Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

autonat/README: Document DOS attack prevention #369

Merged
merged 2 commits into from
Oct 12, 2021
Merged

autonat/README: Document DOS attack prevention #369

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8ec73fc
autonat/README: Document DOS attack prevention
mxinden Oct 6, 2021
314ae0e
autonat/README: Reference RFC in first paragraph
mxinden Oct 12, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions autonat/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,6 +52,22 @@ Upon receiving this message, the peer starts to dial these addresses. It MAY
dial all of them in parallel. The peer MAY use a different IP and peer ID than
it uses for its regular libp2p connection to perform these dial backs.

In order to prevent attacks like the one described in [RFC 3489, Section
12.1.1](https://www.rfc-editor.org/rfc/rfc3489#section-12.1.1) (see excerpt
below), implementations MUST NOT dial any multiaddress unless it is based on the
IP address the requesting node is observed as.

> RFC 3489 12.1.1 Attack I: DDOS Against a Target
>
> In this case, the attacker provides a large number of clients with the same
> faked MAPPED-ADDRESS that points to the intended target. This will trick all
> the STUN clients into thinking that their addresses are equal to that of the
> target. The clients then hand out that address in order to receive traffic on
> it (for example, in SIP or H.323 messages). However, all of that traffic
> becomes focused at the intended target. The attack can provide substantial
> amplification, especially when used with clients that are using STUN to enable
> multimedia applications.

If all dials fail, the receiver sends a `DialResponse` message with the
`ResponseStatus` `E_DIAL_ERROR`. If at least one of the dials complete
successfully, it sends a `DialResponse` with the `ResponseStatus` `OK`. It
Expand Down