@libp2p/gossipsub 16.0.4-fb9e8a76e → 16.0.4-ff9e5fc7c

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.min.js +1 -1
  2. package/dist/index.min.js.map +3 -3
  3. package/dist/src/utils/buildRawMessage.d.ts.map +1 -1
  4. package/dist/src/utils/buildRawMessage.js +22 -5
  5. package/dist/src/utils/buildRawMessage.js.map +1 -1
  6. package/package.json +9 -9
  7. package/src/utils/buildRawMessage.ts +22 -5
package/dist/src/utils/buildRawMessage.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"buildRawMessage.d.ts","sourceRoot":"","sources":["../../../src/utils/buildRawMessage.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAqB,aAAa,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAG1D,eAAO,MAAM,UAAU,yBAAyC,CAAA;AAgBhE,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAA;IAChB,GAAG,EAAE,OAAO,CAAA;CACb;AAED,wBAAsB,eAAe,CACnC,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,QAAQ,EACf,YAAY,EAAE,UAAU,EACxB,eAAe,EAAE,UAAU,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAuD/B;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAA;AAEzG,wBAAsB,oBAAoB,CACxC,eAAe,EAAE,OAAO,YAAY,GAAG,OAAO,UAAU,EACxD,GAAG,EAAE,GAAG,CAAC,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAqF3B"}
1
+ {"version":3,"file":"buildRawMessage.d.ts","sourceRoot":"","sources":["../../../src/utils/buildRawMessage.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAqB,aAAa,EAAE,MAAM,aAAa,CAAA;AAC9D,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAG1D,eAAO,MAAM,UAAU,yBAAyC,CAAA;AAgBhE,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAA;IAChB,GAAG,EAAE,OAAO,CAAA;CACb;AAED,wBAAsB,eAAe,CACnC,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,QAAQ,EACf,YAAY,EAAE,UAAU,EACxB,eAAe,EAAE,UAAU,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAuD/B;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAA;AAEzG,wBAAsB,oBAAoB,CACxC,eAAe,EAAE,OAAO,YAAY,GAAG,OAAO,UAAU,EACxD,GAAG,EAAE,GAAG,CAAC,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAsG3B"}
package/dist/src/utils/buildRawMessage.js CHANGED
@@ -116,9 +116,16 @@ export async function validateToRawMessage(signaturePolicy, msg) {
116
116
  // - verify sig
117
117
  let publicKey;
118
118
  if (msg.key != null) {
119
- publicKey = publicKeyFromProtobuf(msg.key);
120
- // TODO: Should `fromPeerId.pubKey` be optional?
121
- if (fromPeerId.publicKey !== undefined && !publicKey.equals(fromPeerId.publicKey)) {
119
+ // malformed key bytes must reject rather than throw, so an attacker
120
+ // sending them is still scored as delivering an invalid message
121
+ try {
122
+ publicKey = publicKeyFromProtobuf(msg.key);
123
+ }
124
+ catch {
125
+ return { valid: false, error: ValidateError.InvalidPeerId };
126
+ }
127
+ // the message key must derive to the `from` peer id
128
+ if (!fromPeerId.equals(publicKey.toMultihash().bytes)) {
122
129
  return { valid: false, error: ValidateError.InvalidPeerId };
123
130
  }
124
131
  }
@@ -139,7 +146,17 @@ export async function validateToRawMessage(signaturePolicy, msg) {
139
146
  // Get the message in bytes, and prepend with the pubsub prefix
140
147
  // the signature is over the bytes "libp2p-pubsub:<protobuf-message>"
141
148
  const bytes = uint8ArrayConcat([SignPrefix, RPC.Message.encode(rpcMsgPreSign)]);
142
- if (!(await publicKey.verify(bytes, msg.signature))) {
149
+ // a malformed signature (e.g. the wrong length) makes verify throw for
150
+ // some key types; treat that as an invalid signature so the peer is still
