Fixed a replay issue on auth confirm

auth/callback.go

@@ -213,7 +213,7 @@ func (m *Manager) handleConfirm(cmixMsg format.Message, sr *auth.SentRequest,
 	if mgr, err := m.storage.E2e().GetPartner(sr.GetPartner()); mgr != nil || err == nil {
 		jww.WARN.Printf("Cannot confirm auth for %s, channel already "+
 			"exists.", sr.GetPartner())
-		m.storage.Auth().Fail(sr.GetPartner())
+		m.storage.Auth().Done(sr.GetPartner())
 		return
 	}
 
@@ -221,7 +221,7 @@ func (m *Manager) handleConfirm(cmixMsg format.Message, sr *auth.SentRequest,
 	baseFmt, partnerPubKey, err := handleBaseFormat(cmixMsg, grp)
 	if err != nil {
 		jww.WARN.Printf("Failed to handle auth confirm: %s", err)
-		m.storage.Auth().Fail(sr.GetPartner())
+		m.storage.Auth().Done(sr.GetPartner())
 		return
 	}
 
@@ -236,7 +236,7 @@ func (m *Manager) handleConfirm(cmixMsg format.Message, sr *auth.SentRequest,
 	if !success {
 		jww.WARN.Printf("Recieved auth confirmation failed its mac " +
 			"check")
-		m.storage.Auth().Fail(sr.GetPartner())
+		m.storage.Auth().Done(sr.GetPartner())
 		return
 	}
 
@@ -244,7 +244,7 @@ func (m *Manager) handleConfirm(cmixMsg format.Message, sr *auth.SentRequest,
 	if err != nil {
 		jww.WARN.Printf("Failed to unmarshal auth confirmation's "+
 			"encrypted payload: %s", err)
-		m.storage.Auth().Fail(sr.GetPartner())
+		m.storage.Auth().Done(sr.GetPartner())
 		return
 	}
 
@@ -252,7 +252,7 @@ func (m *Manager) handleConfirm(cmixMsg format.Message, sr *auth.SentRequest,
 	if err := m.doConfirm(sr, grp, partnerPubKey, sr.GetMyPrivKey(),
 		sr.GetPartnerHistoricalPubKey(), ecrFmt.GetOwnership()); err != nil {
 		jww.WARN.Printf("Confirmation failed: %s", err)
-		m.storage.Auth().Fail(sr.GetPartner())
+		m.storage.Auth().Done(sr.GetPartner())
 		return
 	}
 }

auth/confirm.go

@@ -40,10 +40,11 @@ func ConfirmRequestAuth(partner contact.Contact, rng io.Reader,
 		return 0, errors.Errorf("failed to find a pending Auth Request: %s",
 			err)
 	}
+	defer storage.Auth().Done(partner.ID)
 
 	// verify the passed contact matches what is stored
 	if storedContact.DhPubKey.Cmp(partner.DhPubKey) != 0 {
-		storage.Auth().Fail(partner.ID)
+		storage.Auth().Done(partner.ID)
 		return 0, errors.WithMessage(err, "Pending Auth Request has different "+
 			"pubkey than stored")
 	}
@@ -64,7 +65,6 @@ func ConfirmRequestAuth(partner contact.Contact, rng io.Reader,
 	salt := make([]byte, saltSize)
 	_, err = rng.Read(salt)
 	if err != nil {
-		storage.Auth().Fail(partner.ID)
 		return 0, errors.Wrap(err, "Failed to generate salt for "+
 			"confirmation")
 	}
@@ -104,10 +104,9 @@ func ConfirmRequestAuth(partner contact.Contact, rng io.Reader,
 	p := storage.E2e().GetE2ESessionParams()
 	if err := storage.E2e().AddPartner(partner.ID, partner.DhPubKey, newPrivKey,
 		p, p); err != nil {
-		storage.Auth().Fail(partner.ID)
-		return 0, errors.Errorf("Failed to create channel with partner (%s) "+
-			"on confirmation: %+v",
-			partner.ID, err)
+		jww.WARN.Printf("Failed to create channel with partner (%s) "+
+			"on confirmation, this is likley a replay: %s",
+			partner.ID, err.Error())
 	}
 
 	// delete the in progress negotiation

storage/auth/store.go

@@ -355,17 +355,18 @@ func (s *Store) GetRequest(partner *id.ID) (RequestType, *SentRequest, contact.C
 	}
 }
 
-// Fail is one of two calls after using a request. This one is to be used when
+// Done is one of two calls after using a request. This one is to be used when
 // the use is unsuccessful. It will allow any thread waiting on access to
 // continue using the structure.
 // It does not return an error because an error is not handleable.
-func (s *Store) Fail(partner *id.ID) {
+func (s *Store) Done(partner *id.ID) {
 	s.mux.RLock()
 	r, ok := s.requests[*partner]
 	s.mux.RUnlock()
 
 	if !ok {
-		jww.ERROR.Panicf("Request cannot be failed, not found: %s", partner)
+		jww.ERROR.Panicf("Request cannot be finished, not " +
+			"found: %s", partner)
 		return
 	}
 

storage/auth/store_test.go

@@ -526,11 +526,11 @@ func TestStore_Fail(t *testing.T) {
 		}
 	}()
 
-	s.Fail(c.ID)
+	s.Done(c.ID)
 
 	// Check if the request's mutex is locked
 	if reflect.ValueOf(&s.requests[*c.ID].mux).Elem().FieldByName("state").Int() != 0 {
-		t.Errorf("Fail() did not unlock mutex.")
+		t.Errorf("Done() did not unlock mutex.")
 	}
 }
 
@@ -540,11 +540,11 @@ func TestStore_Fail_RequestNotInMap(t *testing.T) {
 
 	defer func() {
 		if r := recover(); r == nil {
-			t.Errorf("Fail() did not panic when the request is not in map.")
+			t.Errorf("Done() did not panic when the request is not in map.")
 		}
 	}()
 
-	s.Fail(id.NewIdFromUInt(rand.Uint64(), id.User, t))
+	s.Done(id.NewIdFromUInt(rand.Uint64(), id.User, t))
 }
 
 // Happy path: receive request.