Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

identify + identify/push sanity checks #1469

Closed
dapplion opened this issue Oct 28, 2022 · 1 comment
Closed

identify + identify/push sanity checks #1469

dapplion opened this issue Oct 28, 2022 · 1 comment
Labels
need/triage Needs initial labeling and prioritization P2 Medium: Good to have, but can wait until someone steps up

Comments

@dapplion
Copy link
Contributor

dapplion commented Oct 28, 2022

Multiple items to protect us:

  • Provide an allow list of protocols, ignore all else
  • Limit total count of protocols stored per peer (overlaps with above) in peer store
  • Limit total count of addresses per peer in peer store
  • Modify Identify protobuf decoder to apply limits above at decode time
  • Add rate limit for built-in enabled by default protocols, at least identity, identify/push. Rate limit per peer and globally

After reviewing with @wemeetagain

  • 8KB naturally limits OOM
  • Most important item is rate limiting to kick peers abusing bandwidth
  • Prune peer store for garbage injected by connection spamming
@dapplion dapplion added the need/triage Needs initial labeling and prioritization label Oct 28, 2022
@p-shahi p-shahi added the P2 Medium: Good to have, but can wait until someone steps up label Nov 8, 2022
@maschad
Copy link
Member

maschad commented Sep 28, 2023

Prune peer store for garbage injected by connection spamming

The application would has access to the PeerStore and so it can iterate through the PeerStore and determine what it defines as garbage and subsequently prune it.

Closing this as it will be separated into two issues

@maschad maschad closed this as completed Sep 28, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
need/triage Needs initial labeling and prioritization P2 Medium: Good to have, but can wait until someone steps up
Projects
None yet
Development

No branches or pull requests

3 participants