Upgrade messaging client to support attachments.

briar-core/src/test/java/org/briarproject/briar/blog/BlogManagerImplTest.java

@@ -287,7 +287,8 @@ public class BlogManagerImplTest extends BriarTestCase {
 			will(returnValue(blog1));
 			oneOf(clientHelper).toList(localAuthor1);
 			will(returnValue(authorList1));
-			oneOf(clientHelper).addLocalMessage(txn, message, meta, true);
+			oneOf(clientHelper).addLocalMessage(txn, message, meta, true,
+					false);
 			oneOf(clientHelper).parseAndValidateAuthor(authorList1);
 			will(returnValue(localAuthor1));
 			oneOf(contactManager).getAuthorInfo(txn, localAuthor1.getId());
@@ -340,7 +341,8 @@ public class BlogManagerImplTest extends BriarTestCase {
 			will(returnValue(rssBlog));
 			oneOf(clientHelper).toList(rssLocalAuthor);
 			will(returnValue(rssAuthorList));
-			oneOf(clientHelper).addLocalMessage(txn, rssMessage, meta, true);
+			oneOf(clientHelper).addLocalMessage(txn, rssMessage, meta, true,
+					false);
 			oneOf(clientHelper).parseAndValidateAuthor(rssAuthorList);
 			will(returnValue(rssLocalAuthor));
 			oneOf(db).commitTransaction(txn);
@@ -407,7 +409,7 @@ public class BlogManagerImplTest extends BriarTestCase {
 			will(returnValue(authorList1));
 			// Store the comment
 			oneOf(clientHelper).addLocalMessage(txn, commentMsg, commentMeta,
-					true);
+					true, false);
 			// Create the headers for the comment and its parent
 			oneOf(clientHelper).parseAndValidateAuthor(authorList1);
 			will(returnValue(localAuthor1));
@@ -508,7 +510,7 @@ public class BlogManagerImplTest extends BriarTestCase {
 			will(returnValue(authorList1));
 			// Store the wrapped post
 			oneOf(clientHelper).addLocalMessage(txn, wrappedPostMsg,
-					wrappedPostMeta, true);
+					wrappedPostMeta, true, false);
 			// Create the comment
 			oneOf(blogPostFactory).createBlogComment(blog2.getId(),
 					localAuthor2, comment, messageId, wrappedPostId);
@@ -517,7 +519,7 @@ public class BlogManagerImplTest extends BriarTestCase {
 			will(returnValue(authorList2));
 			// Store the comment
 			oneOf(clientHelper).addLocalMessage(txn, commentMsg, commentMeta,
-					true);
+					true, false);
 			// Create the headers for the comment and the wrapped post
 			oneOf(clientHelper).parseAndValidateAuthor(authorList2);
 			will(returnValue(localAuthor2));
@@ -619,7 +621,7 @@ public class BlogManagerImplTest extends BriarTestCase {
 			will(returnValue(rssAuthorList));
 			// Store the wrapped post
 			oneOf(clientHelper).addLocalMessage(txn, wrappedPostMsg,
-					wrappedPostMeta, true);
+					wrappedPostMeta, true, false);
 			// Create the comment
 			oneOf(blogPostFactory).createBlogComment(blog1.getId(),
 					localAuthor1, comment, rssMessageId, wrappedPostId);
@@ -628,7 +630,7 @@ public class BlogManagerImplTest extends BriarTestCase {
 			will(returnValue(authorList1));
 			// Store the comment
 			oneOf(clientHelper).addLocalMessage(txn, commentMsg, commentMeta,
-					true);
+					true, false);
 			// Create the headers for the comment and the wrapped post
 			oneOf(clientHelper).parseAndValidateAuthor(authorList1);
 			will(returnValue(localAuthor1));
@@ -741,7 +743,7 @@ public class BlogManagerImplTest extends BriarTestCase {
 			will(returnValue(rssAuthorList));
 			// Store the rewrapped post
 			oneOf(clientHelper).addLocalMessage(txn, rewrappedPostMsg,
-					rewrappedPostMeta, true);
+					rewrappedPostMeta, true, false);
 			// Wrap the original comment for blog 2
 			oneOf(clientHelper).getMessageAsList(txn, originalCommentId);
 			will(returnValue(originalCommentBody));
@@ -758,7 +760,7 @@ public class BlogManagerImplTest extends BriarTestCase {
 			will(returnValue(authorList1));
 			// Store the wrapped comment
 			oneOf(clientHelper).addLocalMessage(txn, wrappedCommentMsg,
-					wrappedCommentMeta, true);
+					wrappedCommentMeta, true, false);
 			// Create the new comment
 			oneOf(blogPostFactory).createBlogComment(blog2.getId(),
 					localAuthor2, localComment, originalCommentId,
@@ -768,7 +770,7 @@ public class BlogManagerImplTest extends BriarTestCase {
 			will(returnValue(authorList2));
 			// Store the new comment
 			oneOf(clientHelper).addLocalMessage(txn, localCommentMsg,
-					localCommentMeta, true);
+					localCommentMeta, true, false);
 			// Create the headers for the new comment, the wrapped comment and
 			// the rewrapped post
 			oneOf(clientHelper).parseAndValidateAuthor(authorList2);

briar-core/src/test/java/org/briarproject/briar/introduction/IntroductionIntegrationTest.java

