eth/gasprice: add query limit for FeeHistory to defend DDOS attack #29644

NathanBSC · 2024-04-25T06:15:49Z

Add query limit to defend DDoS attack. Max allow 100 different percentiles in rewardPercentiles.

this PR is ported from bsc 2423

NathanBSC · 2024-04-25T07:52:51Z

I checked the failed golangci-lint, It's strange
and on my mac, it's ok

AaronChen0 · 2024-04-25T08:21:53Z

Please rebase your commit. Your branch is 236 commits behind the master branch. And the return values of function FeeHistory was changed in this commit 1ec7af2

fjl · 2024-04-29T08:07:57Z

This new limit is not necessary because it is already covered by other limits. The percentiles have to be in increasing order, and < 100. It is therefore impossible to submit more than 100.

There was a bug in the validation until recently, but it got fixed in #28954 .

buddh0 · 2024-04-30T03:09:15Z

This new limit is not necessary because it is already covered by other limits. The percentiles have to be in increasing order, and < 100. It is therefore impossible to submit more than 100.

the element of rewardPercentiles is type float64 now, not integer, so is it impossible to submit more than 100? @fjl

karalabe

LGTM

holiman

LGTM

…thereum#29644) * eth/gasprice: add query limit for FeeHistory to defend DDOS attack * fix return values after cherry-pick --------- Co-authored-by: Eric <45141191+zlacfzy@users.noreply.github.com>

…thereum#29644)

…thereum#29644) * eth/gasprice: add query limit for FeeHistory to defend DDOS attack * fix return values after cherry-pick --------- Co-authored-by: Eric <45141191+zlacfzy@users.noreply.github.com>

…thereum#29644)

## Why this should be merged Safer release process by enforcing invariants of `release/*` branches as automated in #137 to fulfil #25. ## How this works New test for `go_tooling` CI job. If the PR target branch is `main` then only the `params.ReleaseType` is checked. If the target is neither `main` nor a release branch then the test is skipped. The checks performed on `release/*` branches are described in the test. ## How this was tested Locally against a dummy release branch with deliberate problems created by (a) including this PR's changes in the final commit and (b) not updating the libevm version. ``` $ go test -v ./... --target_branch="release/v1.13.14-0.1.0.rc.3" === RUN TestCherryPicksFormat --- PASS: TestCherryPicksFormat (0.39s) === RUN TestBranchProperties === RUN TestBranchProperties/branch_name release_test.go:172: Error Trace: .../ava-labs/libevm/libevm/tooling/release/release_test.go:172 Error: Not equal: expected: "release/v1.13.14-0.1.0.beta" actual : "release/v1.13.14-0.1.0.rc.3" Diff: --- Expected +++ Actual @@ -1 +1 @@ -release/v1.13.14-0.1.0.beta +release/v1.13.14-0.1.0.rc.3 Test: TestBranchProperties/branch_name release_test.go:175: On release branch; params.LibEVMReleaseType = "beta", which is unsuitable for release branches === RUN TestBranchProperties/commit_history release_test.go:192: Forked from "main" at commit 4c6e50e (chore: module-renaming workflow inverts between `libevm` and `geth` (#152)) release_test.go:314: ### History since fork from default branch (8 commits): release_test.go:316: internal/build, rpc: add missing HTTP response body Close() calls (ethereum#29223) by Shiming Zhang <wzshiming@hotmail.com> release_test.go:316: core/state: fix bug in statedb.Copy and remove unnecessary preallocation (ethereum#29563) by Aaron Chen <aaronchen.lisp@gmail.com> release_test.go:316: params: print time value instead of pointer in ConfigCompatError (ethereum#29514) by Nathan <Nathan.l@nodereal.io> release_test.go:316: eth/gasprice: add query limit for FeeHistory to defend DDOS attack (ethereum#29644) by Nathan <Nathan.l@nodereal.io> release_test.go:316: core/state/snapshot: add a missing lock (ethereum#30001) by maskpp <maskpp266@gmail.com> release_test.go:316: crypto: add IsOnCurve check (ethereum#31100) by Felix Lange <fjl@twurst.com> release_test.go:316: internal/ethapi: fix panic in debug methods (ethereum#31157) by Sina M <1591639+s1na@users.noreply.github.com> release_test.go:316: x by Arran Schlosberg <me@arranschlosberg.com> === RUN TestBranchProperties/commit_history/cherry_picked_commits release_test.go:314: ### Expected cherry-picks (7 commits): release_test.go:316: internal/build, rpc: add missing HTTP response body Close() calls (ethereum#29223) by Shiming Zhang <wzshiming@hotmail.com> release_test.go:316: core/state: fix bug in statedb.Copy and remove unnecessary preallocation (ethereum#29563) by Aaron Chen <aaronchen.lisp@gmail.com> release_test.go:316: params: print time value instead of pointer in ConfigCompatError (ethereum#29514) by Nathan <Nathan.l@nodereal.io> release_test.go:316: eth/gasprice: add query limit for FeeHistory to defend DDOS attack (ethereum#29644) by Nathan <Nathan.l@nodereal.io> release_test.go:316: core/state/snapshot: add a missing lock (ethereum#30001) by maskpp <maskpp266@gmail.com> release_test.go:316: crypto: add IsOnCurve check (ethereum#31100) by Felix Lange <fjl@twurst.com> release_test.go:316: internal/ethapi: fix panic in debug methods (ethereum#31157) by Sina M <1591639+s1na@users.noreply.github.com> === RUN TestBranchProperties/commit_history/final_commit release_test.go:365: Modified disallowed file "go.yml" release_test.go:365: Modified disallowed file "go.mod" release_test.go:365: Modified disallowed file "go.sum" release_test.go:365: Modified disallowed file "release_test.go" --- FAIL: TestBranchProperties (2.07s) --- FAIL: TestBranchProperties/branch_name (0.00s) --- FAIL: TestBranchProperties/commit_history (2.07s) --- PASS: TestBranchProperties/commit_history/cherry_picked_commits (1.81s) --- FAIL: TestBranchProperties/commit_history/final_commit (0.01s) FAIL FAIL github.com/ava-labs/libevm/libevm/tooling/release 2.712s FAIL ```

