Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Security: Limit the number of inbound peer connections in the listener task #1851

Closed
Tracked by #2867
teor2345 opened this issue Mar 5, 2021 · 0 comments · Fixed by #2961
Closed
Tracked by #2867

Security: Limit the number of inbound peer connections in the listener task #1851

teor2345 opened this issue Mar 5, 2021 · 0 comments · Fixed by #2961
Assignees
@teor2345
Labels
A-network Area: Network protocol updates or fixes C-security Category: Security issues I-remote-node-overload Zebra can overload other nodes on the network
Milestone
2021 Sprint 21

Comments

@teor2345
Copy link
Contributor

teor2345 commented Mar 5, 2021 •
edited
Loading

Motivation

Zebra has no limit on the number of open inbound connections from other peers. This is a remote distributed denial of service risk, if an attacker can make other nodes connect to Zebra.

We're not currently seeing this attack on the network, but it might be easy for malicious nodes to trigger. So we should fix it soon.

Suggested Design

In accept_inbound_connections, limit the number of inbound connections to peerset_initial_target_size. This applies the connection limit as soon as Zebra gets control of the accepted connection from tokio.

peerset_initial_target_size is an existing zebra-network config. It's used to initialise the CandidateSet's outbound peer connection demand.

Edge Cases

Zebra should check and increase the connection limit as early as possible.

Zebra should drop any resources used by rejected connections as soon as possible.
@teor2345 teor2345 added C-bug Category: This is a bug A-rust Area: Updates to Rust code C-cleanup Category: This is a cleanup S-needs-triage Status: A bug report needs triage NU-5 Network Upgrade: NU5 specific tasks P-High C-security Category: Security issues I-heavy Problems with excessive memory, disk, or CPU usage I-slow Problems with performance or responsiveness labels Mar 5, 2021
@teor2345 teor2345 added this to the 2021 Sprint 5 milestone Mar 5, 2021
@teor2345 teor2345 mentioned this issue Mar 5, 2021
Closed
@mpguerra mpguerra added P-Medium and removed P-High S-needs-triage Status: A bug report needs triage labels Mar 8, 2021
@teor2345 teor2345 changed the title Limit the number of peers in the PeerSet Limit the number of connected peers in the PeerSet Mar 9, 2021
@teor2345 teor2345 mentioned this issue Mar 9, 2021
Open
6 tasks
@mpguerra mpguerra removed this from the 2021 Sprint 6 milestone Mar 17, 2021
@teor2345 teor2345 changed the title Limit the number of connected peers in the PeerSet Security: Limit the number of inbound peer connections in the PeerSet Oct 11, 2021
@mpguerra mpguerra mentioned this issue Oct 13, 2021
Closed
24 tasks
@teor2345 teor2345 changed the title Security: Limit the number of inbound peer connections in the PeerSet Security: Limit the number of inbound peer connections in the network listener task Oct 18, 2021
@teor2345 teor2345 changed the title Security: Limit the number of inbound peer connections in the network listener task Security: Limit the number of inbound peer connections in the listener task Oct 18, 2021
@teor2345 teor2345 removed the C-cleanup Category: This is a cleanup label Oct 18, 2021
@teor2345 teor2345 mentioned this issue Oct 18, 2021
Closed
@teor2345 teor2345 added A-network Area: Network protocol updates or fixes I-remote-node-overload Zebra can overload other nodes on the network and removed C-bug Category: This is a bug A-rust Area: Updates to Rust code NU-5 Network Upgrade: NU5 specific tasks I-heavy Problems with excessive memory, disk, or CPU usage I-slow Problems with performance or responsiveness labels Oct 19, 2021
@teor2345 teor2345 mentioned this issue Oct 19, 2021
Closed
@teor2345 teor2345 added the S-blocked Status: Blocked on other tasks label Oct 19, 2021
This was referenced Oct 25, 2021
Merged
Merged
@teor2345 teor2345 mentioned this issue Oct 27, 2021
Merged
3 tasks
@teor2345 teor2345 linked a pull request Oct 27, 2021 that will close this issue
Limit the number of inbound peer connections #2961
Merged
3 tasks
@teor2345 teor2345 removed the S-blocked Status: Blocked on other tasks label Oct 28, 2021
@arya2 arya2 mentioned this issue Mar 31, 2023
Merged
6 tasks
@mpguerra mpguerra mentioned this issue Apr 11, 2023
Closed
4 tasks
mpguerra added a commit that referenced this issue May 19, 2023
@mpguerra
#1850 was fixed by #2944, #1851 was fixed by #2961 and #2902 was fixe…
9b67e09 
…d by #2969
mergify bot pushed a commit that referenced this issue May 23, 2023
@mpguerra @teor2345
Delete outdated TODOs refering to closed issues (#6732)
ec2e9ca 
* ZIPs were updated to remove ambiguity, this was tracked in #1267.

* #2105 was fixed by #3039 and #2379 was closed by #3069

* #2230 was a duplicate of #2231 which was closed by #2511

* #3235 was obsoleted by #2156 which was fixed by #3505

* #1850 was fixed by #2944, #1851 was fixed by #2961 and #2902 was fixed by #2969

* We migrated to Rust 2021 edition in Jan 2022 with #3332

* #1631 was closed as not needed

* #338 was fixed by #3040 and #1162 was fixed by #3067

* #2079 was fixed by #2445

* #4794 was fixed by #6122

* #1678 stopped being an issue

* #3151 was fixed by #3934

* #3204 was closed as not needed

* #1213 was fixed by #4586

* #1774 was closed as not needed

* #4633 was closed as not needed

* Clarify behaviour of difficulty spacing

Co-authored-by: teor <teor@riseup.net>

* Update comment to reflect implemented behaviour

Co-authored-by: teor <teor@riseup.net>

* Update comment to reflect implemented behaviour when retrying block downloads

Co-authored-by: teor <teor@riseup.net>

* Update `TODO` to remove closed issue and clarify when we might want to fix

Co-authored-by: teor <teor@riseup.net>

* Update `TODO` to remove closed issue and clarify what we might want to change in future

Co-authored-by: teor <teor@riseup.net>

* Clarify benefits of how we do block verification

Co-authored-by: teor <teor@riseup.net>

* Fix rustfmt errors

---------

Co-authored-by: teor <teor@riseup.net>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@teor2345 teor2345

Labels
A-network Area: Network protocol updates or fixes C-security Category: Security issues I-remote-node-overload Zebra can overload other nodes on the network
Projects
None yet
Milestone
2021 Sprint 21
Development

Successfully merging a pull request may close this issue.

Limit the number of inbound peer connections ZcashFoundation/zebra
3 participants
@conradoplg @mpguerra @teor2345