151
+ // scored rather than the message escaping to the unscored error path
152
+ let validSignature;
153
+ try {
154
+ validSignature = await publicKey.verify(bytes, msg.signature);
155
+ }
156
+ catch {
157
+ validSignature = false;
158
+ }
159
+ if (!validSignature) {
143
160
  return { valid: false, error: ValidateError.InvalidSignature };
144
161
  }
145
162
  return {
@@ -151,7 +168,7 @@ export async function validateToRawMessage(signaturePolicy, msg) {
151
168
  sequenceNumber: BigInt(`0x${uint8ArrayToString(msg.seqno, 'base16')}`),
152
169
  topic: msg.topic,
153
170
  signature: msg.signature,
154
- key: msg.key != null ? publicKeyFromProtobuf(msg.key) : publicKey
171
+ key: publicKey
155
172
  }
156
173
  };
157
174
  }
package/dist/src/utils/buildRawMessage.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"buildRawMessage.js","sourceRoot":"","sources":["../../../src/utils/buildRawMessage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,KAAK,MAAM,MAAM,4BAA4B,CAAA;AACpD,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAK9D,MAAM,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAA;AAEhE,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAC9E,+CAA+C;AAC/C,IAAI,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,QAAU,CAAA;AAElD,SAAS,SAAS;IAChB,MAAM,CAAC,GAAG,EAAE,YAAY,CAAA;IACxB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IAClD,OAAO,GAAG,CAAA;AACZ,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,KAAe,EACf,YAAwB,EACxB,eAA2B;IAE3B,QAAQ,aAAa,CAAC,IAAI,EAAE,CAAC;QAC3B,KAAK,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAgB;gBAC1B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK;gBAC9C,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,SAAS,EAAE;gBAClB,KAAK;gBACL,SAAS,EAAE,SAAS,EAAE,sCAAsC;gBAC5D,GAAG,EAAE,SAAS,CAAC,gCAAgC;aAChD,CAAA;YAED,+DAA+D;YAC/D,qEAAqE;YACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YAExE,MAAM,CAAC,SAAS,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC7D,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAA;YAE9B,MAAM,GAAG,GAAY;gBACnB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,aAAa,CAAC,MAAM;gBAC1B,IAAI,EAAE,YAAY;gBAClB,cAAc,EAAE,MAAM,CAAC,KAAK,kBAAkB,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC9F,KAAK;gBACL,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,GAAG,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC;aACvC,CAAA;YACD,OAAO;gBACL,GAAG,EAAE,MAAM;gBACX,GAAG;aACJ,CAAA;QACH,CAAC;QAED,KAAK,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;YACjC,OAAO;gBACL,GAAG,EAAE;oBACH,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,SAAS;oBAChB,KAAK;oBACL,SAAS,EAAE,SAAS;oBACpB,GAAG,EAAE,SAAS;iBACf;gBACD,GAAG,EAAE;oBACH,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,YAAY;oBAClB,KAAK;iBACN;aACF,CAAA;QACH,CAAC;QAED;YACE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,eAAwD,EACxD,GAAgB;IAEhB,6BAA6B;IAC7B,2CAA2C;IAE3C,QAAQ,eAAe,EAAE,CAAC;QACxB,KAAK,YAAY;YACf,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,gBAAgB,EAAE,CAAA;YAAC,CAAC;YAC7F,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE,CAAA;YAAC,CAAC;YACrF,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE,CAAA;YAAC,CAAC;YAElF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QAE9G,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,eAAe;YACf,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE,CAAA;YAAC,CAAC;YACrF,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE,CAAA;YAC5D,CAAC;YAED,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