Merge pull request #28 from maticnetwork/mardizzone/POS-1609

dev: chg: solve vulns and set maxInboundPeer and maxOutBoundPeer to 100

config/config.go

@@ -551,8 +551,8 @@ func DefaultP2PConfig() *P2PConfig {
 		UPNP:                    false,
 		AddrBook:                defaultAddrBookPath,
 		AddrBookStrict:          true,
-		MaxNumInboundPeers:      40,
-		MaxNumOutboundPeers:     10,
+		MaxNumInboundPeers:      100,
+		MaxNumOutboundPeers:     100,
 		FlushThrottleTimeout:    100 * time.Millisecond,
 		MaxPacketMsgPayloadSize: 1024,    // 1 kB
 		SendRate:                5120000, // 5 mB/s

crypto/secp256k1/secp256k1.go

@@ -8,15 +8,15 @@ import (
 	"io"
 	"math/big"
 
-	secp256k1 "github.com/btcsuite/btcd/btcec"
+	secp256k1 "github.com/btcsuite/btcd/btcec/v2"
 	ethCrypto "github.com/ethereum/go-ethereum/crypto"
 
 	amino "github.com/tendermint/go-amino"
 
 	"github.com/tendermint/tendermint/crypto"
 )
 
-//-------------------------------------
+// -------------------------------------
 const (
 	PrivKeyAminoName = "tendermint/PrivKeySecp256k1"
 	PubKeyAminoName  = "tendermint/PubKeySecp256k1"

crypto/secp256k1/secp256k1_internal_test.go

@@ -7,7 +7,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	underlyingSecp256k1 "github.com/btcsuite/btcd/btcec"
+	underlyingSecp256k1 "github.com/btcsuite/btcd/btcec/v2"
 )
 
 func Test_genPrivKey(t *testing.T) {

crypto/secp256k1/secp256k1_nocgo.go

@@ -6,14 +6,14 @@ package secp256k1
 import (
 	"math/big"
 
-	secp256k1 "github.com/btcsuite/btcd/btcec"
+	secp256k1 "github.com/btcsuite/btcd/btcec/v2"
 	ethCrypto "github.com/ethereum/go-ethereum/crypto"
 )
 
 // used to reject malleable signatures
 // see:
-//  - https://github.com/ethereum/go-ethereum/blob/f9401ae011ddf7f8d2d95020b7446c17f8d98dc1/crypto/signature_nocgo.go#L90-L93
-//  - https://github.com/ethereum/go-ethereum/blob/f9401ae011ddf7f8d2d95020b7446c17f8d98dc1/crypto/crypto.go#L39
+//   - https://github.com/ethereum/go-ethereum/blob/f9401ae011ddf7f8d2d95020b7446c17f8d98dc1/crypto/signature_nocgo.go#L90-L93
+//   - https://github.com/ethereum/go-ethereum/blob/f9401ae011ddf7f8d2d95020b7446c17f8d98dc1/crypto/crypto.go#L39
 var secp256k1halfN = new(big.Int).Rsh(secp256k1.S256().N, 1)
 
 // Sign creates an ECDSA signature on curve Secp256k1, using SHA256 on the msg.
@@ -52,24 +52,3 @@ func (pubKey PubKeySecp256k1) VerifyBytes(msg []byte, sigStr []byte) bool {
 	return ethCrypto.VerifySignature(pubKey[:], hash, sigStr[:64])
 	// return signature.Verify(crypto.Sha256(msg), pub)
 }
-
-// Read Signature struct from R || S. Caller needs to ensure
-// that len(sigStr) == 64.
-func signatureFromBytes(sigStr []byte) *secp256k1.Signature {
-	return &secp256k1.Signature{
-		R: new(big.Int).SetBytes(sigStr[:32]),
-		S: new(big.Int).SetBytes(sigStr[32:64]),
-	}
-}
-
-// Serialize signature to R || S.
-// R, S are padded to 32 bytes respectively.
-func serializeSig(sig *secp256k1.Signature) []byte {
-	rBytes := sig.R.Bytes()
-	sBytes := sig.S.Bytes()
-	sigBytes := make([]byte, 64)
-	// 0 pad the byte arrays from the left if they aren't big enough.
-	copy(sigBytes[32-len(rBytes):32], rBytes)
-	copy(sigBytes[64-len(sBytes):64], sBytes)
-	return sigBytes
-}

crypto/secp256k1/secp256k1_nocgo_test.go

@@ -1,3 +1,4 @@
+//go:build !libsecp256k1
 // +build !libsecp256k1
 
 package secp256k1
@@ -6,40 +7,8 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
-	"github.com/tendermint/tendermint/crypto/secp256k1"
 )
 
