Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

add consensus ip whitelist #3311

Merged
merged 12 commits into from
Jul 11, 2024
Merged

add consensus ip whitelist #3311

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
9c6864e
add consensus ip whitelist
chengzhinei Jul 5, 2024
445abd6
fmt code
chengzhinei Jul 5, 2024
aefc3f3
hanle fastsync and evidence
Jul 8, 2024
8867016
add enableConsensusIPWhitelist
Jul 8, 2024
c73afcb
use map
Jul 9, 2024
ba15cbf
fmt code
Jul 9, 2024
78a9864
consensus to p2p
Jul 9, 2024
002a8b7
consensus to p2p
Jul 9, 2024
e81192f
let status rsp addr empty
Jul 9, 2024
71dd5cf
fix map nil
chengzhinei Jul 10, 2024
d78755a
fix map nil
chengzhinei Jul 10, 2024
06268fc
fix map del
chengzhinei Jul 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions app/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -137,6 +137,9 @@ type OecConfig struct {
maxSubscriptionClients int

maxTxLimitPerPeer uint64

enableConsensusIPWhitelist bool
consensusIPWhitelist []string
}

const (
Expand Down Expand Up @@ -175,6 +178,8 @@ const (
FlagCsTimeoutPrecommit = "consensus.timeout_precommit"
FlagCsTimeoutPrecommitDelta = "consensus.timeout_precommit_delta"
FlagCsTimeoutCommit = "consensus.timeout_commit"
FlagEnableConsensusIPWhitelist = "consensus.enable_ip_whitelist"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

p2p.enable_ip_whitelist,p2p.ip_whiteklist much better

FlagConsensusIPWhitelist = "consensus.ip_whitelist"
FlagEnableHasBlockPartMsg = "enable-blockpart-ack"
FlagDebugGcInterval = "debug.gc-interval"
FlagCommitGapOffset = "commit-gap-offset"
Expand Down Expand Up @@ -331,6 +336,8 @@ func (c *OecConfig) loadFromConfig() {
c.SetCommitGapHeight(viper.GetInt64(server.FlagCommitGapHeight))
c.SetSentryAddrs(viper.GetString(FlagSentryAddrs))
c.SetNodeKeyWhitelist(viper.GetString(FlagNodeKeyWhitelist))
c.SetEnableConsensusIPWhitelist(viper.GetBool(FlagEnableConsensusIPWhitelist))
c.SetConsensusIPWhitelist(viper.GetString(FlagConsensusIPWhitelist))
c.SetEnableWtx(viper.GetBool(FlagEnableWrappedTx))
c.SetEnableAnalyzer(viper.GetBool(trace.FlagEnableAnalyzer))
c.SetDeliverTxsExecuteMode(viper.GetInt(state.FlagDeliverTxsExecMode))
Expand Down Expand Up @@ -511,6 +518,14 @@ func (c *OecConfig) updateFromKVStr(k, v string) {
c.SetPendingPoolBlacklist(v)
case FlagNodeKeyWhitelist:
c.SetNodeKeyWhitelist(v)
case FlagEnableConsensusIPWhitelist:
r, err := strconv.ParseBool(v)
if err != nil {
return
}
c.SetEnableConsensusIPWhitelist(r)
case FlagConsensusIPWhitelist:
c.SetConsensusIPWhitelist(v)
case FlagMempoolCheckTxCost:
r, err := strconv.ParseBool(v)
if err != nil {
Expand Down Expand Up @@ -810,6 +825,14 @@ func (c *OecConfig) GetNodeKeyWhitelist() []string {
return c.nodeKeyWhitelist
}

func (c *OecConfig) GetEnableConsensusIPWhitelist() bool {
return c.enableConsensusIPWhitelist
}

func (c *OecConfig) GetConsensusIPWhitelist() []string {
return c.consensusIPWhitelist
}

func (c *OecConfig) GetMempoolCheckTxCost() bool {
return c.mempoolCheckTxCost
}
Expand All @@ -831,6 +854,17 @@ func (c *OecConfig) SetNodeKeyWhitelist(value string) {
}
}

func (c *OecConfig) SetEnableConsensusIPWhitelist(value bool) {
c.enableConsensusIPWhitelist = value
}

func (c *OecConfig) SetConsensusIPWhitelist(value string) {
ipList := resolveNodeKeyWhitelist(value)
for _, ip := range ipList {
c.consensusIPWhitelist = append(c.consensusIPWhitelist, strings.TrimSpace(ip))
}
}

func (c *OecConfig) GetSentryAddrs() []string {
return c.sentryAddrs
}
Expand Down
15 changes: 15 additions & 0 deletions libs/tendermint/blockchain/v0/reactor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (

amino "github.com/tendermint/go-amino"

cfg "github.com/okex/exchain/libs/tendermint/config"
"github.com/okex/exchain/libs/tendermint/libs/log"
"github.com/okex/exchain/libs/tendermint/p2p"
sm "github.com/okex/exchain/libs/tendermint/state"
Expand Down Expand Up @@ -202,6 +203,20 @@ func (bcR *BlockchainReactor) respondToPeer(msg *bcBlockRequestMessage,

