Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Possible exploit - block inventory spam #476

Closed
flound1129 opened this issue Apr 17, 2014 · 28 comments
Closed

Possible exploit - block inventory spam #476

flound1129 opened this issue Apr 17, 2014 · 28 comments

Comments

@flound1129
Copy link

Wallt getting spammed constantly with messages like these. I have seen this with several other scrypt coins. Wallet starts using huge amounts of data transfer, spamming disk logs with info, and using tons of cpu.

2014-04-17 20:45:52 getblocks stopping at limit 80215 cd99fff87d39080f616ac28a3aa987fb8ff50dde0e57258a43c4790534259dca
2014-04-17 20:45:52 sending: inv (18003 bytes)
2014-04-17 20:45:52 sending: inv (73 bytes)
2014-04-17 20:45:52 received: inv (37 bytes)
2014-04-17 20:45:52 got inventory: tx 1dd5da5a819fbe17ededcab8d0e107e4bbe5f16f4b629af1caa7124e2dba9fd3 have
2014-04-17 20:45:52 received: inv (37 bytes)
2014-04-17 20:45:52 got inventory: tx 1dd5da5a819fbe17ededcab8d0e107e4bbe5f16f4b629af1caa7124e2dba9fd3 have
2014-04-17 20:45:52 received: getdata (37 bytes)
2014-04-17 20:45:52 received getdata (1 invsz)
2014-04-17 20:45:52 received getdata for: tx 06268a935536caae5616a59650c46bce1a514a2f79b4d0dd1bb8dc6a4d0f048a
2014-04-17 20:45:52 sending: tx (521 bytes)
2014-04-17 20:45:52 received: inv (37 bytes)
2014-04-17 20:45:52 got inventory: tx 1dd5da5a819fbe17ededcab8d0e107e4bbe5f16f4b629af1caa7124e2dba9fd3 have
2014-04-17 20:45:52 received: inv (37 bytes)
2014-04-17 20:45:52 got inventory: tx 1dd5da5a819fbe17ededcab8d0e107e4bbe5f16f4b629af1caa7124e2dba9fd3 have
2014-04-17 20:45:52 received: addr (31 bytes)
2014-04-17 20:45:52 received: getblocks (933 bytes)
2014-04-17 20:45:52 getblocks 80216 to 0000000000000000000000000000000000000000000000000000000000000000 limit 500
2014-04-17 20:45:52 getblocks stopping at limit 80715 e833bca6e7f2a331edb2ef91eb10b1ecbf55f673798f76e253c56b2441fa9f6b
2014-04-17 20:45:52 sending: inv (18003 bytes)
2014-04-17 20:45:52 received: inv (73 bytes)
2014-04-17 20:45:52 got inventory: tx 5c5999c4300e2640ad6e2bd708f70a364a85014d81b7538125d7b371bb7c55cf have
2014-04-17 20:45:52 got inventory: tx 1dd5da5a819fbe17ededcab8d0e107e4bbe5f16f4b629af1caa7124e2dba9fd3 have
2014-04-17 20:45:52 received: getblocks (933 bytes)
2014-04-17 20:45:52 getblocks 80716 to 0000000000000000000000000000000000000000000000000000000000000000 limit 500
2014-04-17 20:45:52 getblocks stopping at limit 81215 ecd3de91892ed2ffc4ecef7a8d0606c539d490ffc0f481f856c4e2b8a065b3ca
2014-04-17 20:45:52 sending: inv (18003 bytes)
2014-04-17 20:45:52 received: inv (37 bytes)
2014-04-17 20:45:52 got inventory: tx 1dd5da5a819fbe17ededcab8d0e107e4bbe5f16f4b629af1caa7124e2dba9fd3 have
2014-04-17 20:45:52 received: inv (37 bytes)
2014-04-17 20:45:52 got inventory: tx 1dd5da5a819fbe17ededcab8d0e107e4bbe5f16f4b629af1caa7124e2dba9fd3 have
2014-04-17 20:45:52 received: inv (73 bytes)
2014-04-17 20:45:52 got inventory: tx 5c5999c4300e2640ad6e2bd708f70a364a85014d81b7538125d7b371bb7c55cf have
2014-04-17 20:45:52 got inventory: tx 1dd5da5a819fbe17ededcab8d0e107e4bbe5f16f4b629af1caa7124e2dba9fd3 have
2014-04-17 20:45:52 received: inv (37 bytes)
2014-04-17 20:45:52 got inventory: tx 1dd5da5a819fbe17ededcab8d0e107e4bbe5f16f4b629af1caa7124e2dba9fd3 have
2014-04-17 20:45:52 received: getblocks (933 bytes)
2014-04-17 20:45:52 getblocks 81216 to 0000000000000000000000000000000000000000000000000000000000000000 limit 500
2014-04-17 20:45:52 getblocks stopping at limit 81715 d3966271ae821fd8143597b00a1e18ae408243f382304a342b915fa44d01f738
2014-04-17 20:45:52 sending: inv (18003 bytes)
2014-04-17 20:45:52 received: addr (31 bytes)

@patricklodder
Copy link
Member

Is this happening on 1.6 or 1.7?

