diff options
| author | Grant Limberg <[email protected]> | 2023-07-18 14:10:31 -0400 |
|---|---|---|
| committer | GitHub <[email protected]> | 2023-07-18 14:10:31 -0400 |
| commit | 5a36b315a3a66b827bfede27b98f414047ac14da (patch) | |
| tree | cce352db33f5b6782a0a8d5eb9df5c8625d57ffb /node | |
| parent | b67cd2cf7a46f5332c55b9a11b916ee68b35267f (diff) | |
Exit if loading an invalid identity from disk (#2058)
* Exit if loading an invalid identity from disk
Previously, if an invalid identity was loaded from disk, ZeroTier would
generate a new identity & chug along and generate a brand new identity
as if nothing happened. When running in containers, this introduces the
possibility for key matter loss; especially when running in containers
where the identity files are mounted in the container read only. In
this case, ZT will continue chugging along with a brand new identity
with no possibility of recovering the private key.
ZeroTier should exit upon loading of invalid identity.public/identity.secret #2056
* add validation test for #2056
Diffstat (limited to 'node')
| -rw-r--r-- | node/Constants.hpp | 1 | ||||
| -rw-r--r-- | node/Node.cpp | 6 |
2 files changed, 6 insertions, 1 deletions
diff --git a/node/Constants.hpp b/node/Constants.hpp index ba302675..32492293 100644 --- a/node/Constants.hpp +++ b/node/Constants.hpp @@ -687,6 +687,7 @@ #define ZT_EXCEPTION_OUT_OF_MEMORY 101 #define ZT_EXCEPTION_PRIVATE_KEY_REQUIRED 102 #define ZT_EXCEPTION_INVALID_ARGUMENT 103 +#define ZT_EXCEPTION_INVALID_IDENTITY 104 #define ZT_EXCEPTION_INVALID_SERIALIZED_DATA_INVALID_TYPE 200 #define ZT_EXCEPTION_INVALID_SERIALIZED_DATA_OVERFLOW 201 #define ZT_EXCEPTION_INVALID_SERIALIZED_DATA_INVALID_CRYPTOGRAPHIC_TOKEN 202 diff --git a/node/Node.cpp b/node/Node.cpp index 8da39700..9b748c6d 100644 --- a/node/Node.cpp +++ b/node/Node.cpp @@ -80,7 +80,11 @@ Node::Node(void *uptr,void *tptr,const struct ZT_Node_Callbacks *callbacks,int64 RR->identity.toString(false,RR->publicIdentityStr); RR->identity.toString(true,RR->secretIdentityStr); } else { - n = -1; + throw ZT_EXCEPTION_INVALID_IDENTITY; + } + + if (!RR->identity.locallyValidate()) { + throw ZT_EXCEPTION_INVALID_IDENTITY; } } |