fedserv/echo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Bind game identity to UID (hijack + cap bypass) and warn on plaintext gossip
All checks were successful
CI / check (push) Successful in 4m17s
Details

Browse source
This commit is contained in:
Jean Chevronnet 2026-07-19 14:15:06 +00:00
parent e23240bf52
commit 4599c4834d
No known key found for this signature in database
2 changed files with 10 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
src/gossip.rs
View file

@ -82,6 +82,11 @@ pub async fn run(engine: Shared, cfg: Gossip, peers: Vec<Peer>, origin: String,
};
let acceptor = tls.as_ref().map(|(a, _)| a.clone());
let connector = tls.as_ref().map(|(_, c)| c.clone());
if cfg.tls.is_none() {
// The handshake exchanges the shared secret before the peer is authenticated,
// so without TLS a passive eavesdropper on the link can learn it. Encrypt it.
tracing::warn!("gossip has no [gossip.tls] — the shared secret crosses the wire in plaintext; enable TLS for any non-loopback peer");
}
if let Some(bind) = cfg.bind.clone() {
tokio::spawn(listen(bind, engine.clone(), cfg.secret.clone(), origin.clone(), outbound.clone(), acceptor));
}