mirror of
https://github.com/permissionlesstech/bitchat.git
synced 2026-07-24 22:45:19 +00:00
Close forged-directness link-rebind DoS on DM routing (#1421)
* Gate connected-link trust on a secure session; deny forged direct announces the connected shortcut
Residual gap after the rotation-heal containment (#1401): "verified
direct" announces prove the signature but not directness — TTL is
unsigned — so a malicious connected peer can replay a victim's fresh
announce with its TTL restored. When the victim has no live link, the
replayer's link rebinds to the victim's ID and reads as "connected",
and MessageRouter's connected fast-path then trusts it outright: every
DM stalls on a Noise handshake the replayer can never complete and is
silently lost while showing "sent".
Router-level trust gate (no wire change):
- Transport gains canDeliverSecurely(to:) — BLE answers with an
established Noise session; Nostr keeps its prompt-delivery predicate;
the protocol default forwards to canDeliverPromptly for transports
without a forgeable link layer.
- MessageRouter.sendPrivate only trusts a connected link outright when
it can deliver securely; otherwise it still sends (kicking the
handshake on a genuine link) but retains a copy and hands a sealed
copy to couriers, like the reachable path. flushOutbox gets the same
gate so a flush over an insecure link resends instead of dropping the
retained copy.
Presence hardening (defense in depth): a "direct" announce arriving on
a link already bound to a different peer no longer shortcuts the
claimed peer into "connected" — only real link state does. Genuine
first-contact and direct announces are unaffected; only the ambiguous
heal path loses the forgeable shortcut.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
* Harden the insecure-link outbox bound; document the second-replay presence gap and the courier metadata tradeoff
Review follow-ups on the canDeliverSecurely gate:
- flushOutbox no longer counts connected-but-insecure flushes toward the
maxSendAttempts drop: the message was actually transmitted over a live
link, so a peer whose Noise handshake stalls across reconnect flapping
must not burn through the cap and lose the store-and-forward copy the
gate exists to preserve. Retention stays bounded by the 24h outbox TTL
and the per-peer FIFO cap; acks still clear it. Attempt-counting stays
for reachable-only (heuristic) sends. Regression test: >8 connected-
insecure flushes keep the retained copy, drop callback never fires.
- Document the known second-replay presence gap: linkBoundToOtherPeer
reads the binding before rebindLinkAfterVerifiedDirectAnnounce steals
the link, so once a first replay has rebound a link to an absent
victim's ID, a second replay marks the victim connected. Presence
display only — DMs stay on the retain+courier path via the router
gate. Not closed at the announce layer because the post-rebind state
is indistinguishable from a legitimate rotation/reconnect heal (a
supported, field-verified flow). Covered by a two-announce test.
- Note the accepted courier-spray metadata tradeoff at the connected-
insecure send: nearby verified peers receive a sealed copy (they learn
a DM exists, never its content), cleared on ack.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* Promote a healed rotation to connected; normalize the secure-delivery probe; retain Codable properties in Periphery
Codex review follow-ups on 5017c232:
- P1: a legitimate rotation announce necessarily arrives on a link still
bound to the OLD peer ID, so the linkBoundToOtherPeer denial stored the
new identity as disconnected — and the rebind only fixed link state,
never the registry. A healed rotation then read as disconnected until
the peer happened to announce again. rebindLinkAfterVerifiedDirect-
Announce now promotes the rebound identity to connected after the
containment checks pass (registry markConnected + topology/snapshot/
peer-list refresh; the .peerConnected UI event already fired from the
announce path). This consciously moves the forged-presence residue
from second-replay to first-successful-rebind — bounded by the rebind
containment (never steals a live identity, one rebind per link per
cooldown) and still display-only: DMs stay gated on canDeliverSecurely.
Comments and the pinned tests updated; new regression test covers
rotate-on-open-link -> rebind -> isPeerConnected(new) == true.
- P2: BLEService.canDeliverSecurely probed the Noise session with the
peer ID as given, but sessions are keyed by the short wire ID — a send
keyed by the full 64-hex Noise key (favorites resolution) misread an
established session as insecure and needlessly retained + couriered
every DM until ack. Normalize with toShort() like isPeerConnected.
