void/ZeroTierOne
2
0
Fork 0
mirror of https://github.com/zerotier/ZeroTierOne.git synced 2025-04-19 13:36:54 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

fixed comment

Browse source
This commit is contained in:
mamoniot 2023-03-23 13:18:00 -04:00
parent 2f61e59e5c
commit 7cc8db2187
No known key found for this signature in database
GPG key ID: ADCCDBBE0E3D3B3B
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
zssp/src/zssp.rs
View file

@ -546,8 +546,9 @@ impl<Application: ApplicationLayer> Context<Application> {
let assembled;
let incoming_packet = if fragment_count > 1 {
// Using just incoming_counter unhashed would be good DOS resistant,
// but why not make it harder by mixing in a random value and the physical path in as well.
// incoming_counter is expected to be a random u64 generated by the remote peer.
// Using just incoming_counter to defragment would be good DOS resistance,
// but why not make it harder by hasing it with a random salt and the physical path in as well.
let mut hasher = self.defrag_salt.build_hasher();
source.hash(&mut hasher);
hasher.write_u64(incoming_counter);
@ -559,8 +560,8 @@ impl<Application: ApplicationLayer> Context<Application> {
// By only checking 2 slots we avoid a full table lookup while also minimizing the chance that 2 offers collide.
// To DOS, an adversary would either need to volumetrically spam the defrag table to keep all slots full
// or replay Alice's packet header from a spoofed physical path before Alice's packet is fully assembled.
// Volumetric spam is quite difficult since without the `defrag_salt: RandomState` value an adversary
// cannot control which slots their fragments index to. And since Alice's packet header has a randomly
// Volumetric spam is quite difficult since without the `defrag_salt` value an adversary cannot
// control which slots their fragments index to. And since Alice's packet header has a randomly
// generated counter value replaying it in time requires extreme amounts of network control.
let (slot0, timestamp0) = &mut *self.defrag[idx0].lock().unwrap();
if slot0.counter() == hashed_counter {