Check that protocol version and deviceId match on encrypted identity

Author: daniellandau

src/service/backends/lan.js

@@ -707,6 +707,25 @@ export const Channel = GObject.registerClass({
         return this._authenticate(connection);
     }
 
+    async _exchangeIdentities() {
+        await this.sendPacket(this.backend.identity);
+        const identity = await this.readPacket();
+
+        if (this.identity.body.protocolVersion !== identity.body.protocolVersion) {
+            this.identity = null;
+            throw new Error(`Unexpected protocol version ${identity.protocolVersion}; ` +
+                            `handshake started with protocol version ${this.identity.protocolVersion}`);
+        }
+
+        if (this.identity.body.deviceId !== identity.body.deviceId) {
+            this.identity = null;
+            throw new Error(`Unexpected device ID "${identity.body.deviceId}"; ` +
+                            `handshake started with device ID "${this.identity.body.deviceId}"`);
+        }
+
+        this.identity = identity;
+    }
+
     /**
      * Negotiate an incoming connection
      *
@@ -755,8 +774,7 @@ export const Channel = GObject.registerClass({
             // Starting with protocol version 8, the devices are expected to
             // exchange identity packets again after TLS negotiation
             if (this.identity.body.protocolVersion >= 8) {
-                await this.sendPacket(this.backend.identity);
-                this.identity = await this.readPacket();
+                await this._exchangeIdentities();
             }
         } catch (e) {
             this.close();
@@ -786,8 +804,7 @@ export const Channel = GObject.registerClass({
             // Starting with protocol version 8, the devices are expected to
             // exchange identity packets again after TLS negotiation
             if (this.identity.body.protocolVersion >= 8) {
-                await this.sendPacket(this.backend.identity);
-                this.identity = await this.readPacket();
+                await this._exchangeIdentities();
             }
         } catch (e) {
             this.close();