Test drives a real XX handshake and asserts both ID forms pass.
- Periphery: the PrekeyBundleStore.StoredBundle.noiseKey "assign-only"
flake fired again and slipped past its baselined USR (read exists in
loadFromDisk; the indexer intermittently misses it). Replace the
baseline entry with retain_codable_properties: true — deterministic,
and a truly-dead Codable field is a persisted-format change anyway.
Local periphery scan --strict: no unused code detected.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: jack <jackjackbits@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
jack
co-authored by
jack
Claude Opus 4.8
jack
Claude Opus 4.8
parent
c8479c15e3
commit
b7c6f42b3a
@@ -253,6 +253,144 @@ struct BLEServiceCoreTests {
|
||||
#expect(ble.currentPeerSnapshots().map(\.peerID).contains(attackerPeerID))
|
||||
}
|
||||
|
||||
@Test
|
||||
func replayedDirectAnnounceForAbsentPeerNeverYieldsSecureDelivery() async throws {
|
||||
// Residual heal-path gap: the victim has NO live link, so the
|
||||
// identity-owns-a-link containment cannot refuse the rebind. The
|
||||
// replay steals the link binding, and because a successful rebind
|
||||
// promotes its new owner to connected (a legitimate rotation heal
|
||||
// requires that), the absent victim may read as connected. That
|
||||
// forged presence is display-only and accepted — the invariant that
|
||||
// holds is that the stolen link can never produce an established
|
||||
// Noise session, so MessageRouter's canDeliverSecurely gate routes
|
||||
// DMs through retain + courier instead of trusting it outright.
|
||||
let ble = makeService()
|
||||
let attackerPeerID = PeerID(str: "1122334455667788")
|
||||
let attackerLink = "central-attacker-absent-victim"
|
||||
ble._test_seedConnectedPeer(attackerPeerID, nickname: "attacker")
|
||||
ble._test_bindCentral(attackerLink, to: attackerPeerID)
|
||||
|
||||
// The absent victim's fresh signed announce, replayed on the
|
||||
// attacker's bound link with its direct TTL restored.
|
||||
let victimSigner = NoiseEncryptionService(keychain: MockKeychain())
|
||||
let announcement = AnnouncementPacket(
|
||||
nickname: "victim",
|
||||
noisePublicKey: victimSigner.getStaticPublicKeyData(),
|
||||
signingPublicKey: victimSigner.getSigningPublicKeyData(),
|
||||
directNeighbors: nil
|
||||
)
|
||||
let payload = try #require(announcement.encode(), "Failed to encode announcement")
|
||||
let victimPeerID = PeerID(publicKey: announcement.noisePublicKey)
|
||||
let unsigned = BitchatPacket(
|
||||
type: MessageType.announce.rawValue,
|
||||
senderID: Data(hexString: victimPeerID.id) ?? Data(),
|
||||
recipientID: nil,
|
||||
timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
|
||||
payload: payload,
|
||||
signature: nil,
|
||||
ttl: 7
|
||||
)
|
||||
let packet = try #require(victimSigner.signPacket(unsigned), "Failed to sign announce packet")
|
||||
|
||||
#expect(ble._test_recordIngressIfNew(packet: packet, linkID: attackerLink))
|
||||
ble._test_handlePacket(packet, fromPeerID: victimPeerID, preseedPeer: false)
|
||||
|
||||
// The rebind steals the link (no live link owns the victim's
|
||||
// identity, so containment cannot refuse) …
|
||||
let rebound = await TestHelpers.waitUntil(
|
||||
{ ble._test_centralBinding(attackerLink) == victimPeerID },
|
||||
timeout: TestConstants.longTimeout
|
||||
)
|
||||
#expect(rebound)
|
||||
// … and the promote marks the absent victim connected: the accepted,
|
||||
// display-only forged-presence residue (documented at
|
||||
// BLEAnnounceHandler's linkBoundToOtherPeer check) …
|
||||
let forgedPresence = await TestHelpers.waitUntil(
|
||||
{ ble.isPeerConnected(victimPeerID) },
|
||||
timeout: TestConstants.longTimeout
|
||||
)
|
||||
#expect(forgedPresence)
|
||||
// … but secure delivery stays impossible — the DM gate holds, and
|
||||
// MessageRouter retains + couriers instead of trusting the link.
