uTransport::send() APIs MUST have requirements for validating source address in UMessages

eclipse-uprotocol / up-spec

uProtocol Specifications

Apache License 2.0

32 stars 25 forks source link

uTransport::send() APIs MUST have requirements for validating source address in UMessages #218

Closed stevenhartley closed 1 month ago

stevenhartley commented 1 month ago

When you send a message, the source address has to be the same as what was passed when you created the transport from the UriProvider, otherwise you can spoof other uEs and devices.

Add requirements to up-l1/README.adoc to mandate the validation (saw that TCK is spoofing the source address which is a no-no

PLeVasseur commented 1 month ago

A uStreamer is kinda spoofing from one transport onto the next, so we need to allow some wiggle room here for certain cases like the uStreamer, right?