Skip to content

p2p: rejected inbound connections aren't closed, cause fd leak #2046

New issue
New issue
Closed
Closed
p2p: rejected inbound connections aren't closed, cause fd leak#2046
Assignees
xla
Labels
C:p2pComponent: P2P pkgT:bugType Bug (Confirmed)T:securityType: Security (specify priority)
Milestone
Wishlist
@ebuchman

Description

@ebuchman
ebuchman
opened on Jul 24, 2018

Issue was discovered by a security auditor.

We don't close inbound connection objects when we reject them for max peers:

tendermint/p2p/switch.go

Lines 487 to 500 in 05a76fb

func (sw *Switch) listenerRoutine(l Listener) {
for {
inConn, ok := <-l.Connections()
if !ok {
break
}
// ignore connection if we already have enough
// leave room for MinNumOutboundPeers
maxPeers := sw.config.MaxNumPeers - DefaultMinNumOutboundPeers
if maxPeers <= sw.peers.Size() {
sw.Logger.Info("Ignoring inbound connection: already have enough peers", "address", inConn.RemoteAddr().String(), "numPeers", sw.peers.Size(), "max", maxPeers)
continue
}

This can be easily exploited to cause nodes to panic from use of too many file descriptors (and may partially explain some of the high fd usage we've been seeing on testnets).

Metadata

Metadata

Assignees

Labels

C:p2pComponent: P2P pkgT:bugType Bug (Confirmed)T:securityType: Security (specify priority)

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions