Adrien Beraud 6aee7ceb5c network: cache sessions only for address-validated peers ...

A session was cached for an address whenever we answered a peer there,
including replies to Initial and Hello envelopes, whose source address is
not verified. A spoofed Initial or Hello therefore replaced the session of
the real owner of the address, whose Data envelopes were then dropped until
a retry, and spoofed Initials from many addresses filled the cache and
evicted legitimate sessions, which were picked by address order.

Only cache a session for a peer whose ephemeral key arrived in a Session
or Data envelope, i.e. opened with our key for its address. Replies to
Initial and Hello envelopes derive their keys without caching them, so a
node that sent an Initial only confirms the session, and switches to Data
envelopes, once the peer answered a Session envelope. Evict the least
recently used session when the cache is full.

2026-10-29 23:28:48 -04:00

..

opendht

network: cache sessions only for address-validated peers

2026-10-29 23:28:48 -04:00

opendht.h

Switch project license from GPL-3.0-or-later to MIT

2026-01-17 22:25:43 -05:00