nik/bitchat
1
0
Fork 0
mirror of https://github.com/permissionlesstech/bitchat.git synced 2026-08-29 07:27:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #955 from permissionlesstech/fix/topology-update-after-verification

Browse Source 
Fix topology update running before announce verification
This commit is contained in:
jack 2026-01-12 18:39:56 -10:00 committed by GitHub
commit 342eabbc00
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
bitchat/Services/BLE/BLEService.swift
View File

@ -3580,11 +3580,6 @@ extension BLEService {
return
}
// Update topology with their claimed neighbors
if let neighbors = announcement.directNeighbors {
meshTopology.updateNeighbors(for: peerID.routingData, neighbors: neighbors)
}
// Verify that the sender's derived ID from the announced noise public key matches the packet senderID
// This helps detect relayed or spoofed announces. Only warn in release; assert in debug.
let derivedFromKey = PeerID(publicKey: announcement.noisePublicKey)
@ -3657,6 +3652,9 @@ extension BLEService {
// Require verified announce; ignore otherwise (no backward compatibility)
if !verified {
SecureLogger.warning("❌ Ignoring unverified announce from \(peerID.id.prefix(8))…", category: .security)
// Reset flags to prevent post-barrier code from acting on unverified announces
isNewPeer = false
isReconnectedPeer = false
return
}
@ -3704,6 +3702,11 @@ extension BLEService {
}
}
// Update topology with verified neighbor claims (only for authenticated announces)
if verifiedAnnounce, let neighbors = announcement.directNeighbors {
meshTopology.updateNeighbors(for: peerID.routingData, neighbors: neighbors)
}
// Persist cryptographic identity and signing key for robust offline verification
identityManager.upsertCryptographicIdentity(
fingerprint: announcement.noisePublicKey.sha256Fingerprint(),