@flound1129
Copy link
Author

1.6

@rnicoll
Copy link
Contributor

rnicoll commented Apr 17, 2014

Can you try 1.7, see if that fixes this? It's a major re-engineering under the hood, should be a lot more robust....

@flound1129
Copy link
Author

Is 1.7 stable for mining?
On Apr 17, 2014 5:18 PM, "Ross Nicoll" notifications@github.com wrote:

Can you try 1.7, see if that fixes this? It's a major re-engineering under
the hood, should be a lot more robust....

Reply to this email directly or view it on GitHubhttps://github.com//issues/476#issuecomment-40764092
.

@rnicoll
Copy link
Contributor

rnicoll commented Apr 17, 2014

I've had it running as a miner on the test network for 5-ish days in a row with no hiccups, so... you'd probably be first big test on live, but I think we're ready for it. Would want @langerhans or @leofidus to give a thumbs-up too, though.

@leofidus
Copy link
Contributor

I've used 1.7 a lot for solo mining on the testnet, and have been doing that for longer than this is an official Dogecoin branch. Using it for larger-scale mining should be safe and it would be great to get a few testers before the official release.

@flound1129
Copy link
Author

I'll test it out on one of my nodes, and if it works out OK I'll move it to the other two.

@flound1129
Copy link
Author

Getting this error when trying to compile:

/usr/bin/ld: ../src/leveldb/libleveldb.a(db_impl.o): relocation R_X86_64_32S against _ZTVN7leveldb2DBE' can not be used when making a shared object; recompile with -fPIC ../src/leveldb/libleveldb.a: error adding symbols: Bad value collect2: error: ld returned 1 exit status make[3]: *** [dogecoind] Error 1 make[3]: Leaving directory/home/wallets/source/dogecoin/src'
make[2]: *** [all-recursive] Error 1
make[2]: Leaving directory /home/wallets/source/dogecoin/src' make[1]: *** [all] Error 2 make[1]: Leaving directory/home/wallets/source/dogecoin/src'
make: *** [all-recursive] Error 1

configure is simple ./configure --gui=no --with-incompatible-bdb

@rnicoll
Copy link
Contributor

rnicoll commented Apr 18, 2014

Looks like something's gone wrong with the configure process. One thing to try first would be to "make distclean" in the top directory, clear everything out, then run "./autogen.sh" and "./configure" again.

Failing that, what's your build OS and I'll try reproducing the problem over the weekend?

@rnicoll
Copy link
Contributor

rnicoll commented Apr 18, 2014

Oh, meant to ask, which other Scrypt wallets are you seeing this with?

@flound1129
Copy link
Author

I've noticed it on both MOON and TIPS as well. I did not spend much time troubleshooting the compile issue, I just added -fPIC to the CFLAGS in the Makefile.

@rnicoll
Copy link
Contributor

rnicoll commented Apr 18, 2014

Adding -fPIC should solve this, but I'd still like to see if I can recreate the problem so we can get a permanent solution. What OS are you building on?

@langerhans
Copy link
Member

Compilation issue: bitcoin/bitcoin#3864
cd src/leveldb; make clean

@flound1129
Copy link
Author

Ubuntu Trusty
On Apr 18, 2014 12:25 PM, "Ross Nicoll" notifications@github.com wrote:

Adding -fPIC should solve this, but I'd still like to see if I can
recreate the problem so we can get a permanent solution. What OS are you
building on?

Reply to this email directly or view it on GitHubhttps://github.com//issues/476#issuecomment-40821787
.

@rnicoll
Copy link
Contributor

rnicoll commented Apr 20, 2014

@flound1129 We've had a major concern raised in #479 which if you haven't moved to 1.7 yet, is probably a reason to hold off. We're investigating now, and I'll update you on whether we can reproduce the problem or not.

@flound1129
Copy link
Author

At this point the attacks on the network have grown to the point where it's worth the risk to implement the new version. I'll keep you in the loop with any issues. Thanks.

@flound1129
Copy link
Author

I'm getting a LOT of these in my logs now.. Is this a problem?

