Use a random sequence number in floodsub (#634)

* Use a random sequence number in floodsub

* Comment

protocols/floodsub/Cargo.toml

@@ -12,6 +12,7 @@ fnv = "1.0"
 futures = "0.1"
 libp2p-core = { path = "../../core" }
 protobuf = "2.0.2"
+rand = "0.5"
 smallvec = "0.6.5"
 tokio-codec = "0.1"
 tokio-io = "0.1"

protocols/floodsub/src/layer.rs

@@ -24,6 +24,7 @@ use handler::FloodsubHandler;
 use libp2p_core::nodes::{ConnectedPoint, NetworkBehavior, NetworkBehaviorAction};
 use libp2p_core::{nodes::protocols_handler::ProtocolsHandler, PeerId};
 use protocol::{FloodsubMessage, FloodsubRpc, FloodsubSubscription, FloodsubSubscriptionAction};
+use rand;
 use smallvec::SmallVec;
 use std::{collections::VecDeque, iter, marker::PhantomData};
 use std::collections::hash_map::{DefaultHasher, HashMap};
@@ -48,9 +49,6 @@ pub struct FloodsubBehaviour<TSubstream> {
     // erroneously.
     subscribed_topics: SmallVec<[Topic; 16]>,
 
-    // Sequence number for the messages we send.
-    seq_no: usize,
-
     // We keep track of the messages we received (in the format `hash(source ID, seq_no)`) so that
     // we don't dispatch the same message twice if we receive it twice on the network.
     received: CuckooFilter<DefaultHasher>,
@@ -67,7 +65,6 @@ impl<TSubstream> FloodsubBehaviour<TSubstream> {
             local_peer_id,
             connected_peers: HashMap::new(),
             subscribed_topics: SmallVec::new(),
-            seq_no: 0,
             received: CuckooFilter::new(),
             marker: PhantomData,
         }
@@ -144,7 +141,10 @@ impl<TSubstream> FloodsubBehaviour<TSubstream> {
         let message = FloodsubMessage {
             source: self.local_peer_id.clone(),
             data: data.into(),
-            sequence_number: self.next_sequence_number(),
+            // If the sequence numbers are predictable, then an attacker could flood the network
+            // with packets with the predetermined sequence numbers and absorb our legitimate
+            // messages. We therefore use a random number.
+            sequence_number: rand::random::<[u8; 20]>().to_vec(),
             topics: topic.into_iter().map(|t| t.into().clone()).collect(),
         };
 
@@ -170,13 +170,6 @@ impl<TSubstream> FloodsubBehaviour<TSubstream> {
             });
         }
     }
-
-    /// Builds a unique sequence number to put in a `FloodsubMessage`.
-    fn next_sequence_number(&mut self) -> Vec<u8> {
-        let data = self.seq_no.to_string();
-        self.seq_no += 1;
-        data.into()
-    }
 }
 
 impl<TSubstream> NetworkBehavior for FloodsubBehaviour<TSubstream>

protocols/floodsub/src/lib.rs

@@ -25,6 +25,7 @@ extern crate fnv;
 extern crate futures;
 extern crate libp2p_core;
 extern crate protobuf;
+extern crate rand;
 extern crate smallvec;
 extern crate tokio_codec;
 extern crate tokio_io;