feat: add remote ID validation in RelayClient RequestConnection
Add check to ensure secConn.RemoteID() matches the provided leaseID, preventing potential connection mismatches. Introduces ErrRemoteIDMismatch error and logs warning on mismatch, closing the stream to maintain connection integrity.
lemon-mint committed
Nov 3, 2025 at 21:37 UTC
2882c220f5ccf50ed9a6c57e5422f165778e7c46
1 file changed
+7
portal/client.go
+7
@@ -17,6 +17,7 @@ import (
17
var (
18
ErrInvalidResponse = errors.New("invalid response")
19
ErrConnectionRejected = errors.New("connection rejected")
20
+ ErrRemoteIDMismatch = errors.New("remote ID mismatch")
21
)
22
23
type IncommingConn struct {
@@ -546,6 +547,12 @@ func (g *RelayClient) RequestConnection(leaseID string, alpn string, clientCred
547
return rdverb.ResponseCode_RESPONSE_CODE_UNKNOWN, nil, err
548
}
549
550
+ if secConn.RemoteID() != leaseID {
551
+ log.Warn().Str("lease_id", leaseID).Msg("[RelayClient] Remote ID mismatch")
552
+ stream.Close()
553
+ return rdverb.ResponseCode_RESPONSE_CODE_UNKNOWN, nil, ErrRemoteIDMismatch
554
+ }
555
+
556
log.Debug().
557
Str("lease_id", leaseID).
558
Str("local_id", secConn.LocalID()).