Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

dkg/bcast: exchange full messages #2798

Merged
merged 5 commits into from
Jan 22, 2024
Merged

Conversation

gsora
Copy link
Collaborator

@gsora gsora commented Jan 17, 2024

Instead of passing around hashes, share the whole message with the target for them to validate.

category: refactor
ticket: none

Instead of passing around hashes, share the whole message with the target for them to validate.
Copy link

codecov bot commented Jan 17, 2024

Codecov Report

Attention: 25 lines in your changes are missing coverage. Please review.

Comparison is base (61b0df4) 0.00% compared to head (9fbf05c) 53.28%.
Report is 9 commits behind head on main.

❗ Current head 9fbf05c differs from pull request most recent head f96bd54. Consider uploading reports for the commit f96bd54 to get more accurate results

Files Patch % Lines
dkg/bcast/server.go 66.66% 6 Missing and 4 partials ⚠️
dkg/frostp2p.go 69.69% 7 Missing and 3 partials ⚠️
dkg/nodesigs.go 62.50% 2 Missing and 1 partial ⚠️
dkg/dkg.go 50.00% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff            @@
##           main    #2798       +/-   ##
=========================================
+ Coverage      0   53.28%   +53.28%     
=========================================
  Files         0      199      +199     
  Lines         0    27669    +27669     
=========================================
+ Hits          0    14744    +14744     
- Misses        0    11096    +11096     
- Partials      0     1829     +1829     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

dkg/bcast/impl_test.go Outdated Show resolved Hide resolved
dkg/bcast/server.go Show resolved Hide resolved
dkg/bcast/server.go Show resolved Hide resolved
dkg/dkgpb/v1/bcast.proto Show resolved Hide resolved
dkg/frostp2p.go Show resolved Hide resolved

target := targetFn(messageID)

err := msgAny.UnmarshalTo(target)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is still an incomplete solution as a malicious peer can still broadcast a malformed message in the correct pb.FrostRount1Casts. They can still be able to get the sign on this data from other peers.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

They don't control the input anymore though, i.e. it's not just a slice of bytes.

What do you suggest we check?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure if we can check each field in pb.FrostRound1Cast

Copy link
Contributor

@dB2510 dB2510 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

dkg/bcast/server.go Outdated Show resolved Hide resolved
@gsora gsora added the merge when ready Indicates bulldozer bot may merge when all checks pass label Jan 22, 2024
Copy link

sonarcloud bot commented Jan 22, 2024

Quality Gate Passed Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarCloud

@obol-bulldozer obol-bulldozer bot merged commit 77050fc into main Jan 22, 2024
11 checks passed
@obol-bulldozer obol-bulldozer bot deleted the gsora/rel-broad-full-msg branch January 22, 2024 09:11
gsora added a commit that referenced this pull request Jan 24, 2024
Instead of passing around hashes, share the whole message with the target for them to validate.


category: refactor
ticket: none
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
merge when ready Indicates bulldozer bot may merge when all checks pass qs-audit v0.19.1
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants