AGentooCat/i2p.i2p
1
0
Fork 0
forked from I2P_Developers/i2p.i2p
Code Issues Pull Requests Packages Projects Releases Wiki Activity

NetDB: Disallow RSA for RI or LS

Browse Source
This commit is contained in:
zzz
2016-10-21 18:21:12 +00:00
parent f5f411b62f
commit 71f7c712cd
2 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
core/java/src/net/i2p/data/DatabaseEntry.java
View File

@@ -13,6 +13,8 @@ import java.util.Arrays;
import net.i2p.I2PAppContext; import net.i2p.I2PAppContext;
import net.i2p.crypto.DSAEngine; import net.i2p.crypto.DSAEngine;
import net.i2p.crypto.SigAlgo;
import net.i2p.crypto.SigType;
/** /**
*<p> *<p>
@@ -206,6 +208,12 @@ public abstract class DatabaseEntry extends DataStructureImpl {
if (data == null) if (data == null)
return false; return false;
// if the data is non-null the SPK will be non-null // if the data is non-null the SPK will be non-null
return DSAEngine.getInstance().verifySignature(_signature, data, getSigningPublicKey()); SigningPublicKey spk = getSigningPublicKey();
SigType type = spk.getType();
// As of 0.9.28, disallow RSA as it's so slow it could be
// used as a DoS
if (type == null || type.getBaseAlgorithm() == SigAlgo.RSA)
return false;
return DSAEngine.getInstance().verifySignature(_signature, data, spk);
} }
} }

3
router/java/src/net/i2p/router/networkdb/kademlia/KademliaNetworkDatabaseFacade.java
View File

@@ -19,6 +19,7 @@ import java.util.Iterator;
import java.util.Map; import java.util.Map;
import java.util.Set; import java.util.Set;
import net.i2p.crypto.SigAlgo;
import net.i2p.crypto.SigType; import net.i2p.crypto.SigType;
import net.i2p.data.Certificate; import net.i2p.data.Certificate;
import net.i2p.data.DatabaseEntry; import net.i2p.data.DatabaseEntry;
@@ -1080,7 +1081,7 @@ public class KademliaNetworkDatabaseFacade extends NetworkDatabaseFacade {
try { try {
KeyCertificate kc = c.toKeyCertificate(); KeyCertificate kc = c.toKeyCertificate();
SigType type = kc.getSigType(); SigType type = kc.getSigType();
if (type == null || !type.isAvailable()) { if (type == null || !type.isAvailable() || type.getBaseAlgorithm() == SigAlgo.RSA) {
failPermanently(d); failPermanently(d);
String stype = (type != null) ? type.toString() : Integer.toString(kc.getSigTypeCode()); String stype = (type != null) ? type.toString() : Integer.toString(kc.getSigTypeCode());
if (_log.shouldLog(Log.WARN)) if (_log.shouldLog(Log.WARN))