From 30a91c84c8232bbb86de6b6406b90d45a5e2d4aa Mon Sep 17 00:00:00 2001 From: Brian Warner Date: Thu, 8 Nov 2007 14:02:36 -0700 Subject: [PATCH] mutable: verify incoming share signatures during Publish, it's not that expensive and it's a good idea --- src/allmydata/mutable.py | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/src/allmydata/mutable.py b/src/allmydata/mutable.py index 20b0429a..d7a0d669 100644 --- a/src/allmydata/mutable.py +++ b/src/allmydata/mutable.py @@ -745,11 +745,13 @@ class Publish: (seqnum, root_hash, IV, k, N, segsize, datalen, pubkey_s, signature, prefix) = r - # TODO: consider verifying the signature here. It's expensive. - # What can an attacker (in this case the server) accomplish? They - # could make us think that there's a newer version of the file - # out there, which would cause us to throw - # UncoordinatedWriteError (i.e. it's a DoS attack). + # self._pubkey is present because we require read-before-replace + valid = self._pubkey.verify(prefix, signature) + if not valid: + self.log("WEIRD: bad signature from %s shnum %d" % + (shnum, idlib.shortnodeid_b2a(peerid))) + continue + share = (shnum, seqnum, root_hash) current_share_peers.add(shnum, (peerid, seqnum, root_hash) ) -- 2.45.2