@@ -1075,8 +1075,8 @@ public class IntroductionIntegrationTest
 							m.getPreviousMessageId(), m.getSessionId(),
 							m.getEphemeralPublicKey(), m.getAcceptTimestamp(),
 							m.getTransportProperties());
-			c0.getClientHelper()
-					.addLocalMessage(txn, msg, new BdfDictionary(), true);
+			c0.getClientHelper().addLocalMessage(txn, msg, new BdfDictionary(),
+					true, false);
 			Group group0 = getLocalGroup();
 			BdfDictionary query = BdfDictionary.of(
 					new BdfEntry(SESSION_KEY_SESSION_ID, m.getSessionId())

briar-core/src/test/java/org/briarproject/briar/messaging/CountingInputStreamTest.java

@@ -0,0 +1,185 @@
+package org.briarproject.briar.messaging;
+
+import org.briarproject.bramble.test.BrambleTestCase;
+import org.junit.Test;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Random;
+
+import static org.briarproject.bramble.test.TestUtils.getRandomBytes;
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+
+public class CountingInputStreamTest extends BrambleTestCase {
+
+	private final Random random = new Random();
+	private final byte[] src = getRandomBytes(123);
+
+	@Test
+	public void testCountsSingleByteReads() throws Exception {
+		InputStream delegate = new ByteArrayInputStream(src);
+		// The limit is high enough to read the whole src array
+		CountingInputStream in =
+				new CountingInputStream(delegate, src.length + 1);
+
+		// No bytes should have been read initially
+		assertEquals(0L, in.getBytesRead());
+		// The reads should return the contents of the src array
+		for (int i = 0; i < src.length; i++) {
+			assertEquals(i, in.getBytesRead());
+			assertEquals(src[i] & 0xFF, in.read());
+		}
+		// The count should match the length of the src array
+		assertEquals(src.length, in.getBytesRead());
+		// Trying to read another byte should return EOF
+		assertEquals(-1, in.read());
+		// Reading EOF shouldn't affect the count
+		assertEquals(src.length, in.getBytesRead());
+	}
+
+	@Test
+	public void testCountsMultiByteReads() throws Exception {
+		InputStream delegate = new ByteArrayInputStream(src);
+		// The limit is high enough to read the whole src array
+		CountingInputStream in =
+				new CountingInputStream(delegate, src.length + 1);
+
+		// No bytes should have been read initially
+		assertEquals(0L, in.getBytesRead());
+		// Copy the src array in random-sized pieces
+		byte[] dest = new byte[src.length];
+		int offset = 0;
+		while (offset < dest.length) {
+			assertEquals(offset, in.getBytesRead());
+			int length = Math.min(random.nextInt(10), dest.length - offset);
+			assertEquals(length, in.read(dest, offset, length));
+			offset += length;
+		}
+		// The dest array should be a copy of the src array
+		assertArrayEquals(src, dest);
+		// The count should match the length of the src array
+		assertEquals(src.length, in.getBytesRead());
+		// Trying to read another byte should return EOF
+		assertEquals(-1, in.read(dest, 0, 1));
+		// Reading EOF shouldn't affect the count
+		assertEquals(src.length, in.getBytesRead());
+	}
+
+	@Test
+	public void testCountsSkips() throws Exception {
+		InputStream delegate = new ByteArrayInputStream(src);
+		// The limit is high enough to read the whole src array
+		CountingInputStream in =
+				new CountingInputStream(delegate, src.length + 1);
+
+		// No bytes should have been read initially
+		assertEquals(0L, in.getBytesRead());
+		// Skip the src array in random-sized pieces
+		int offset = 0;
+		while (offset < src.length) {
+			assertEquals(offset, in.getBytesRead());
+			int length = Math.min(random.nextInt(10), src.length - offset);
+			assertEquals(length, in.skip(length));
+			offset += length;
+		}
+		// The count should match the length of the src array
+		assertEquals(src.length, in.getBytesRead());
+		// Trying to skip another byte should return zero
+		assertEquals(0, in.skip(1));
+		// Returning zero shouldn't affect the count
+		assertEquals(src.length, in.getBytesRead());
+	}
+
+	@Test
+	public void testReturnsEofWhenSingleByteReadReachesLimit()
+			throws Exception {
+		InputStream delegate = new ByteArrayInputStream(src);
+		// The limit is one byte lower than the length of the src array
+		CountingInputStream in =
+				new CountingInputStream(delegate, src.length - 1);
+
+		// The reads should return the contents of the src array, except the
+		// last byte
+		for (int i = 0; i < src.length - 1; i++) {
+			assertEquals(src[i] & 0xFF, in.read());
+		}
+		// The count should match the limit
+		assertEquals(src.length - 1, in.getBytesRead());
+		// Trying to read another byte should return EOF
+		assertEquals(-1, in.read());
+		// Reading EOF shouldn't affect the count
+		assertEquals(src.length - 1, in.getBytesRead());
+	}
+
+	@Test
+	public void testReturnsEofWhenMultiByteReadReachesLimit() throws Exception {
+		InputStream delegate = new ByteArrayInputStream(src);
+		// The limit is one byte lower than the length of the src array
+		CountingInputStream in =
+				new CountingInputStream(delegate, src.length - 1);
+
+		// Copy the src array in random-sized pieces, except the last two bytes
+		byte[] dest = new byte[src.length];
+		int offset = 0;
+		while (offset < dest.length - 2) {
+			int length = Math.min(random.nextInt(10), dest.length - 2 - offset);
+			assertEquals(length, in.read(dest, offset, length));
+			offset += length;
+		}
+		// Trying to read two bytes should only return one, reaching the limit
+		assertEquals(1, in.read(dest, offset, 2));
+		// The dest array should be a copy of the src array, except the last
+		// byte
+		for (int i = 0; i < src.length - 1; i++) assertEquals(src[i], dest[i]);
+		// The count should match the limit
+		assertEquals(src.length - 1, in.getBytesRead());
+		// Trying to read another byte should return EOF
+		assertEquals(-1, in.read(dest, 0, 1));
+		// Reading EOF shouldn't affect the count
+		assertEquals(src.length - 1, in.getBytesRead());
+	}
+
+	@Test
+	public void testReturnsZeroWhenSkipReachesLimit() throws Exception {
+		InputStream delegate = new ByteArrayInputStream(src);
+		// The limit is one byte lower than the length of the src array
+		CountingInputStream in =
+				new CountingInputStream(delegate, src.length - 1);
+
+		// Skip the src array in random-sized pieces, except the last two bytes
+		int offset = 0;
+		while (offset < src.length - 2) {
+			assertEquals(offset, in.getBytesRead());
+			int length = Math.min(random.nextInt(10), src.length - 2 - offset);
+			assertEquals(length, in.skip(length));
+			offset += length;
+		}
+		// Trying to skip two bytes should only skip one, reaching the limit
+		assertEquals(1, in.skip(2));
+		// The count should match the limit
+		assertEquals(src.length - 1, in.getBytesRead());
+		// Trying to skip another byte should return zero
+		assertEquals(0, in.skip(1));
+		// Returning zero shouldn't affect the count
+		assertEquals(src.length - 1, in.getBytesRead());
+	}
+
+	@Test
+	public void testMarkIsNotSupported() {
+		InputStream delegate = new ByteArrayInputStream(src);
+		CountingInputStream in = new CountingInputStream(delegate, src.length);
+		assertFalse(in.markSupported());
+	}
+
+	@Test(expected = IOException.class)
+	public void testResetIsNotSupported() throws Exception {
+		InputStream delegate = new ByteArrayInputStream(src);
+		CountingInputStream in = new CountingInputStream(delegate, src.length);
+		in.mark(src.length);
+		assertEquals(src.length, in.read(new byte[src.length]));
+		in.reset();
+	}
+}

