mirror of
https://github.com/permissionlesstech/bitchat.git
synced 2026-07-26 11:25:19 +00:00
Gate connected-link trust on a secure session; deny forged direct announces the connected shortcut
Residual gap after the rotation-heal containment (#1401): "verified direct" announces prove the signature but not directness — TTL is unsigned — so a malicious connected peer can replay a victim's fresh announce with its TTL restored. When the victim has no live link, the replayer's link rebinds to the victim's ID and reads as "connected", and MessageRouter's connected fast-path then trusts it outright: every DM stalls on a Noise handshake the replayer can never complete and is silently lost while showing "sent". Router-level trust gate (no wire change): - Transport gains canDeliverSecurely(to:) — BLE answers with an established Noise session; Nostr keeps its prompt-delivery predicate; the protocol default forwards to canDeliverPromptly for transports without a forgeable link layer. - MessageRouter.sendPrivate only trusts a connected link outright when it can deliver securely; otherwise it still sends (kicking the handshake on a genuine link) but retains a copy and hands a sealed copy to couriers, like the reachable path. flushOutbox gets the same gate so a flush over an insecure link resends instead of dropping the retained copy. Presence hardening (defense in depth): a "direct" announce arriving on a link already bound to a different peer no longer shortcuts the claimed peer into "connected" — only real link state does. Genuine first-contact and direct announces are unaffected; only the ambiguous heal path loses the forgeable shortcut. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
jack
@@ -8,6 +8,7 @@ struct BLEAnnounceHandlerTests {
|
||||
var existingNoisePublicKey: Data?
|
||||
var signatureValid = true
|
||||
var linkState: (hasPeripheral: Bool, hasCentral: Bool) = (false, false)
|
||||
var linkBoundToOtherPeer = false
|
||||
var upsertResult = BLEPeerAnnounceUpdate(isNewPeer: false, wasDisconnected: false, previousNickname: nil)
|
||||
var dedupSeenIDs: Set<String> = []
|
||||
var shouldEmitReconnectLogResult = true
|
||||
@@ -41,6 +42,7 @@ struct BLEAnnounceHandlerTests {
|
||||
return recorder.signatureValid
|
||||
},
|
||||
linkState: { _ in recorder.linkState },
|
||||
linkBoundToOtherPeer: { _, _ in recorder.linkBoundToOtherPeer },
|
||||
withRegistryBarrier: { body in
|
||||
recorder.barrierCount += 1
|
||||
body()
|
||||
@@ -334,6 +336,60 @@ struct BLEAnnounceHandlerTests {
|
||||
#expect(recorder.afterglowDelays.count == 1)
|
||||
}
|
||||
|
||||
/// TTL is unsigned, so a replayed announce with its TTL restored looks
|
||||
/// "direct" — but it arrives on a link another peer already owns. That
|
||||
/// link must not shortcut the (possibly absent) claimed peer into
|
||||
/// "connected".
|
||||
@Test
|
||||
func directAnnounceOnLinkBoundToAnotherPeerDoesNotMarkConnected() throws {
|
||||
let now = Date(timeIntervalSince1970: 1_000)
|
||||
let noiseKey = Data(repeating: 0x88, count: 32)
|
||||
let peerID = PeerID(publicKey: noiseKey)
|
||||
let packet = try makeAnnouncePacket(
|
||||
noisePublicKey: noiseKey,
|
||||
peerID: peerID,
|
||||
timestamp: timestamp(now),
|
||||
signature: Data(repeating: 0xEE, count: 64)
|
||||
)
|
||||
|
||||
let recorder = Recorder()
|
||||
recorder.linkBoundToOtherPeer = true
|
||||
recorder.upsertResult = BLEPeerAnnounceUpdate(isNewPeer: true, wasDisconnected: false, previousNickname: nil)
|
||||
let handler = makeHandler(recorder: recorder, now: now)
|
||||
|
||||
let result = handler.handle(packet, from: peerID)
|
||||
|
||||
#expect(result?.isDirectAnnounce == true)
|
||||
#expect(result?.isVerified == true)
|
||||
#expect(recorder.upsertCalls.count == 1)
|
||||
#expect(recorder.upsertCalls.first?.isConnected == false)
|
||||
}
|
||||
|
||||
/// A peer with its own live link stays connected even when a copy of its
|
||||
/// announce arrives on someone else's link.
