Skip to content

Commit a893d2b

Browse files
committed
p2p: avoid false-positives in addr rate-limiting
On some occasions, a peer will send us addresses a few seconds after the connection is established. As peers start with token=1 and only get an additional token only every 10 seconds, some of these addresses might be rate-limited. The following log snippet contains an example: ``` 04:12:02 [net] Added connection to [redacted] peer=1234 ... 04:12:03 [net] Received addr: 1 addresses (1 processed, 0 rate-limited) from peer=1234 04:12:34 [net] Received addr: 4 addresses (3 processed, 1 rate-limited) from peer=1234 04:13:09 [net] Received addr: 2 addresses (2 processed, 0 rate-limited) from peer=1234 ``` The peer starts with token=1 and uses one for its self-announcement at 04:12:03. Until the next addr message arrives at 04:12:34, it re-gains 3 tokens and uses them, however, the fourth address in this addr message is rate-limited. At 04:13:09, the peer has token=3 and uses 2. This change gives peers token=5 to start with. To choose this value, I looked at the address relay of freshly connected peers. The data was sampled from the debug.logs from different nodes. It appears, that only very few peers require more than 5 initial tokens. (see image in PR) By increasing the initial tokens to 5, someone could connect, send 5 addresses, disconnect, and repeat to spam the node with addresses. Previously, the same was possible but only one address was processed. I don't think this is a problem since we have bitcoin#30568.
1 parent 161864a commit a893d2b

File tree

2 files changed

+5
-4
lines changed

2 files changed

+5
-4
lines changed

src/net_processing.cpp

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -372,9 +372,9 @@ struct Peer {
372372
std::atomic_bool m_wants_addrv2{false};
373373
/** Whether this peer has already sent us a getaddr message. */
374374
bool m_getaddr_recvd GUARDED_BY(NetEventsInterface::g_msgproc_mutex){false};
375-
/** Number of addresses that can be processed from this peer. Start at 1 to
376-
* permit self-announcement. */
377-
double m_addr_token_bucket GUARDED_BY(NetEventsInterface::g_msgproc_mutex){1.0};
375+
/** Number of addresses that can be processed from this peer. Starts at 5 to
376+
* allow a few addresses to be processed when the connection is opened. */
377+
double m_addr_token_bucket GUARDED_BY(NetEventsInterface::g_msgproc_mutex){5.0};
378378
/** When m_addr_token_bucket was last updated */
379379
std::chrono::microseconds m_addr_token_timestamp GUARDED_BY(NetEventsInterface::g_msgproc_mutex){GetTime<std::chrono::microseconds>()};
380380
/** Total number of addresses that were dropped due to rate limiting. */

test/functional/p2p_addr_relay.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,8 @@
3838
class AddrReceiver(P2PInterface):
3939
num_ipv4_received = 0
4040
test_addr_contents = False
41-
_tokens = 1
41+
# Start with 5 tokens to match "m_addr_token_bucket"
42+
_tokens = 5
4243
send_getaddr = True
4344

4445
def __init__(self, test_addr_contents=False, send_getaddr=True):

0 commit comments

Comments
 (0)