// Receive implements Reactor by handling 4 types of messages (look below).
func (bcR *BlockchainReactor) Receive(chID byte, src p2p.Peer, msgBytes []byte) {
if cfg.DynamicConfig.GetEnableConsensusIPWhitelist() {
okIP := false
for _, ip := range cfg.DynamicConfig.GetConsensusIPWhitelist() {
chengzhinei marked this conversation as resolved.
Show resolved Hide resolved
chengzhinei marked this conversation as resolved.
Show resolved Hide resolved
if src.RemoteIP().String() == ip {
okIP = true
break
}
}
if !okIP {
bcR.Logger.Error("consensus msg:IP not in whitelist", "IP", src.RemoteIP().String())
return
}
}

msg, err := decodeMsg(msgBytes)
if err != nil {
bcR.Logger.Error("Error decoding message", "src", src, "chId", chID, "msg", msg, "err", err, "bytes", msgBytes)
Expand Down
8 changes: 8 additions & 0 deletions libs/tendermint/config/dynamic_config_okchain.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,8 @@ type IDynamicConfig interface {
GetMaxSubscriptionClients() int
GetPendingPoolBlacklist() string
GetMaxTxLimitPerPeer() uint64
GetEnableConsensusIPWhitelist() bool
GetConsensusIPWhitelist() []string
}

var DynamicConfig IDynamicConfig = MockDynamicConfig{}
Expand Down Expand Up @@ -233,3 +235,9 @@ func (d MockDynamicConfig) GetPendingPoolBlacklist() string {
func (c MockDynamicConfig) GetMaxTxLimitPerPeer() uint64 {
return DefaultMempoolConfig().MaxTxLimitPerPeer
}

func (c MockDynamicConfig) GetEnableConsensusIPWhitelist() bool { return false }

func (c MockDynamicConfig) GetConsensusIPWhitelist() []string {
return []string{}
}
20 changes: 17 additions & 3 deletions libs/tendermint/consensus/reactor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,17 +3,17 @@ package consensus
import (
"bytes"
"fmt"
"github.com/okex/exchain/libs/tendermint/crypto"
"github.com/okex/exchain/libs/tendermint/libs/automation"
"reflect"
"sync"
"time"

"github.com/pkg/errors"

amino "github.com/tendermint/go-amino"

cfg "github.com/okex/exchain/libs/tendermint/config"
cstypes "github.com/okex/exchain/libs/tendermint/consensus/types"
"github.com/okex/exchain/libs/tendermint/crypto"
"github.com/okex/exchain/libs/tendermint/libs/automation"
"github.com/okex/exchain/libs/tendermint/libs/bits"
tmevents "github.com/okex/exchain/libs/tendermint/libs/events"
"github.com/okex/exchain/libs/tendermint/libs/log"
Expand Down Expand Up @@ -343,6 +343,20 @@ func (conR *Reactor) Receive(chID byte, src p2p.Peer, msgBytes []byte) {
return
}

if cfg.DynamicConfig.GetEnableConsensusIPWhitelist() {
okIP := false
for _, ip := range cfg.DynamicConfig.GetConsensusIPWhitelist() {
chengzhinei marked this conversation as resolved.
Show resolved Hide resolved
if src.RemoteIP().String() == ip {
okIP = true
break
}
}
if !okIP {
conR.Logger.Error("consensus msg:IP not in whitelist", "IP", src.RemoteIP().String())
return
}
}

msg, err := decodeMsg(msgBytes)
if err != nil {
conR.Logger.Error("Error decoding message", "src", src, "chId", chID, "msg", msg, "err", err, "bytes", msgBytes)
Expand Down
15 changes: 15 additions & 0 deletions libs/tendermint/evidence/reactor.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (

amino "github.com/tendermint/go-amino"

cfg "github.com/okex/exchain/libs/tendermint/config"
clist "github.com/okex/exchain/libs/tendermint/libs/clist"
"github.com/okex/exchain/libs/tendermint/libs/log"
"github.com/okex/exchain/libs/tendermint/p2p"
Expand Down Expand Up @@ -63,6 +64,20 @@ func (evR *Reactor) AddPeer(peer p2p.Peer) {
// Receive implements Reactor.
// It adds any received evidence to the evpool.
func (evR *Reactor) Receive(chID byte, src p2p.Peer, msgBytes []byte) {
if cfg.DynamicConfig.GetEnableConsensusIPWhitelist() {
okIP := false
for _, ip := range cfg.DynamicConfig.GetConsensusIPWhitelist() {
chengzhinei marked this conversation as resolved.
Show resolved Hide resolved
if src.RemoteIP().String() == ip {
okIP = true
break
}
}
if !okIP {
evR.Logger.Error("consensus msg:IP not in whitelist", "IP", src.RemoteIP().String())
return
}
}

msg, err := decodeMsg(msgBytes)
if err != nil {
evR.Logger.Error("Error decoding message", "src", src, "chId", chID, "msg", msg, "err", err, "bytes", msgBytes)
Expand Down
Loading