From f190df862189d9fa5019890df1a5aa68e3ce9d2d Mon Sep 17 00:00:00 2001 From: Adam Ierymenko Date: Wed, 25 Sep 2024 20:12:19 -0400 Subject: [PATCH] Restrict usage to when encryption is not active. --- node/Packet.cpp | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/node/Packet.cpp b/node/Packet.cpp index 99100c69..4ccdef63 100644 --- a/node/Packet.cpp +++ b/node/Packet.cpp @@ -1071,6 +1071,7 @@ void Packet::armor(const void *key,bool encryptPayload,bool extendedArmor,const } } + /* NOTE: this is currently only ever used with NONE encryption for HELLO packets. */ if (extendedArmor) { ECC::Pair ephemeralKeyPair = ECC::generate(); uint8_t ephemeralSymmetric[32]; @@ -1088,9 +1089,10 @@ void Packet::armor(const void *key,bool encryptPayload,bool extendedArmor,const bool Packet::dearmor(const void *key,const AES aesKeys[2],const Identity &identity) { uint8_t *const data = reinterpret_cast(unsafeData()); + const unsigned int cs = cipher(); - if (extendedArmor()) { - if (size() < ZT_ECC_EPHEMERAL_PUBLIC_KEY_LEN) { + if (extendedArmor() && (cs == ZT_PROTO_CIPHER_SUITE__C25519_POLY1305_NONE)) { + if (size() < (ZT_PACKET_IDX_VERB + 1 + ZT_ECC_EPHEMERAL_PUBLIC_KEY_LEN)) { return false; } uint8_t ephemeralSymmetric[32]; @@ -1112,7 +1114,6 @@ bool Packet::dearmor(const void *key,const AES aesKeys[2],const Identity &identi const unsigned int payloadLen = size() - ZT_PACKET_IDX_VERB; unsigned char *const payload = data + ZT_PACKET_IDX_VERB; - const unsigned int cs = cipher(); if (cs == ZT_PROTO_CIPHER_SUITE__AES_GMAC_SIV) { if (aesKeys) {