-// Ensure that signature verification works, and that
-// non-canonical signatures fail.
-// // Note: run with CGO_ENABLED=0 or go test -tags !cgo.
-func TestSignatureVerificationAndRejectUpperS(t *testing.T) {
-	msg := []byte("We have lingered long enough on the shores of the cosmic ocean.")
-	for i := 0; i < 500; i++ {
-		priv := GenPrivKey()
-		sigStr, err := priv.Sign(msg)
-		require.NoError(t, err)
-		sig := signatureFromBytes(sigStr)
-		require.False(t, sig.S.Cmp(secp256k1halfN) > 0)
-
-		pub := priv.PubKey()
-		addr := pub.Address()
-		t.Log("address ", addr)
-
-		require.True(t, pub.VerifyBytes(msg, sigStr))
-
-		// malleate:
-		sig.S.Sub(secp256k1.S256().CurveParams.N, sig.S)
-		require.True(t, sig.S.Cmp(secp256k1halfN) > 0)
-		malSigStr := serializeSig(sig)
-
-		require.False(t, pub.VerifyBytes(msg, malSigStr),
-			"VerifyBytes incorrect with malleated & invalid S. sig=%v, key=%v",
-			sig,
-			priv,
-		)
-	}
-}
-
 func TestGenEthPrivKey(t *testing.T) {
 	msg := []byte("We have lingered long enough on the shores of the cosmic ocean.")
 	priv := GenPrivKey()

crypto/secp256k1/secp256k1_test.go

@@ -12,7 +12,7 @@ import (
 	"github.com/tendermint/tendermint/crypto"
 	"github.com/tendermint/tendermint/crypto/secp256k1"
 
-	underlyingSecp256k1 "github.com/btcsuite/btcd/btcec"
+	underlyingSecp256k1 "github.com/btcsuite/btcd/btcec/v2"
 )
 
 type keyData struct {
@@ -76,7 +76,7 @@ func TestSecp256k1LoadPrivkeyAndSerializeIsIdentity(t *testing.T) {
 
 		// This function creates a private and public key in the underlying libraries format.
 		// The private key is basically calling new(big.Int).SetBytes(pk), which removes leading zero bytes
-		priv, _ := underlyingSecp256k1.PrivKeyFromBytes(underlyingSecp256k1.S256(), privKeyBytes[:])
+		priv, _ := underlyingSecp256k1.PrivKeyFromBytes(privKeyBytes[:])
 		// this takes the bytes returned by `(big int).Bytes()`, and if the length is less than 32 bytes,
 		// pads the bytes from the left with zero bytes. Therefore these two functions composed
 		// result in the identity function on privKeyBytes, hence the following equality check