2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf
2014-05-07 18:54:42 force request: block 400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf

@rnicoll
Copy link
Contributor

rnicoll commented May 7, 2014

Looks like a random hiccup with block 212267... probably a broken peer. To other devs; something to check DDoS handling for?

@flound1129
Copy link
Author

No I get a lot of these for many different blocks.

@patricklodder
Copy link
Member

Do I understand right from the source that prints this (link) that this is done when we're working on a sidechain (like we're racing someone else)? So "we" are on the sidechain, not "them"?

I checked the surrounding blocks on sochain: https://chain.so/block/400d76cde441c6bf418aa992e684dd20d3d5f56ddec9354b0d9e2be30cc57cdf and this one followed another block from f2pool very quickly.

@flound1129: did you find an orphan on top of this block? when did you start seeing this, and how often does it happen? Perhaps we can investigate some more blocks?

If it's because 2 pools found a block at the same height, that would explain it I think?

@flound1129
Copy link
Author

No, my orphan rate is very low. I hardly ever see an orphan.

2014-05-07 20:11:12 force request: block 0b6768f67b74fd14a0d3f8116568ad912ad80dce13422a1026a60bba9e45945f
2014-05-07 20:11:12 force request: block 0b6768f67b74fd14a0d3f8116568ad912ad80dce13422a1026a60bba9e45945f
2014-05-07 20:11:12 force request: block 0b6768f67b74fd14a0d3f8116568ad912ad80dce13422a1026a60bba9e45945f
2014-05-07 20:11:12 force request: block 0b6768f67b74fd14a0d3f8116568ad912ad80dce13422a1026a60bba9e45945f
2014-05-07 20:11:12 force request: block 0b6768f67b74fd14a0d3f8116568ad912ad80dce13422a1026a60bba9e45945f
2014-05-07 20:11:12 force request: block 0b6768f67b74fd14a0d3f8116568ad912ad80dce13422a1026a60bba9e45945f
2014-05-07 20:11:12 force request: block 0b6768f67b74fd14a0d3f8116568ad912ad80dce13422a1026a60bba9e45945f
2014-05-07 20:11:12 force request: block 0b6768f67b74fd14a0d3f8116568ad912ad80dce13422a1026a60bba9e45945f
2014-05-07 20:11:12 force request: block 0b6768f67b74fd14a0d3f8116568ad912ad80dce13422a1026a60bba9e45945f
2014-05-07 20:11:12 force request: block 0b6768f67b74fd14a0d3f8116568ad912ad80dce13422a1026a60bba9e45945f
2014-05-07 20:11:12 force request: block 0b6768f67b74fd14a0d3f8116568ad912ad80dce13422a1026a60bba9e45945f
2014-05-07 20:11:12 force request: block 0b6768f67b74fd14a0d3f8116568ad912ad80dce13422a1026a60bba9e45945f
2014-05-07 20:11:16 nActualTimespan = 142 before bounds
2014-05-07 20:11:16 GetNextWorkRequired RETARGET
2014-05-07 20:11:16 nTargetTimespan = 60 nActualTimespan = 70
2014-05-07 20:11:16 Before: 1b5180ad 00000000005180ad000000000000000000000000000000000000000000000000
2014-05-07 20:11:16 After: 1b5f161f 00000000005f161f2aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
2014-05-07 20:11:16 UpdateTip: new best=44200a2a6492300e7329536c73c8e7c3884c1564059951224d5ac16cfdee7993 height=212341 log2_work=59.4401 tx=9658641 date=2014-05-07 20:11:12 progress=1.000000
2014-05-07 20:11:16 ProcessBlock: ACCEPTED
2014-05-07 20:11:16 CreateNewBlock(): total size 1000
2014-05-07 20:11:16 nActualTimespan = 10 before bounds
2014-05-07 20:11:16 GetNextWorkRequired RETARGET
2014-05-07 20:11:16 nTargetTimespan = 60 nActualTimespan = 54
2014-05-07 20:11:16 Before: 1b5f161f 00000000005f161f000000000000000000000000000000000000000000000000
2014-05-07 20:11:16 After: 1b5593e8 00000000005593e8b33333333333333333333333333333333333333333333333
2014-05-07 20:11:16 force request: block 44200a2a6492300e7329536c73c8e7c3884c1564059951224d5ac16cfdee7993
2014-05-07 20:11:16 force request: block 44200a2a6492300e7329536c73c8e7c3884c1564059951224d5ac16cfdee7993
2014-05-07 20:11:16 force request: block 44200a2a6492300e7329536c73c8e7c3884c1564059951224d5ac16cfdee7993
2014-05-07 20:11:16 force request: block 44200a2a6492300e7329536c73c8e7c3884c1564059951224d5ac16cfdee7993

