Skip to content

defend against misbehaving peers #155

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ingon merged 2 commits into from
Feb 22, 2026
Merged

defend against misbehaving peers #155

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
9c04dc5
defend against misbehaving peers
ingon Feb 22, 2026
b0c7a04
add docs for 40 byte reason
ingon Feb 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion destination.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -260,7 +260,7 @@ func (d *destinationConn) runConnect(ctx context.Context, stream *quic.Stream, r
case err != nil:
return pbconnect.WriteError(stream, pberror.Code_DestinationRelayEncryptionError, "select encryption scheme: %v", err)
case encryption == model.TLSEncryption:
scfg, err := d.dst.getSourceTLS(req.Connect.SourceTls.ClientName)
scfg, err := d.dst.getSourceTLS(req.Connect.SourceTls.GetClientName())
if err != nil {
return pbconnect.WriteError(stream, pberror.Code_DestinationRelayEncryptionError, "destination tls: %v", err)
}
Expand Down
7 changes: 7 additions & 0 deletions peer.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -344,6 +344,10 @@ func (p *peer) newECDHConfig() (*ecdh.PrivateKey, *pbconnect.ECDHConfiguration,
}

func (p *peer) getECDHPublicKey(cfg *pbconnect.ECDHConfiguration) (*ecdh.PublicKey, error) {
if cfg == nil {
return nil, fmt.Errorf("missing ecdh configuration")
}

remotes, ok := p.peers.Peek()
if !ok {
return nil, fmt.Errorf("no peers found")
Expand Down Expand Up @@ -375,6 +379,9 @@ func (p *peer) getECDHPublicKey(cfg *pbconnect.ECDHConfiguration) (*ecdh.PublicK
if !ok {
return nil, fmt.Errorf("peer certificate has unexpected public key type %T", candidates[0].PublicKey)
}
if len(cfg.KeyTime) != 40 { // expected size is 32 (ECDG public key) + 8 (timestamp)
return nil, fmt.Errorf("keytime length check failed: %d", len(cfg.KeyTime))
}
if !ed25519.Verify(certPublic, cfg.KeyTime, cfg.Signature) {
return nil, fmt.Errorf("signature verification failed")
}
Expand Down
3 changes: 2 additions & 1 deletion sources.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -191,7 +191,8 @@ func (s *HTTPSource) Run(ctx context.Context) error {
slogc.FineDefault("error writing proxy server error", "err", err)
}
default:
if _, err := fmt.Fprintf(w, "[source %s] %v", endpoint, err); err != nil {
slog.Log(context.Background(), slog.LevelInfo, "source dial failed", "err", err)
if _, err := fmt.Fprintf(w, "[source %s] failed to dial destination (check logs)", endpoint); err != nil {
slogc.FineDefault("error writing proxy server error", "err", err)
}
}
Expand Down