Detect some simple classes of evil spy nodes
[dnsseed-rust] / src / main.rs
index 30c363541ceacd3f269c0aa676da6b95afb18c10..4bf93510c5e3aaa41ba8fb38e8c4356965f3af73 100644 (file)
@@ -24,6 +24,7 @@ use printer::{Printer, Stat};
 use peer::Peer;
 use datastore::{AddressState, Store, U64Setting, RegexSetting};
 use timeout_stream::TimeoutStream;
+use rand::Rng;
 
 use tokio::prelude::*;
 use tokio::timer::Delay;
@@ -44,8 +45,10 @@ struct PeerState {
        fail_reason: AddressState,
        recvd_version: bool,
        recvd_verack: bool,
+       recvd_pong: bool,
        recvd_addrs: bool,
        recvd_block: bool,
+       pong_nonce: u64,
 }
 
 pub fn scan_node(scan_time: Instant, node: SocketAddr, manual: bool) {
@@ -53,16 +56,20 @@ pub fn scan_node(scan_time: Instant, node: SocketAddr, manual: bool) {
        let printer = unsafe { PRINTER.as_ref().unwrap() };
        let store = unsafe { DATA_STORE.as_ref().unwrap() };
 
+       let mut rng = rand::thread_rng();
        let peer_state = Arc::new(Mutex::new(PeerState {
                recvd_version: false,
                recvd_verack: false,
+               recvd_pong: false,
                recvd_addrs: false,
                recvd_block: false,
+               pong_nonce: rng.gen(),
                node_services: 0,
                fail_reason: AddressState::Timeout,
                msg: (String::new(), false),
                request: Arc::clone(&unsafe { REQUEST_BLOCK.as_ref().unwrap() }.lock().unwrap()),
        }));
+       let err_peer_state = Arc::clone(&peer_state);
        let final_peer_state = Arc::clone(&peer_state);
 
        let peer = Delay::new(scan_time).then(move |_| {
@@ -71,7 +78,19 @@ pub fn scan_node(scan_time: Instant, node: SocketAddr, manual: bool) {
                Peer::new(node.clone(), Duration::from_secs(timeout), printer)
        });
        tokio::spawn(peer.and_then(move |(mut write, read)| {
-               TimeoutStream::new_timeout(read, scan_time + Duration::from_secs(store.get_u64(U64Setting::RunTimeout))).map_err(|_| { () }).for_each(move |msg| {
+               TimeoutStream::new_timeout(read, scan_time + Duration::from_secs(store.get_u64(U64Setting::RunTimeout))).map_err(move |err| {
+                       match err {
+                               bitcoin::consensus::encode::Error::UnrecognizedNetworkCommand(ref msg) => {
+                                       // If we got here, we hit one of the explicitly disallowed messages indicating
+                                       // a bogus "node".
+                                       let mut state_lock = err_peer_state.lock().unwrap();
+                                       state_lock.msg = (format!("(bad msg type {})", msg), true);
+                                       state_lock.fail_reason = AddressState::EvilNode;
+                               },
+                               _ => {},
+                       }
+                       ()
+               }).for_each(move |msg| {
                        let mut state_lock = peer_state.lock().unwrap();
                        macro_rules! check_set_flag {
                                ($recvd_flag: ident, $msg: expr) => { {
@@ -122,7 +141,7 @@ pub fn scan_node(scan_time: Instant, node: SocketAddr, manual: bool) {
                                },
                                NetworkMessage::Verack => {
                                        check_set_flag!(recvd_verack, "verack");
-                                       if let Err(_) = write.try_send(NetworkMessage::GetAddr) {
+                                       if let Err(_) = write.try_send(NetworkMessage::Ping(state_lock.pong_nonce)) {
                                                return future::err(());
                                        }
                                },
@@ -131,6 +150,17 @@ pub fn scan_node(scan_time: Instant, node: SocketAddr, manual: bool) {
                                                return future::err(())
                                        }
                                },
+                               NetworkMessage::Pong(v) => {
+                                       if v != state_lock.pong_nonce {
+                                               state_lock.fail_reason = AddressState::ProtocolViolation;
+                                               state_lock.msg = ("due to invalid pong nonce".to_string(), true);
+                                               return future::err(());
+                                       }
+                                       check_set_flag!(recvd_pong, "pong");
+                                       if let Err(_) = write.try_send(NetworkMessage::GetAddr) {
+                                               return future::err(());
+                                       }
+                               },
                                NetworkMessage::Addr(addrs) => {
                                        if addrs.len() > 1000 {
                                                state_lock.fail_reason = AddressState::ProtocolViolation;
@@ -160,6 +190,20 @@ pub fn scan_node(scan_time: Instant, node: SocketAddr, manual: bool) {
                                        check_set_flag!(recvd_block, "block");
                                        return future::err(());
                                },
+                               NetworkMessage::Inv(invs) => {
+                                       for inv in invs {
+                                               if inv.inv_type == InvType::Transaction {
+                                                       state_lock.fail_reason = AddressState::EvilNode;
+                                                       state_lock.msg = ("due to unrequested inv tx".to_string(), true);
+                                                       return future::err(());
+                                               }
+                                       }
+                               },
+                               NetworkMessage::Tx(_) => {
+                                       state_lock.fail_reason = AddressState::EvilNode;
+                                       state_lock.msg = ("due to unrequested transaction".to_string(), true);
+                                       return future::err(());
+                               },
                                _ => {},
                        }
                        future::ok(())
@@ -172,7 +216,7 @@ pub fn scan_node(scan_time: Instant, node: SocketAddr, manual: bool) {
                printer.set_stat(Stat::ConnectionClosed);
 
