Security Patch

Eliminate denial of service vulnerability

Leap v3.1.5 contains a security patch eliminating a denial of service vulnerability present in all prior versions of Leap.

Bug Fixes

net_plugin improve block latency calculation

Summary:

Changed net latency calculation by removing default lower bound of 1. Correctly logs 0 when there is no latency.

Fixed bug causing keosd to hang in some cases

Details:

Remove the +1 to the block latency calculation otherwise even 0ms latency indicates 1 block latency instead of 0. The +1 makes the comparisons of head and msg.head in the if-else off by 1 when there is no latency.

Added additional logging so that issues like #588 are easier to debug.

Before:

debug 2022-12-21T21:54:29.938 net-3     net_plugin.cpp:1790           recv_handshake       ] ["localhost:9878 - f9bdaf6" - 43 127.0.0.1:52370] Network latency is 0ms, 0 blocks discrepancy by network latency, 1 blocks discrepancy expected once message received

After:

debug 2023-01-31T00:27:27.386 net-0     net_plugin.cpp:1795           recv_handshake       ] ["localhost:9878 - 978ab39" - 1 127.0.0.1:54362] Network latency is 0ms, 0 blocks discrepancy by network latency, 0 blocks discrepancy expected once message received

Correct --terminate-at-block

Summary:

Fixed an issue where the --terminate-at-block option was terminating the node at the next block instead of the requested block in head mode. The test functionality was also reworked to improve its effectiveness and reduce test run time.

Problem:

--terminate-at-block was terminating the node at +1 requested block in head mode.

Impact:

The incorrect termination behavior of --terminate-at-block in head mode affected the accuracy of block synchronization and potentially led to unexpected block processing.

Changes:

• Fixed the code to ensure that the node terminates at the correct block when --terminate-at-block is set.
• Reworked the test functionality to better test the terminate-at-block functionality and improve test run time.

Resolution:

The issue has been resolved, and the --terminate-at-block option now correctly terminates the node at the specified block in head mode, ensuring accurate block synchronization.

Subjective Account Max Failure Window Size

Summary:

Added configuration option for setting the window size in blocks for subjective account max failures in Leap v3.1.

Problem:

Prior to this update, there was no configuration option to customize the window size for subjective account max failures.

Impact:

Users were unable to adjust the time frame for subjective account blocks, limiting their flexibility in managing failures.

Changes:

Introduces a new configuration option, "--subjective-account-max-failures-window-size," to set the window size in number of blocks.

Resolution:

This update empowers users to define the time window for subjective account blocks according to their specific requirements, providing greater control over the handling of failures in Leap v3.1.

Test Fixes

Summary:

Fixed an issue in the nodeos_forked_chain_lr_test test in version 3.1 of the AntelopeIO/leap software. The problem was related to the incorrect updating of preKillBlockNum and preKillBlockProducer, which affected the validation calculation. The issue has been resolved, and the test now runs without errors.

Problem:

Incorrect updating of preKillBlockNum and preKillBlockProducer in nodeos_forked_chain_lr_test.

Impact:

The problem affected the validation calculation in the nodeos_forked_chain_lr_test, potentially leading to incorrect results.

Changes:

• Updated the assignment of preKillBlockNum and preKillBlockProducer in the nodeos_forked_chain_test.py file.

Resolution:

The issue has been fixed, and the nodeos_forked_chain_lr_test now runs without errors, ensuring accurate validation calculations.

Changes to Pinned Builds

Summary:

This release introduces a new manual dispatch workflow for the [3.1] Pinned Builds feature in AntelopeIO's leap project. The workflow runs Pinned Builds in GitHub Actions and addresses an issue related to the pinned_build.sh script and artifact uploads. It also includes improvements in the selection of build platforms and artifact naming.

Problem:

The previous workflow for Pinned Builds in leap had issues with the execution of the pinned_build.sh script and the naming of artifacts.

Impact:

The problems with the Pinned Builds workflow affected the execution and naming of artifacts, potentially causing confusion and hindering the use of Pinned Builds.

Changes:

• Created a shell for the initial pinned_build.yaml workflow, enabling the merge of the [3.1] Pinned Builds manual dispatch workflow.
• Modified the workflow matrix to include different build platforms (ubuntu18, ubuntu20, ubuntu22).
• Adjusted the container selection logic in the workflow matrix.
• Removed the redundant execution of cpack in the pinned_build.sh script.
• Fixed the syntax in the workflow and addressed a forgotten run command.
• Modified the artifact upload step to exclude the leap-dev.deb artifact.
• Removed the unused job "Discover Platforms" from the workflow.
• Simplified the artifact naming and path matching.
• Used a self-hosted runner for the Pinned Builds workflow.
• Excluded the resmon plugin test in ubuntu20 due to its flakiness.

Resolution:

After these changes, the Pinned Builds workflow in leap now runs smoothly in GitHub Actions, resolving the issues with script execution and artifact naming. The workflow ensures consistent and reliable Pinned Builds, improving the development process in leap.

Changes to Logging

Summary:

Fixed issue with dirty database being reported as "genesis not found" instead of "dirty database".

Problem:

Dirty database reported as "genesis not found" instead of "dirty database."

Impact:

Misleading error message and incorrect reporting of the database state.

Changes:

• Propagated all exceptions except system_error.
• Added a comment explaining the non-propagation of system_error.
• Updated reporting of dirty database.

Resolution:

Dirty database is now correctly reported, improving error handling and providing accurate information about the database state.

Changes to Documentation

Summary:

Fixed log messages in transaction_success_tracing and transaction_failure_tracing to improve relevancy and reduce CPU load and network bandwidth during transaction tracing.

Problem:

Log messages in transaction_success_tracing and transaction_failure_tracing were not entirely relevant to transaction tracing, leading to higher CPU load and network bandwidth.

Impact:

The unwanted log messages caused increased CPU load and network bandwidth, affecting the performance of the transaction tracing user interface.

Changes:

• Moved the log messages from transaction_success_tracing and transaction_failure_tracing to the producer_plugin logger.
• Adjusted the log level of the messages to the all (trace) level for better traceability.

Resolution:

Log messages in transaction_success_tracing and transaction_failure_tracing have been moved to the producer_plugin logger, improving relevancy and reducing CPU load and network bandwidth during transaction tracing.

Further details on changes since last release

Contributors

Special thanks to the contributors that submitted patches for this release:

• @heifner
• @jolly-fellow
• @greg7mdp
• @huangminghuang
• @spoonincode
• @oschwaldp-oci
• @linh2931
• @vladtr
• @mikelik
• @dimas1185

Full list of changes since last release

Full Changelog: v3.1.4...v3.1.5