Prevent replay attacks with NetworkID field: (#4370)

Add a `NetworkID` field to help prevent replay attacks on and from
side-chains.

The new field must be used when the server is using a network id > 1024.

To preserve legacy behavior, all chains with a network ID less than 1025
retain the existing behavior. This includes Mainnet, Testnet, Devnet,
and hooks-testnet. If `sfNetworkID` is present in any transaction
submitted to any of the nodes on one of these chains, then
`telNETWORK_ID_MAKES_TX_NON_CANONICAL` is returned.

Since chains with a network ID less than 1025, including Mainnet, retain
the existing behavior, there is no need for an amendment.

The `NetworkID` helps to prevent replay attacks because users specify a
`NetworkID` field in every transaction for that chain.

This change introduces a new UINT32 field, `sfNetworkID` ("NetworkID").
There are also three new local error codes for transaction results:

- `telNETWORK_ID_MAKES_TX_NON_CANONICAL`
- `telREQUIRES_NETWORK_ID`
- `telWRONG_NETWORK`

To learn about the other transaction result codes, see:
https://xrpl.org/transaction-results.html

Local error codes were chosen because a transaction is not necessarily
malformed if it is submitted to a node running on the incorrect chain.
This is a local error specific to that node and could be corrected by
switching to a different node or by changing the `network_id` on that
node. See:
https://xrpl.org/connect-your-rippled-to-the-xrp-test-net.html

In addition to using `NetworkID`, it is still generally recommended to
use different accounts and keys on side-chains. However, people will
undoubtedly use the same keys on multiple chains; for example, this is
common practice on other blockchain networks. There are also some
legitimate use cases for this.

A `app.NetworkID` test suite has been added, and `core.Config` was
updated to include some network_id tests.
This commit is contained in:
RichardAH
2023-04-12 02:11:17 +02:00
committed by GitHub
parent 066f91ca07
commit 4f95b9d7a6
14 changed files with 269 additions and 0 deletions

View File

@@ -411,6 +411,71 @@ port_wss_admin
}
}
void
testNetworkID()
{
testcase("network id");
std::string error;
Config c;
try
{
c.loadFromString(R"rippleConfig(
[network_id]
main
)rippleConfig");
}
catch (std::runtime_error& e)
{
error = e.what();
}
BEAST_EXPECT(error == "");
BEAST_EXPECT(c.NETWORK_ID == 0);
try
{
c.loadFromString(R"rippleConfig(
)rippleConfig");
}
catch (std::runtime_error& e)
{
error = e.what();
}
BEAST_EXPECT(error == "");
BEAST_EXPECT(c.NETWORK_ID == 0);
try
{
c.loadFromString(R"rippleConfig(
[network_id]
255
)rippleConfig");
}
catch (std::runtime_error& e)
{
error = e.what();
}
BEAST_EXPECT(error == "");
BEAST_EXPECT(c.NETWORK_ID == 255);
try
{
c.loadFromString(R"rippleConfig(
[network_id]
10000
)rippleConfig");
}
catch (std::runtime_error& e)
{
error = e.what();
}
BEAST_EXPECT(error == "");
BEAST_EXPECT(c.NETWORK_ID == 10000);
}
void
testValidatorsFile()
{
@@ -1230,6 +1295,7 @@ r.ripple.com:51235
testGetters();
testAmendment();
testOverlay();
testNetworkID();
}
};