- 23 11月, 2016 1 次提交
-
-
由 Felix Lange 提交于
The discovery DHT contains a number of hosts with LAN and loopback IPs. These get relayed because some implementations do not perform any checks on the IP. go-ethereum already prevented relay in most cases because it verifies that the host actually exists before adding it to the local table. But this verification causes other issues. We have received several reports where people's VPSs got shut down by hosting providers because sending packets to random LAN hosts is indistinguishable from a slow port scan. The new check prevents sending random packets to LAN by discarding LAN IPs sent by Internet hosts (and loopback IPs from LAN and Internet hosts). The new check also blacklists almost all currently registered special-purpose networks assigned by IANA to avoid inciting random responses from services in the LAN. As another precaution against abuse of the DHT, ports below 1024 are now considered invalid.
-
- 22 2月, 2016 1 次提交
-
-
As we aren't really using the standarized SHA-3
-
- 18 12月, 2015 1 次提交
-
-
由 Felix Lange 提交于
-
- 27 11月, 2015 1 次提交
-
-
由 Péter Szilágyi 提交于
-
- 30 9月, 2015 1 次提交
-
-
由 Felix Lange 提交于
nodeDB.querySeeds was not safe for concurrent use but could be called concurrenty on multiple goroutines in the following case: - the table was empty - a timed refresh started - a lookup was started and initiated refresh These conditions are unlikely to coincide during normal use, but are much more likely to occur all at once when the user's machine just woke from sleep. The root cause of the issue is that querySeeds reused the same leveldb iterator until it was exhausted. This commit moves the refresh scheduling logic into its own goroutine (so only one refresh is ever active) and changes querySeeds to not use a persistent iterator. The seed node selection is now more random and ignores nodes that have not been contacted in the last 5 days.
-
- 11 8月, 2015 1 次提交
-
-
由 Felix Lange 提交于
Table.mutex was being held while waiting for a reply packet, which effectively made many parts of the whole stack block on that packet, including the net_peerCount RPC call.
-
- 06 8月, 2015 1 次提交
-
-
由 Felix Lange 提交于
Not closing the table used to be fine, but now the table has a database.
-
- 24 7月, 2015 1 次提交
-
-
由 Felix Lange 提交于
I forgot to update one instance of "go-ethereum" in commit 3f047be5.
-
- 23 7月, 2015 1 次提交
-
-
由 Felix Lange 提交于
All code outside of cmd/ is licensed as LGPL. The headers now reflect this by calling the whole work "the go-ethereum library".
-
- 07 7月, 2015 1 次提交
-
-
由 Felix Lange 提交于
-
- 10 6月, 2015 1 次提交
-
-
由 Felix Lange 提交于
rand.Source isn't safe for concurrent use.
-
- 25 5月, 2015 1 次提交
-
-
由 Felix Lange 提交于
-
- 06 5月, 2015 1 次提交
-
-
由 Felix Lange 提交于
The previous metric was pubkey1^pubkey2, as specified in the Kademlia paper. We missed that EC public keys are not uniformly distributed. Using the hash of the public keys addresses that. It also makes it a bit harder to generate node IDs that are close to a particular node.
-
- 30 4月, 2015 2 次提交
-
-
由 Felix Lange 提交于
-
由 Felix Lange 提交于
This commit changes the discovery protocol to use the new "v4" endpoint format, which allows for separate UDP and TCP ports and makes it possible to discover the UDP address after NAT.
-
- 24 4月, 2015 3 次提交
-
-
由 Péter Szilágyi 提交于
-
由 Péter Szilágyi 提交于
-
由 Péter Szilágyi 提交于
-
- 01 4月, 2015 2 次提交
-
-
由 Felix Lange 提交于
-
由 Felix Lange 提交于
This a fix for an attack vector where the discovery protocol could be used to amplify traffic in a DDOS attack. A malicious actor would send a findnode request with the IP address and UDP port of the target as the source address. The recipient of the findnode packet would then send a neighbors packet (which is 16x the size of findnode) to the victim. Our solution is to require a 'bond' with the sender of findnode. If no bond exists, the findnode packet is not processed. A bond between nodes α and β is created when α replies to a ping from β. This (initial) version of the bonding implementation might still be vulnerable against replay attacks during the expiration time window. We will add stricter source address validation later.
-
- 09 2月, 2015 1 次提交
-
-
由 Felix Lange 提交于
-
- 07 2月, 2015 1 次提交
-
-
由 Felix Lange 提交于
The discovery RPC protocol does not yet distinguish TCP and UDP ports. But it can't hurt to do so in our internal model.
-
- 06 2月, 2015 2 次提交
-
-
由 Felix Lange 提交于
-
由 Felix Lange 提交于
-