tronprotocol / tronprotocol/java-tron

Add timestamp validation and deduplication to hello handshake messages

Open
#6,675 10 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: next-release topic:net
Dominant language
Java
Stars
4.2k
Forks
1.7k
Avg merge
6d 20h
Merged PRs (30d)
14

Description

Summary

When TRON nodes process handshake (Hello) messages, although the messages include a timestamp signature, the receiver currently does not validate the timestamp, nor is there a mechanism for message uniqueness or deduplication. Historical messages could be intercepted and reused to establish connections. Adding timestamp validation and a simple deduplication mechanism can more effectively filter out expired or repeated messages, improving handshake stability and node connection reliability.

Root Cause

Hello messages include a timestamp signature, but the receiver does not validate its freshness, and there is no unique identifier or deduplication. Historical messages could be intercepted and replayed to establish connections, which slightly affects node connection stability.

Reproduction

  • Construct a Hello message containing a historical timestamp or previously sent content.
  • Send this message from different peers to the target node.
  • The target node processes each Hello message from each peer normally, without verifying timestamp validity or message uniqueness.

Impact

  • A malicious node that intercepts and replays historical messages could successfully establish connections with the target node.
  • This may cause unnecessary connection attempts and additional resource consumption on the target node.

Suggested Fix

Add lightweight validation in the existing handshake process:

  • Implement timestamp validation to ensure it falls within a reasonable time window (e.g., 30s).
  • Introduce a simple unique identifier (e.g., based on timestamp) and perform short-term deduplication using a cache.

By using the above methods, handshake message processing can be more standardized and stable without affecting the existing signature mechanism.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the existing handshake process and locating how Hello-message timestamps and signatures are received and checked. Reproduce the historical and repeated-message cases described in the issue; done means stale timestamps are rejected within the chosen window and recently seen messages are deduplicated without changing signature handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
networking, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.