Add some sanity checking for Dht records.

nimiq · Nov 13, 2024 · 91dc023 · 91dc023
1 parent 45665ee
commit 91dc023
Show file tree

Hide file tree

Showing 2 changed files with 30 additions and 1 deletion.
diff --git a/dht/src/lib.rs b/dht/src/lib.rs
@@ -24,10 +24,31 @@ impl Verifier {
             TaggedSigned::<ValidatorRecord<PeerId>, KeyPair>::deserialize_from_vec(&record.value)
                 .map_err(DhtVerifierError::MalformedValue)?;
 
+        // Make sure the peer who signed the record is also the one presented in the record.
+        if let Some(publisher) = record.publisher {
+            if validator_record.record.peer_id != publisher {
+                return Err(DhtVerifierError::PublisherMismatch(
+                    publisher,
+                    validator_record.record.peer_id,
+                ));
+            }
+        } else {
+            log::warn!("Validating a dht record without a publisher");
+            return Err(DhtVerifierError::PublisherMissing);
+        }
+
         // Deserialize the key of the record which is an Address. If it fails return an error.
         let validator_address = Address::deserialize_from_vec(record.key.as_ref())
             .map_err(DhtVerifierError::MalformedKey)?;
 
+        // Make sure the validator address used as key is identical to the one in the record.
+        if validator_record.record.validator_address != validator_address {
+            return Err(DhtVerifierError::AddressMismatch(
+                validator_address,
+                validator_record.record.validator_address,
+            ));
+        }
+
         // Acquire blockchain read access. For now exclude Light clients.
         let blockchain = match self.blockchain {
             BlockchainProxy::Light(ref _light_blockchain) => {

diff --git a/network-libp2p/src/dht.rs b/network-libp2p/src/dht.rs
@@ -1,17 +1,25 @@
 use libp2p::{kad::Record, PeerId};
 use nimiq_keys::Address;
+use nimiq_network_interface::network::Network as NetworkInterface;
 use nimiq_serde::DeserializeError;
 use nimiq_validator_network::validator_record::ValidatorRecord;
 
 pub use crate::network_types::DhtRecord;
+use crate::Network;
 
 #[derive(Debug)]
 pub enum DhtVerifierError {
     MalformedTag,
+    UnknownTag,
     MalformedKey(DeserializeError),
     MalformedValue(DeserializeError),
-    UnknownTag,
     UnknownValidator(Address),
+    AddressMismatch(Address, Address),
+    PublisherMissing,
+    PublisherMismatch(
+        <Network as NetworkInterface>::PeerId,
+        <Network as NetworkInterface>::PeerId,
+    ),
     StateIncomplete,
     InvalidSignature,
 }