mirror of https://github.com/status-im/op-geth.git
de7af720d6
This a fix for an attack vector where the discovery protocol could be used to amplify traffic in a DDOS attack. A malicious actor would send a findnode request with the IP address and UDP port of the target as the source address. The recipient of the findnode packet would then send a neighbors packet (which is 16x the size of findnode) to the victim. Our solution is to require a 'bond' with the sender of findnode. If no bond exists, the findnode packet is not processed. A bond between nodes α and β is created when α replies to a ping from β. This (initial) version of the bonding implementation might still be vulnerable against replay attacks during the expiration time window. We will add stricter source address validation later. |
||
|---|---|---|
| .. | ||
| discover | ||
| nat | ||
| handshake.go | ||
| handshake_test.go | ||
| message.go | ||
| message_test.go | ||
| peer.go | ||
| peer_error.go | ||
| peer_test.go | ||
| protocol.go | ||
| rlpx.go | ||
| rlpx_test.go | ||
| server.go | ||
| server_test.go | ||
| testlog_test.go | ||