briar-core/src/test/java/org/briarproject/briar/messaging/MessageSizeIntegrationTest.java

@@ -8,20 +8,25 @@ import org.briarproject.bramble.api.sync.GroupId;
 import org.briarproject.bramble.api.sync.MessageId;
 import org.briarproject.briar.api.forum.ForumPost;
 import org.briarproject.briar.api.forum.ForumPostFactory;
+import org.briarproject.briar.api.messaging.AttachmentHeader;
 import org.briarproject.briar.api.messaging.PrivateMessage;
 import org.briarproject.briar.api.messaging.PrivateMessageFactory;
 import org.briarproject.briar.test.BriarTestCase;
 import org.junit.Test;
 
+import java.util.ArrayList;
+import java.util.List;
+
 import javax.inject.Inject;
 
-import static java.util.Collections.emptyList;
 import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_AUTHOR_NAME_LENGTH;
 import static org.briarproject.bramble.api.identity.AuthorConstants.MAX_PUBLIC_KEY_LENGTH;
 import static org.briarproject.bramble.api.record.Record.MAX_RECORD_PAYLOAD_BYTES;
 import static org.briarproject.bramble.test.TestUtils.getRandomId;
 import static org.briarproject.bramble.util.StringUtils.getRandomString;
 import static org.briarproject.briar.api.forum.ForumConstants.MAX_FORUM_POST_TEXT_LENGTH;
+import static org.briarproject.briar.api.messaging.MessagingConstants.MAX_ATTACHMENTS_PER_MESSAGE;
+import static org.briarproject.briar.api.messaging.MessagingConstants.MAX_CONTENT_TYPE_BYTES;
 import static org.briarproject.briar.api.messaging.MessagingConstants.MAX_PRIVATE_MESSAGE_TEXT_LENGTH;
 import static org.junit.Assert.assertTrue;
 
@@ -43,18 +48,40 @@ public class MessageSizeIntegrationTest extends BriarTestCase {
 		component.inject(this);
 	}
 