,gBAAgB,EAAE,CAAA;YAAC,CAAC;YAC7F,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,EAAE,CAAA;YAAC,CAAC;YAErF,IAAI,UAAkB,CAAA;YACtB,IAAI,CAAC;gBACH,yBAAyB;gBACzB,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,EAAE,CAAA;YAC7D,CAAC;YAED,uBAAuB;YACvB,+BAA+B;YAC/B,oBAAoB;YACpB,+BAA+B;YAC/B,mCAAmC;YACnC,eAAe;YAEf,IAAI,SAAoB,CAAA;YACxB,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBACpB,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAC1C,gDAAgD;gBAChD,IAAI,UAAU,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;oBAClF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,EAAE,CAAA;gBAC7D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,UAAU,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;oBACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,EAAE,CAAA;gBAC7D,CAAC;gBACD,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;YAClC,CAAC;YAED,MAAM,aAAa,GAAgB;gBACjC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,SAAS,EAAE,SAAS,EAAE,sCAAsC;gBAC5D,GAAG,EAAE,SAAS,CAAC,gCAAgC;aAChD,CAAA;YAED,+DAA+D;YAC/D,qEAAqE;YACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;YAE/E,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;gBACpD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,gBAAgB,EAAE,CAAA;YAChE,CAAC;YAED,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC;oBACnC,cAAc,EAAE,MAAM,CAAC,KAAK,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACtE,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS;iBAClE;aACF,CAAA;QACH,CAAC;QAED;YACE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IAClC,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"buildRawMessage.js","sourceRoot":"","sources":["../../../src/utils/buildRawMessage.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAA;AAC3D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AACrD,OAAO,KAAK,MAAM,MAAM,4BAA4B,CAAA;AACpD,OAAO,EAAE,MAAM,IAAI,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAC/D,OAAO,EAAE,UAAU,IAAI,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AAC5E,OAAO,EAAE,QAAQ,IAAI,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACtE,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AACvC,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AAK9D,MAAM,CAAC,MAAM,UAAU,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAA;AAEhE,8EAA8E;AAC9E,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAC9E,+CAA+C;AAC/C,IAAI,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,QAAU,CAAA;AAElD,SAAS,SAAS;IAChB,MAAM,CAAC,GAAG,EAAE,YAAY,CAAA;IACxB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;IAC7B,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAA;IAClD,OAAO,GAAG,CAAA;AACZ,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAA4B,EAC5B,KAAe,EACf,YAAwB,EACxB,eAA2B;IAE3B,QAAQ,aAAa,CAAC,IAAI,EAAE,CAAC;QAC3B,KAAK,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC/B,MAAM,MAAM,GAAgB;gBAC1B,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK;gBAC9C,IAAI,EAAE,eAAe;gBACrB,KAAK,EAAE,SAAS,EAAE;gBAClB,KAAK;gBACL,SAAS,EAAE,SAAS,EAAE,sCAAsC;gBAC5D,GAAG,EAAE,SAAS,CAAC,gCAAgC;aAChD,CAAA;YAED,+DAA+D;YAC/D,qEAAqE;YACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;YAExE,MAAM,CAAC,SAAS,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAC7D,MAAM,CAAC,GAAG,GAAG,aAAa,CAAC,GAAG,CAAA;YAE9B,MAAM,GAAG,GAAY;gBACnB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,aAAa,CAAC,MAAM;gBAC1B,IAAI,EAAE,YAAY;gBAClB,cAAc,EAAE,MAAM,CAAC,KAAK,kBAAkB,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