From 1fa5360a210b4b820441fdbc6f5dfbbb9eaf14f3 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 21:46:41 +0000 Subject: screen: signatures required as the policy a change came under says Review 3, R1: what a node received was vouched for only while its own document's policy required signatures. A joiner's first sync, and every node's message bringing `required`, went in by the rules alone: a malicious first peer could plant changes under other members' actors at their next seqs, their real ones then failing as duplicates for good. The signatures a message carries are always offered now, and the screen always has them: a change waits for one where the policy at the heads it is judged at requires it (rules::Reads::required, read once per heads), whatever the receiving document holds. Changes written under a policy not requiring signatures wait for none, as on every other node; the check for forged changes runs always. Changes waiting for a signature are judged again whenever signatures come. The test of signatures required now takes the history into an empty document; a new one takes changes written under a policy not requiring them without any. --- src/swarm/sync.rs | 22 +++++++++------------- 1 file changed, 9 insertions(+), 13 deletions(-) (limited to 'src/swarm/sync.rs') diff --git a/src/swarm/sync.rs b/src/swarm/sync.rs index 75c20f1..e76f5f9 100644 --- a/src/swarm/sync.rs +++ b/src/swarm/sync.rs @@ -503,7 +503,7 @@ pub(crate) async fn handle_sync( let epoch_label = epoch; // Signatures of changes (`document::signatures`): a malformed list, or more than any // sender sends, counts for nothing. - let signatures = crate::document::signatures::unpack(&envelope.signatures) + let mut signatures = crate::document::signatures::unpack(&envelope.signatures) .filter(|signatures| signatures.len() <= crate::document::signatures::MAX_PER_MESSAGE) .unwrap_or_default(); let from_ready = envelope.ready; @@ -643,21 +643,18 @@ pub(crate) async fn handle_sync( let result = (|| { // Judged first, each as the policy it was written under has it // (`access::screen`), whether this document has one yet or not; - // with signatures required, by those it sent too. - let policy = crate::access::policy::of(&*doc); + // and vouched for by the signatures it sent too, where that policy + // requires them. { let bytes = message.take_changes(); - let required = policy.required(); - if required { - known.offer(doc, signatures.clone()); - } + known.offer(doc, std::mem::take(&mut signatures)); let outcome = crate::access::screen::apply_bytes( doc, epoch, epoch_seq, &bytes, &screening, - required.then_some(&mut *known), + Some(&mut *known), log, )?; refused_again = outcome.refused_again; @@ -708,10 +705,10 @@ pub(crate) async fn handle_sync( stats.asked_known_elsewhere(asked); peer_state.asked_known += (asked.0 + asked.1) as u64; replica.refresh_heads(); - // The signatures it sent, and those waiting for what it brought. - if !signatures.is_empty() || replica.heads() != heads_before.as_slice() { + // The signatures waiting for what it brought (those it sent, offered before). + if replica.heads() != heads_before.as_slice() { let replica = &mut *replica; - replica.signatures.offer(&replica.doc, signatures); + replica.signatures.offer(&replica.doc, Vec::new()); } let heads_after = replica.heads().to_vec(); if delivered { @@ -955,7 +952,6 @@ async fn download_and_apply_delta( bail!("the epoch changed during the download"); } let heads_before = replica.heads().to_vec(); - let policy = crate::access::policy::of(&replica.doc); { // Judged first (`access::screen`), whether this document has a policy yet or // not. @@ -967,7 +963,7 @@ async fn download_and_apply_delta( epoch_seq, &bytes, &screening, - policy.required().then_some(&mut replica.signatures), + Some(&mut replica.signatures), &mut crate::document::PatchLog::inactive(), )?; } -- cgit v1.3.1