Put addresses from the peer's version message and remote IP in the connection cache, don't send them directly to the address book #7951
Labels
A-network
Area: Network protocol updates or fixes
C-security
Category: Security issues
I-invalid-data
Zebra relies on invalid or untrusted data, or sends invalid data
I-remote-trigger
Remote nodes can make Zebra do something bad
Motivation
This prevents an attack where peers can repeatedly connect, supply an address in the version message, and fill the address book.
Complex Requirements or Code
Potential drawbacks:
We might lose these addresses when the peer sends an addr message (but addr messages should always contain that peer's address, so in some cases we might lose the remote address of inbound connections). This is fixed in #7952 by adding all new addresses to the cache, taking any that are needed, then truncating the rest if needed.
These addresses are treated like gossiped addresses, so they have slightly higher priority. This is unlikely to have a significant impact, because their times will quickly become outdated by new addresses from this peer or other peers.
The text was updated successfully, but these errors were encountered: