status-im
/
nim-eth
mirror of https://github.com/status-im/nim-eth.git
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

Don't allow to use HandshareSecrets if auth response is invalid

This commit is contained in:
kdeme 2020-06-04 13:38:04 +02:00
parent 47602e634c
commit 12627b34d3
No known key found for this signature in database
GPG Key ID: 4E8DD21420AF43F5
1 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
eth/p2p/discoveryv5/encoding.nim
View File

@ -226,15 +226,15 @@ proc decodeMessage(body: openarray[byte]):
err(PacketError)
proc decodeAuthResp(c: Codec, fromId: NodeId, head: AuthHeader,
challenge: Whoareyou, secrets: var HandshakeSecrets, newNode: var Node):
DecodeResult[void] {.raises:[Defect].} =
challenge: Whoareyou, newNode: var Node):
DecodeResult[HandshakeSecrets] {.raises:[Defect].} =
if head.scheme != authSchemeName:
warn "Unknown auth scheme"
return err(HandshakeError)
let ephKey = ? PublicKey.fromRaw(head.ephemeralKey).mapErrTo(HandshakeError)
secrets = ? deriveKeys(fromId, c.localNode.id, c.privKey, ephKey,
let secrets = ? deriveKeys(fromId, c.localNode.id, c.privKey, ephKey,
challenge.idNonce).mapErrTo(HandshakeError)
var zeroNonce: array[gcmNonceSize, byte]
@ -261,7 +261,7 @@ proc decodeAuthResp(c: Codec, fromId: NodeId, head: AuthHeader,
let sig = ? SignatureNR.fromRaw(authResp.signature).mapErrTo(HandshakeError)
let h = idNonceHash(head.idNonce, head.ephemeralKey)
if verify(sig, h, newNode.pubkey):
ok()
ok(secrets)
else:
err(HandshakeError)
@ -295,10 +295,11 @@ proc decodePacket*(c: var Codec,
trace "Decoding failed (different nonce)"
return err(HandshakeError)
var sec: HandshakeSecrets
if c.decodeAuthResp(fromId, auth, challenge, sec, newNode).isErr:
trace "Decoding failed (bad auth)"
let secrets = c.decodeAuthResp(fromId, auth, challenge, newNode)
if secrets.isErr:
trace "Decoding failed (invalid auth response)"
return err(HandshakeError)
var sec = secrets[]
c.handshakes.del(key)