                let mut state_lock = final_peer_state.lock().unwrap();
-               if state_lock.recvd_version && state_lock.recvd_verack &&
+               if state_lock.recvd_version && state_lock.recvd_verack && state_lock.recvd_pong &&
                                state_lock.recvd_addrs && state_lock.recvd_block {
                        let old_state = store.set_node_state(node, AddressState::Good, state_lock.node_services);
                        if manual || (old_state != AddressState::Good && state_lock.msg.0 != "") {
@@ -181,7 +225,9 @@ pub fn scan_node(scan_time: Instant, node: SocketAddr, manual: bool) {
                } else {
                        assert!(state_lock.fail_reason != AddressState::Good);
                        if state_lock.fail_reason == AddressState::TimeoutDuringRequest && state_lock.recvd_version && state_lock.recvd_verack {
-                               if !state_lock.recvd_addrs {
+                               if !state_lock.recvd_pong {
+                                       state_lock.fail_reason = AddressState::TimeoutAwaitingPong;
+                               } else if !state_lock.recvd_addrs {
                                        state_lock.fail_reason = AddressState::TimeoutAwaitingAddr;
                                } else if !state_lock.recvd_block {
                                        state_lock.fail_reason = AddressState::TimeoutAwaitingBlock;
@@ -211,10 +257,13 @@ fn poll_dnsseeds() {
                }
                printer.add_line(format!("Added {} new addresses from other DNS seeds", new_addrs), false);
                Delay::new(Instant::now() + Duration::from_secs(60)).then(|_| {
-                       if !START_SHUTDOWN.load(Ordering::Relaxed) {
-                               poll_dnsseeds();
-                       }
-                       future::ok(())
+                       let store = unsafe { DATA_STORE.as_ref().unwrap() };
+                       store.save_data().then(|_| {
+                               if !START_SHUTDOWN.load(Ordering::Relaxed) {
+                                       poll_dnsseeds();
+                               }
+                               future::ok(())
+                       })
                })
        }));
 }
@@ -234,14 +283,11 @@ fn scan_net() {
                        scan_node(iter_time, node, false);
                        iter_time += per_iter_time;
                }
-               Delay::new(cmp::max(iter_time, start_time + Duration::from_secs(15))).then(|_| {
-                       let store = unsafe { DATA_STORE.as_ref().unwrap() };
-                       store.save_data().then(|_| {
-                               if !START_SHUTDOWN.load(Ordering::Relaxed) {
-                                       scan_net();
-                               }
-                               future::ok(())
-                       })
+               Delay::new(cmp::max(iter_time, start_time + Duration::from_secs(1))).then(|_| {
+                       if !START_SHUTDOWN.load(Ordering::Relaxed) {
+                               scan_net();
+                       }
+                       future::ok(())
                })
        }));
 }
@@ -306,7 +352,7 @@ fn make_trusted_conn(trusted_sockaddr: SocketAddr) {
                                                if top_height >= starting_height as u64 {
                                                        if let Err(_) = trusted_write.try_send(NetworkMessage::GetData(vec![Inventory {
                                                                inv_type: InvType::WitnessBlock,
-                                                               hash: height_map.get(&(top_height - 1008)).unwrap().clone(),
+                                                               hash: height_map.get(&(top_height - 216)).unwrap().clone(),
                                                        }])) {
                                                                return future::err(());
                                                        }
@@ -327,7 +373,7 @@ fn make_trusted_conn(trusted_sockaddr: SocketAddr) {
                                        let hash = block.header.bitcoin_hash();
                                        let header_map = unsafe { HEADER_MAP.as_ref().unwrap() }.lock().unwrap();
                                        let height = *header_map.get(&hash).expect("Got loose block from trusted peer we coulnd't have requested");
-                                       if height == unsafe { HIGHEST_HEADER.as_ref().unwrap() }.lock().unwrap().1 - 1008 {
+                                       if height == unsafe { HIGHEST_HEADER.as_ref().unwrap() }.lock().unwrap().1 - 216 {
                                                *unsafe { REQUEST_BLOCK.as_ref().unwrap() }.lock().unwrap() = Arc::new((height, hash, block));
                                                if !SCANNING.swap(true, Ordering::SeqCst) {
                                                        scan_net();