security(mesh): resolver probes the unauthenticated PeerInfo.reflexive while verifying+discarding the record's signed endpoints; PunchTo has no record gate #102

New issue

Open

opened 2026-07-25 21:53:58 +00:00 by vxfemboy · 0 comments

vxfemboy commented

2026-07-25 21:53:58 +00:00

(Migrated from github.com)

on_rdv verifies r.node_id == node && verify_record(r) (bin/yipd/src/peer_manager.rs:1022) but then probes PeerInfo.reflexive — the UNSIGNED field — and never uses the record's SIGNED endpoints. A malicious/compromised rendezvous answers Lookup(Y) with Y's genuine record + any reflexive it likes, steering Y's probes anywhere. PunchTo is worse: no record gate at all, and it calls begin_handshake when Idle, with reflexive filled from an unauthenticated Lookup source — a reflection/probe-steering primitive. Bounded by Noise-IK (wrong address just fails to authenticate), so probe-steering/reflection/connection-DoS, not impersonation. Fix: when a verified record is present, restrict/intersect the probe target to record.endpoints; treat reflexive as an extra candidate only. Sharper cousin of the mesh record-less PeerInfo follow-up noted in #100.

See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.

on_rdv verifies `r.node_id == node && verify_record(r)` (bin/yipd/src/peer_manager.rs:1022) but then probes `PeerInfo.reflexive` — the UNSIGNED field — and never uses the record's SIGNED `endpoints`. A malicious/compromised rendezvous answers Lookup(Y) with Y's genuine record + any reflexive it likes, steering Y's probes anywhere. `PunchTo` is worse: no record gate at all, and it calls begin_handshake when Idle, with reflexive filled from an unauthenticated Lookup source — a reflection/probe-steering primitive. Bounded by Noise-IK (wrong address just fails to authenticate), so probe-steering/reflection/connection-DoS, not impersonation. Fix: when a verified record is present, restrict/intersect the probe target to `record.endpoints`; treat reflexive as an extra candidate only. Sharper cousin of the mesh record-less PeerInfo follow-up noted in #100. See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.