Add IV to the attachment table.

app/src/main/java/org/thoughtcrime/securesms/database/AttachmentTable.kt

@@ -90,7 +90,9 @@ import org.thoughtcrime.securesms.util.FileUtils
 import org.thoughtcrime.securesms.util.JsonUtils.SaneJSONObject
 import org.thoughtcrime.securesms.util.MediaUtil
 import org.thoughtcrime.securesms.util.StorageUtil
+import org.thoughtcrime.securesms.util.Util
 import org.thoughtcrime.securesms.video.EncryptedMediaDataSource
+import org.whispersystems.signalservice.api.attachment.AttachmentUploadResult
 import org.whispersystems.signalservice.api.util.UuidUtil
 import org.whispersystems.signalservice.internal.util.JsonUtil
 import java.io.File
@@ -118,6 +120,7 @@ class AttachmentTable(
     const val MESSAGE_ID = "message_id"
     const val CONTENT_TYPE = "content_type"
     const val REMOTE_KEY = "remote_key"
+    const val REMOTE_IV = "remote_iv"
     const val REMOTE_LOCATION = "remote_location"
     const val REMOTE_DIGEST = "remote_digest"
     const val REMOTE_INCREMENTAL_DIGEST = "remote_incremental_digest"
@@ -178,6 +181,7 @@ class AttachmentTable(
       MESSAGE_ID,
       CONTENT_TYPE,
       REMOTE_KEY,
+      REMOTE_IV,
       REMOTE_LOCATION,
       REMOTE_DIGEST,
       REMOTE_INCREMENTAL_DIGEST,
@@ -263,7 +267,8 @@ class AttachmentTable(
         $THUMBNAIL_FILE TEXT DEFAULT NULL,
         $THUMBNAIL_RANDOM BLOB DEFAULT NULL,
         $THUMBNAIL_RESTORE_STATE INTEGER DEFAULT ${ThumbnailRestoreState.NONE.value},
-        $ATTACHMENT_UUID TEXT DEFAULT NULL
+        $ATTACHMENT_UUID TEXT DEFAULT NULL,
+        $REMOTE_IV BLOB DEFAULT NULL
       )
       """
 
@@ -1026,7 +1031,7 @@ class AttachmentTable(
    * it's ending hash, which is critical for backups.
    */
   @Throws(IOException::class)
-  fun finalizeAttachmentAfterUpload(id: AttachmentId, attachment: Attachment, uploadTimestamp: Long) {
+  fun finalizeAttachmentAfterUpload(id: AttachmentId, uploadResult: AttachmentUploadResult) {
     Log.i(TAG, "[finalizeAttachmentAfterUpload] Finalizing upload for $id.")
 
     val dataStream = getAttachmentStream(id, 0)
@@ -1040,17 +1045,14 @@ class AttachmentTable(
 
     val values = contentValuesOf(
       TRANSFER_STATE to TRANSFER_PROGRESS_DONE,
-      CDN_NUMBER to attachment.cdn.serialize(),
-      REMOTE_LOCATION to attachment.remoteLocation,
-      REMOTE_DIGEST to attachment.remoteDigest,
-      REMOTE_INCREMENTAL_DIGEST to attachment.incrementalDigest,
-      REMOTE_INCREMENTAL_DIGEST_CHUNK_SIZE to attachment.incrementalMacChunkSize,
-      REMOTE_KEY to attachment.remoteKey,
-      DATA_SIZE to attachment.size,
+      CDN_NUMBER to uploadResult.cdnNumber,
+      REMOTE_LOCATION to uploadResult.remoteId.toString(),
+      REMOTE_DIGEST to uploadResult.digest,
+      REMOTE_INCREMENTAL_DIGEST to uploadResult.incrementalDigest,
+      REMOTE_INCREMENTAL_DIGEST_CHUNK_SIZE to uploadResult.incrementalDigestChunkSize,
+      DATA_SIZE to uploadResult.dataSize,
       DATA_HASH_END to dataHashEnd,
-      FAST_PREFLIGHT_ID to attachment.fastPreflightId,
-      BLUR_HASH to attachment.getVisualHashStringOrNull(),
-      UPLOAD_TIMESTAMP to uploadTimestamp
+      UPLOAD_TIMESTAMP to uploadResult.uploadTimestamp
     )
 
     val dataFilePath = getDataFilePath(id) ?: throw IOException("No data file found for attachment!")
@@ -1153,6 +1155,25 @@ class AttachmentTable(
     }
   }
 
