I2P 2.3.0 Release

Release Announcements
Post Reply
User avatar
eyedeekay
Posts: 75
Joined: 21 Jul 2018 06:53

I2P 2.3.0 Release

Post by eyedeekay »

This release contains fixes for CVE-2023-36325.
CVE-2023-36325 is a context-confusion bug which occurred in the bloom filter.
An attacker crafts an I2NP message containing a unique messageID, and sends that messageID to a client.
The message, after passing through the bloom filter, is not allowed to be re-used in a second message.
The attacker then sends the same message directly to the router.
The router passes the message to the bloom filter, and is dropped.
This leaks the information that the messageID has been seen before, giving the attacker a strong reason to believe that the router is hosting the client.
This has been fixed by separting the bloom filter's functionality into different contexts based on whether a message came down a client tunnel, an exploratory tunnel, was sent to the router directly.
Under normal circumstances, this attack takes several days to perform successfully and may be confounded by several factors such as routers restarting during the attack phase and sensitivity to false-positives.
Users of Java I2P are recommended to update immediately to avoid the attack.

In the course of fixing this context confusion bug, we have revised some of our strategies to code defensively, against these types of leaks.
This includes tweaks to the netDb, the rate-limiting mechanisms, and the behavior of floodfill routers.

This release adds not_bob as a second default hosts provider, and adds `notbob.i2p <http://notbob.i2p>`_ and `ramble.i2p <http://ramble.i2p>`_ to the console homepage.

This release also contains a tweakable blocklist.
Blocklisting is semi-permanent, each blocked IP address is normally blocked until the router is restarted.
Users who observe explosive blocklist growth during sybil attacks may opt-in to shorter timeouts by configuring the blocklist to expire entries at an interval.
This feature is off-by-default and is only recommended for advanced users at this time.

This release also includes an API for plugins to modify with the Desktop GUI(DTG).
It is now possible to add menu items to the system tray, enabling more intuitive launching of plugins which use native application interfaces.

As usual, we recommend that you update to this release.
The best way to maintain security and help the network is to run the latest release.
Last edited by eyedeekay on 30 Jun 2023 19:28, edited 3 times in total.
User avatar
eyedeekay
Posts: 75
Joined: 21 Jul 2018 06:53

Re: Upcoming I2P 2.3.0 Release

Post by eyedeekay »

Pushing tag freeze back another day, release should still be on the 19th for Java I2P.
User avatar
eyedeekay
Posts: 75
Joined: 21 Jul 2018 06:53

Re: Upcoming I2P 2.3.0 Release

Post by eyedeekay »

My work laptop died unexpectedly yesterday, fortunately no work was lost but I was unable to access Transifex and also my personal email. I've fixed the laptop and we'll be back underway tomorrow. I will wait for the weekday to do the tag freeze, making it the 12th, and will do the release on the 26th.
User avatar
eyedeekay
Posts: 75
Joined: 21 Jul 2018 06:53

Re: Upcoming I2P 2.3.0 Release

Post by eyedeekay »

I apologize for the repeated delays, we really needed to get things right in this release. New builds are going out now, automatic updaters should be good in about an hour and Launchpad builds are going into the queue right after that.
Post Reply