|
||||
#expect(!ble.canDeliverSecurely(to: victimPeerID))
|
||||
}
|
||||
|
||||
/// A legitimate rotation announce necessarily arrives on a link still
|
||||
/// bound to the OLD ID, so its registry upsert stores the new peer
|
||||
/// disconnected. The successful rebind must promote it: a healed
|
||||
/// rotation with a live link has to read as connected again for routing
|
||||
/// and outbox flushes.
|
||||
@Test
|
||||
func rotationHealPromotesRotatedPeerToConnected() async throws {
|
||||
let ble = makeService()
|
||||
let oldPeerID = PeerID(str: "1122334455667788")
|
||||
let centralUUID = "central-rotation-promote"
|
||||
|
||||
ble._test_seedConnectedPeer(oldPeerID, nickname: "alice")
|
||||
ble._test_bindCentral(centralUUID, to: oldPeerID)
|
||||
|
||||
let signer = NoiseEncryptionService(keychain: MockKeychain())
|
||||
let announcement = AnnouncementPacket(
|
||||
nickname: "alice",
|
||||
noisePublicKey: signer.getStaticPublicKeyData(),
|
||||
signingPublicKey: signer.getSigningPublicKeyData(),
|
||||
directNeighbors: nil
|
||||
)
|
||||
let payload = try #require(announcement.encode(), "Failed to encode announcement")
|
||||
let newPeerID = PeerID(publicKey: announcement.noisePublicKey)
|
||||
let unsigned = BitchatPacket(
|
||||
type: MessageType.announce.rawValue,
|
||||
senderID: Data(hexString: newPeerID.id) ?? Data(),
|
||||
recipientID: nil,
|
||||
timestamp: UInt64(Date().timeIntervalSince1970 * 1000),
|
||||
payload: payload,
|
||||
signature: nil,
|
||||
ttl: 7
|
||||
)
|
||||
let packet = try #require(signer.signPacket(unsigned), "Failed to sign announce packet")
|
||||
|
||||
#expect(ble._test_recordIngressIfNew(packet: packet, linkID: centralUUID))
|
||||
ble._test_handlePacket(packet, fromPeerID: newPeerID, preseedPeer: false)
|
||||
|
||||
let rebound = await TestHelpers.waitUntil(
|
||||
{ ble._test_centralBinding(centralUUID) == newPeerID },
|
||||
timeout: TestConstants.longTimeout
|
||||
)
|
||||
#expect(rebound)
|
||||
|
||||
let connected = await TestHelpers.waitUntil(
|
||||
{ ble.isPeerConnected(newPeerID) },
|
||||
timeout: TestConstants.longTimeout
|
||||
)
|
||||
#expect(connected)
|
||||
}
|
||||
|
||||
/// Noise sessions are keyed by the short wire ID, but routers may key
|
||||
/// sends by the full 64-hex Noise key (favorites resolution does). The
|
||||
/// secure-delivery gate must normalize like isPeerConnected, or an
|
||||
/// established session is misread as insecure and every DM needlessly
|
||||
/// retains + couriers until an ack.
|
||||
@Test
|
||||
func canDeliverSecurelyNormalizesFullNoiseKeyPeerIDs() async throws {
|
||||
let ble = makeService()
|
||||
let remote = NoiseEncryptionService(keychain: MockKeychain())
|
||||
let remoteKey = remote.getStaticPublicKeyData()
|
||||
let shortID = PeerID(publicKey: remoteKey)
|
||||
let fullKeyID = PeerID(hexData: remoteKey)
|
||||
#expect(fullKeyID.toShort() == shortID)
|
||||
#expect(!ble.canDeliverSecurely(to: shortID))
|
||||
|
||||
// Full XX handshake; the local side keys the session by the short
|
||||
// wire ID, exactly as packets present it in production.
