From 8d62db7551ee7f5eaba5beeae1bed8f71fbaeebd Mon Sep 17 00:00:00 2001
From: Alexandru Vasile <60601340+lexnv@users.noreply.github.com>
Date: Wed, 15 Jan 2025 13:04:37 +0200
Subject: [PATCH] req-resp/litep2p: Reject inbound requests from banned peers
(#7158)
This PR rejects inbound requests from banned peers (reputation is below
the banned threshold).
This mirrors the request-response implementation from the libp2p side.
I won't expect this to get triggered too often, but we'll monitor this
metric.
While at it, have registered a new inbound failure metric to have
visibility into this.
Discovered during the investigation of:
https://github.com/paritytech/polkadot-sdk/issues/7076#issuecomment-2589613046
cc @paritytech/networking
---------
Signed-off-by: Alexandru Vasile <alexandru.vasile@parity.io>
(cherry picked from commit ef064a357c97c2635f05295aac1698a91fa2f4fd)
---
prdoc/pr_7158.prdoc | 12 +++++++++
.../src/litep2p/shim/request_response/mod.rs | 25 ++++++++++++++-----
2 files changed, 31 insertions(+), 6 deletions(-)
create mode 100644 prdoc/pr_7158.prdoc
diff --git a/prdoc/pr_7158.prdoc b/prdoc/pr_7158.prdoc
new file mode 100644
index 00000000000..e113a7fdcd1
--- /dev/null
+++ b/prdoc/pr_7158.prdoc
@@ -0,0 +1,12 @@
+title: Reject litep2p inbound requests from banned peers
+
+doc:
+ - audience: Node Dev
+ description: |
+ This PR rejects inbound requests from banned peers (reputation is below the banned threshold).
+ This mirrors the request-response implementation from the libp2p side.
+ While at it, have registered a new inbound failure metric to have visibility into this.
+
+crates:
+- name: sc-network
+ bump: patch
diff --git a/substrate/client/network/src/litep2p/shim/request_response/mod.rs b/substrate/client/network/src/litep2p/shim/request_response/mod.rs
index 146f2e4add9..690d5a31e6a 100644
--- a/substrate/client/network/src/litep2p/shim/request_response/mod.rs
+++ b/substrate/client/network/src/litep2p/shim/request_response/mod.rs
@@ -273,6 +273,13 @@ impl RequestResponseProtocol {
request_id: RequestId,
request: Vec<u8>,
) {
+ log::trace!(
+ target: LOG_TARGET,
+ "{}: request received from {peer:?} ({fallback:?} {request_id:?}), request size {:?}",
+ self.protocol,
+ request.len(),
+ );
+
let Some(inbound_queue) = &self.inbound_queue else {
log::trace!(
target: LOG_TARGET,
@@ -284,12 +291,18 @@ impl RequestResponseProtocol {
return;
};
- log::trace!(
- target: LOG_TARGET,
- "{}: request received from {peer:?} ({fallback:?} {request_id:?}), request size {:?}",
- self.protocol,
- request.len(),
- );
+ if self.peerstore_handle.is_banned(&peer.into()) {
+ log::trace!(
+ target: LOG_TARGET,
+ "{}: rejecting inbound request from banned {peer:?} ({request_id:?})",
+ self.protocol,
+ );
+
+ self.handle.reject_request(request_id);
+ self.metrics.register_inbound_request_failure("banned-peer");
+ return;
+ }
+
let (tx, rx) = oneshot::channel();
match inbound_queue.try_send(IncomingRequest {
--
GitLab