Niko/qcc
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

handleAuthCert: look up identity by cert CommonName, not pubkey

Browse source 
Use cert's Subject.CommonName (the phone number) to find identity instead of extracting pubkey and iterating DB. Each cert is bound to a number; the cert tells us which number directly. Also verify cert pubkey matches stored identity pubkey.
This commit is contained in:
Niko Marmeladkov 2026-07-01 15:41:54 +03:00
parent 48143cdbf5
commit 50344a350a
2 changed files with 5 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
internal/identity/manager.go
View file

@ -44,10 +44,6 @@ func NewManager(engine *store.Engine, masterKey [32]byte, prefix string, cooldow
}
func (m *Manager) Allocate(pubKey [32]byte) (*Identity, error) {
if existing, err := m.GetByPubKey(pubKey); err == nil {
return existing, nil
}
var number string
for attempts := 0; attempts < 100; attempts++ {
number = GenerateNumber(m.prefix)

9
internal/server/server.go
View file

@ -344,14 +344,15 @@ func (s *Server) handleAuthCert(sess *Session, payload []byte) {
var pubKey [32]byte
copy(pubKey[:], pubKeyRaw)
ident, err := s.identMgr.GetByPubKey(pubKey)
number := cert.Subject.CommonName
ident, err := s.identMgr.GetByNumber(number)
if err != nil {
sendOpError(sess.Stream(), types.ErrAuthFailed, "identity not found")
sendOpError(sess.Stream(), types.ErrAuthFailed, "identity not found for cert number")
return
}
if sess.IsAuthenticated() && sess.Number() != ident.Number {
sendOpError(sess.Stream(), types.ErrAuthFailed, "cert number mismatch")
if ident.PubKey != pubKey {
sendOpError(sess.Stream(), types.ErrAuthFailed, "cert key mismatch")
return
}