+  fun createKeyIvIfNecessary(attachmentId: AttachmentId) {
+    val key = Util.getSecretBytes(64)
+    val iv = Util.getSecretBytes(16)
+
+    writableDatabase.withinTransaction {
+      writableDatabase
+        .update(TABLE_NAME)
+        .values(REMOTE_KEY to Base64.encodeWithPadding(key))
+        .where("$ID = ? AND $REMOTE_KEY IS NULL", attachmentId.id)
+        .run()
+
+      writableDatabase
+        .update(TABLE_NAME)
+        .values(REMOTE_IV to iv)
+        .where("$ID = ? AND $REMOTE_IV IS NULL", attachmentId.id)
+        .run()
+    }
+  }
+
   /**
    * Inserts new attachments in the table. The [Attachment]s may or may not have data, depending on whether it's an attachment we created locally or some
    * inbound attachment that we haven't fetched yet.
@@ -1507,6 +1528,7 @@ class AttachmentTable(
               cdn = Cdn.deserialize(jsonObject.getInt(CDN_NUMBER)),
               location = jsonObject.getString(REMOTE_LOCATION),
               key = jsonObject.getString(REMOTE_KEY),
+              iv = null,
               digest = null,
               incrementalDigest = null,
               incrementalMacChunkSize = 0,
@@ -2040,6 +2062,7 @@ class AttachmentTable(
       contentValues.put(REMOTE_INCREMENTAL_DIGEST, uploadTemplate?.incrementalDigest)
       contentValues.put(REMOTE_INCREMENTAL_DIGEST_CHUNK_SIZE, uploadTemplate?.incrementalMacChunkSize ?: 0)
       contentValues.put(REMOTE_KEY, uploadTemplate?.remoteKey)
+      contentValues.put(REMOTE_IV, uploadTemplate?.remoteIv)
       contentValues.put(FILE_NAME, StorageUtil.getCleanFileName(attachment.fileName))
       contentValues.put(FAST_PREFLIGHT_ID, attachment.fastPreflightId)
       contentValues.put(VOICE_NOTE, if (attachment.voiceNote) 1 else 0)
@@ -2120,6 +2143,7 @@ class AttachmentTable(
       cdn = cursor.requireObject(CDN_NUMBER, Cdn.Serializer),
       location = cursor.requireString(REMOTE_LOCATION),
       key = cursor.requireString(REMOTE_KEY),
+      iv = cursor.requireBlob(REMOTE_IV),
       digest = cursor.requireBlob(REMOTE_DIGEST),
       incrementalDigest = cursor.requireBlob(REMOTE_INCREMENTAL_DIGEST),
       incrementalMacChunkSize = cursor.requireInt(REMOTE_INCREMENTAL_DIGEST_CHUNK_SIZE),

app/src/main/java/org/thoughtcrime/securesms/database/helpers/SignalDatabaseMigrations.kt

@@ -101,6 +101,7 @@ import org.thoughtcrime.securesms.database.helpers.migration.V240_MessageFullTex
 import org.thoughtcrime.securesms.database.helpers.migration.V241_ExpireTimerVersion
 import org.thoughtcrime.securesms.database.helpers.migration.V242_MessageFullTextSearchEmojiSupportV2
 import org.thoughtcrime.securesms.database.helpers.migration.V243_MessageFullTextSearchDisableSecureDelete
+import org.thoughtcrime.securesms.database.helpers.migration.V244_AttachmentRemoteIv
 
 /**
  * Contains all of the database migrations for [SignalDatabase]. Broken into a separate file for cleanliness.
@@ -204,10 +205,11 @@ object SignalDatabaseMigrations {
     240 to V240_MessageFullTextSearchSecureDelete,
     241 to V241_ExpireTimerVersion,
     242 to V242_MessageFullTextSearchEmojiSupportV2,
-    243 to V243_MessageFullTextSearchDisableSecureDelete
+    243 to V243_MessageFullTextSearchDisableSecureDelete,
+    244 to V244_AttachmentRemoteIv
   )
 
-  const val DATABASE_VERSION = 243
+  const val DATABASE_VERSION = 244
 
   @JvmStatic
   fun migrate(context: Application, db: SQLiteDatabase, oldVersion: Int, newVersion: Int) {

app/src/main/java/org/thoughtcrime/securesms/database/helpers/migration/V244_AttachmentRemoteIv.kt

@@ -0,0 +1,18 @@
+/*
+ * Copyright 2024 Signal Messenger, LLC
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+package org.thoughtcrime.securesms.database.helpers.migration
+
+import android.app.Application
+import net.zetetic.database.sqlcipher.SQLiteDatabase
+
+/**
+ * Adds the remoteIv column to attachments.
+ */
+object V244_AttachmentRemoteIv : SignalDatabaseMigration {
+  override fun migrate(context: Application, db: SQLiteDatabase, oldVersion: Int, newVersion: Int) {
+    db.execSQL("ALTER TABLE attachment ADD COLUMN remote_iv BLOB DEFAULT NULL;")
+  }
+}