commit 9efbd441891299ea2cc8007c26475bba9300479f
author Adrien Béraud <adrien.beraud@savoirfairelinux.com> Sun Aug 27 12:38:07 2023 -0400
committer Adrien Béraud <adrien.beraud@savoirfairelinux.com> Sun Aug 27 12:44:39 2023 -0400
tree bbc417efa3f8f22d508829efeb815030eee088a4
parent 24cc01e3deacb1332745929840268af06ebe9068

ConnectionManager: check that request owner matches TLS certificate

Change-Id: I27cf22e66a4c86742b022136d036ca77c25dc724

src/connectionmanager.cpp

diff --git a/src/connectionmanager.cpp b/src/connectionmanager.cpp
index 1ca85e7..baab5af 100644
--- a/src/connectionmanager.cpp
+++ b/src/connectionmanager.cpp
@@ -1124,10 +1124,17 @@
         config_->ioContext,
         identity(),
         dhParams(),
-        [ph, w = weak()](const dht::crypto::Certificate& cert) {
+        [ph, deviceId, w=weak(), l=config_->logger](const dht::crypto::Certificate& cert) {
             auto shared = w.lock();
             if (!shared)
                 return false;
+            if (cert.getPublicKey().getId() != ph
+             || deviceId != cert.getPublicKey().getLongId()) {
+                if (l) l->warn("[device {}] TLS certificate with ID {} doesn't match the DHT request.",
+                                        deviceId,
+                                        cert.getPublicKey().getLongId());
+                return false;
+            }
             auto crt = shared->certStore().getCertificate(cert.getLongId().toString());
             if (!crt)
                 return false;