f19778b7d9
https://hackerone.com/reports/991106
> It’s possible to use UDP gossip protocol to amplify DDoS attacks. An attacker
> can spoof IP address in UDP packet when sending PullRequest to the node.
> There's no any validation if provided source IP address is not spoofed and
> the node can send much larger PullResponse to victim's IP. As I checked,
> PullRequest is about 290 bytes, while PullResponse is about 10 kB. It means
> that amplification is about 34x. This way an attacker can easily perform DDoS
> attack both on Solana node and third-party server.
>
> To prevent it, need for example to implement ping-pong mechanism similar as
> in Ethereum: Before accepting requests from remote client needs to validate
> his IP. Local node sends Ping packet to the remote node and it needs to reply
> with Pong packet that contains hash of matching Ping packet. Content of Ping
> packet is unpredictable. If hash from Pong packet matches, local node can
> remember IP where Ping packet was sent as correct and allow further
> communication.
>
> More info:
> https://github.com/ethereum/devp2p/blob/master/discv4.md#endpoint-proof
> https://github.com/ethereum/devp2p/blob/master/discv4.md#wire-protocol
The commit adds a PingCache, which maintains records of remote nodes
which have returned a valid response to a ping message, and on-the-fly
ping messages pending a pong response from the remote node.
When handling pull-requests, those from addresses which have not passed
the ping-pong check are filtered out, and additionally ping packets are
added for addresses which need to be (re)verified.
(cherry picked from commit ae91270961)
Co-authored-by: behzad nouri <behzadnouri@gmail.com>
102 lines
2.5 KiB
Rust
102 lines
2.5 KiB
Rust
#![cfg_attr(RUSTC_WITH_SPECIALIZATION, feature(specialization))]
|
|
//! The `solana` library implements the Solana high-performance blockchain architecture.
|
|
//! It includes a full Rust implementation of the architecture (see
|
|
//! [Validator](server/struct.Validator.html)) as well as hooks to GPU implementations of its most
|
|
//! paralellizable components (i.e. [SigVerify](sigverify/index.html)). It also includes
|
|
//! command-line tools to spin up validators and a Rust library
|
|
//!
|
|
|
|
pub mod accounts_hash_verifier;
|
|
pub mod banking_stage;
|
|
pub mod bigtable_upload_service;
|
|
pub mod broadcast_stage;
|
|
pub mod cache_block_time_service;
|
|
pub mod cluster_info_vote_listener;
|
|
pub mod commitment_service;
|
|
pub mod completed_data_sets_service;
|
|
mod deprecated;
|
|
pub mod sample_performance_service;
|
|
pub mod shred_fetch_stage;
|
|
#[macro_use]
|
|
pub mod contact_info;
|
|
pub mod bank_weight_fork_choice;
|
|
pub mod cluster_info;
|
|
pub mod cluster_slots;
|
|
pub mod cluster_slots_service;
|
|
pub mod consensus;
|
|
pub mod crds;
|
|
pub mod crds_gossip;
|
|
pub mod crds_gossip_error;
|
|
pub mod crds_gossip_pull;
|
|
pub mod crds_gossip_push;
|
|
pub mod crds_shards;
|
|
pub mod crds_value;
|
|
pub mod data_budget;
|
|
pub mod epoch_slots;
|
|
pub mod fetch_stage;
|
|
pub mod fork_choice;
|
|
pub mod gen_keys;
|
|
pub mod gossip_service;
|
|
pub mod heaviest_subtree_fork_choice;
|
|
pub mod ledger_cleanup_service;
|
|
pub mod local_vote_signer_service;
|
|
pub mod non_circulating_supply;
|
|
pub mod optimistic_confirmation_verifier;
|
|
pub mod optimistically_confirmed_bank_tracker;
|
|
pub mod ping_pong;
|
|
pub mod poh_recorder;
|
|
pub mod poh_service;
|
|
pub mod progress_map;
|
|
pub mod pubkey_references;
|
|
pub mod repair_response;
|
|
pub mod repair_service;
|
|
pub mod repair_weight;
|
|
pub mod repair_weighted_traversal;
|
|
pub mod replay_stage;
|
|
mod result;
|
|
pub mod retransmit_stage;
|
|
pub mod rewards_recorder_service;
|
|
pub mod rpc;
|
|
pub mod rpc_health;
|
|
pub mod rpc_pubsub;
|
|
pub mod rpc_pubsub_service;
|
|
pub mod rpc_service;
|
|
pub mod rpc_subscriptions;
|
|
pub mod send_transaction_service;
|
|
pub mod serve_repair;
|
|
pub mod serve_repair_service;
|
|
pub mod sigverify;
|
|
pub mod sigverify_shreds;
|
|
pub mod sigverify_stage;
|
|
pub mod snapshot_packager_service;
|
|
pub mod test_validator;
|
|
pub mod tpu;
|
|
pub mod transaction_status_service;
|
|
pub mod tree_diff;
|
|
pub mod tvu;
|
|
pub mod validator;
|
|
pub mod verified_vote_packets;
|
|
pub mod vote_stake_tracker;
|
|
pub mod weighted_shuffle;
|
|
pub mod window_service;
|
|
|
|
#[macro_use]
|
|
extern crate log;
|
|
|
|
#[macro_use]
|
|
extern crate serde_derive;
|
|
|
|
#[cfg(test)]
|
|
#[macro_use]
|
|
extern crate serde_json;
|
|
|
|
#[macro_use]
|
|
extern crate solana_metrics;
|
|
|
|
#[macro_use]
|
|
extern crate solana_frozen_abi_macro;
|
|
|
|
#[cfg(test)]
|
|
#[macro_use]
|
|
extern crate matches;
|