Close forged-directness link-rebind DoS on DM routing (#1421)

* Gate connected-link trust on a secure session; deny forged direct announces the connected shortcut Residual gap after the rotation-heal containment (#1401): "verified direct" announces prove the signature but not directness — TTL is unsigned — so a malicious connected peer can replay a victim's fresh announce with its TTL restored. When the victim has no live link, the replayer's link rebinds to the victim's ID and reads as "connected", and MessageRouter's connected fast-path then trusts it outright: every DM stalls on a Noise handshake the replayer can never complete and is silently lost while showing "sent". Router-level trust gate (no wire change): - Transport gains canDeliverSecurely(to:) — BLE answers with an established Noise session; Nostr keeps its prompt-delivery predicate; the protocol default forwards to canDeliverPromptly for transports without a forgeable link layer. - MessageRouter.sendPrivate only trusts a connected link outright when it can deliver securely; otherwise it still sends (kicking the handshake on a genuine link) but retains a copy and hands a sealed copy to couriers, like the reachable path. flushOutbox gets the same gate so a flush over an insecure link resends instead of dropping the retained copy. Presence hardening (defense in depth): a "direct" announce arriving on a link already bound to a different peer no longer shortcuts the claimed peer into "connected" — only real link state does. Genuine first-contact and direct announces are unaffected; only the ambiguous heal path loses the forgeable shortcut. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Harden the insecure-link outbox bound; document the second-replay presence gap and the courier metadata tradeoff Review follow-ups on the canDeliverSecurely gate: - flushOutbox no longer counts connected-but-insecure flushes toward the maxSendAttempts drop: the message was actually transmitted over a live link, so a peer whose Noise handshake stalls across reconnect flapping must not burn through the cap and lose the store-and-forward copy the gate exists to preserve. Retention stays bounded by the 24h outbox TTL and the per-peer FIFO cap; acks still clear it. Attempt-counting stays for reachable-only (heuristic) sends. Regression test: >8 connected- insecure flushes keep the retained copy, drop callback never fires. - Document the known second-replay presence gap: linkBoundToOtherPeer reads the binding before rebindLinkAfterVerifiedDirectAnnounce steals the link, so once a first replay has rebound a link to an absent victim's ID, a second replay marks the victim connected. Presence display only — DMs stay on the retain+courier path via the router gate. Not closed at the announce layer because the post-rebind state is indistinguishable from a legitimate rotation/reconnect heal (a supported, field-verified flow). Covered by a two-announce test. - Note the accepted courier-spray metadata tradeoff at the connected- insecure send: nearby verified peers receive a sealed copy (they learn a DM exists, never its content), cleared on ack. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Promote a healed rotation to connected; normalize the secure-delivery probe; retain Codable properties in Periphery Codex review follow-ups on 5017c232: - P1: a legitimate rotation announce necessarily arrives on a link still bound to the OLD peer ID, so the linkBoundToOtherPeer denial stored the new identity as disconnected — and the rebind only fixed link state, never the registry. A healed rotation then read as disconnected until the peer happened to announce again. rebindLinkAfterVerifiedDirect- Announce now promotes the rebound identity to connected after the containment checks pass (registry markConnected + topology/snapshot/ peer-list refresh; the .peerConnected UI event already fired from the announce path). This consciously moves the forged-presence residue from second-replay to first-successful-rebind — bounded by the rebind containment (never steals a live identity, one rebind per link per cooldown) and still display-only: DMs stay gated on canDeliverSecurely. Comments and the pinned tests updated; new regression test covers rotate-on-open-link -> rebind -> isPeerConnected(new) == true. - P2: BLEService.canDeliverSecurely probed the Noise session with the peer ID as given, but sessions are keyed by the short wire ID — a send keyed by the full 64-hex Noise key (favorites resolution) misread an established session as insecure and needlessly retained + couriered every DM until ack. Normalize with toShort() like isPeerConnected. Test drives a real XX handshake and asserts both ID forms pass. - Periphery: the PrekeyBundleStore.StoredBundle.noiseKey "assign-only" flake fired again and slipped past its baselined USR (read exists in loadFromDisk; the indexer intermittently misses it). Replace the baseline entry with retain_codable_properties: true — deterministic, and a truly-dead Codable field is a persisted-format change anyway. Local periphery scan --strict: no unused code detected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: jack <jackjackbits@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-25 01:05:19 +00:00 · 2026-07-09 16:46:33 +02:00
parent c8479c15e3
commit b7c6f42b3a
12 changed files with 530 additions and 12 deletions
@@ -316,6 +316,108 @@ struct MessageRouterTests {
        #expect(couriers.contains(favorite))
    }

+    /// Residual gap after the rotation-heal containment: a replayed "direct"
+    /// announce (TTL is unsigned) can bind an absent victim's peer ID to the
+    /// replayer's link, leaving the victim "connected" on a link whose Noise
+    /// handshake can never complete. The connected fast-path must not trust
+    /// that outright: the send still goes out (a genuine link finishes the
+    /// handshake), but a copy is retained and a sealed copy goes to couriers
+    /// so nothing is silently lost.
