diff --git a/packages/core-http-utils/lib/plugins/whitelist.js b/packages/core-http-utils/lib/plugins/whitelist.js index fe640b6775..33cf8ac2d6 100644 --- a/packages/core-http-utils/lib/plugins/whitelist.js +++ b/packages/core-http-utils/lib/plugins/whitelist.js @@ -1,5 +1,4 @@ const Boom = require('boom') -const requestIp = require('request-ip') const mm = require('micromatch') const logger = require('@arkecosystem/core-container').resolvePlugin('logger') @@ -7,7 +6,7 @@ const register = async (server, options) => { server.ext({ type: 'onRequest', async method(request, h) { - const remoteAddress = requestIp.getClientIp(request) + const remoteAddress = request.info.remoteAddress if (Array.isArray(options.whitelist)) { for (const ip of options.whitelist) { diff --git a/packages/core-http-utils/package.json b/packages/core-http-utils/package.json index 6e6c3c81a5..9965a726f2 100644 --- a/packages/core-http-utils/package.json +++ b/packages/core-http-utils/package.json @@ -27,7 +27,6 @@ "inert": "^5.1.2", "lout": "^11.1.0", "micromatch": "^3.1.10", - "request-ip": "^2.1.3", "vision": "^5.4.3" }, "publishConfig": { diff --git a/packages/core-p2p/CHANGELOG.md b/packages/core-p2p/CHANGELOG.md index 368c2bf57f..53db9e08ff 100644 --- a/packages/core-p2p/CHANGELOG.md +++ b/packages/core-p2p/CHANGELOG.md @@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0. ## Unreleased +## 0.2.1 - 2018-12-11 + +### Fixed + +- Ensure no local peers are enlisted +- Ensure the IP of the TCP connection is used + ## 0.2.0 - 2018-12-03 ### Added diff --git a/packages/core-p2p/lib/server/plugins/accept-request.js b/packages/core-p2p/lib/server/plugins/accept-request.js index da727acc62..d766755687 100644 --- a/packages/core-p2p/lib/server/plugins/accept-request.js +++ b/packages/core-p2p/lib/server/plugins/accept-request.js @@ -1,5 +1,4 @@ const Boom = require('boom') -const requestIp = require('request-ip') const isWhitelisted = require('../../utils/is-whitelist') const monitor = require('../../monitor') @@ -15,7 +14,7 @@ const register = async (server, options) => { server.ext({ type: 'onRequest', async method(request, h) { - const remoteAddress = requestIp.getClientIp(request) + const remoteAddress = request.info.remoteAddress if (request.path.startsWith('/config')) { return h.continue diff --git a/packages/core-p2p/lib/server/versions/1/handlers.js b/packages/core-p2p/lib/server/versions/1/handlers.js index 6a7e12fbbf..a49f07e3fb 100644 --- a/packages/core-p2p/lib/server/versions/1/handlers.js +++ b/packages/core-p2p/lib/server/versions/1/handlers.js @@ -6,7 +6,6 @@ const { slots, crypto } = require('@arkecosystem/crypto') const { Block, Transaction } = require('@arkecosystem/crypto').models const Joi = require('@arkecosystem/crypto').validator.engine.joi -const requestIp = require('request-ip') const pluralize = require('pluralize') const transactionPool = app.resolvePlugin('transactionPool') @@ -240,7 +239,7 @@ exports.postBlock = { // missingIds = block.transactionIds.slice(0) // } // if (missingIds.length > 0) { - let peer = await