ExternalVendorCode/ZeroTierOne
1
0
Fork 0
mirror of https://github.com/zerotier/ZeroTierOne.git synced 2025-06-16 14:18:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add a bit of hardening in the network certificate of membership by incorporating a full hash of the identity to which it is issued. This means the recipient need not depend entirely on the root verifying identities properly to make sure impersonation is not occurring.

Browse Source
This commit is contained in:
Adam Ierymenko
2021-09-20 18:26:49 -04:00
parent 39b97f9163
commit 7c3166e9be
7 changed files with 78 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
selftest.cpp
View File

@ -561,8 +561,8 @@ static int testCertificate()
std::cout << idA.address().toString(buf) << ", " << idB.address().toString(buf) << std::endl;
std::cout << "[certificate] Generating certificates A and B...";
CertificateOfMembership cA(10000,100,1,idA.address());
CertificateOfMembership cB(10099,100,1,idB.address());
CertificateOfMembership cA(10000,100,1,idA);
CertificateOfMembership cB(10099,100,1,idB);
std::cout << std::endl;
std::cout << "[certificate] Signing certificates A and B with authority...";
@ -574,13 +574,13 @@ static int testCertificate()
//std::cout << "[certificate] B: " << cB.toString() << std::endl;
std::cout << "[certificate] A agrees with B and B with A... ";
if (cA.agreesWith(cB))
if (cA.agreesWith(cB, idB))
std::cout << "yes, ";
else {
std::cout << "FAIL" << std::endl;
return -1;
}
if (cB.agreesWith(cA))
if (cB.agreesWith(cA, idA))
std::cout << "yes." << std::endl;
else {
std::cout << "FAIL" << std::endl;
@ -588,18 +588,18 @@ static int testCertificate()
}
std::cout << "[certificate] Generating two certificates that should not agree...";
cA = CertificateOfMembership(10000,100,1,idA.address());
cB = CertificateOfMembership(10101,100,1,idB.address());
cA = CertificateOfMembership(10000,100,1,idA);
cB = CertificateOfMembership(10101,100,1,idB);
std::cout << std::endl;
std::cout << "[certificate] A agrees with B and B with A... ";
if (!cA.agreesWith(cB))
if (!cA.agreesWith(cB, idB))
std::cout << "no, ";
else {
std::cout << "FAIL" << std::endl;
return -1;
}
if (!cB.agreesWith(cA))
if (!cB.agreesWith(cA, idA))
std::cout << "no." << std::endl;
else {
std::cout << "FAIL" << std::endl;