+	@Test
+	public void testLegacyPrivateMessageFitsIntoRecord() throws Exception {
+		// Create a maximum-length private message
+		GroupId groupId = new GroupId(getRandomId());
+		long timestamp = Long.MAX_VALUE;
+		String text = getRandomString(MAX_PRIVATE_MESSAGE_TEXT_LENGTH);
+		PrivateMessage message = privateMessageFactory
+				.createLegacyPrivateMessage(groupId, timestamp, text);
+		// Check the size of the serialised message
+		int length = message.getMessage().getRawLength();
+		assertTrue(length > UniqueId.LENGTH + 8
+				+ MAX_PRIVATE_MESSAGE_TEXT_LENGTH);
+		assertTrue(length <= MAX_RECORD_PAYLOAD_BYTES);
+	}
+
 	@Test
 	public void testPrivateMessageFitsIntoRecord() throws Exception {
 		// Create a maximum-length private message
 		GroupId groupId = new GroupId(getRandomId());
 		long timestamp = Long.MAX_VALUE;
 		String text = getRandomString(MAX_PRIVATE_MESSAGE_TEXT_LENGTH);
+		// Create the maximum number of maximum-length attachment headers
+		List<AttachmentHeader> headers = new ArrayList<>();
+		for (int i = 0; i < MAX_ATTACHMENTS_PER_MESSAGE; i++) {
+			headers.add(new AttachmentHeader(new MessageId(getRandomId()),
+					getRandomString(MAX_CONTENT_TYPE_BYTES)));
+		}
 		PrivateMessage message = privateMessageFactory.createPrivateMessage(
-				groupId, timestamp, text, emptyList());
+				groupId, timestamp, text, headers);
 		// Check the size of the serialised message
 		int length = message.getMessage().getRawLength();
 		assertTrue(length > UniqueId.LENGTH + 8
-				+ MAX_PRIVATE_MESSAGE_TEXT_LENGTH);
+				+ MAX_PRIVATE_MESSAGE_TEXT_LENGTH + MAX_ATTACHMENTS_PER_MESSAGE
+				* (UniqueId.LENGTH + MAX_CONTENT_TYPE_BYTES));
 		assertTrue(length <= MAX_RECORD_PAYLOAD_BYTES);
 	}
 

briar-core/src/test/java/org/briarproject/briar/messaging/PrivateMessageValidatorTest.java

@@ -1,83 +1,472 @@
 package org.briarproject.briar.messaging;
 
-import org.briarproject.bramble.api.FormatException;
-import org.briarproject.bramble.api.client.BdfMessageContext;
+import org.briarproject.bramble.api.UniqueId;
 import org.briarproject.bramble.api.data.BdfDictionary;
+import org.briarproject.bramble.api.data.BdfEntry;
 import org.briarproject.bramble.api.data.BdfList;
-import org.briarproject.bramble.test.ValidatorTestCase;
+import org.briarproject.bramble.api.data.BdfReader;
+import org.briarproject.bramble.api.data.BdfReaderFactory;
+import org.briarproject.bramble.api.data.MetadataEncoder;
+import org.briarproject.bramble.api.db.Metadata;
+import org.briarproject.bramble.api.sync.Group;
+import org.briarproject.bramble.api.sync.InvalidMessageException;
+import org.briarproject.bramble.api.sync.Message;
+import org.briarproject.bramble.api.sync.MessageContext;
+import org.briarproject.bramble.api.sync.MessageId;
+import org.briarproject.bramble.api.system.Clock;
+import org.briarproject.bramble.test.BrambleMockTestCase;
+import org.jmock.Expectations;
 import org.junit.Test;
 
+import java.io.InputStream;
+
+import static org.briarproject.bramble.api.transport.TransportConstants.MAX_CLOCK_DIFFERENCE;
+import static org.briarproject.bramble.test.TestUtils.getClientId;
+import static org.briarproject.bramble.test.TestUtils.getGroup;
+import static org.briarproject.bramble.test.TestUtils.getMessage;
+import static org.briarproject.bramble.test.TestUtils.getRandomBytes;
+import static org.briarproject.bramble.test.TestUtils.getRandomId;
 import static org.briarproject.bramble.util.StringUtils.getRandomString;
+import static org.briarproject.briar.api.messaging.MessagingConstants.MAX_ATTACHMENTS_PER_MESSAGE;
+import static org.briarproject.briar.api.messaging.MessagingConstants.MAX_CONTENT_TYPE_BYTES;
 import static org.briarproject.briar.api.messaging.MessagingConstants.MAX_PRIVATE_MESSAGE_TEXT_LENGTH;
 import static org.briarproject.briar.client.MessageTrackerConstants.MSG_KEY_READ;
+import static org.briarproject.briar.messaging.MessageTypes.ATTACHMENT;
+import static org.briarproject.briar.messaging.MessageTypes.PRIVATE_MESSAGE;
+import static org.briarproject.briar.messaging.MessagingConstants.MSG_KEY_ATTACHMENT_HEADERS;
+import static org.briarproject.briar.messaging.MessagingConstants.MSG_KEY_CONTENT_TYPE;
+import static org.briarproject.briar.messaging.MessagingConstants.MSG_KEY_DESCRIPTOR_LENGTH;
+import static org.briarproject.briar.messaging.MessagingConstants.MSG_KEY_HAS_TEXT;
+import static org.briarproject.briar.messaging.MessagingConstants.MSG_KEY_LOCAL;
+import static org.briarproject.briar.messaging.MessagingConstants.MSG_KEY_MSG_TYPE;
+import static org.briarproject.briar.messaging.MessagingConstants.MSG_KEY_TIMESTAMP;
 import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
 
-public class PrivateMessageValidatorTest extends ValidatorTestCase {
+public class PrivateMessageValidatorTest extends BrambleMockTestCase {
 