monitor.getPeer(requestIp.getClientIp(request)) + let peer = await monitor.getPeer(request.info.remoteAddress) // only for test because it can be used for DDOS attack if (!peer && process.env.NODE_ENV === 'test_p2p') { peer = await monitor.getRandomPeer() @@ -270,7 +269,7 @@ exports.postBlock = { } // } else return { success: false } - block.ip = requestIp.getClientIp(request) + block.ip = request.info.remoteAddress blockchain.queueBlock(block) return { success: true } @@ -360,7 +359,7 @@ exports.getBlocks = { } logger.info( - `${requestIp.getClientIp(request)} has downloaded ${pluralize( + `${request.info.remoteAddress} has downloaded ${pluralize( 'block', blocks.length, true, diff --git a/packages/core-p2p/lib/server/versions/internal/handlers/blocks.js b/packages/core-p2p/lib/server/versions/internal/handlers/blocks.js index 11daf8ffb1..e99e97a784 100644 --- a/packages/core-p2p/lib/server/versions/internal/handlers/blocks.js +++ b/packages/core-p2p/lib/server/versions/internal/handlers/blocks.js @@ -1,5 +1,4 @@ const app = require('@arkecosystem/core-container') -const requestIp = require('request-ip') const schema = require('../schemas/blocks') /** @@ -12,7 +11,7 @@ exports.store = { * @return {Hapi.Response} */ handler: (request, h) => { - request.payload.block.ip = requestIp.getClientIp(request) + request.payload.block.ip = request.info.remoteAddress app.resolvePlugin('blockchain').queueBlock(request.payload.block) diff --git a/packages/core-p2p/lib/utils/is-myself.js b/packages/core-p2p/lib/utils/is-myself.js index da828c07a4..c60d6c975b 100644 --- a/packages/core-p2p/lib/utils/is-myself.js +++ b/packages/core-p2p/lib/utils/is-myself.js @@ -10,7 +10,11 @@ const os = require('os') module.exports = ipAddress => { const interfaces = os.networkInterfaces() - return Object.keys(interfaces).some(ifname => - interfaces[ifname].some(iface => iface.address === ipAddress), + return ( + ipAddress.startsWith('127.') || + ipAddress.startsWith('0.') || + Object.keys(interfaces).some(ifname => + interfaces[ifname].some(iface => iface.address === ipAddress), + ) ) } diff --git a/packages/core-p2p/package.json b/packages/core-p2p/package.json index 9dcc7f9c6e..90c395a07d 100644 --- a/packages/core-p2p/package.json +++ b/packages/core-p2p/package.json @@ -1,7 +1,7 @@ { "name": "@arkecosystem/core-p2p", "description": "P2P API for Ark Core", - "version": "0.2.0", + "version": "0.2.1", "contributors": [ "François-Xavier Thoorens ", "Kristjan Košič ", @@ -42,7 +42,6 @@ "micromatch": "^3.1.10", "pluralize": "^7.0.0", "pretty-ms": "^4.0.0", - "request-ip": "^2.1.3", "semver": "^5.6.0", "sntp": "^3.0.2" }, diff --git a/packages/core/CHANGELOG.md b/packages/core/CHANGELOG.md index 3ddcaf906b..efacb65ec8 100644 --- a/packages/core/CHANGELOG.md +++ b/packages/core/CHANGELOG.md @@ -7,6 +7,13 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0. ## Unreleased +## 2.0.14 - 2018-12-11 + +### Fixed + +- Ensure no local peers are enlisted +- Ensure the IP of the TCP connection is used + ## 2.0.13 - 2018-12-07 ### Fixed diff --git a/packages/core/lib/config/mainnet/peers.json