enbility / ship-go / 30114636067

93%

Build Type

push

github

Committed by web-flow

Commit Message

fix(pairing): keep the addCu listener deactivated whenever a trusted addCu device exists (#92)

Per pairing spec §4.3, processing of addCu-requests SHALL stay
deactivated as long as the pairing with the trusted devZ is intended.
Two entry points violated this:

1. Startup — startPairingService enabled the pairing listener
unconditionally in listener mode, even when a trusted addCu device had
been restored from persistence. Beyond the direct §4.3 violation, this
broke the §4.3 1.b.i trust transfer after a reboot: a new request
arriving during the 15-minute replacement window was evaluated and
deferred — but only after its digest was recorded and the listener
stopped itself, so the post-window re-evaluation rejected the
re-announced request as a replay, permanently locking the new devZ out.
2. RegisterRemoteService after start — registering a trusted addCu
device never touched the listener; it was only disarmed indirectly once
the SHIP handshake reached ConnectionStateCompleted. For an offline devZ
the listener stayed armed indefinitely, and the window is exploitable: a
third devZ announcing a valid request lands in OnPairingSuccess, finds
the just-registered device as trusted addCu with a differing
fingerprint, and — since no replacement window is armed on this path —
immediately steals the trust via the 1.b.i transfer logic.

Fix

- startPairingService guards listener activation on
GetTrustedAddCuDevice(): with a trusted addCu device present, the
listener stays off and the §4.3 1.a replacement timer owns reactivation.
A request announced during the window stays un-consumed in the mDNS
cache and receives a clean first evaluation once the timer expires.
- RegisterRemoteService stops the listener when the registered service
is a trusted addCu device and the Hub has started — the mirror of
UnregisterRemoteService's addCu path, which reactivates it.

Together: the listener is off whenever a trusted addCu device exists,
regardless of how or when the trust w... (continued)

Coverage Stats

40 of 40 new or added lines in 3 files covered. (100.0%)

18 existing lines in 4 files now uncovered.

5904 of 6352 relevant lines covered (92.95%)

11915.49 hits per line