aboutsummaryrefslogtreecommitdiffstats
path: root/p2p/discv5/udp.go
diff options
context:
space:
mode:
authorFelix Lange <fjl@twurst.com>2016-11-22 01:11:54 +0800
committerFelix Lange <fjl@twurst.com>2016-11-23 05:21:18 +0800
commita98d1d67d6192df0bd57f608921a82cc508eee18 (patch)
tree49eb8ce8813e8f53cf7d949b2d7dd0ef575713e8 /p2p/discv5/udp.go
parentba2884f3431312c616e21f57deeb03a7c4374d57 (diff)
downloaddexon-a98d1d67d6192df0bd57f608921a82cc508eee18.tar
dexon-a98d1d67d6192df0bd57f608921a82cc508eee18.tar.gz
dexon-a98d1d67d6192df0bd57f608921a82cc508eee18.tar.bz2
dexon-a98d1d67d6192df0bd57f608921a82cc508eee18.tar.lz
dexon-a98d1d67d6192df0bd57f608921a82cc508eee18.tar.xz
dexon-a98d1d67d6192df0bd57f608921a82cc508eee18.tar.zst
dexon-a98d1d67d6192df0bd57f608921a82cc508eee18.zip
p2p/discover, p2p/discv5: prevent relay of invalid IPs and low ports
The discovery DHT contains a number of hosts with LAN and loopback IPs. These get relayed because some implementations do not perform any checks on the IP. go-ethereum already prevented relay in most cases because it verifies that the host actually exists before adding it to the local table. But this verification causes other issues. We have received several reports where people's VPSs got shut down by hosting providers because sending packets to random LAN hosts is indistinguishable from a slow port scan. The new check prevents sending random packets to LAN by discarding LAN IPs sent by Internet hosts (and loopback IPs from LAN and Internet hosts). The new check also blacklists almost all currently registered special-purpose networks assigned by IANA to avoid inciting random responses from services in the LAN. As another precaution against abuse of the DHT, ports below 1024 are now considered invalid.
Diffstat (limited to 'p2p/discv5/udp.go')
-rw-r--r--p2p/discv5/udp.go10
1 files changed, 8 insertions, 2 deletions
diff --git a/p2p/discv5/udp.go b/p2p/discv5/udp.go
index f86fb4d81..396f438a2 100644
--- a/p2p/discv5/udp.go
+++ b/p2p/discv5/udp.go
@@ -29,6 +29,7 @@ import (
"github.com/ethereum/go-ethereum/logger"
"github.com/ethereum/go-ethereum/logger/glog"
"github.com/ethereum/go-ethereum/p2p/nat"
+ "github.com/ethereum/go-ethereum/p2p/netutil"
"github.com/ethereum/go-ethereum/rlp"
)
@@ -198,8 +199,10 @@ func (e1 rpcEndpoint) equal(e2 rpcEndpoint) bool {
return e1.UDP == e2.UDP && e1.TCP == e2.TCP && bytes.Equal(e1.IP, e2.IP)
}
-func nodeFromRPC(rn rpcNode) (*Node, error) {
- // TODO: don't accept localhost, LAN addresses from internet hosts
+func nodeFromRPC(sender *net.UDPAddr, rn rpcNode) (*Node, error) {
+ if err := netutil.CheckRelayIP(sender.IP, rn.IP); err != nil {
+ return nil, err
+ }
n := NewNode(rn.ID, rn.IP, rn.UDP, rn.TCP)
err := n.validateComplete()
return n, err
@@ -327,6 +330,9 @@ func (t *udp) sendTopicNodes(remote *Node, queryHash common.Hash, nodes []*Node)
return
}
for i, result := range nodes {
+ if netutil.CheckRelayIP(remote.IP, result.IP) != nil {
+ continue
+ }
p.Nodes = append(p.Nodes, nodeToRPC(result))
if len(p.Nodes) == maxTopicNodes || i == len(nodes)-1 {
t.sendPacket(remote.ID, remote.addr(), byte(topicNodesPacket), p)