2014-05-07 20:05:38 GetNextWorkRequired RETARGET
2014-05-07 20:05:38 nTargetTimespan = 60 nActualTimespan = 59
2014-05-07 20:05:38 Before: 1b416f4e 0000000000416f4e000000000000000000000000000000000000000000000000
2014-05-07 20:05:38 After: 1b40581d 000000000040581dc44444444444444444444444444444444444444444444444
2014-05-07 20:05:38 force request: block 2193380fd1a718e1e981156c956a0dca7c132bf833fa4f7347fbdf654caed89e
2014-05-07 20:05:38 force request: block 2193380fd1a718e1e981156c956a0dca7c132bf833fa4f7347fbdf654caed89e
2014-05-07 20:05:38 force request: block 2193380fd1a718e1e981156c956a0dca7c132bf833fa4f7347fbdf654caed89e
2014-05-07 20:05:38 force request: block 2193380fd1a718e1e981156c956a0dca7c132bf833fa4f7347fbdf654caed89e
2014-05-07 20:05:38 force request: block 2193380fd1a718e1e981156c956a0dca7c132bf833fa4f7347fbdf654caed89e
2014-05-07 20:05:38 force request: block 2193380fd1a718e1e981156c956a0dca7c132bf833fa4f7347fbdf654caed89e
2014-05-07 20:05:38 force request: block 2193380fd1a718e1e981156c956a0dca7c132bf833fa4f7347fbdf654caed89e
2014-05-07 20:05:58 keypool reserve 4091
2014-05-07 20:05:58 keypool return 4091
2014-05-07 20:05:58 CreateNewBlock(): total size 1452
2014-05-07 20:05:58 nActualTimespan = 52 before bounds
2014-05-07 20:05:58 GetNextWorkRequired RETARGET
2014-05-07 20:05:58 nTargetTimespan = 60 nActualTimespan = 59
2014-05-07 20:05:58 Before: 1b416f4e 0000000000416f4e000000000000000000000000000000000000000000000000
2014-05-07 20:05:58 After: 1b40581d 000000000040581dc44444444444444444444444444444444444444444444444
2014-05-07 20:05:58 CreateNewBlock(): total size 1452
2014-05-07 20:05:58 nActualTimespan = 52 before bounds
2014-05-07 20:05:58 GetNextWorkRequired RETARGET
2014-05-07 20:05:58 nTargetTimespan = 60 nActualTimespan = 59
2014-05-07 20:05:58 Before: 1b416f4e 0000000000416f4e000000000000000000000000000000000000000000000000
2014-05-07 20:05:58 After: 1b40581d 000000000040581dc44444444444444444444444444444444444444444444444
2014-05-07 20:06:05 force request: block 2193380fd1a718e1e981156c956a0dca7c132bf833fa4f7347fbdf654caed89e
2014-05-07 20:06:25 socket recv error 110

@flound1129
Copy link
Author

It's possible that this is just two pools finding a block very close together, and one becoming stale (not orphaned) and discarded.

I just want to make sure it's not some kind of attempted dos.

@flound1129
Copy link
Author

Our block stale rate on doge has been at or over 10% for the past couple days so I'm looking into any possible cause.

@patricklodder
Copy link
Member

To me that would make sense, yes, but would like someone else to confirm. If you can map the find time of the stale blocks to the time the 'force request' occurs, then that would further confirm this suspicion.

@leofidus
Copy link
Contributor

leofidus commented May 8, 2014

It looks like those force request: block could be triggered by a malicious/misbehaving peer,but it doesn't look frequent enough to be malicious. A high local orphan rate could probably be a cause too, I don't know. Is the node running with Dogecoin 1.6 or Dogecoin 1.7?

It's worth noting that Bitcoin 0.10 will be removing that particular piece of code with PR3514.

@rnicoll
Copy link
Contributor

rnicoll commented Aug 1, 2014

Just coming back to very old issues; did 1.7 help this at all in the end? Can we close or is this still outstanding?

@flound1129
Copy link
Author

I'm not sure whether 1.7 helped, because in the end I wound up creating a 'border' set of Doge instances that weren't being used for mining to connect to the outside world.

Also, I don't think 1.7 logs that info anymore. So it's difficult to say whether it helped.

@rnicoll
Copy link
Contributor

rnicoll commented Aug 7, 2015

1.10 includes basically a massive set of changes to relay network from upstream (Bitcoin), so I'm going to close this for now. If you do see the problem again, do let us know!

@rnicoll rnicoll closed this as completed Aug 7, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

5 participants