-	@Test(expected = FormatException.class)
+	private final BdfReaderFactory bdfReaderFactory =
+			context.mock(BdfReaderFactory.class);
+	private final MetadataEncoder metadataEncoder =
+			context.mock(MetadataEncoder.class);
+	private final Clock clock = context.mock(Clock.class);
+	private final BdfReader reader = context.mock(BdfReader.class);
+
+	private final Group group = getGroup(getClientId(), 123);
+	private final Message message = getMessage(group.getId());
+	private final long now = message.getTimestamp() + 1000;
+	private final String text =
+			getRandomString(MAX_PRIVATE_MESSAGE_TEXT_LENGTH);
+	private final BdfList attachmentHeader = getAttachmentHeader();
+	private final MessageId attachmentId = new MessageId(getRandomId());
+	private final String contentType = getRandomString(MAX_CONTENT_TYPE_BYTES);
+	private final BdfDictionary legacyMeta = BdfDictionary.of(
+			new BdfEntry(MSG_KEY_TIMESTAMP, message.getTimestamp()),
+			new BdfEntry(MSG_KEY_LOCAL, false),
+			new BdfEntry(MSG_KEY_READ, false)
+	);
+	private final BdfDictionary noAttachmentsMeta = BdfDictionary.of(
+			new BdfEntry(MSG_KEY_TIMESTAMP, message.getTimestamp()),
+			new BdfEntry(MSG_KEY_LOCAL, false),
+			new BdfEntry(MSG_KEY_READ, false),
+			new BdfEntry(MSG_KEY_MSG_TYPE, PRIVATE_MESSAGE),
+			new BdfEntry(MSG_KEY_HAS_TEXT, true),
+			new BdfEntry(MSG_KEY_ATTACHMENT_HEADERS, new BdfList())
+	);
+	private final BdfDictionary noTextMeta = BdfDictionary.of(
+			new BdfEntry(MSG_KEY_TIMESTAMP, message.getTimestamp()),
+			new BdfEntry(MSG_KEY_LOCAL, false),
+			new BdfEntry(MSG_KEY_READ, false),
+			new BdfEntry(MSG_KEY_MSG_TYPE, PRIVATE_MESSAGE),
+			new BdfEntry(MSG_KEY_HAS_TEXT, false),
+			new BdfEntry(MSG_KEY_ATTACHMENT_HEADERS,
+					BdfList.of(attachmentHeader))
+	);
+	private final BdfDictionary attachmentMeta = BdfDictionary.of(
+			new BdfEntry(MSG_KEY_TIMESTAMP, message.getTimestamp()),
+			new BdfEntry(MSG_KEY_LOCAL, false),
+			new BdfEntry(MSG_KEY_MSG_TYPE, ATTACHMENT),
+			// Descriptor length is zero as the test doesn't read from the
+			// counting input stream
+			new BdfEntry(MSG_KEY_DESCRIPTOR_LENGTH, 0L),
+			new BdfEntry(MSG_KEY_CONTENT_TYPE, contentType)
+	);
+
+	private final PrivateMessageValidator validator =
+			new PrivateMessageValidator(bdfReaderFactory, metadataEncoder,
+					clock);
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsFarFutureTimestamp() throws Exception {
+		expectCheckTimestamp(message.getTimestamp() - MAX_CLOCK_DIFFERENCE - 1);
+
+		validator.validateMessage(message, group);
+	}
+
+	@Test(expected = InvalidMessageException.class)
 	public void testRejectsTooShortBody() throws Exception {
-		PrivateMessageValidator v = new PrivateMessageValidator(clientHelper,
-				metadataEncoder, clock);
-		v.validateMessage(message, group, new BdfList());
+		expectCheckTimestamp(now);
+		expectParseList(new BdfList());
+
+		validator.validateMessage(message, group);
 	}
 
-	@Test(expected = FormatException.class)
-	public void testRejectsTooLongBody() throws Exception {
-		PrivateMessageValidator v = new PrivateMessageValidator(clientHelper,
-				metadataEncoder, clock);
-		v.validateMessage(message, group, BdfList.of("", 123));
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTrailingDataForLegacyMessage() throws Exception {
+		expectCheckTimestamp(now);
+		expectParseList(BdfList.of(text));
+		expectReadEof(false);
+
+		validator.validateMessage(message, group);
 	}
 
-	@Test(expected = FormatException.class)
-	public void testRejectsNullText() throws Exception {
-		PrivateMessageValidator v = new PrivateMessageValidator(clientHelper,
-				metadataEncoder, clock);
-		v.validateMessage(message, group, BdfList.of((String) null));
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsNullTextForLegacyMessage() throws Exception {
+		testRejectsLegacyMessage(BdfList.of((String) null));
 	}
 
-	@Test(expected = FormatException.class)
-	public void testRejectsNonStringText() throws Exception {
-		PrivateMessageValidator v = new PrivateMessageValidator(clientHelper,
-				metadataEncoder, clock);
-		v.validateMessage(message, group, BdfList.of(123));
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsNonStringTextForLegacyMessage() throws Exception {
+		testRejectsLegacyMessage(BdfList.of(123));
 	}
 
-	@Test(expected = FormatException.class)
-	public void testRejectsTooLongText() throws Exception {
-		PrivateMessageValidator v = new PrivateMessageValidator(clientHelper,
-				metadataEncoder, clock);
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooLongTextForLegacyMessage() throws Exception {
 		String invalidText =
 				getRandomString(MAX_PRIVATE_MESSAGE_TEXT_LENGTH + 1);
-		v.validateMessage(message, group, BdfList.of(invalidText));
+
+		testRejectsLegacyMessage(BdfList.of(invalidText));
 	}
 
