Jun 25, 2023 New Release I2P 2.3.0 - Security Fixes, Tweakable blocklists, DTG API idk
This release contains fixes for CVE-2023-36325. CVE-2023-36325 is a context-confusion bug which occurred in the bloom filter. An attacker crafts an I2NP message containing a unique messageID, and sends that messageID to a client. The message, after passing through the bloom filter, is not allowed to be re-used in a second message. The attacker then sends the same message directly to the router. The router passes the message to the bloom filter, and is dropped. This leaks the information that the messageID has been seen before, giving the attacker a strong reason to believe that the router is hosting the client. This has been fixed by separating the bloom filter's functionality into different contexts based on whether a message came down a client tunnel, an exploratory tunnel, was sent to the router directly. Under normal circumstances, this attack takes several days to perform successfully and may be confounded by several factors such as routers restarting during the attack phase and sensitivity to false-positives. Users of Java I2P are recommended to update immediately to avoid the attack.
In the course of fixing this context confusion bug, we have revised some of our strategies to code defensively, against these types of leaks. This includes tweaks to the netDb, the rate-limiting mechanisms, and the behavior of floodfill routers.
This release adds not_bob as a second default hosts provider, and adds notbob.i2p and ramble.i2p to the console homepage.
This release also contains a tweakable blocklist. Blocklisting is semi-permanent, each blocked IP address is normally blocked until the router is restarted. Users who observe explosive blocklist growth during sybil attacks may opt-in to shorter timeouts by configuring the blocklist to expire entries at an interval. This feature is off-by-default and is only recommended for advanced users at this time.
This release also includes an API for plugins to modify with the Desktop GUI(DTG). It is now possible to add menu items to the system tray, enabling more intuitive launching of plugins which use native application interfaces.
As usual, we recommend that you update to this release. The best way to maintain security and help the network is to run the latest release.