search

ethereum / ddht

Python implementation of Discovery V5 Protocol
MIT License
18 stars 16 forks source link

Add protection against spam handshake floods #229

Open njgheorghita opened 3 years ago

njgheorghita commented 3 years ago

The other thing that I think we're going to run into is that someone can probably force us to flush our sessions by initiating lots and lots of handshakes in quick succession. It won't crash the app but it will require us to re-establish sessions which costs something. We can probably mitigate this (in some other PR) by simply limiting the number of incomplete handshakes for a given Endpoint so that executing such an attack requires many IP addresses which makes the attack more expensive.

From #209

pipermerriam commented 3 years ago

Probably good to maybe have two session stores, one for in-progress handshakes and one for completed ones. That ensures that we don't evict valid sessions just to make room for a maybe new session. This modification would likely take place in the ddht.v5_1.pool.Pool