beacon: punch-grant authoritative-key verification + panic-recover hardening - #46
Merged
Merged
Conversation
…c-recover hardening Punch-grant verification now resolves the target's pubkey from the registry's authoritative index (via SetAuthoritativeKeyLookup) instead of the Discover-populated cache, and the Discover key binding is first-write-wins, so an unauthenticated Discover can no longer rebind a node's key. Adds panic-recover backstops across the UDP read/dispatch and relay paths, a nil-socket guard, a WSS auth length guard, and fuzz + attack-replay regression coverage. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The beacon UDP round-trip tests used 2-3s read deadlines and the compat WSS bridge a 30s accept budget; both flake on loaded public CI runners (pre-existing, observed on main). Widen the UDP reads to 10s and the WSS accept wait to 60s. A genuinely dropped reply still fails, just later. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the WS3 punch-token bypass and adds panic-recover coverage across the beacon's untrusted-input paths.
Punch-grant verification (Finding A)
verifyPunchGrantnow resolves the target pubkey from the registry's authoritative index via a newSetAuthoritativeKeyLookuphook (wired tor.LookupPublicKeyin the rendezvous binary), instead of the Discover-populatednodePubKeyscache.LoadOrStore), so an unauthenticated Discover can no longer rebind an existing node's key.require_punch_tokenis enabled.Panic-recover hardening
recover.go).Tests
DiscoverPubKeyOverwrite,PunchTokenBypassViaPubKeyRebind) to assert the controls now hold.-race.🤖 Generated with Claude Code