…thereum#29644)

…thereum#29644) * eth/gasprice: add query limit for FeeHistory to defend DDOS attack * fix return values after cherry-pick --------- Co-authored-by: Eric <45141191+zlacfzy@users.noreply.github.com>

…thereum#29644)

…thereum#29644) * eth/gasprice: add query limit for FeeHistory to defend DDOS attack * fix return values after cherry-pick --------- Co-authored-by: Eric <45141191+zlacfzy@users.noreply.github.com>

NathanBSC marked this pull request as ready for review April 25, 2024 06:18

NathanBSC requested review from karalabe, holiman and rjl493456442 as code owners April 25, 2024 06:18

NathanBSC marked this pull request as draft April 25, 2024 07:23

NathanBSC marked this pull request as ready for review April 25, 2024 07:42

zlacfzy and others added 2 commits April 25, 2024 16:30

eth/gasprice: add query limit for FeeHistory to defend DDOS attack

4408ba2

fix return values after cherry-pick

fce2b5b

NathanBSC force-pushed the add_query_limit_FeeHistory branch from 5600e1e to fce2b5b Compare April 25, 2024 08:33

fjl closed this Apr 29, 2024

buddh0 mentioned this pull request May 6, 2024

internal/ethapi: crash casued by no limits for rewardPercentiles at interface FeeHistory #29709

Closed

karalabe reopened this May 7, 2024

karalabe approved these changes May 7, 2024

View reviewed changes

karalabe added this to the 1.14.1 milestone May 7, 2024

holiman approved these changes May 7, 2024

View reviewed changes

karalabe merged commit e4b8058 into ethereum:master May 7, 2024
2 of 3 checks passed

BrewTestBot mentioned this pull request May 8, 2024

ethereum 1.14.2 Homebrew/homebrew-core#171174

Merged

ian0371 mentioned this pull request May 9, 2024

Update RPCs: feehistory, accesslist klaytn/klaytn#2153

Merged

9 tasks

yosuzzy mentioned this pull request May 30, 2024

eth/gasprice: add comment to constant #29892

Merged

gzliudan added a commit to gzliudan/XDPoSChain that referenced this pull request Mar 13, 2025

eth/gasprice: add query limit for FeeHistory to defend DDOS attack (e…

dcaecc3

…thereum#29644)

gzliudan mentioned this pull request Mar 13, 2025

eth/gasprice: improve function FeeHistory XinFinOrg/XDPoSChain#911

Merged

19 tasks

gzliudan added a commit to gzliudan/XDPoSChain that referenced this pull request Mar 14, 2025

eth/gasprice: add query limit for FeeHistory to defend DDOS attack (e…

8f68af5

…thereum#29644)

JukLee0ira pushed a commit to JukLee0ira/XDPoSChain that referenced this pull request Mar 26, 2025

eth/gasprice: add query limit for FeeHistory to defend DDOS attack (e…

b4236e6

…thereum#29644)

gzliudan added a commit to XinFinOrg/XDPoSChain that referenced this pull request Mar 26, 2025

eth/gasprice: add query limit for FeeHistory to defend DDOS attack (e…

9baeeb1

…thereum#29644)

gzliudan added a commit to XinFinOrg/XDPoSChain that referenced this pull request Apr 11, 2025

eth/gasprice: add query limit for FeeHistory to defend DDOS attack (e…

4e753f3

…thereum#29644)

Unique-Divine mentioned this pull request Apr 16, 2025

feat(nibiru): geth v1.14 compatible with Nibiru NibiruChain/go-ethereum#9

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

eth/gasprice: add query limit for FeeHistory to defend DDOS attack #29644

eth/gasprice: add query limit for FeeHistory to defend DDOS attack #29644

NathanBSC commented Apr 25, 2024 •

edited

Loading

NathanBSC commented Apr 25, 2024

AaronChen0 commented Apr 25, 2024 •

edited

Loading

fjl commented Apr 29, 2024 •

edited

Loading

buddh0 commented Apr 30, 2024 •

edited

Loading

karalabe left a comment

holiman left a comment

eth/gasprice: add query limit for FeeHistory to defend DDOS attack #29644

eth/gasprice: add query limit for FeeHistory to defend DDOS attack #29644

Conversation

NathanBSC commented Apr 25, 2024 • edited Loading

NathanBSC commented Apr 25, 2024

AaronChen0 commented Apr 25, 2024 • edited Loading

fjl commented Apr 29, 2024 • edited Loading

buddh0 commented Apr 30, 2024 • edited Loading

karalabe left a comment

Choose a reason for hiding this comment

holiman left a comment

Choose a reason for hiding this comment

NathanBSC commented Apr 25, 2024 •

edited

Loading

AaronChen0 commented Apr 25, 2024 •

edited

Loading

fjl commented Apr 29, 2024 •

edited

Loading

buddh0 commented Apr 30, 2024 •

edited

Loading