+    @Test @MainActor
+    func sendPrivate_connectedWithoutSecureSessionRetainsAndDepositsWithCourier() async {
+        let victim = PeerID(str: "00000000000000aa")
+        let victimKey = Data(repeating: 0xBB, count: 32)
+        let courier = PeerID(str: "00000000000000cc")
+        let courierKey = Data(repeating: 0xCC, count: 32)
+
+        let transport = MockTransport()
+        transport.connectedPeers.insert(victim)
+        transport.connectedPeers.insert(courier)
+        transport.securePeers = [] // no established Noise session with anyone
+        transport.updatePeerSnapshots([Self.snapshot(courier, key: courierKey, verified: true)])
+
+        let router = MessageRouter(
+            transports: [transport],
+            courierDirectory: Self.directory(recipient: victim, recipientKey: victimKey)
+        )
+        router.sendPrivate("Hello", to: victim, recipientNickname: "Peer", messageID: "cs1")
+
+        // The send is still attempted (it kicks the handshake on a genuine
+        // link) but not trusted outright: a courier gets a sealed copy now …
+        #expect(transport.sentPrivateMessages.map(\.messageID) == ["cs1"])
+        #expect(transport.sentCourierMessages.count == 1)
+        #expect(transport.sentCourierMessages.first?.messageID == "cs1")
+        #expect(transport.sentCourierMessages.first?.recipientNoiseKey == victimKey)
+        #expect(transport.sentCourierMessages.first?.couriers == [courier])
+
+        // … and the retained copy keeps flushing until a delivery ack — a
+        // flush over the insecure link must resend without dropping it.
+        router.flushOutbox(for: victim)
+        router.flushOutbox(for: victim)
+        #expect(transport.sentPrivateMessages.count == 3)
+        router.markDelivered("cs1")
+        router.flushOutbox(for: victim)
+        #expect(transport.sentPrivateMessages.count == 3)
+    }
+
+    /// Flushes over a connected-but-insecure link never count toward the
+    /// attempt-cap drop: the message was actually transmitted over a live
+    /// link, so a peer whose Noise handshake stalls across reconnect flapping
+    /// must not burn through the cap and lose the store-and-forward copy the
+    /// secure-session gate exists to preserve. Retention stays bounded by
+    /// the 24h outbox TTL and the per-peer FIFO cap; an ack clears it.
+    @Test @MainActor
+    func flushOutbox_connectedInsecureFlushesNeverDropTheRetainedCopy() async {
+        let peerID = PeerID(str: "00000000000000ac")
+        let transport = MockTransport()
+        transport.connectedPeers.insert(peerID)
+        transport.securePeers = [] // handshake never completes
+
+        let router = MessageRouter(transports: [transport])
+        var dropped: [String] = []
+        router.onMessageDropped = { messageID, _ in dropped.append(messageID) }
+
+        router.sendPrivate("Hello", to: peerID, recipientNickname: "Peer", messageID: "ci1")
+
+        // Well past maxSendAttempts (8): every flush resends, none drops.
+        for _ in 0..<10 {
+            router.flushOutbox(for: peerID)
+        }
+        #expect(dropped.isEmpty)
+        #expect(transport.sentPrivateMessages.count == 11)
+
+        // The copy is still retained and an ack still clears it.
+        router.markDelivered("ci1")
+        router.flushOutbox(for: peerID)
+        #expect(transport.sentPrivateMessages.count == 11)
+    }
+
+    /// With an established secure session the connected fast-path stays
+    /// exactly as before: trusted outright, no retained copy, no courier.
+    @Test @MainActor
+    func sendPrivate_connectedWithSecureSessionIsTrustedOutright() async {
+        let peerID = PeerID(str: "00000000000000ab")
+        let peerKey = Data(repeating: 0xAB, count: 32)
+        let courier = PeerID(str: "00000000000000cc")
+
+        let transport = MockTransport()
+        transport.connectedPeers.insert(peerID)
+        transport.connectedPeers.insert(courier)
+        transport.securePeers = [peerID]
+        transport.updatePeerSnapshots([Self.snapshot(courier, key: Data(repeating: 0xCC, count: 32), verified: true)])
+
+        let router = MessageRouter(
+            transports: [transport],
+            courierDirectory: Self.directory(recipient: peerID, recipientKey: peerKey)
+        )
+        router.sendPrivate("Hello", to: peerID, recipientNickname: "Peer", messageID: "cs2")
+
+        #expect(transport.sentPrivateMessages.map(\.messageID) == ["cs2"])
+        #expect(transport.sentCourierMessages.isEmpty)
+        router.flushOutbox(for: peerID)
+        #expect(transport.sentPrivateMessages.count == 1)
+    }
+
    @Test @MainActor
    func courierBecameAvailable_retriesDepositOnceWithoutDoubleBurn() async {
        let recipient = PeerID(str: "00000000000000aa")