fix(p2p): never ban loopback peers — stop RST of co-located reconnects (#757) - #1
Draft
frstrtr wants to merge 1 commit into
Draft
fix(p2p): never ban loopback peers — stop RST of co-located reconnects (#757)#1frstrtr wants to merge 1 commit into
frstrtr wants to merge 1 commit into
Conversation
…s (#757)
Under connection churn, co-located / loopback peers (mixed-fleet, NAT'd
deployments where c2pool and p2pool-dash reconnect over 127.0.0.1) were
silently RST'd on every fresh incoming connection.
Root cause: two ban paths added for Dash Core v23+ support wrote
self.node.bans['127.0.0.1'] without the localhost exemption that
Protocol.badPeerHappened deliberately applies:
- handle_version self-nonce rate-limiter: a loopback self-connection
(node reaching its own advertised 127.0.0.1) counts toward the
3-strikes-in-10min ban -> bans 127.0.0.1 for 5 min.
- ClientFactory.clientConnectionFailed: an outbound connect to a
loopback peer that is momentarily down during churn (restart) bans
127.0.0.1 for 60s.
Once bans['127.0.0.1'] is set, ServerFactory.buildProtocol returns None
for every incoming loopback connection -> silent RST. Churn keeps
refreshing the ban, so it persists.
Fix (connection hygiene only; no share/sharechain/protocol change):
exempt loopback (127.0.0.0/8, ::1) from both new ban paths, and as
defense-in-depth from the buildProtocol ban gate, so no ban source can
RST a loopback re-accept. Adds LoopbackBanTest regression coverage.
Same class as the c2pool zombie-session leak: stale admission-control
state (there a dead session, here a ban entry) not cleaned up causes new
legitimate connections to be RST'd.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem (issue #757)
Under connection churn, the node silently RSTs loopback reconnects from co-located peers — relevant to mixed-fleet / NAT'd deployments where processes reconnect over
127.0.0.1.Root cause
Two ban paths added in
60d5140(Dash Core v23+ support) writeself.node.bans['127.0.0.1']without the localhost exemption thatProtocol.badPeerHappeneddeliberately applies (# never ban localhost):handle_versionself-nonce rate-limiter (p2p.py:157) — a loopback self-connection (a node reaching its own advertised127.0.0.1) counts toward the 3-strikes-in-10-min rule and bans127.0.0.1for 5 min.ClientFactory.clientConnectionFailed(p2p.py:612) — an outbound connect to a loopback peer that is momentarily down during churn (restart) bans127.0.0.1for 60s.Once
bans['127.0.0.1']is set,ServerFactory.buildProtocol(p2p.py:538) returnsNonefor every fresh incoming loopback connection → silent RST. Churn keeps refreshing the ban, so it persists.Fix
Connection hygiene only — no share / sharechain / protocol behavior changes (consensus-neutral). Exempt loopback (
127.0.0.0/8,::1) from:buildProtocolban gate, so no ban source can RST a loopback re-accept.Adds
LoopbackBanTestregression coverage intest_p2p.py.Note (not changed here)
buildProtocolalso caps incoming connections per /16 ident at 3, and all127.xcollapse to one ident — so a co-located fleet with >3 loopback peers can hit a steady-state cap independent of churn. Left as-is (avoids unbounded loopback fan-in); can be revisited if a larger co-located topology needs it.