-
Notifications
You must be signed in to change notification settings - Fork 174
fix(l1): update existing contact ENR on NODES response #6172
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Merged
ElFantasma
merged 190 commits into
main
from
fix/update-existing-contact-enr-on-nodes-response
Feb 19, 2026
Merged
Changes from all commits
Commits
Show all changes
190 commits
Select commit
Hold shift + click to select a range
eb5427e
initial discv5
ElFantasma dd0990b
Merge branch 'main' into discv5
ElFantasma a61953f
discv5 stub modules
ElFantasma 637aaac
Merge branch 'main' into discv5
ElFantasma e1a8a83
Ordinary packet
ElFantasma fec454e
Added WhoAreYou packet
ElFantasma 2e65c2e
Merge branch 'main' into discv5
ElFantasma 6ecfb65
WhoAreYou decode test pass
ElFantasma 0de7e39
WhoAreYou encode test pass
ElFantasma a56f4da
protocol version check
ElFantasma 7a8541b
Added Discv5Codec
ElFantasma 334044e
feat(l1): implement `discv5`'s `Pong` message (#5616)
azteca1998 ac66212
Merge branch 'main' into discv5
ElFantasma 31b82d2
Added decryption and corrected Ping decoding
ElFantasma db0a79c
Corrected Ping encoding
ElFantasma 3020428
feat(l1): implement discv5 TalkReq message coding (#5631)
edg-l 552160a
feat(l1): implement discv5 nodes message coding (#5630)
edg-l d2da66c
feat(l1): implement discv5's FindNode message (#5629)
edg-l 4af6e40
chore(l1): fix discv5 branch lints (#5633)
edg-l e247d48
chore(l1): improve discv5 new_nonce (#5652)
edg-l 13b1e16
chore(l1): put all discv5 behind a feature flag (#5651)
edg-l 48282da
feat(l1): implement discv5 TICKET message codec (#5650)
edg-l 2907a37
feat(l1): implement `discv5` `TalkRes` message codec (#5632)
azteca1998 c547ab5
Merge branch 'main' into discv5
ElFantasma 52fa23e
Merge branch 'main' into discv5
ElFantasma 4aae22c
feat(l1): implement discv5 handshake encoding/decoding (#5653)
edg-l 92ea30a
Merge branch 'main' into discv5
edg-l f2e8501
feat(l1): discv5, add ordinary packet coding (#5665)
edg-l 0eda82b
Merge branch 'main' into discv5
ElFantasma 8cab21f
Merge branch 'main' into discv5
edg-l bb8e46a
feat(l1): add discv5 session structures and remaining official vector…
edg-l 1a3fca7
Initial server code - WIP
ElFantasma 60c7e3f
Merge branch 'discv5' into discv5-server
ElFantasma 16da2ac
rename feature
edg-l de865e2
rename
edg-l aba0c28
Corrected FindNode and sending it inside a Package - WIP
ElFantasma e314828
Random FindNode message - WIP
ElFantasma 45d01e2
Merge branch 'main' into discv5
ElFantasma c0c293e
Improving protocol - WIP
ElFantasma a43b915
address comments
edg-l afdaeba
Merge branch 'main' into discv5
edg-l d7ada2b
Updated some types
ElFantasma 9e562dd
Merge branch 'main' into discv5
ElFantasma 683191a
Merge branch 'discv5' into discv5-server
ElFantasma 3e93c71
Updated feature name
ElFantasma 2aca677
Addressed PR comments and corrected req_id type
ElFantasma 6b819a1
Corrected static_header type
ElFantasma 41d100e
Removed unnecessary stuff
ElFantasma c1d3031
Merge branch 'main' into discv5
ElFantasma ffd7c61
Merge branch 'discv5' into discv5-server
ElFantasma ec85eb5
Several refactors to support partially decoded Packets - WIP
ElFantasma 79354b6
Merge branch 'main' into discv5-server
ElFantasma 06652ed
Merge branch 'main' into discv5-server
ElFantasma 3a07910
Saving messages by nonce
ElFantasma 438fb8d
Building handshake message from WhoAreYou
ElFantasma a0a92ea
Merge branch 'main' into discv5-server
ElFantasma 377fc00
Fixing tests improving code
ElFantasma 1115a8a
Merge branch 'main' into discv5-server
ElFantasma e237fa7
Improved tests
ElFantasma 3040f2e
More tests and a fix in FindNode
ElFantasma 82ac8dc
Merge branch 'main' into discv5-server
ElFantasma 1dbf0c6
Removed DecodedPacket dependencies in server
ElFantasma 9072f7c
Fixed some error in NodeRecord decoding
ElFantasma fc7f1d4
Removed DecodedPacket to use Packet only - WIP
ElFantasma 206e613
Added PacketTypeWrapper for better Packet handling
ElFantasma f532169
Merge branch 'main' into discv5-server
ElFantasma 1645035
Better FindNode randomization and handling Nodes message