|
||||
let m1 = try ble._test_noiseInitiateHandshake(with: shortID)
|
||||
let m2 = try #require(try remote.processHandshakeMessage(from: ble.myPeerID, message: m1))
|
||||
let m3 = try #require(try ble._test_noiseProcessHandshakeMessage(from: shortID, message: m2))
|
||||
_ = try remote.processHandshakeMessage(from: ble.myPeerID, message: m3)
|
||||
|
||||
#expect(ble.canDeliverSecurely(to: shortID))
|
||||
#expect(ble.canDeliverSecurely(to: fullKeyID))
|
||||
}
|
||||
|
||||
@Test
|
||||
func ingressRejectsSelfLoopbackBeforeSpoofChecks() async throws {
|
||||
let ble = makeService()
|
||||
|
||||
@@ -51,6 +51,10 @@ final class MockTransport: Transport {
|
||||
|
||||
var connectedPeers: Set<PeerID> = []
|
||||
var reachablePeers: Set<PeerID> = []
|
||||
/// Peers with an established secure session. `nil` mirrors the protocol
|
||||
/// default (prompt delivery), so connected peers stay "secure" for tests
|
||||
/// that never care about the distinction.
|
||||
var securePeers: Set<PeerID>?
|
||||
var peerNicknames: [PeerID: String] = [:]
|
||||
var peerFingerprints: [PeerID: String] = [:]
|
||||
var peerNoiseStates: [PeerID: LazyHandshakeState] = [:]
|
||||
@@ -88,6 +92,10 @@ final class MockTransport: Transport {
|
||||
reachablePeers.contains(peerID) || connectedPeers.contains(peerID)
|
||||
}
|
||||
|
||||
func canDeliverSecurely(to peerID: PeerID) -> Bool {
|
||||
securePeers?.contains(peerID) ?? canDeliverPromptly(to: peerID)
|
||||
}
|
||||
|
||||
func peerNickname(peerID: PeerID) -> String? {
|
||||
peerNicknames[peerID]
|
||||
}
|
||||
|
||||
@@ -103,6 +103,9 @@ struct ProtocolContractTests {
|
||||
#expect(probe.sentMessages.count == 1)
|
||||
#expect(probe.sentMessages.first?.content == "hello")
|
||||
#expect(probe.acceptPendingFile(id: "pending") == nil)
|
||||
// Secure delivery defaults to prompt delivery (itself defaulting to
|
||||
// reachability) for transports without a forgeable link layer.
|
||||
#expect(probe.canDeliverSecurely(to: peerID) == false)
|
||||
}
|
||||
|
||||
@Test
|
||||
|
||||
@@ -8,6 +8,7 @@ struct BLEAnnounceHandlerTests {
|
||||
var existingNoisePublicKey: Data?
|
||||
var signatureValid = true
|
||||
var linkState: (hasPeripheral: Bool, hasCentral: Bool) = (false, false)
|
||||
var linkBoundToOtherPeer = false
|
||||
var upsertResult = BLEPeerAnnounceUpdate(isNewPeer: false, wasDisconnected: false, previousNickname: nil)
|
||||
var dedupSeenIDs: Set<String> = []
|
||||
var shouldEmitReconnectLogResult = true
|
||||
@@ -41,6 +42,7 @@ struct BLEAnnounceHandlerTests {
|
||||
return recorder.signatureValid
|
||||
},
|
||||
linkState: { _ in recorder.linkState },
|
||||
linkBoundToOtherPeer: { _, _ in recorder.linkBoundToOtherPeer },
|
||||
withRegistryBarrier: { body in
|
||||
recorder.barrierCount += 1
|
||||
body()
|
||||
@@ -334,6 +336,105 @@ struct BLEAnnounceHandlerTests {
|
||||
#expect(recorder.afterglowDelays.count == 1)
|
||||
}
|
||||
|
||||
/// TTL is unsigned, so a replayed announce with its TTL restored looks
|
||||
/// "direct" — but it arrives on a link another peer already owns. That
|
||||
/// link must not shortcut the (possibly absent) claimed peer into
|
||||
/// "connected".
