DiscV4 sending FindNode request

[ana-prdekalo]

Hi,
I was going through discv4 code, and I noticed that FindNode is issued on a successful Pong response on this line.

In discv4 docs it is said that:

To guard against traffic amplification attacks, Neighbors replies should only be sent if the sender of FindNode has been verified by the endpoint proof procedure.

Again, from the docs, the sender is verified if:

The sender of a packet is considered verified if it has sent a valid Pong response with matching ping hash within the last 12 hours.

My understanding is that if I'm running a node, in order for my FindNode request to be verified, I should've responded to the Ping request with Pong to the node I'm requesting Neighbours from.

So, if my understanding of the docs and the code is okay, in the current implementation, we are sending FindNode after we initiate Ping, but this doesn't mean that we're necessarily verified in "the eyes" of a node we're requesting Neighbors from. Am I correct?

If my understanding is correct, why not assume that when we receive Ping from some node, our Pong will be successfully sent&verified and tie requesting neighbors to Ping message rather than to Pong?

[mattsse]

oh, I believe your assessment is correct, nice find.

the problematic line is this one:

reth/crates/net/discv4/src/lib.rs

Lines 1315 to 1316 in 2cddd0f

	// only ping if the node was added to the table
	self.try_ping(closest, PingReason::Lookup(closest, ctx.clone()))

which sends a ping, but this only proves the endpoint from our side but does not prove it for the target node.

but this doesn't mean that we're necessarily verified in "the eyes" of a node we're requesting Neighbors from. Am I correct?

exactly

so we should indeed wait until the endpoint proof has been established (we sent a pong to a ping, that should follow after we received a pong)

[ana-prdekalo]

Great! I'm glad that I was of help 🙂