Skip to content

security(handshake): #34 anti-replay baseline is in-memory only — a restarted responder accepts one stale Init and learns endpoint from it #104

Description

@vxfemboy

accept_fresh_init treats last_accepted_init_ts==None as always-fresh (bin/yipd/src/peer_manager.rs:1686) and never persists it. After a responder restart the baseline is None, so the first Init — including a captured stale one replayed off-path — is accepted and the cold-start arm learns endpoint=src from it (transient session-build + endpoint-hijack window; the replayer can't complete Noise-IK, so it self-heals on the next genuine fresh Init). Fix: an explicit boot-time floor on the baseline (no accepted Init may be older than this responder's boot time). Same family as the reg_seq wall-clock fix.

See docs/2026-07-25-project-review-and-roadmap.md for the full review synthesis.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions