From bd0d50571421e6c3ec857b36792f07f2b338a9bd Mon Sep 17 00:00:00 2001
From: orignal <i2porignal@yandex.ru>
Date: Thu, 8 Oct 2026 15:56:57 -0400
Subject: [PATCH] verify announce_peer token

---
 libi2pd_client/TorrentsDHT.cpp | 24 ++++++++++++++++--------
 libi2pd_client/TorrentsDHT.h   |  6 +++---
 2 files changed, 19 insertions(+), 11 deletions(-)

diff --git a/libi2pd_client/TorrentsDHT.cpp b/libi2pd_client/TorrentsDHT.cpp
index 305cfa67..e228f30f 100644
--- a/libi2pd_client/TorrentsDHT.cpp
+++ b/libi2pd_client/TorrentsDHT.cpp
@@ -320,7 +320,7 @@ namespace torrents
 	{
 		auto it = m_IncomingGetPeers.find (token);
 		if (it != m_IncomingGetPeers.end ())
-			return it->second.first.lock ();
+			return it->second.first;
 		return nullptr;
 	}
 
@@ -604,7 +604,7 @@ namespace torrents
 				 break;
 				 case 'q':
 					if (query == "announce_peer")
-						HandleAnnouncePeer (transactionID, infoHash, token);
+						HandleAnnouncePeer (transactionID, id, infoHash, token);
 					else
 						LogPrint (eLogError, "TorrentsDHT: Query can't come as raw datagram");
 				break;
@@ -761,7 +761,8 @@ namespace torrents
 		}
 	}
 
-	void TorrentsDHT::HandleAnnouncePeer (std::string_view transactionID, const Torrent::InfoHash& infoHash, uint64_t token)
+	void TorrentsDHT::HandleAnnouncePeer (std::string_view transactionID, const NodeID& nodeID,
+		const Torrent::InfoHash& infoHash, uint64_t token)
 	{
 		LogPrint (eLogDebug, "TorrentsDHT: Announce peer received");
 		auto it = m_Torrents.find (infoHash);
@@ -770,12 +771,19 @@ namespace torrents
 			auto node = it->second->GetIncomingGetPeerNode (token);
 			if (node)
 			{
-				it->second->AddPeer (node->peer);
-				SendResponseMsg (CreateDictionary ({
-						{ "id", CreateByteString (std::string_view ((const char *)node->id.data (), node->id.size ())) },
-												}),
-					transactionID, node->peer, node->port + 1); // to rport
+				if (node->id == nodeID)
+				{
+					it->second->AddPeer (node->peer);
+					SendResponseMsg (CreateDictionary ({
+							{ "id", CreateByteString (std::string_view ((const char *)m_NodeID.data (), m_NodeID.size ())) },
+													}),
+						transactionID, node->peer, node->port + 1); // to rport
+				}
+				else
+					LogPrint (eLogInfo, "TorrentsDHT: Announce peer node/token mismatch");
 			}
+			else
+				LogPrint (eLogInfo, "TorrentsDHT: Announce peer token not found");
 		}
 	}
 
diff --git a/libi2pd_client/TorrentsDHT.h b/libi2pd_client/TorrentsDHT.h
index 4d2a0f48..1cf8264d 100644
--- a/libi2pd_client/TorrentsDHT.h
+++ b/libi2pd_client/TorrentsDHT.h
@@ -164,7 +164,7 @@ namespace torrents
 		private:
 
 			std::unordered_map<i2p::data::IdentHash, uint64_t> m_Peers; // ident -> update time in monotonic seconds
-			std::unordered_map<GetPeersToken, std::pair<std::weak_ptr<Node>, uint64_t> > m_IncomingGetPeers; // they request peers and send announces to us
+			std::unordered_map<GetPeersToken, std::pair<std::shared_ptr<Node>, uint64_t> > m_IncomingGetPeers; // they request peers and send announces to us
 			uint64_t m_LastUpdateTime; // monotonic second
 	};
 
@@ -253,8 +253,8 @@ namespace torrents
 			void HandleGetPeersResponsePeersAndAnnounce (std::shared_ptr<RequestInfo> info,
 				const std::vector<std::string_view>& peers, uint64_t token, const i2p::data::IdentHash& toIdent, uint16_t toPort);
 			void HandleFindNodeResponse (std::shared_ptr<RequestInfo> info, std::string_view nodes);
-			void HandleAnnouncePeer (std::string_view transactionID, const Torrent::InfoHash& infoHash, uint64_t token);
-
+			void HandleAnnouncePeer (std::string_view transactionID, const NodeID& nodeID,
+				const Torrent::InfoHash& infoHash, uint64_t token);
 			void SendDatagram (std::string_view msg, const i2p::data::IdentHash& toIdent, uint16_t toPort);
 			void SendRawDatagram (std::string_view msg, const i2p::data::IdentHash& toIdent, uint16_t toPort);
 			void SendQueryMsg (KRPCQuery query, std::string_view arguments, const i2p::data::IdentHash& toIdent,