;gBAC9F,KAAK;gBACL,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,GAAG,EAAE,qBAAqB,CAAC,MAAM,CAAC,GAAG,CAAC;aACvC,CAAA;YACD,OAAO;gBACL,GAAG,EAAE,MAAM;gBACX,GAAG;aACJ,CAAA;QACH,CAAC;QAED,KAAK,iBAAiB,CAAC,SAAS,CAAC,CAAC,CAAC;YACjC,OAAO;gBACL,GAAG,EAAE;oBACH,IAAI,EAAE,SAAS;oBACf,IAAI,EAAE,eAAe;oBACrB,KAAK,EAAE,SAAS;oBAChB,KAAK;oBACL,SAAS,EAAE,SAAS;oBACpB,GAAG,EAAE,SAAS;iBACf;gBACD,GAAG,EAAE;oBACH,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,YAAY;oBAClB,KAAK;iBACN;aACF,CAAA;QACH,CAAC;QAED;YACE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IAClC,CAAC;AACH,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,eAAwD,EACxD,GAAgB;IAEhB,6BAA6B;IAC7B,2CAA2C;IAE3C,QAAQ,eAAe,EAAE,CAAC;QACxB,KAAK,YAAY;YACf,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,gBAAgB,EAAE,CAAA;YAAC,CAAC;YAC7F,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE,CAAA;YAAC,CAAC;YACrF,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,WAAW,EAAE,CAAA;YAAC,CAAC;YAElF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,CAAA;QAE9G,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,eAAe;YACf,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE,CAAA;YAAC,CAAC;YACrF,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,YAAY,EAAE,CAAA;YAC5D,CAAC;YAED,IAAI,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,gBAAgB,EAAE,CAAA;YAAC,CAAC;YAC7F,IAAI,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,CAAC;gBAAC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,EAAE,CAAA;YAAC,CAAC;YAErF,IAAI,UAAkB,CAAA;YACtB,IAAI,CAAC;gBACH,yBAAyB;gBACzB,UAAU,GAAG,mBAAmB,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;YAC3D,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,EAAE,CAAA;YAC7D,CAAC;YAED,uBAAuB;YACvB,+BAA+B;YAC/B,oBAAoB;YACpB,+BAA+B;YAC/B,mCAAmC;YACnC,eAAe;YAEf,IAAI,SAAoB,CAAA;YACxB,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;gBACpB,oEAAoE;gBACpE,gEAAgE;gBAChE,IAAI,CAAC;oBACH,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;gBAC5C,CAAC;gBAAC,MAAM,CAAC;oBACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,EAAE,CAAA;gBAC7D,CAAC;gBAED,oDAAoD;gBACpD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,EAAE,CAAA;gBAC7D,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,IAAI,UAAU,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;oBACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,aAAa,EAAE,CAAA;gBAC7D,CAAC;gBACD,SAAS,GAAG,UAAU,CAAC,SAAS,CAAA;YAClC,CAAC;YAED,MAAM,aAAa,GAAgB;gBACjC,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,SAAS,EAAE,SAAS,EAAE,sCAAsC;gBAC5D,GAAG,EAAE,SAAS,CAAC,gCAAgC;aAChD,CAAA;YAED,+DAA+D;YAC/D,qEAAqE;YACrE,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;YAE/E,uEAAuE;YACvE,0EAA0E;YAC1E,qEAAqE;YACrE,IAAI,cAAuB,CAAA;YAC3B,IAAI,CAAC;gBACH,cAAc,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAA;YAC/D,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc,GAAG,KAAK,CAAA;YACxB,CAAC;YAED,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,CAAC,gBAAgB,EAAE,CAAA;YAChE,CAAC;YAED,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE;oBACP,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,IAAI,UAAU,CAAC,CAAC,CAAC;oBACnC,cAAc,EAAE,MAAM,CAAC,KAAK,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;oBACtE,KAAK,EAAE,GAAG,CAAC,KAAK;oBAChB,SAAS,EAAE,GAAG,CAAC,SAAS;oBACxB,GAAG,EAAE,SAAS;iBACf;aACF,CAAA;QACH,CAAC;QAED;YACE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAA;IAClC,CAAC;AACH,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@libp2p/gossipsub",
