security(handshake): #34 anti-replay baseline is in-memory only — a restarted responder accepts one stale Init and learns endpoint from it #104
Labels
No labels
bug
documentation
duplicate
enhancement
good first issue
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
femboy/yip#104
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
accept_fresh_init treats last_accepted_init_ts==None as always-fresh (bin/yipd/src/peer_manager.rs:1686) and never persists it. After a responder restart the baseline is None, so the first Init — including a captured stale one replayed off-path — is accepted and the cold-start arm learns endpoint=src from it (transient session-build + endpoint-hijack window; the replayer can't complete Noise-IK, so it self-heals on the next genuine fresh Init). Fix: an explicit boot-time floor on the baseline (no accepted Init may be older than this responder's boot time). Same family as the reg_seq wall-clock fix.
See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.