fix(net): gate peer traffic on hello validation and enforce timeout

common/src/main/java/org/tron/core/config/Parameter.java

@@ -98,6 +98,7 @@ public class NodeConstant {
   public class NetConstants {
 
     public static final long SYNC_FETCH_BATCH_NUM = 2000;
+    public static final long HELLO_TIME_OUT = 10000L;
     public static final long ADV_TIME_OUT = 20000L;
     public static final long SYNC_TIME_OUT = 5000L;
     public static final long NET_MAX_TRX_PER_SECOND = 700L;

framework/src/main/java/org/tron/core/net/P2pEventHandlerImpl.java

@@ -127,6 +127,18 @@ public void onMessage(Channel c, byte[] data) {
       return;
     }
 
+    if (data == null || data.length == 0) {
+      peerConnection.disconnect(Protocol.ReasonCode.BAD_PROTOCOL);
+      return;
+    }
+
+    if (peerConnection.getHelloMessageReceive() == null
+        && data[0] != MessageTypes.P2P_HELLO.asByte()
+        && data[0] != MessageTypes.P2P_DISCONNECT.asByte()) {
+      peerConnection.disconnect(Protocol.ReasonCode.BAD_PROTOCOL);
+      return;
+    }
+
     if (MessageTypes.PBFT_MSG.asByte() == data[0]) {
       PbftMessage message = null;
       try {

framework/src/main/java/org/tron/core/net/message/handshake/HelloMessage.java

@@ -4,22 +4,25 @@
 import lombok.Getter;
 import org.apache.commons.lang3.StringUtils;
 import org.tron.common.utils.ByteArray;
-import org.tron.common.utils.DecodeUtil;
 import org.tron.common.utils.Sha256Hash;
 import org.tron.common.utils.StringUtil;
 import org.tron.core.ChainBaseManager;
 import org.tron.core.capsule.BlockCapsule;
 import org.tron.core.config.args.Args;
 import org.tron.core.net.message.MessageTypes;
 import org.tron.core.net.message.TronMessage;
+import org.tron.p2p.base.Constant;
 import org.tron.p2p.discover.Node;
+import org.tron.p2p.utils.NetUtil;
 import org.tron.program.Version;
 import org.tron.protos.Discover.Endpoint;
 import org.tron.protos.Protocol;
 import org.tron.protos.Protocol.HelloMessage.Builder;
 
 public class HelloMessage extends TronMessage {
 
+  private static final int MAX_BYTE_SIZE = 200;
+
   @Getter
   private Protocol.HelloMessage helloMessage;
 
@@ -121,6 +124,10 @@ public Class<?> getAnswerMessage() {
 
   @Override
   public String toString() {
+    if (!valid()) {
+      return "P2P_HELLO: invalid hello message";
+    }
+
     StringBuilder builder = new StringBuilder();
 
     builder.append(super.toString())
@@ -156,6 +163,10 @@ public Protocol.HelloMessage getInstance() {
   }
 
   public boolean valid() {
+    if (!validEndPoint()) {
+      return false;
+    }
+
     byte[] genesisBlockByte = this.helloMessage.getGenesisBlockId().getHash().toByteArray();
     if (genesisBlockByte.length != Sha256Hash.LENGTH) {
       return false;
@@ -171,25 +182,46 @@ public boolean valid() {
       return false;
     }
 
-    int maxByteSize = 200;
     ByteString address = this.helloMessage.getAddress();
-    if (!address.isEmpty() && address.toByteArray().length > maxByteSize) {
+    if (!address.isEmpty() && address.toByteArray().length > MAX_BYTE_SIZE) {
       return false;
     }
 
     ByteString sig = this.helloMessage.getSignature();
-    if (!sig.isEmpty() && sig.toByteArray().length > maxByteSize) {
+    if (!sig.isEmpty() && sig.toByteArray().length > MAX_BYTE_SIZE) {
       return false;
     }
 
     ByteString codeVersion = this.helloMessage.getCodeVersion();
-    if (!codeVersion.isEmpty() && codeVersion.toByteArray().length > maxByteSize) {
+    if (!codeVersion.isEmpty() && codeVersion.toByteArray().length > MAX_BYTE_SIZE) {
       return false;
     }
 
