Location
crates/librefang-wire/src/peer.rs:34-91 (NonceTracker)crates/librefang-wire/src/peer.rs:264, 552
Problem
The handshake HMAC binds nonce + sender node_id but not recipient address or recipient identity. NonceTracker is per-PeerNode (each kernel has its own Arc<DashMap>). An attacker who captures peer-B's handshake bytes destined for server-X can replay those exact bytes to a different server Y in the federation — Y has never seen this nonce, the HMAC verifies (same shared_secret), Y now believes it's talking to peer-B.
After the replay, since the attacker also captured B's our_nonce (it's in the captured bytes) and the shared_secret is global, the attacker derives the post-handshake session_key and sends authenticated AgentMessage traffic to Y as "peer-B".
Impact
Single-packet capture from any LAN segment between two real peers → impersonate the captured peer to every other server in the federation.
Fix
Bind HMAC to the recipient too: include recipient_node_id in the signed material (nonce || sender_node_id || recipient_node_id). Caller must know who it's talking to and put that in the auth_data; recipient verifies its own node_id is in the auth_data. Replays to a different recipient fail HMAC.
Verified-not-duplicate-of: No existing issue covers OFP handshake replay.
Filed via automated multi-perspective audit (round 3: WASM sandbox / CI–Docker–supply chain / OFP wire + channel adapters). Curated against all 411 open issues in librefang/librefang to avoid duplicates.
Location
crates/librefang-wire/src/peer.rs:34-91(NonceTracker)crates/librefang-wire/src/peer.rs:264, 552Problem
The handshake HMAC binds nonce + sender node_id but not recipient address or recipient identity.
NonceTrackeris per-PeerNode(each kernel has its ownArc<DashMap>). An attacker who captures peer-B's handshake bytes destined for server-X can replay those exact bytes to a different server Y in the federation — Y has never seen this nonce, the HMAC verifies (same shared_secret), Y now believes it's talking to peer-B.After the replay, since the attacker also captured B's
our_nonce(it's in the captured bytes) and the shared_secret is global, the attacker derives the post-handshake session_key and sends authenticatedAgentMessagetraffic to Y as "peer-B".Impact
Single-packet capture from any LAN segment between two real peers → impersonate the captured peer to every other server in the federation.
Fix
Bind HMAC to the recipient too: include
recipient_node_idin the signed material (nonce || sender_node_id || recipient_node_id). Caller must know who it's talking to and put that in the auth_data; recipient verifies its own node_id is in the auth_data. Replays to a different recipient fail HMAC.Verified-not-duplicate-of: No existing issue covers OFP handshake replay.
Filed via automated multi-perspective audit (round 3: WASM sandbox / CI–Docker–supply chain / OFP wire + channel adapters). Curated against all 411 open issues in librefang/librefang to avoid duplicates.