void/ZeroTierOne
2
0
Fork 0
mirror of https://github.com/zerotier/ZeroTierOne.git synced 2025-06-06 12:33:44 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Turns out we do want to propagate packets unauthenticated in the supernode case. This is fine.

Browse source
This commit is contained in:
Adam Ierymenko 2014-09-08 14:33:12 -04:00
parent b8729de9da
commit ea0f836ef1
1 changed files with 6 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
node/PacketDecoder.cpp
View file

@ -610,13 +610,12 @@ bool PacketDecoder::_doMULTICAST_FRAME(const RuntimeEnvironment *_r,const Shared
} }
} }
// Check the multicast frame's signature to verify that its original sender is // Authenticate multicasts for networks that require this -- note that the only
// who it claims to be. // nodes that will ever see multicasts for networks they don't belong to are
if ((!network)||(network->authenticateMulticasts())) { // supernodes, and in this case not authenticating is not a big deal. When nodes
// Note that right now we authenticate multicasts if we aren't a member of a // that are members see packets with failed authentication they will drop them
// network... have to think about whether this is mandatory. It mostly only // and they will no longer propagate.
// matters for supernodes though, since ordinary peers are unlikely ever to if ((network)&&(network->authenticateMulticasts())) {
// see multicasts for networks they don't belong to.
const unsigned int signedPartLen = (ZT_PROTO_VERB_MULTICAST_FRAME_IDX_FRAME - ZT_PROTO_VERB_MULTICAST_FRAME_IDX__START_OF_SIGNED_PORTION) + frameLen; const unsigned int signedPartLen = (ZT_PROTO_VERB_MULTICAST_FRAME_IDX_FRAME - ZT_PROTO_VERB_MULTICAST_FRAME_IDX__START_OF_SIGNED_PORTION) + frameLen;
if (!originPeer->identity().verify(field(ZT_PROTO_VERB_MULTICAST_FRAME_IDX__START_OF_SIGNED_PORTION,signedPartLen),signedPartLen,signature,signatureLen)) { if (!originPeer->identity().verify(field(ZT_PROTO_VERB_MULTICAST_FRAME_IDX__START_OF_SIGNED_PORTION,signedPartLen),signedPartLen,signature,signatureLen)) {
LOG("dropped MULTICAST_FRAME from %s(%s): failed signature verification, claims to be from %s",source().toString().c_str(),_remoteAddress.toString().c_str(),origin.toString().c_str()); LOG("dropped MULTICAST_FRAME from %s(%s): failed signature verification, claims to be from %s",source().toString().c_str(),_remoteAddress.toString().c_str(),origin.toString().c_str());