     return true;
   }
 
+  public boolean validEndPoint() {
+    Endpoint from = this.helloMessage.getFrom();
+    ByteString ipv4 = from.getAddress();
+    ByteString ipv6 = from.getAddressIpv6();
+    if (from.getNodeId().size() != Constant.NODE_ID_LEN
+        || from.getPort() <= 0 || from.getPort() > 0xFFFF
+        || ipv4.size() > MAX_BYTE_SIZE || ipv6.size() > MAX_BYTE_SIZE) {
+      return false;
+    }
+    if (ipv4.isEmpty() && ipv6.isEmpty()) {
+      return false;
+    }
+    // Validate raw literals before getFrom() constructs a Node during logging.
+    if (!ipv4.isEmpty() && !NetUtil.validIpV4(ByteArray.toStr(ipv4.toByteArray()))) {
+      return false;
+    }
+    if (!ipv6.isEmpty() && !NetUtil.validIpV6(ByteArray.toStr(ipv6.toByteArray()))) {
+      return false;
+    }
+    return true;
+  }
+
   public static Endpoint getEndpointFromNode(Node node) {
     Endpoint.Builder builder = Endpoint.newBuilder()
         .setPort(node.getPort());

framework/src/main/java/org/tron/core/net/peer/PeerConnection.java

@@ -107,7 +107,7 @@ public class PeerConnection {
 
   @Setter
   @Getter
-  private HelloMessage helloMessageReceive;
+  private volatile HelloMessage helloMessageReceive;
 
   @Setter
   @Getter

framework/src/main/java/org/tron/core/net/peer/PeerStatusCheck.java

@@ -56,6 +56,14 @@ public void statusCheck() {
         isDisconnected = true;
       }
 
+      if (!isDisconnected) {
+        isDisconnected = peer.getHelloMessageReceive() == null
+            && peer.getChannel().getStartTime() <= now - NetConstants.HELLO_TIME_OUT;
+        if (isDisconnected) {
+          logger.warn("Peer {} hello message timeout", peer.getInetAddress());
+        }
+      }
+
       if (!isDisconnected) {
         isDisconnected = peer.getAdvInvRequest().values().stream()
             .anyMatch(time -> time < now - NetConstants.ADV_TIME_OUT);

framework/src/main/java/org/tron/core/net/service/handshake/HandshakeService.java

@@ -4,9 +4,7 @@
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
-import org.tron.common.utils.ByteArray;
 import org.tron.core.ChainBaseManager;
-import org.tron.core.ChainBaseManager.NodeType;
 import org.tron.core.config.args.Args;
 import org.tron.core.net.TronNetService;
 import org.tron.core.net.message.handshake.HelloMessage;
@@ -41,27 +39,29 @@ public void processHelloMessage(PeerConnection peer, HelloMessage msg) {
       return;
     }
 
+    if (!msg.valid()) {
+      logger.warn("Peer {} invalid hello message parameters, genesisHashLength: {}, "
+              + "solidHashLength: {}, headHashLength: {}, address: {}, sig: {}, codeVersion: {}, "
+              + "endpointValid: {}",
+          peer.getInetSocketAddress(),
+          msg.getInstance().getGenesisBlockId().getHash().size(),
+          msg.getInstance().getSolidBlockId().getHash().size(),
+          msg.getInstance().getHeadBlockId().getHash().size(),
+          msg.getInstance().getAddress().size(),
+          msg.getInstance().getSignature().size(),
+          msg.getInstance().getCodeVersion().size(),
+          msg.validEndPoint());
+      peer.disconnect(ReasonCode.INCOMPATIBLE_PROTOCOL);
+      return;
+    }
+
     TronNetService.getP2pService().updateNodeId(peer.getChannel(), msg.getFrom().getHexId());
     if (peer.isDisconnect()) {
       logger.info("Duplicate Peer {}", peer.getInetSocketAddress());
       peer.disconnect(ReasonCode.DUPLICATE_PEER);
       return;
     }
 
-    if (!msg.valid()) {
-      logger.warn("Peer {} invalid hello message parameters, GenesisBlockId: {}, SolidBlockId: {}, "
-              + "HeadBlockId: {}, address: {}, sig: {}, codeVersion: {}",
-          peer.getInetSocketAddress(),
-          ByteArray.toHexString(msg.getInstance().getGenesisBlockId().getHash().toByteArray()),
-          ByteArray.toHexString(msg.getInstance().getSolidBlockId().getHash().toByteArray()),
-          ByteArray.toHexString(msg.getInstance().getHeadBlockId().getHash().toByteArray()),
-          msg.getInstance().getAddress().toByteArray().length,
-          msg.getInstance().getSignature().toByteArray().length,
-          msg.getInstance().getCodeVersion().toByteArray().length);
-      peer.disconnect(ReasonCode.INCOMPATIBLE_PROTOCOL);
-      return;
-    }
-
     peer.setAddress(msg.getHelloMessage().getAddress());
 
     if (!relayService.checkHelloMessage(msg, peer.getChannel())) {