ElFantasma dff4a4a
Nodes messages handling and some bug fixes
ElFantasma c453579
Nodes messages handling and some bug fixes
ElFantasma 6637230
Merge branch 'main' into discv5-server
ElFantasma f19fa11
Put peer_table and discovery_server behind discv5 feature flag
ElFantasma 94a0fbc
Reordered p2p.rs
ElFantasma 6e1ff33
Merge branch 'main' into discv5-server
ElFantasma 76ec6b9
Added links to github issues on comments
ElFantasma c260ea9
Verifiying ENR fork-ids
ElFantasma 840e16f
ENR is sent optionally on Handshake messages
ElFantasma ba152dd
Merge branch 'main' into discv5-server
ElFantasma 8aa81ea
Merge branch 'discv5-server' into discv5-server-enr-validation
ElFantasma 43cc825
Merge branch 'discv5-server-enr-validation' into discv5-server-option…
ElFantasma 8930dc9
Added store to discv4 PeerTable
ElFantasma 3924c01
Merge branch 'discv5-server-enr-validation' into discv5-server-option…
ElFantasma 5a10661
Improved discv4 initiate candidates
ElFantasma e5ca440
Improved discv4 initiate candidates
ElFantasma a7b639b
Merge branch 'discv5-server-enr-validation' into discv5-server-option…
ElFantasma c277322
Fixed clippy issue
ElFantasma ea4aafb
Merge branch 'discv5-server-enr-validation' into discv5-server-option…
ElFantasma 79bb838
Fixed l2 initialization
ElFantasma b91d7d0
Merge branch 'main' into discv5-server
ElFantasma 21acbf3
Merge branch 'main' into discv5-server
ElFantasma 49d7db7
Merge branch 'main' into discv5-server
ElFantasma 9ff749f
prune expired messages from messages_by_nonce
ElFantasma e6f4790
Merge branch 'discv5-server-enr-validation' into discv5-server-option…
ElFantasma 0fa0c25
Merge branch 'discv5-server-optional-enr-send-on-handshake' into disc…
ElFantasma c6b9b96
Merge branch 'main' into discv5-server
ElFantasma f27b30e
Merge branch 'discv5-server' into discv5-server-enr-validation
ElFantasma b966976
Merge branch 'discv5-server-enr-validation' into discv5-server-option…
ElFantasma b29c82a
Merge branch 'discv5-server-optional-enr-send-on-handshake' into disc…
ElFantasma 23d4a3e
Implemented ping/pong workflow
ElFantasma 19d0a43
Added recipient-port to Pong messages
ElFantasma 11dea1f
Improved error messaging and revalidate intervals
ElFantasma 5e82edf
cargo fmt
ElFantasma 7fdcef3
Addressed PR comments
ElFantasma 08cdc24
Merge branch 'main' into discv5-server
ElFantasma 7c62ef8
Removed duplicate code
ElFantasma 0d11c39
Merge branch 'main' into discv5-server
ElFantasma 5f06156
Merge branch 'main' into discv5-server
ElFantasma d8a79c0
Added PacketTrait to reduce code duplication
ElFantasma bb0a679
Merge branch 'discv5-server' into discv5-server-enr-validation
ElFantasma 002b3d3
Merge branch 'discv5-server-enr-validation' into discv5-server-option…
ElFantasma a0f1014
Merge branch 'discv5-server-optional-enr-send-on-handshake' into disc…
ElFantasma 4ef7ecd
Merge branch 'discv5-server-maintain-messages-by-nonce' into discv5-s…
ElFantasma ede1342
Implement discv5 FindNode request handling
ElFantasma 8d06692
cargo fmt
ElFantasma 8f8eee8
Implemented discv5 handshake handling
ElFantasma 1937849
Merge branch 'main' into discv5-server-enr-validation
ElFantasma d298c15
Merge branch 'discv5-server-enr-validation' into discv5-server-option…
ElFantasma 11c7f90
Merge branch 'discv5-server-optional-enr-send-on-handshake' into disc…
ElFantasma 66ee8b9
Merge branch 'discv5-server-maintain-messages-by-nonce' into discv5-s…
ElFantasma 5ba8ea6
Merge branch 'discv5-server-ping-pong-workflow' into discv5-server-fi…
ElFantasma 198dd89
Merge branch 'discv5-server-findnode-handling' into discv5-server-han…
ElFantasma 54df884
rate limit WHOAREYOU packets per source IP to prevent amplification a…
ElFantasma 4a84a6d
cargo fmt
ElFantasma e1c5fc7
request updated ENR when PONG enr_seq differs from cached
ElFantasma 952bf3c
cargo fmt
ElFantasma ded19fe
Merge branch 'main' into discv5-server-enr-validation
ElFantasma c48ca79
Merge branch 'discv5-server-enr-validation' into discv5-server-option…
ElFantasma b6c7473
Added PR suggestion
ElFantasma 0befa05
Merge branch 'main' into discv5-server-enr-validation