b/packages/core/lib/config/mainnet/peers.json index e084b53d0d..b2d79f801e 100644 --- a/packages/core/lib/config/mainnet/peers.json +++ b/packages/core/lib/config/mainnet/peers.json @@ -1,5 +1,5 @@ { - "minimumVersion": ">=2.0.12", + "minimumVersion": ">=2.0.14", "minimumNetworkReach": 20, "globalTimeout": 5000, "coldStart": 30, diff --git a/packages/core/package.json b/packages/core/package.json index 7a86715e46..bbdd88914f 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,7 +1,7 @@ { "name": "@arkecosystem/core", "description": "Core of the Ark Blockchain", - "version": "2.0.13", + "version": "2.0.14", "contributors": [ "François-Xavier Thoorens ", "Kristjan Košič ", diff --git a/yarn.lock b/yarn.lock index 1f5ca425fa..4ca715656a 100644 --- a/yarn.lock +++ b/yarn.lock @@ -5633,13 +5633,13 @@ hapi-pagination@^2.0.1: hoek "^5.0.2" joi "^13.0.2" -hapi-rate-limit@^2.1.4: - version "2.1.4" - resolved "https://registry.yarnpkg.com/hapi-rate-limit/-/hapi-rate-limit-2.1.4.tgz#bd2b15465faea6d7c2b3aad05f015ee628cc0005" - integrity sha512-xNZColWoYdoOKXEIC6GX4LJ4TUqpzaR4u/XZdq40/O2JYovENhQPc3ChnWHdToKA0o0QkNsBXR8tTrBDoNjEEQ== +hapi-rate-limit@^3.0.0: + version "3.0.0" + resolved "https://registry.yarnpkg.com/hapi-rate-limit/-/hapi-rate-limit-3.0.0.tgz#70d121e2007e3736dfd679f1373eed32289834a2" + integrity sha512-AvzAH3nMSh0t11a69PpCHjuVSKi6/J0kOT7lN68XAi5Yo/K9VD3svjYCH+Fy1dfRwQRgnaXOxJQHUDvkf2sRYw== dependencies: boom "^7.2.0" - hoek "^6.0.0" + joi "^14.3.0" hapi-trailing-slash@^3.0.1: version "3.0.1" @@ -5837,7 +5837,7 @@ hoek@6.x.x: resolved "https://registry.yarnpkg.com/hoek/-/hoek-6.0.4.tgz#8db638130825534575e8e4e80f97ca66108e6382" integrity sha512-9D47elppcwrTx2x9B6TrovxnUtlTBYFcHGgo0+LRA1+YfUkCecT//41ovdh6zbl7whB9Hc2whRO1c6lzPoTgww== -hoek@^6.0.0, hoek@^6.1.1: +hoek@^6.1.1: version "6.1.1" resolved "https://registry.yarnpkg.com/hoek/-/hoek-6.1.1.tgz#dae8ca1c97b091b123281d87d4eba38d71580b7d" integrity sha512-q60PigXXRtRFSe1+Eal3y/wlIq5weFsYPiyulkg1EAObgWhkDqSwj4xqgtd7qT3IpS6e4eLigyMWH6duPRI7QA== @@ -6598,11 +6598,6 @@ is-wsl@^1.1.0: resolved "https://registry.yarnpkg.com/is-wsl/-/is-wsl-1.1.0.tgz#1f16e4aa22b04d1336b66188a66af3c600c3a66d" integrity sha1-HxbkqiKwTRM2tmGIpmrzxgDDpm0= -is_js@^0.9.0: - version "0.9.0" - resolved "https://registry.yarnpkg.com/is_js/-/is_js-0.9.0.tgz#0ab94540502ba7afa24c856aa985561669e9c52d" - integrity sha1-CrlFQFArp6+iTIVqqYVWFmnpxS0= - isarray@0.0.1: version "0.0.1" resolved "https://registry.yarnpkg.com/isarray/-/isarray-0.0.1.tgz#8a18acfca9a8f4177e09abfc6038939b05d1eedf" @@ -10415,13 +10410,6 @@ repeating@^2.0.0: dependencies: is-finite "^1.0.0" -request-ip@^2.1.3: - version "2.1.3" - resolved "https://registry.yarnpkg.com/request-ip/-/request-ip-2.1.3.tgz#99ab2bafdeaf2002626e28083cb10597511d9e14" - integrity sha512-J3qdE/IhVM3BXkwMIVO4yFrvhJlU3H7JH16+6yHucadT4fePnR8dyh+vEs6FIx0S2x5TCt2ptiPfHcn0sqhbYQ== - dependencies: - is_js "^0.9.0" - request-promise-core@1.1.1: version "1.1.1" resolved "https://registry.yarnpkg.com/request-promise-core/-/request-promise-core-1.1.1.tgz#3eee00b2c5aa83239cfb04c5700da36f81cd08b6"