go.mod

@@ -1,36 +1,72 @@
 module github.com/tendermint/tendermint
 
-go 1.12
+go 1.21
 
 require (
-	github.com/VividCortex/gohistogram v1.0.0 // indirect
-	github.com/Workiva/go-datastructures v1.0.50
-	github.com/btcsuite/btcd v0.0.0-20190115013929-ed77733ec07d
-	github.com/btcsuite/btcd/chaincfg/chainhash v1.0.1 // indirect
-	github.com/btcsuite/btcutil v0.0.0-20180706230648-ab6388e0c60a
-	github.com/ethereum/go-ethereum v0.0.0-00010101000000-000000000000
+	github.com/Workiva/go-datastructures v1.0.53
+	github.com/btcsuite/btcd/btcec/v2 v2.3.2
+	github.com/btcsuite/btcutil v1.0.3-0.20201208143702-a53e38424cce
+	github.com/ethereum/go-ethereum v1.10.26
 	github.com/fortytw2/leaktest v1.3.0
-	github.com/go-kit/kit v0.9.0
-	github.com/go-logfmt/logfmt v0.5.0
-	github.com/gogo/protobuf v1.3.1
-	github.com/golang/protobuf v1.5.2
-	github.com/gorilla/websocket v1.4.2
-	github.com/libp2p/go-buffer-pool v0.0.2
-	github.com/magiconair/properties v1.8.1
+	github.com/go-kit/kit v0.12.0
+	github.com/go-logfmt/logfmt v0.5.1
+	github.com/gogo/protobuf v1.3.2
+	github.com/golang/protobuf v1.5.3
+	github.com/gorilla/websocket v1.5.0
+	github.com/libp2p/go-buffer-pool v0.1.0
+	github.com/magiconair/properties v1.8.6
 	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.0.0
-	github.com/rcrowley/go-metrics v0.0.0-20180503174638-e2704e165165
-	github.com/rs/cors v1.7.0
+	github.com/prometheus/client_golang v1.14.0
+	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475
+	github.com/rs/cors v1.8.2
 	github.com/snikch/goodman v0.0.0-20171125024755-10e37e294daa
-	github.com/spf13/cobra v0.0.3
-	github.com/spf13/viper v1.4.0
-	github.com/stretchr/testify v1.7.0
+	github.com/spf13/cobra v1.5.0
+	github.com/spf13/viper v1.13.0
+	github.com/stretchr/testify v1.8.3
+	github.com/tendermint/go-amino v0.16.0
+	github.com/tendermint/tm-db v0.6.7
+	golang.org/x/crypto v0.11.0
+	golang.org/x/net v0.12.0
+	google.golang.org/grpc v1.58.2
+)
+
+require (
+	github.com/beorn7/perks v1.0.1 // indirect
+	github.com/cespare/xxhash/v2 v2.2.0 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1 // indirect
+	github.com/etcd-io/bbolt v1.3.3 // indirect
+	github.com/fsnotify/fsnotify v1.6.0 // indirect
+	github.com/go-kit/log v0.2.1 // indirect
+	github.com/golang/snappy v0.0.5-0.20220116011046-fa5810519dcb // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/holiman/uint256 v1.2.2-0.20230321075855-87b91420868c // indirect
+	github.com/inconshreveable/mousetrap v1.0.0 // indirect
+	github.com/jmhodges/levigo v1.0.0 // indirect
+	github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/pelletier/go-toml v1.9.5 // indirect
+	github.com/pelletier/go-toml/v2 v2.0.5 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/prometheus/client_model v0.3.0 // indirect
+	github.com/prometheus/common v0.39.0 // indirect
+	github.com/prometheus/procfs v0.9.0 // indirect
+	github.com/spf13/afero v1.8.2 // indirect
+	github.com/spf13/cast v1.5.0 // indirect
+	github.com/spf13/jwalterweatherman v1.1.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/stumble/gorocksdb v0.0.3 // indirect
-	github.com/tendermint/go-amino v0.14.1
-	github.com/tendermint/tm-db v0.2.0
-	golang.org/x/crypto v0.0.0-20210322153248-0c34fe9e7dc2
-	golang.org/x/net v0.0.0-20210805182204-aaa1db679c0d
-	google.golang.org/grpc v1.42.0
+	github.com/subosito/gotenv v1.4.1 // indirect
+	github.com/syndtr/goleveldb v1.0.1-0.20210819022825-2ae1ddf74ef7 // indirect
+	golang.org/x/sys v0.10.0 // indirect
+	golang.org/x/text v0.11.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 // indirect
+	google.golang.org/protobuf v1.31.0 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
-replace github.com/ethereum/go-ethereum => github.com/maticnetwork/bor v0.2.16
+replace github.com/ethereum/go-ethereum => github.com/maticnetwork/bor v1.0.4
+
+replace github.com/tendermint/tm-db => github.com/tendermint/tm-db v0.2.0