||||
BridgeService.shared.bridgeOutgoing(content: content, senderPeerID: senderPeerID, timestamp: timestamp)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -147,7 +150,7 @@ private extension ChatOutgoingCoordinator {
|
||||
messageID: message.id,
|
||||
timestamp: message.timestamp
|
||||
)
|
||||
context.bridgeOutgoingPublicMessage(trimmed, messageID: message.id)
|
||||
context.bridgeOutgoingPublicMessage(trimmed, senderPeerID: context.myPeerID, timestamp: message.timestamp)
|
||||
}
|
||||
|
||||
/// Geohash sends mine a NIP-13 nonce tag first (off the main actor, see
|
||||
|
||||
@@ -417,9 +417,12 @@ final class ChatPublicConversationCoordinator: PublicMessagePipelineDelegate {
|
||||
/// rate limit; low/no-PoW events keep the strict limits so old clients
|
||||
/// still get through at normal rates.
|
||||
/// Identity keys of the archived echoes seeded into the mesh timeline at
|
||||
/// launch. The mesh wire format carries no stable message ID, so a
|
||||
/// re-synced copy of an already-rendered echo arrives with a fresh UUID —
|
||||
/// this content identity is the only way to recognize it.
|
||||
/// launch. Re-synced copies of others' messages now arrive with the same
|
||||
/// derived stable ID (`MeshMessageIdentity`), so the store's insert-by-ID
|
||||
/// catches those — but the archive-restored rows themselves carry
|
||||
/// `echo-`-prefixed IDs, and self echoes get fresh UUIDs, so this content
|
||||
/// identity remains the way to recognize a live copy of an
|
||||
/// already-rendered echo.
|
||||
private var archivedEchoKeys = Set<String>()
|
||||
|
||||
func registerArchivedEcho(senderPeerID: PeerID?, timestamp: Date, content: String) {
|
||||
|
||||
Reference in New Issue
Block a user