 	@Test
-	public void testAcceptsMaxLengthText() throws Exception {
-		PrivateMessageValidator v = new PrivateMessageValidator(clientHelper,
-				metadataEncoder, clock);
-		String text = getRandomString(MAX_PRIVATE_MESSAGE_TEXT_LENGTH);
-		BdfMessageContext messageContext =
-				v.validateMessage(message, group, BdfList.of(text));
-		assertExpectedContext(messageContext);
+	public void testAcceptsMaxLengthTextForLegacyMessage() throws Exception {
+		testAcceptsLegacyMessage(BdfList.of(text));
 	}
 
 	@Test
-	public void testAcceptsMinLengthText() throws Exception {
-		PrivateMessageValidator v = new PrivateMessageValidator(clientHelper,
-				metadataEncoder, clock);
-		BdfMessageContext messageContext =
-				v.validateMessage(message, group, BdfList.of(""));
-		assertExpectedContext(messageContext);
+	public void testAcceptsMinLengthTextForLegacyMessage() throws Exception {
+		testAcceptsLegacyMessage(BdfList.of(""));
 	}
 
-	private void assertExpectedContext(BdfMessageContext messageContext)
-			throws FormatException {
-		BdfDictionary meta = messageContext.getDictionary();
-		assertEquals(3, meta.size());
-		assertEquals(timestamp, meta.getLong("timestamp").longValue());
-		assertFalse(meta.getBoolean("local"));
-		assertFalse(meta.getBoolean(MSG_KEY_READ));
-		assertEquals(0, messageContext.getDependencies().size());
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTrailingDataForPrivateMessage() throws Exception {
+		expectCheckTimestamp(now);
+		expectParseList(BdfList.of(PRIVATE_MESSAGE, text, new BdfList()));
+		expectReadEof(false);
+
+		validator.validateMessage(message, group);
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooShortBodyForPrivateMessage() throws Exception {
+		testRejectsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooLongBodyForPrivateMessage() throws Exception {
+		testRejectsPrivateMessage(
+				BdfList.of(PRIVATE_MESSAGE, text, new BdfList(), 123));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsNullTextWithoutAttachmentsForPrivateMessage()
+			throws Exception {
+		testRejectsPrivateMessage(
+				BdfList.of(PRIVATE_MESSAGE, null, new BdfList()));
+	}
+
+	@Test
+	public void testAcceptsNullTextWithAttachmentsForPrivateMessage()
+			throws Exception {
+		testAcceptsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, null,
+				BdfList.of(attachmentHeader)), noTextMeta);
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsNonStringTextForPrivateMessage() throws Exception {
+		testRejectsPrivateMessage(
+				BdfList.of(PRIVATE_MESSAGE, 123, new BdfList()));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooLongTextForPrivateMessage() throws Exception {
+		String invalidText =
+				getRandomString(MAX_PRIVATE_MESSAGE_TEXT_LENGTH + 1);
+
+		testRejectsPrivateMessage(
+				BdfList.of(PRIVATE_MESSAGE, invalidText, new BdfList()));
+	}
+
+	@Test
+	public void testAcceptsMaxLengthTextForPrivateMessage() throws Exception {
+		testAcceptsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text,
+				new BdfList()), noAttachmentsMeta);
+	}
+
+	@Test
+	public void testAcceptsMinLengthTextForPrivateMessage() throws Exception {
+		testAcceptsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, "",
+				new BdfList()), noAttachmentsMeta);
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsNullAttachmentListForPrivateMessage()
+			throws Exception {
+		testRejectsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text, null));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsNonListAttachmentListForPrivateMessage()
+			throws Exception {
+		testRejectsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text, 123));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooLongAttachmentListForPrivateMessage()
+			throws Exception {
+		BdfList invalidList = new BdfList();
+		for (int i = 0; i < MAX_ATTACHMENTS_PER_MESSAGE + 1; i++) {
+			invalidList.add(getAttachmentHeader());
+		}
+
+		testRejectsPrivateMessage(
+				BdfList.of(PRIVATE_MESSAGE, text, invalidList));
+	}
+
+	@Test
+	public void testAcceptsMaxLengthAttachmentListForPrivateMessage()
+			throws Exception {
+		BdfList attachmentList = new BdfList();
+		for (int i = 0; i < MAX_ATTACHMENTS_PER_MESSAGE; i++) {
+			attachmentList.add(getAttachmentHeader());
+		}
+		BdfDictionary maxAttachmentsMeta = new BdfDictionary(noAttachmentsMeta);
+		maxAttachmentsMeta.put(MSG_KEY_ATTACHMENT_HEADERS, attachmentList);
+
+		testAcceptsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text,
+				attachmentList), maxAttachmentsMeta);
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsNullAttachmentIdForPrivateMessage()
+			throws Exception {
+		BdfList invalidHeader = BdfList.of(null, contentType);
+
+		testRejectsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text,
+				BdfList.of(invalidHeader)));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsNonRawAttachmentIdForPrivateMessage()
+			throws Exception {
+		BdfList invalidHeader = BdfList.of(123, contentType);
+
+		testRejectsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text,
+				BdfList.of(invalidHeader)));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooShortAttachmentIdForPrivateMessage()
+			throws Exception {
+		BdfList invalidHeader =
+				BdfList.of(getRandomBytes(UniqueId.LENGTH - 1), contentType);
+
+		testRejectsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text,
+				BdfList.of(invalidHeader)));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooLongAttachmentIdForPrivateMessage()
+			throws Exception {
+		BdfList invalidHeader =
+				BdfList.of(getRandomBytes(UniqueId.LENGTH + 1), contentType);
+
+		testRejectsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text,
+				BdfList.of(invalidHeader)));
