Merge pull request #3712 from tendermint/release/v0.31.7

Release/v0.31.7

CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## v0.31.7
+
+*June 3, 2019*
+
+This releases fixes a regression in the mempool introduced in v0.31.6.
+The regression caused the invalid committed txs to be proposed in blocks over and
+over again.
+
+### BUG FIXES:
+- [mempool] \#3699 Remove all committed txs from the mempool.
+    This reverts the change from v0.31.6 where we only remove valid txs from the mempool.
+    Note this means malicious proposals can cause txs to be dropped from the
+    mempools of other nodes by including them in blocks before they are valid.
+    See \#3322.
+
 ## v0.31.6
 
 *May 31st, 2019*

CHANGELOG_PENDING.md

@@ -1,4 +1,4 @@
-## v0.31.7
+## v0.31.8
 
 **
 

mempool/clist_mempool.go

@@ -538,24 +538,23 @@ func (mem *CListMempool) Update(
 		if deliverTxResponses[i].Code == abci.CodeTypeOK {
 			// Add valid committed tx to the cache (if missing).
 			_ = mem.cache.Push(tx)
-
-			// Remove valid committed tx from the mempool.
-			if e, ok := mem.txsMap.Load(txKey(tx)); ok {
-				mem.removeTx(tx, e.(*clist.CElement), false)
-			}
 		} else {
 			// Allow invalid transactions to be resubmitted.
 			mem.cache.Remove(tx)
+		}
 
-			// Don't remove invalid tx from the mempool.
-			// Otherwise evil proposer can drop valid txs.
-			// Example:
-			//   100 -> 101 -> 102
-			// Block, proposed by evil proposer:
-			//   101 -> 102
-			// Mempool (if you remove txs):
-			//   100
-			// https://github.com/tendermint/tendermint/issues/3322.
+		// Remove committed tx from the mempool.
+		//
+		// Note an evil proposer can drop valid txs!
+		// Mempool before:
+		//   100 -> 101 -> 102
+		// Block, proposed by an evil proposer:
+		//   101 -> 102
+		// Mempool after:
+		//   100
+		// https://github.com/tendermint/tendermint/issues/3322.
+		if e, ok := mem.txsMap.Load(txKey(tx)); ok {
+			mem.removeTx(tx, e.(*clist.CElement), false)
 		}
 	}
 

mempool/clist_mempool_test.go

@@ -200,12 +200,15 @@ func TestMempoolUpdate(t *testing.T) {
 		assert.Zero(t, mempool.Size())
 	}
 
-	// 3. Removes invalid transactions from the cache, but leaves them in the mempool (if present)
+	// 3. Removes invalid transactions from the cache and the mempool (if present)
 	{
 		err := mempool.CheckTx([]byte{0x03}, nil)
 		require.NoError(t, err)
 		mempool.Update(1, []types.Tx{[]byte{0x03}}, abciResponses(1, 1), nil, nil)
-		assert.Equal(t, 1, mempool.Size())
+		assert.Zero(t, mempool.Size())
+
+		err = mempool.CheckTx([]byte{0x03}, nil)
+		assert.NoError(t, err)
 	}
 }
 

scripts/release_management/bump-semver.py

@@ -8,6 +8,7 @@
 
 import re
 import argparse
+import sys
 
 
 def semver(ver):
@@ -17,6 +18,18 @@ def semver(ver):
   return ver
 
 
+def get_tendermint_version():
+  """Extracts the current Tendermint version from version/version.go"""
+  pattern = re.compile(r"TMCoreSemVer = \"(?P<version>([0-9.]+)+)\"")
+  with open("version/version.go", "rt") as version_file:
+    for line in version_file:
+      m = pattern.search(line)
+      if m:
+        return m.group('version')
+
+  return None
+
+
 if __name__ == "__main__":
   parser = argparse.ArgumentParser()
   parser.add_argument("--version", help="Version number to bump, e.g.: v1.0.0", required=True, type=semver)
@@ -34,4 +47,16 @@ if __name__ == "__main__":
   else:
     patch = int(patch) + 1
 
-  print("{0}.{1}".format(majorminorprefix, patch))
+  expected_version = "{0}.{1}".format(majorminorprefix, patch)
+  # if we're doing a release
+  if expected_version != "v0.0.0":
+    cur_version = get_tendermint_version()
+    if not cur_version:
+      print("Failed to obtain Tendermint version from version/version.go")
+      sys.exit(1)
+    expected_version_noprefix = expected_version.lstrip("v")
+    if expected_version_noprefix != "0.0.0" and expected_version_noprefix != cur_version:
+      print("Expected version/version.go#TMCoreSemVer to be {0}, but was {1}".format(expected_version_noprefix, cur_version))
+      sys.exit(1)
+
+  print(expected_version)

version/version.go

@@ -20,7 +20,7 @@ const (
 	// Must be a string because scripts like dist.sh read this file.
 	// XXX: Don't change the name of this variable or you will break
 	// automation :)
-	TMCoreSemVer = "0.31.5"
+	TMCoreSemVer = "0.31.7"
 
 	// ABCISemVer is the semantic version of the ABCI library
 	ABCISemVer  = "0.16.0"