3
- "version": "16.0.4-fb9e8a76e",
3
+ "version": "16.0.4-ff9e5fc7c",
4
4
  "description": "A typescript implementation of gossipsub",
5
5
  "files": [
6
6
  "src",
@@ -79,11 +79,11 @@
79
79
  },
80
80
  "homepage": "https://github.com/libp2p/js-libp2p/tree/main/packages/gossipsub#readme",
81
81
  "dependencies": {
82
- "@libp2p/crypto": "5.1.21-fb9e8a76e",
83
- "@libp2p/interface": "3.2.5-fb9e8a76e",
84
- "@libp2p/interface-internal": "3.1.8-fb9e8a76e",
85
- "@libp2p/peer-id": "6.0.12-fb9e8a76e",
86
- "@libp2p/utils": "7.2.4-fb9e8a76e",
82
+ "@libp2p/crypto": "5.1.21-ff9e5fc7c",
83
+ "@libp2p/interface": "3.2.5-ff9e5fc7c",
84
+ "@libp2p/interface-internal": "3.1.8-ff9e5fc7c",
85
+ "@libp2p/peer-id": "6.0.12-ff9e5fc7c",
86
+ "@libp2p/utils": "7.2.4-ff9e5fc7c",
87
87
  "@multiformats/multiaddr": "^13.0.3",
88
88
  "denque": "^2.1.0",
89
89
  "it-length-prefixed": "^11.0.1",
@@ -96,9 +96,9 @@
96
96
  },
97
97
  "devDependencies": {
98
98
  "@chainsafe/as-sha256": "^1.2.0",
99
- "@libp2p/floodsub": "11.0.25-fb9e8a76e",
100
- "@libp2p/logger": "6.2.10-fb9e8a76e",
101
- "@libp2p/peer-store": "12.0.23-fb9e8a76e",
99
+ "@libp2p/floodsub": "11.0.25-ff9e5fc7c",
100
+ "@libp2p/logger": "6.2.10-ff9e5fc7c",
101
+ "@libp2p/peer-store": "12.0.23-ff9e5fc7c",
102
102
  "@types/benchmark": "^2.1.5",
103
103
  "@types/sinon": "^21.0.1",
104
104
  "abortable-iterator": "^5.1.0",
package/src/utils/buildRawMessage.ts CHANGED
@@ -138,9 +138,16 @@ export async function validateToRawMessage (
138
138
 
139
139
  let publicKey: PublicKey
140
140
  if (msg.key != null) {
141
- publicKey = publicKeyFromProtobuf(msg.key)
142
- // TODO: Should `fromPeerId.pubKey` be optional?
143
- if (fromPeerId.publicKey !== undefined && !publicKey.equals(fromPeerId.publicKey)) {
141
+ // malformed key bytes must reject rather than throw, so an attacker
142
+ // sending them is still scored as delivering an invalid message
143
+ try {
144
+ publicKey = publicKeyFromProtobuf(msg.key)
145
+ } catch {
146
+ return { valid: false, error: ValidateError.InvalidPeerId }
147
+ }
148
+
149
+ // the message key must derive to the `from` peer id
150
+ if (!fromPeerId.equals(publicKey.toMultihash().bytes)) {
144
151
  return { valid: false, error: ValidateError.InvalidPeerId }
145
152
  }
146
153
  } else {
@@ -163,7 +170,17 @@ export async function validateToRawMessage (
163
170
  // the signature is over the bytes "libp2p-pubsub:<protobuf-message>"
164
171
  const bytes = uint8ArrayConcat([SignPrefix, RPC.Message.encode(rpcMsgPreSign)])
165
172
 
166
- if (!(await publicKey.verify(bytes, msg.signature))) {
173
+ // a malformed signature (e.g. the wrong length) makes verify throw for
174
+ // some key types; treat that as an invalid signature so the peer is still
175
+ // scored rather than the message escaping to the unscored error path
176
+ let validSignature: boolean
177
+ try {
178
+ validSignature = await publicKey.verify(bytes, msg.signature)
179
+ } catch {
180
+ validSignature = false
181
+ }
182
+
183
+ if (!validSignature) {
167
184
  return { valid: false, error: ValidateError.InvalidSignature }
168
185
  }
169
186
 
@@ -176,7 +193,7 @@ export async function validateToRawMessage (
176
193
  sequenceNumber: BigInt(`0x${uint8ArrayToString(msg.seqno, 'base16')}`),
177
194
  topic: msg.topic,
178
195
  signature: msg.signature,
179
- key: msg.key != null ? publicKeyFromProtobuf(msg.key) : publicKey
196
+ key: publicKey
180
197
  }
181
198
  }
182
199
  }