ethereum / ethereum/devp2p

discv5: topic index should check ENR endpoint is equal to source IP of reg traffic

Open
#279 2 comments 1 reaction 0 assignees View on GitHub
Dominant language
JavaScript
Stars
1.1k
Forks
297
Avg merge
5h 50m
Merged PRs (30d)
1

Description

In the base layer DHT, we allow nodes to add ENRs into the node table even when the IP on the ENR doesn't match the endpoint they are sending from. This is to make NAT discovery work through reflected packets.

This policy is not appropriate for the topic index, however, since it would open an attack vector where nodes can try to submit multiple ENRs with different IPs to work around the address restrictions in the ad cache. So it is better to strictly enforce the IP and UDP source port being equal to the ENR information in order to place an ad.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by locating the discv5 topic-index logic that accepts ENRs for advertisements and trace how the registration source endpoint is compared with ENR data. Review the existing tests around topic-index admission, then verify that an advertisement is accepted only when both the IP and UDP source port match the ENR information.

Written by the indexing model from the issue text.

Assessment

Domain
networking, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.