|
||||
@Test
|
||||
func directAnnounceOnLinkBoundToAnotherPeerDoesNotMarkConnected() throws {
|
||||
let now = Date(timeIntervalSince1970: 1_000)
|
||||
let noiseKey = Data(repeating: 0x88, count: 32)
|
||||
let peerID = PeerID(publicKey: noiseKey)
|
||||
let packet = try makeAnnouncePacket(
|
||||
noisePublicKey: noiseKey,
|
||||
peerID: peerID,
|
||||
timestamp: timestamp(now),
|
||||
signature: Data(repeating: 0xEE, count: 64)
|
||||
)
|
||||
|
||||
let recorder = Recorder()
|
||||
recorder.linkBoundToOtherPeer = true
|
||||
recorder.upsertResult = BLEPeerAnnounceUpdate(isNewPeer: true, wasDisconnected: false, previousNickname: nil)
|
||||
let handler = makeHandler(recorder: recorder, now: now)
|
||||
|
||||
let result = handler.handle(packet, from: peerID)
|
||||
|
||||
#expect(result?.isDirectAnnounce == true)
|
||||
#expect(result?.isVerified == true)
|
||||
#expect(recorder.upsertCalls.count == 1)
|
||||
#expect(recorder.upsertCalls.first?.isConnected == false)
|
||||
}
|
||||
|
||||
/// A peer with its own live link stays connected even when a copy of its
|
||||
/// announce arrives on someone else's link.
|
||||
@Test
|
||||
func directAnnounceOnForeignLinkKeepsPeerWithOwnLinkConnected() throws {
|
||||
let now = Date(timeIntervalSince1970: 1_000)
|
||||
let noiseKey = Data(repeating: 0x99, count: 32)
|
||||
let peerID = PeerID(publicKey: noiseKey)
|
||||
let packet = try makeAnnouncePacket(
|
||||
noisePublicKey: noiseKey,
|
||||
peerID: peerID,
|
||||
timestamp: timestamp(now),
|
||||
signature: Data(repeating: 0xEE, count: 64)
|
||||
)
|
||||
|
||||
let recorder = Recorder()
|
||||
recorder.linkBoundToOtherPeer = true
|
||||
recorder.linkState = (hasPeripheral: false, hasCentral: true)
|
||||
let handler = makeHandler(recorder: recorder, now: now)
|
||||
|
||||
handler.handle(packet, from: peerID)
|
||||
|
||||
#expect(recorder.upsertCalls.count == 1)
|
||||
#expect(recorder.upsertCalls.first?.isConnected == true)
|
||||
}
|
||||
|
||||
/// Documents the handler's contract around the rebind: the
|
||||
/// linkBoundToOtherPeer read reflects the binding BEFORE the rebind runs,
|
||||
/// so a replayed "direct" announce on someone else's link is denied the
|
||||
/// connected shortcut — presence only flips via the rebind itself
|
||||
/// (BLEService promotes the new owner after a successful, containment-
|
||||
/// checked rebind) or via a later announce arriving on the now-rebound
|
||||
/// link, as simulated here. Either way the residue is presence display
|
||||
/// only — DMs remain gated on canDeliverSecurely, so without a Noise
|
||||
/// session they take the retain + courier path (see MessageRouterTests
|
||||
/// .sendPrivate_connectedWithoutSecureSessionRetainsAndDepositsWithCourier).