|
||||
@Test
|
||||
func directAnnounceOnForeignLinkKeepsPeerWithOwnLinkConnected() throws {
|
||||
let now = Date(timeIntervalSince1970: 1_000)
|
||||
let noiseKey = Data(repeating: 0x99, count: 32)
|
||||
let peerID = PeerID(publicKey: noiseKey)
|
||||
let packet = try makeAnnouncePacket(
|
||||
noisePublicKey: noiseKey,
|
||||
peerID: peerID,
|
||||
timestamp: timestamp(now),
|
||||
signature: Data(repeating: 0xEE, count: 64)
|
||||
)
|
||||
|
||||
let recorder = Recorder()
|
||||
recorder.linkBoundToOtherPeer = true
|
||||
recorder.linkState = (hasPeripheral: false, hasCentral: true)
|
||||
let handler = makeHandler(recorder: recorder, now: now)
|
||||
|
||||
handler.handle(packet, from: peerID)
|
||||
|
||||
#expect(recorder.upsertCalls.count == 1)
|
||||
#expect(recorder.upsertCalls.first?.isConnected == true)
|
||||
}
|
||||
|
||||
@Test
|
||||
func announceBackIsSkippedWhenAlreadyMarked() throws {
|
||||
let now = Date(timeIntervalSince1970: 1_000)
|
||||
|
||||
@@ -316,6 +316,76 @@ struct MessageRouterTests {
|
||||
#expect(couriers.contains(favorite))
|
||||
}
|
||||
|
||||
/// Residual gap after the rotation-heal containment: a replayed "direct"
|
||||
/// announce (TTL is unsigned) can bind an absent victim's peer ID to the
|
||||
/// replayer's link, leaving the victim "connected" on a link whose Noise
|
||||
/// handshake can never complete. The connected fast-path must not trust
|
||||
/// that outright: the send still goes out (a genuine link finishes the
|
||||
/// handshake), but a copy is retained and a sealed copy goes to couriers
|
||||
/// so nothing is silently lost.
|
||||
@Test @MainActor
|
||||
func sendPrivate_connectedWithoutSecureSessionRetainsAndDepositsWithCourier() async {
|
||||
let victim = PeerID(str: "00000000000000aa")
|
||||
let victimKey = Data(repeating: 0xBB, count: 32)
|
||||
let courier = PeerID(str: "00000000000000cc")
|
||||
let courierKey = Data(repeating: 0xCC, count: 32)
|
||||
|
||||
let transport = MockTransport()
|
||||
transport.connectedPeers.insert(victim)
|
||||
transport.connectedPeers.insert(courier)
|
||||
transport.securePeers = [] // no established Noise session with anyone
|
||||
transport.updatePeerSnapshots([Self.snapshot(courier, key: courierKey, verified: true)])
|
||||
|
||||
let router = MessageRouter(
|
||||
transports: [transport],
|
||||
courierDirectory: Self.directory(recipient: victim, recipientKey: victimKey)
|
||||
)
|
||||
router.sendPrivate("Hello", to: victim, recipientNickname: "Peer", messageID: "cs1")
|
||||
|
||||
// The send is still attempted (it kicks the handshake on a genuine
|
||||
// link) but not trusted outright: a courier gets a sealed copy now …
|
||||
#expect(transport.sentPrivateMessages.map(\.messageID) == ["cs1"])
|
||||
#expect(transport.sentCourierMessages.count == 1)
|
||||
#expect(transport.sentCourierMessages.first?.messageID == "cs1")
|
||||
#expect(transport.sentCourierMessages.first?.recipientNoiseKey == victimKey)
|
||||
#expect(transport.sentCourierMessages.first?.couriers == [courier])
|
||||
|
||||
// … and the retained copy keeps flushing until a delivery ack — a
|
||||
// flush over the insecure link must resend without dropping it.
|
||||
router.flushOutbox(for: victim)
|
||||
router.flushOutbox(for: victim)
|
||||
#expect(transport.sentPrivateMessages.count == 3)
|
||||
router.markDelivered("cs1")
|
||||
router.flushOutbox(for: victim)
|
||||
#expect(transport.sentPrivateMessages.count == 3)
|
||||
}
|
||||
|
||||
/// With an established secure session the connected fast-path stays
|
||||
/// exactly as before: trusted outright, no retained copy, no courier.
|
||||
@Test @MainActor
|
||||
func sendPrivate_connectedWithSecureSessionIsTrustedOutright() async {
|
||||
let peerID = PeerID(str: "00000000000000ab")
|
||||
let peerKey = Data(repeating: 0xAB, count: 32)
|
||||
let courier = PeerID(str: "00000000000000cc")
|
||||
|
||||
let transport = MockTransport()
|
||||
transport.connectedPeers.insert(peerID)
|
||||
transport.connectedPeers.insert(courier)
|
||||
transport.securePeers = [peerID]
|
||||
transport.updatePeerSnapshots([Self.snapshot(courier, key: Data(repeating: 0xCC, count: 32), verified: true)])
|
||||
|
||||
let router = MessageRouter(
|
||||
transports: [transport],
|
||||
courierDirectory: Self.directory(recipient: peerID, recipientKey: peerKey)
|
||||
)
|
||||
router.sendPrivate("Hello", to: peerID, recipientNickname: "Peer", messageID: "cs2")
|
||||
|
||||
#expect(transport.sentPrivateMessages.map(\.messageID) == ["cs2"])
|
||||
#expect(transport.sentCourierMessages.isEmpty)
|
||||
router.flushOutbox(for: peerID)
|
||||
#expect(transport.sentPrivateMessages.count == 1)
|
||||
}
|
||||
|
||||
@Test @MainActor
|
||||
func courierBecameAvailable_retriesDepositOnceWithoutDoubleBurn() async {
|
||||
let recipient = PeerID(str: "00000000000000aa")
|
||||
|
||||
Reference in New Issue
Block a user