ElFantasma 3efd2b9
Merge branch 'discv5-server-enr-validation' into discv5-server-option…
ElFantasma ece3e41
Merge branch 'discv5-server-optional-enr-send-on-handshake' into disc…
ElFantasma ee24f5d
Merge branch 'discv5-server-maintain-messages-by-nonce' into discv5-s…
ElFantasma 2136f81
Merge branch 'discv5-server-ping-pong-workflow' into discv5-server-fi…
ElFantasma b2bb21d
Merge branch 'discv5-server-findnode-handling' into discv5-server-han…
ElFantasma 3799fd1
Merge branch 'discv5-server-handshake-handling' into discv5-server-ra…
ElFantasma adc9016
Merge branch 'discv5-server-rate-limit' into discv5-server-enr-update…
ElFantasma b5347ef
Merge branch 'main' into discv5-server-optional-enr-send-on-handshake
ElFantasma 817d889
Merge branch 'main' into discv5-server-optional-enr-send-on-handshake
ElFantasma b024329
perf(l1): execution-based prewarming (#5906)
iovoid 3b451cc
perf(levm): use fxhashset for access lists (#5824)
edg-l c1d8667
refactor(l1): move embedded tests to dedicated tests/ directories (#5…
ilitteri f18a8b7
Added PR suggestion
ElFantasma 76ceb6b
perf(levm): improve CALLDATACOPY/CODECOPY/EXTCODECOPY (#5810)
edg-l 04ad794
Merge branch 'discv5-server-optional-enr-send-on-handshake' into disc…
ElFantasma 52861b3
Merge branch 'discv5-server-maintain-messages-by-nonce' into discv5-s…
ElFantasma d7ba2db
perf(l1): execution-based prewarming (#5906)
iovoid d3a6fd8
perf(levm): use fxhashset for access lists (#5824)
edg-l f47cf71
refactor(l1): move embedded tests to dedicated tests/ directories (#5…
ilitteri 1717a01
Added PR suggestion
ElFantasma 19bd12f
perf(levm): improve CALLDATACOPY/CODECOPY/EXTCODECOPY (#5810)
edg-l 893f1e6
Merge branch 'discv5-server-ping-pong-workflow' into discv5-server-fi…
ElFantasma 9f5e1db
Merge branch 'discv5-server-findnode-handling' into discv5-server-han…
ElFantasma 4248caa
Merge branch 'discv5-server-handshake-handling' into discv5-server-ra…
ElFantasma 2367500
Fixed Cargo.lock after merge
ElFantasma 951d368
Merge branch 'discv5-server-findnode-handling' into discv5-server-han…
ElFantasma bb8dfcb
Merge branch 'discv5-server-handshake-handling' into discv5-server-ra…
ElFantasma a7efd0f
Merge branch 'discv5-server-rate-limit' into discv5-server-enr-update…
ElFantasma f52d05a
Merge branch 'main' into discv5-server-ping-pong-workflow
ElFantasma 2ce3abe
Merge branch 'discv5-server-ping-pong-workflow' into discv5-server-fi…
ElFantasma a13be93
Merge branch 'discv5-server-findnode-handling' into discv5-server-han…
ElFantasma d7e4916
Merge branch 'discv5-server-handshake-handling' into discv5-server-ra…
ElFantasma 6cd7208
Merge branch 'discv5-server-rate-limit' into discv5-server-enr-update…
ElFantasma eb35886
Merge branch 'main' into discv5-server-findnode-handling
ElFantasma 2f4c387
Merge branch 'discv5-server-findnode-handling' into discv5-server-han…
ElFantasma 5cdde1d
Merge branch 'discv5-server-handshake-handling' into discv5-server-ra…
ElFantasma dee4d7b
Merge branch 'discv5-server-rate-limit' into discv5-server-enr-update…
ElFantasma 5eb63f1
Merge branch 'main' into discv5-server-findnode-handling
ElFantasma fd05a99
Merge branch 'discv5-server-findnode-handling' into discv5-server-han…
ElFantasma c86ae64
Merge branch 'discv5-server-handshake-handling' into discv5-server-ra…
ElFantasma 33ac9d9
Merge branch 'discv5-server-rate-limit' into discv5-server-enr-update…
ElFantasma 8981cb1
Merge branch 'main' into discv5-server-handshake-handling
ElFantasma 87bbc11
Merge branch 'discv5-server-handshake-handling' into discv5-server-ra…
ElFantasma 315bfeb
Merge branch 'discv5-server-rate-limit' into discv5-server-enr-update…
ElFantasma 68d8473
Merge branch 'main' into discv5-server-rate-limit
ElFantasma e61cc4c
Merge branch 'discv5-server-rate-limit' into discv5-server-enr-update…
ElFantasma 880d5c4
Merge branch 'main' into discv5-server-enr-update-on-pong
ElFantasma b766e21
Merge branch 'main' into discv5-server-enr-update-on-pong
ElFantasma 7ce78de
fix(l1): generate fresh req_id for FINDNODE on ENR mismatch, extract …
ElFantasma f7d2120
