discv5: topic index should check ENR endpoint is equal to source IP of reg traffic
- Dominant language
- JavaScript
- Stars
- 1.1k
- Forks
- 297
- Avg merge
- 5h 50m
- Merged PRs (30d)
- 1
Description
In the base layer DHT, we allow nodes to add ENRs into the node table even when the IP on the ENR doesn't match the endpoint they are sending from. This is to make NAT discovery work through reflected packets.
This policy is not appropriate for the topic index, however, since it would open an attack vector where nodes can try to submit multiple ENRs with different IPs to work around the address restrictions in the ad cache. So it is better to strictly enforce the IP and UDP source port being equal to the ENR information in order to place an ad.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by locating the discv5 topic-index logic that accepts ENRs for advertisements and trace how the registration source endpoint is compared with ENR data. Review the existing tests around topic-index admission, then verify that an advertisement is accepted only when both the IP and UDP source port match the ENR information.
Written by the indexing model from the issue text.
Assessment
- Domain
- networking, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100