+	}
+
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsNullContentTypeForPrivateMessage()
+			throws Exception {
+		BdfList invalidHeader = BdfList.of(attachmentId, null);
+
+		testRejectsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text,
+				BdfList.of(invalidHeader)));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsNonStringContentTypeForPrivateMessage()
+			throws Exception {
+		BdfList invalidHeader = BdfList.of(attachmentId, 123);
+
+		testRejectsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text,
+				BdfList.of(invalidHeader)));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooShortContentTypeForPrivateMessage()
+			throws Exception {
+		BdfList invalidHeader = BdfList.of(attachmentId, "");
+
+		testRejectsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text,
+				BdfList.of(invalidHeader)));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooLongContentTypeForPrivateMessage()
+			throws Exception {
+		BdfList invalidHeader = BdfList.of(attachmentId,
+				getRandomString(MAX_CONTENT_TYPE_BYTES + 1));
+
+		testRejectsPrivateMessage(BdfList.of(PRIVATE_MESSAGE, text,
+				BdfList.of(invalidHeader)));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooShortDescriptorWithoutTrailingDataForAttachment()
+			throws Exception {
+		expectCheckTimestamp(now);
+		expectParseList(BdfList.of(ATTACHMENT));
+		// Single-element list is interpreted as a legacy private message, so
+		// EOF is expected
+		expectReadEof(true);
+
+		validator.validateMessage(message, group);
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooShortDescriptorWithTrailingDataForAttachment()
+			throws Exception {
+		expectCheckTimestamp(now);
+		expectParseList(BdfList.of(ATTACHMENT));
+		// Single-element list is interpreted as a legacy private message, so
+		// EOF is expected
+		expectReadEof(false);
+
+		validator.validateMessage(message, group);
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooLongDescriptorForAttachment() throws Exception {
+		testRejectsAttachment(BdfList.of(ATTACHMENT, contentType, 123));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsNullContentTypeForAttachment() throws Exception {
+		testRejectsAttachment(BdfList.of(ATTACHMENT, null));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsNonStringContentTypeForAttachment()
+			throws Exception {
+		testRejectsAttachment(BdfList.of(ATTACHMENT, 123));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooShortContentTypeForAttachment() throws Exception {
+		testRejectsAttachment(BdfList.of(ATTACHMENT, ""));
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsTooLongContentTypeForAttachment() throws Exception {
+		String invalidContentType = getRandomString(MAX_CONTENT_TYPE_BYTES + 1);
+
+		testRejectsAttachment(BdfList.of(ATTACHMENT, invalidContentType));
+	}
+
+	@Test
+	public void testAcceptsValidDescriptorForAttachment() throws Exception {
+		expectCheckTimestamp(now);
+		expectParseList(BdfList.of(ATTACHMENT, contentType));
+		expectEncodeMetadata(attachmentMeta);
+
+		validator.validateMessage(message, group);
+	}
+
+	@Test(expected = InvalidMessageException.class)
+	public void testRejectsUnknownMessageType() throws Exception {
+		expectCheckTimestamp(now);
+		expectParseList(BdfList.of(ATTACHMENT + 1, contentType));
+
+		validator.validateMessage(message, group);
+	}
+
+	private void testRejectsLegacyMessage(BdfList body) throws Exception {
+		expectCheckTimestamp(now);
+		expectParseList(body);
+		expectReadEof(true);
+
+		validator.validateMessage(message, group);
+	}
+
+	private void testAcceptsLegacyMessage(BdfList body) throws Exception {
+		expectCheckTimestamp(now);
+		expectParseList(body);
+		expectReadEof(true);
+		expectEncodeMetadata(legacyMeta);
+
+		MessageContext result = validator.validateMessage(message, group);
+		assertEquals(0, result.getDependencies().size());
+	}
+
+	private void testRejectsPrivateMessage(BdfList body) throws Exception {
+		expectCheckTimestamp(now);
+		expectParseList(body);
+		expectReadEof(true);
+
+		validator.validateMessage(message, group);
+	}
+
+	private void testAcceptsPrivateMessage(BdfList body, BdfDictionary meta)
+			throws Exception {
+		expectCheckTimestamp(now);
+		expectParseList(body);
+		expectReadEof(true);
+		expectEncodeMetadata(meta);
+
+		MessageContext result = validator.validateMessage(message, group);
+		assertEquals(0, result.getDependencies().size());
+	}
+
+	private void testRejectsAttachment(BdfList descriptor) throws Exception {
+		expectCheckTimestamp(now);
+		expectParseList(descriptor);
+
+		validator.validateMessage(message, group);
+	}
+
+	private void expectCheckTimestamp(long now) {
+		context.checking(new Expectations() {{
+			oneOf(clock).currentTimeMillis();
+			will(returnValue(now));
+		}});
+	}
+
+	private void expectParseList(BdfList body) throws Exception {
+		context.checking(new Expectations() {{
+			oneOf(bdfReaderFactory).createReader(with(any(InputStream.class)));
+			will(returnValue(reader));
+			oneOf(reader).readList();
+			will(returnValue(body));
+		}});
+	}
+
+	private void expectReadEof(boolean eof) throws Exception {
+		context.checking(new Expectations() {{
+			oneOf(reader).eof();
+			will(returnValue(eof));
+		}});
+	}
+
+	private void expectEncodeMetadata(BdfDictionary meta) throws Exception {
+		context.checking(new Expectations() {{
+			oneOf(metadataEncoder).encode(meta);
+			will(returnValue(new Metadata()));
+		}});
+	}
+
+	private BdfList getAttachmentHeader() {
+		return BdfList.of(new MessageId(getRandomId()),
+				getRandomString(MAX_CONTENT_TYPE_BYTES));
 	}
 }

briar-core/src/test/java/org/briarproject/briar/messaging/SimplexMessagingIntegrationTest.java