fix(l1): don't swallow errors in test_enr_update_request_on_pong
ElFantasma 9aa9095
cargo fmt
ElFantasma 38e11d1
fix(l1): remove unnecessary clone in handle_pong
ElFantasma c3768dd
fix(l1): use > instead of != for enr_seq comparison in handle_pong
ElFantasma d624d88
fix(l1): update existing contact ENR on NODES response
ElFantasma a1a0e15
fix(l1): defer fork-id validation and handle missing record in ENR up…
ElFantasma e21d523
Merge branch 'main' into fix/update-existing-contact-enr-on-nodes-res…
ElFantasma 1f39ea9
refactor(l1): extract evaluate_fork_id helper in new_contact_records
ElFantasma 5d52f9b
fix(l1): reset validation state when contact IP/port changes on ENR u…
ElFantasma c413edc
Merge branch 'main' into fix/update-existing-contact-enr-on-nodes-res…
ElFantasma 33ad9a6
Merge branch 'main' into fix/update-existing-contact-enr-on-nodes-res…
ElFantasma 36057d1
Merge branch 'main' into fix/update-existing-contact-enr-on-nodes-res…
ElFantasma 1cab0d1
cargo fmt
ElFantasma File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When updating an existing contact in the Occupied branch, contact.node = node can change the contact's IP address, but validation_timestamp is not reset. The validate_contact method (line 798) relies on was_validated() + an IP match to prevent amplification attacks (see the anti-amplification comment on lines 806-809). After this update, a previously-validated contact now appears validated at a new IP it was never actually pinged at.
Attack scenario: A malicious node M, previously validated at IP_M, creates a legitimately-signed ENR with IP_victim and higher seq. When this ENR arrives in a NODES response, we update M's contact: node.ip = IP_victim, while validation_timestamp is preserved. A spoofed FindNode packet with src = IP_victim now passes validate_contact, causing us to send a large NODES response to the victim.
The fix would be to check if the IP changed and, if so, reset validation_timestamp (and ping_req_id). This is a new concern — on main, new_contact_records only inserted vacant entries, so a contact's IP could never change through this path.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The specific attack scenario doesn't quite work as described. Let me trace through it:
In discv5, messages are encrypted with session keys established via ECDH handshake. A third party can't forge a FindNode as node M without M's session key.
More importantly,
validate_contact(which checkssender_ip == contact.node.ip) is not called in the discv5handle_find_nodehandler at all — that check only exists in discv4. Sovalidation_timestampis irrelevant to this path.handle_find_noderesponds tocontact.node.udp_addr()(the stored IP from the ENR), not to the actualsender_addrfrom the UDP packet. This is a pre-existing behavior — before this PR, the handler was already responding to the stored contact IP without any IP check.What our PR changes: it makes it possible for a peer to update its stored IP via a NODES response (previously only possible during initial discovery). This marginally broadens the existing issue but doesn't create it.
The real pre-existing issue is that discv5's
handle_find_nodelacks the anti-amplification defense that discv4 has. The proper fix (as a separate PR) would be:sender_addrtohandle_find_nodeand respond to it instead ofcontact.node.udp_addr()sender_addr.ip() == contact.node.ipcheck (like discv4'svalidate_contact)Neither alone is sufficient (responding to stored IP allows ENR-based redirection; responding to sender_addr alone allows UDP spoofing), but together they make amplification much harder.
That said, resetting
validation_timestampon IP change is cheap and reasonable as defense-in-depth — happy to add it. But it won't fix the actual gap sincevalidate_contactisn't used in the discv5 FindNode path.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added the validation_timestamp + ping_req_id reset when IP or UDP port changes: 5d52f9b
Also opened #6199 for the pre-existing anti-amplification gap in discv5's
handle_find_node.