|
||||
@Test
|
||||
func secondReplayedDirectAnnounceAfterRebindMarksAbsentPeerConnected() throws {
|
||||
let now = Date(timeIntervalSince1970: 1_000)
|
||||
let noiseKey = Data(repeating: 0xA1, count: 32)
|
||||
let victim = PeerID(publicKey: noiseKey)
|
||||
let packet = try makeAnnouncePacket(
|
||||
noisePublicKey: noiseKey,
|
||||
peerID: victim,
|
||||
timestamp: timestamp(now),
|
||||
signature: Data(repeating: 0xEE, count: 64)
|
||||
)
|
||||
|
||||
let recorder = Recorder()
|
||||
let handler = makeHandler(recorder: recorder, now: now)
|
||||
|
||||
// First replay: the link still belongs to the replayer and the victim
|
||||
// has no live link of its own — the connected shortcut is denied.
|
||||
recorder.linkBoundToOtherPeer = true
|
||||
recorder.linkState = (hasPeripheral: false, hasCentral: false)
|
||||
handler.handle(packet, from: victim)
|
||||
#expect(recorder.upsertCalls.count == 1)
|
||||
#expect(recorder.upsertCalls.first?.isConnected == false)
|
||||
|
||||
// The rebind then binds the replayer's link to the victim's ID (the
|
||||
// rotation-heal path, containment-checked in BLEService). A second
|
||||
// replay now finds the link owned by the claimed peer …
|
||||
recorder.linkBoundToOtherPeer = false
|
||||
recorder.linkState = (hasPeripheral: false, hasCentral: true)
|
||||
handler.handle(packet, from: victim)
|
||||
|
||||
// … and the absent victim reads as connected: the residual gap.
|
||||
#expect(recorder.upsertCalls.count == 2)
|
||||
#expect(recorder.upsertCalls.last?.isConnected == true)
|
||||
}
|
||||
|
||||
@Test
|
||||
func announceBackIsSkippedWhenAlreadyMarked() throws {
|
||||
let now = Date(timeIntervalSince1970: 1_000)
|
||||
|
||||
@@ -316,6 +316,108 @@ struct MessageRouterTests {
|
||||
#expect(couriers.contains(favorite))
|
||||
}
|
||||
|
||||
/// Residual gap after the rotation-heal containment: a replayed "direct"
|
||||
/// announce (TTL is unsigned) can bind an absent victim's peer ID to the
|
||||
/// replayer's link, leaving the victim "connected" on a link whose Noise
|
||||
/// handshake can never complete. The connected fast-path must not trust
|
||||
/// that outright: the send still goes out (a genuine link finishes the
|
||||
/// handshake), but a copy is retained and a sealed copy goes to couriers
|
||||
/// so nothing is silently lost.
|
||||
@Test @MainActor
|
||||
func sendPrivate_connectedWithoutSecureSessionRetainsAndDepositsWithCourier() async {
|
||||
let victim = PeerID(str: "00000000000000aa")
|
||||
let victimKey = Data(repeating: 0xBB, count: 32)
|
||||
let courier = PeerID(str: "00000000000000cc")
|
||||
let courierKey = Data(repeating: 0xCC, count: 32)
|
||||
|
||||
let transport = MockTransport()
|
||||
transport.connectedPeers.insert(victim)
|
||||
transport.connectedPeers.insert(courier)
|
||||
transport.securePeers = [] // no established Noise session with anyone
|
||||
transport.updatePeerSnapshots([Self.snapshot(courier, key: courierKey, verified: true)])
|
||||
|
||||
let router = MessageRouter(
|
||||
transports: [transport],
|
||||
courierDirectory: Self.directory(recipient: victim, recipientKey: victimKey)
|
||||
)
|
||||
router.sendPrivate("Hello", to: victim, recipientNickname: "Peer", messageID: "cs1")
|
||||
|
||||
// The send is still attempted (it kicks the handshake on a genuine
|
||||
// link) but not trusted outright: a courier gets a sealed copy now …
|
||||
#expect(transport.sentPrivateMessages.map(\.messageID) == ["cs1"])
|
||||
#expect(transport.sentCourierMessages.count == 1)
|
||||
#expect(transport.sentCourierMessages.first?.messageID == "cs1")
|
||||
#expect(transport.sentCourierMessages.first?.recipientNoiseKey == victimKey)
|
||||
#expect(transport.sentCourierMessages.first?.couriers == [courier])
|
||||
|
||||
// … and the retained copy keeps flushing until a delivery ack — a
|
||||
// flush over the insecure link must resend without dropping it.
