octo
/
Zebra
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Security: Move the Verack response after the version check (#2121) 

We should do as many local checks as possible, before sending further
messages.
This commit is contained in:
teor 2021-05-18 06:39:44 +10:00 committed by GitHub
parent e0fdadaca2
commit 7969459b19
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
zebra-network/src/peer/handshake.rs
View File

@ -493,18 +493,6 @@ pub async fn negotiate_version(
Err(HandshakeError::NonceReuse)?; Err(HandshakeError::NonceReuse)?;
} }
peer_conn.send(Message::Verack).await?;
let remote_msg = peer_conn
.next()
.await
.ok_or(HandshakeError::ConnectionClosed)??;
if let Message::Verack = remote_msg {
debug!("got verack from remote peer");
} else {
Err(HandshakeError::UnexpectedMessage(Box::new(remote_msg)))?;
}
// XXX in zcashd remote peer can only send one version message and // XXX in zcashd remote peer can only send one version message and
// we would disconnect here if it received a second one. Is it even possible // we would disconnect here if it received a second one. Is it even possible
// for that to happen to us here? // for that to happen to us here?
@ -532,6 +520,18 @@ pub async fn negotiate_version(
Err(HandshakeError::ObsoleteVersion(remote_version))?; Err(HandshakeError::ObsoleteVersion(remote_version))?;
} }
peer_conn.send(Message::Verack).await?;
let remote_msg = peer_conn
.next()
.await
.ok_or(HandshakeError::ConnectionClosed)??;
if let Message::Verack = remote_msg {
debug!("got verack from remote peer");
} else {
Err(HandshakeError::UnexpectedMessage(Box::new(remote_msg)))?;
}
Ok((remote_version, remote_services, remote_canonical_addr)) Ok((remote_version, remote_services, remote_canonical_addr))
} }