@@ -15,9 +15,11 @@ import org.briarproject.bramble.api.sync.event.MessageStateChangedEvent;
 import org.briarproject.bramble.test.TestDatabaseConfigModule;
 import org.briarproject.bramble.test.TestTransportConnectionReader;
 import org.briarproject.bramble.test.TestTransportConnectionWriter;
+import org.briarproject.briar.api.messaging.AttachmentHeader;
 import org.briarproject.briar.api.messaging.MessagingManager;
 import org.briarproject.briar.api.messaging.PrivateMessage;
 import org.briarproject.briar.api.messaging.PrivateMessageFactory;
+import org.briarproject.briar.api.messaging.event.AttachmentReceivedEvent;
 import org.briarproject.briar.api.messaging.event.PrivateMessageReceivedEvent;
 import org.briarproject.briar.test.BriarTestCase;
 import org.junit.After;
@@ -27,9 +29,10 @@ import org.junit.Test;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
+import java.io.InputStream;
 import java.util.concurrent.CountDownLatch;
 
-import static java.util.Collections.emptyList;
+import static java.util.Collections.singletonList;
 import static java.util.concurrent.TimeUnit.MILLISECONDS;
 import static org.briarproject.bramble.api.sync.validation.MessageState.DELIVERED;
 import static org.briarproject.bramble.test.TestPluginConfigModule.SIMPLEX_TRANSPORT_ID;
@@ -84,10 +87,12 @@ public class SimplexMessagingIntegrationTest extends BriarTestCase {
 		read(bob, write(alice, bobId), 2);
 		// Sync Bob's client versions and transport properties
 		read(alice, write(bob, aliceId), 2);
-		// Sync the private message
-		read(bob, write(alice, bobId), 1);
+		// Sync the private message and the attachment
+		read(bob, write(alice, bobId), 2);
 		// Bob should have received the private message
 		assertTrue(listener.messageAdded);
+		// Bob should have received the attachment
+		assertTrue(listener.attachmentAdded);
 	}
 
 	private ContactId setUp(SimplexMessagingIntegrationTestComponent device,
@@ -107,16 +112,20 @@ public class SimplexMessagingIntegrationTest extends BriarTestCase {
 
 	private void sendMessage(SimplexMessagingIntegrationTestComponent device,
 			ContactId contactId) throws Exception {
-		// Send Bob a message
 		MessagingManager messagingManager = device.getMessagingManager();
 		GroupId groupId = messagingManager.getConversationId(contactId);
+		long timestamp = System.currentTimeMillis();
+		InputStream in = new ByteArrayInputStream(new byte[] {0, 1, 2, 3});
+		AttachmentHeader attachmentHeader = messagingManager.addLocalAttachment(
+				groupId, timestamp, "image/png", in);
 		PrivateMessageFactory privateMessageFactory =
 				device.getPrivateMessageFactory();
 		PrivateMessage message = privateMessageFactory.createPrivateMessage(
-				groupId, System.currentTimeMillis(), "Hi!", emptyList());
+				groupId, timestamp, "Hi!", singletonList(attachmentHeader));
 		messagingManager.addLocalMessage(message);
 	}
 
+	@SuppressWarnings("SameParameterValue")
 	private void read(SimplexMessagingIntegrationTestComponent device,
 			byte[] stream, int deliveries) throws Exception {
 		// Listen for message deliveries
@@ -187,10 +196,15 @@ public class SimplexMessagingIntegrationTest extends BriarTestCase {
 	private static class PrivateMessageListener implements EventListener {
 
 		private volatile boolean messageAdded = false;
+		private volatile boolean attachmentAdded = false;
 
 		@Override
 		public void eventOccurred(Event e) {
-			if (e instanceof PrivateMessageReceivedEvent) messageAdded = true;
+			if (e instanceof PrivateMessageReceivedEvent) {
+				messageAdded = true;
+			} else if (e instanceof AttachmentReceivedEvent) {
+				attachmentAdded = true;
+			}
 		}
 	}
 }

briar-core/src/test/java/org/briarproject/briar/privategroup/invitation/AbstractProtocolEngineTest.java

@@ -169,7 +169,8 @@ abstract class AbstractProtocolEngineTest extends BrambleMockTestCase {
 			oneOf(messageEncoder).encodeMetadata(type, privateGroupId,
 					message.getTimestamp(), true, true, visible, false, false);
 			will(returnValue(meta));
-			oneOf(clientHelper).addLocalMessage(txn, message, meta, true);
+			oneOf(clientHelper).addLocalMessage(txn, message, meta, true,
+					false);
 		}});
 	}