diff --git a/src/msg/fbuf/p2pmsg_conversion.cpp b/src/msg/fbuf/p2pmsg_conversion.cpp index 0d2d2679..f1a6503f 100644 --- a/src/msg/fbuf/p2pmsg_conversion.cpp +++ b/src/msg/fbuf/p2pmsg_conversion.cpp @@ -52,10 +52,19 @@ namespace msg::fbuf::p2pmsg return p2p::peer_message_info{p2p_msg, p2p_msg->content_type(), p2p_msg->created_on()}; } - bool verify_proposal_msg_signature(const p2p::peer_message_info &mi) + bool verify_proposal_msg_trust(const p2p::peer_message_info &mi) { const auto &msg = *mi.p2p_msg->content_as_ProposalMsg(); + std::string_view pubkey = flatbuf_bytes_to_sv(msg.pubkey()); + + // Before verifying the hash, Validate if the message is from a trusted node. + if (!unl::exists(std::string(pubkey))) + { + LOG_DEBUG << "Peer proposal message pubkey verification failed. Not in UNL."; + return false; + } + // Get hash of proposal data field values and verify the signature against the hash. flatbuf_hasher hasher; hasher.add(msg.stage()); @@ -71,19 +80,28 @@ namespace msg::fbuf::p2pmsg hasher.add(msg.last_primary_shard_id()); hasher.add(msg.last_blob_shard_id()); - return crypto::verify(hasher.hash(), flatbuf_bytes_to_sv(msg.sig()), flatbuf_bytes_to_sv(msg.pubkey())) == 0; + return crypto::verify(hasher.hash(), flatbuf_bytes_to_sv(msg.sig()), pubkey) == 0; } - bool verify_npl_msg_signature(const p2p::peer_message_info &mi) + bool verify_npl_msg_trust(const p2p::peer_message_info &mi) { const auto &msg = *mi.p2p_msg->content_as_NplMsg(); + std::string_view pubkey = flatbuf_bytes_to_sv(msg.pubkey()); + + // Before verifying the hash, Validate if the message is from a trusted node. + if (!unl::exists(std::string(pubkey))) + { + LOG_INFO << "Peer npl message pubkey verification failed. Not in UNL."; + return false; + } + // Get hash of npl message field values and verify the signature against the hash. flatbuf_hasher hasher; hasher.add(msg.data()); hasher.add(msg.lcl_id()); - return crypto::verify(hasher.hash(), flatbuf_bytes_to_sv(msg.sig()), flatbuf_bytes_to_sv(msg.pubkey())) == 0; + return crypto::verify(hasher.hash(), flatbuf_bytes_to_sv(msg.sig()), pubkey) == 0; } const p2p::peer_challenge create_peer_challenge_from_msg(const p2p::peer_message_info &mi) diff --git a/src/msg/fbuf/p2pmsg_conversion.hpp b/src/msg/fbuf/p2pmsg_conversion.hpp index 371bc0c2..b62e20b2 100644 --- a/src/msg/fbuf/p2pmsg_conversion.hpp +++ b/src/msg/fbuf/p2pmsg_conversion.hpp @@ -15,9 +15,9 @@ namespace msg::fbuf::p2pmsg const p2p::peer_message_info get_peer_message_info(std::string_view message); - bool verify_proposal_msg_signature(const p2p::peer_message_info &mi); + bool verify_proposal_msg_trust(const p2p::peer_message_info &mi); - bool verify_npl_msg_signature(const p2p::peer_message_info &mi); + bool verify_npl_msg_trust(const p2p::peer_message_info &mi); const p2p::peer_challenge create_peer_challenge_from_msg(const p2p::peer_message_info &mi); diff --git a/src/p2p/peer_comm_server.cpp b/src/p2p/peer_comm_server.cpp index adcb282d..d772ffd4 100644 --- a/src/p2p/peer_comm_server.cpp +++ b/src/p2p/peer_comm_server.cpp @@ -200,8 +200,13 @@ namespace p2p { if (connected_status_check_counter == 600) { - // One is added to session list size to reflect the loop back connection. - const bool current_state = (sessions.size() + 1) < (unl::count() * WEAKLY_CONNECTED_THRESHOLD); + // Get the count of peers which are unl nodes. + // One is added to session list size only if we are a unl node, to reflect the self connection. + const int connected_peer_count = std::count_if(sessions.begin(), sessions.end(), [](const p2p::peer_comm_session &session) { + return session.is_unl; + }) + + (conf::cfg.node.is_unl ? 1 : 0); + const bool current_state = connected_peer_count < (unl::count() * WEAKLY_CONNECTED_THRESHOLD); if (is_weakly_connected != current_state) { is_weakly_connected = !is_weakly_connected; diff --git a/src/p2p/peer_session_handler.cpp b/src/p2p/peer_session_handler.cpp index e9760463..ca5e58e6 100644 --- a/src/p2p/peer_session_handler.cpp +++ b/src/p2p/peer_session_handler.cpp @@ -154,7 +154,7 @@ namespace p2p } else if (mi.type == p2pmsg::P2PMsgContent_ProposalMsg) { - if (!p2pmsg::verify_proposal_msg_signature(mi)) + if (!p2pmsg::verify_proposal_msg_trust(mi)) { session.increment_metric(comm::SESSION_THRESHOLDS::MAX_BADSIGMSGS_PER_MINUTE, 1); LOG_DEBUG << "Proposal rejected due to trust failure. " << session.display_name(); @@ -165,7 +165,7 @@ namespace p2p } else if (mi.type == p2pmsg::P2PMsgContent_NplMsg) { - if (!p2pmsg::verify_npl_msg_signature(mi)) + if (!p2pmsg::verify_npl_msg_trust(mi)) { session.increment_metric(comm::SESSION_THRESHOLDS::MAX_BADSIGMSGS_PER_MINUTE, 1); LOG_DEBUG << "Npl message rejected due to trust failure. " << session.display_name();