minode/message.py

@@ -145,10 +145,13 @@ class Version():
     def from_message(cls, m):
         payload = m.payload
 
-        (  # unused: timestamp, net_addr_local
+        (  # unused: net_addr_local
-            protocol_version, services, _, net_addr_remote, _, nonce
+            protocol_version, services, timestamp, net_addr_remote, _, nonce
         ) = struct.unpack('>IQQ26s26s8s', payload[:80])
 
+        if abs(time.time() - timestamp) > 3600:
+            raise ValueError('remote time offset is too large')
+
         net_addr_remote = structure.NetAddrNoPrefix.from_bytes(net_addr_remote)
 
         host = net_addr_remote.host

minode/tests/test_message.py

@@ -1,4 +1,6 @@
 """Tests for messages"""
+import struct
+import time
 import unittest
 from binascii import unhexlify
 
@@ -75,6 +77,13 @@ class TestMessage(unittest.TestCase):
         """Test version message"""
         msg = message.Message.from_bytes(sample_version_msg)
         self.assertEqual(msg.command, b'version')
+        with self.assertRaises(ValueError):
+            # large time offset
+            version_packet = message.Version.from_message(msg)
+        msg.payload = (
+            msg.payload[:12] + struct.pack('>Q', int(time.time()))
+            + msg.payload[20:])
+
         version_packet = message.Version.from_message(msg)
         self.assertEqual(version_packet.host, '127.0.0.1')
         self.assertEqual(version_packet.port, 8444)