|
||||
router.flushOutbox(for: victim)
|
||||
router.flushOutbox(for: victim)
|
||||
#expect(transport.sentPrivateMessages.count == 3)
|
||||
router.markDelivered("cs1")
|
||||
router.flushOutbox(for: victim)
|
||||
#expect(transport.sentPrivateMessages.count == 3)
|
||||
}
|
||||
|
||||
/// Flushes over a connected-but-insecure link never count toward the
|
||||
/// attempt-cap drop: the message was actually transmitted over a live
|
||||
/// link, so a peer whose Noise handshake stalls across reconnect flapping
|
||||
/// must not burn through the cap and lose the store-and-forward copy the
|
||||
/// secure-session gate exists to preserve. Retention stays bounded by
|
||||
/// the 24h outbox TTL and the per-peer FIFO cap; an ack clears it.
|
||||
@Test @MainActor
|
||||
func flushOutbox_connectedInsecureFlushesNeverDropTheRetainedCopy() async {
|
||||
let peerID = PeerID(str: "00000000000000ac")
|
||||
let transport = MockTransport()
|
||||
transport.connectedPeers.insert(peerID)
|
||||
transport.securePeers = [] // handshake never completes
|
||||
|
||||
let router = MessageRouter(transports: [transport])
|
||||
var dropped: [String] = []
|
||||
router.onMessageDropped = { messageID, _ in dropped.append(messageID) }
|
||||
|
||||
router.sendPrivate("Hello", to: peerID, recipientNickname: "Peer", messageID: "ci1")
|
||||
|
||||
// Well past maxSendAttempts (8): every flush resends, none drops.
|
||||
for _ in 0..<10 {
|
||||
router.flushOutbox(for: peerID)
|
||||
}
|
||||
#expect(dropped.isEmpty)
|
||||
#expect(transport.sentPrivateMessages.count == 11)
|
||||
|
||||
// The copy is still retained and an ack still clears it.
|
||||
router.markDelivered("ci1")
|
||||
router.flushOutbox(for: peerID)
|
||||
#expect(transport.sentPrivateMessages.count == 11)
|
||||
}
|
||||
|
||||
/// With an established secure session the connected fast-path stays
|
||||
/// exactly as before: trusted outright, no retained copy, no courier.
|
||||
@Test @MainActor
|
||||
func sendPrivate_connectedWithSecureSessionIsTrustedOutright() async {
|
||||
let peerID = PeerID(str: "00000000000000ab")
|
||||
let peerKey = Data(repeating: 0xAB, count: 32)
|
||||
let courier = PeerID(str: "00000000000000cc")
|
||||
|
||||
let transport = MockTransport()
|
||||
transport.connectedPeers.insert(peerID)
|
||||
transport.connectedPeers.insert(courier)
|
||||
transport.securePeers = [peerID]
|
||||
transport.updatePeerSnapshots([Self.snapshot(courier, key: Data(repeating: 0xCC, count: 32), verified: true)])
|
||||
|
||||
let router = MessageRouter(
|
||||
transports: [transport],
|
||||
courierDirectory: Self.directory(recipient: peerID, recipientKey: peerKey)
|
||||
)
|
||||
router.sendPrivate("Hello", to: peerID, recipientNickname: "Peer", messageID: "cs2")
|
||||
|
||||
#expect(transport.sentPrivateMessages.map(\.messageID) == ["cs2"])
|
||||
#expect(transport.sentCourierMessages.isEmpty)
|
||||
router.flushOutbox(for: peerID)
|
||||
#expect(transport.sentPrivateMessages.count == 1)
|
||||
}
|
||||
|
||||
@Test @MainActor
|
||||
func courierBecameAvailable_retriesDepositOnceWithoutDoubleBurn() async {
|
||||
let recipient = PeerID(str: "00000000000000aa")
|
||||
|
||||
Reference in New Issue
Block a user