Merge bitcoin/bitcoin#22910: net: Encapsulate asmap in NetGroupManager

36f814c0e84d009c0e0aa26981a20ac4cf338a85 [netgroupman] Remove NetGroupManager::GetAsmap() (John Newbery)
4709fc2019e27e74be02dc5fc123b9f6f46d7990 [netgroupman] Move asmap checksum calculation to NetGroupManager (John Newbery)
1b978a7e8c71dcc1501705022e66f6779c8c4528 [netgroupman] Move GetMappedAS() and GetGroup() logic to NetGroupManager (John Newbery)
ddb4101e6377a998b7c598bf52217b47698ddec9 [net] Only use public CNetAddr functions and data in GetMappedAS() and GetGroup() (John Newbery)
6b2268162e96bc4fe1a3ebad454996b1d3d4615c [netgroupman] Add GetMappedAS() and GetGroup() (John Newbery)
19431560e3e1124979c60f39eca9429c4a0df29f [net] Move asmap into NetGroupManager (John Newbery)
17c24d458042229e00dd4e0b75a32e593be29564 [init] Add netgroupman to node.context (John Newbery)
9b3836710b8160d212aacd56154938e5bb4b26b7 [build] Add netgroup.cpp|h (John Newbery)

Pull request description:

  The asmap data is currently owned by addrman, but is used by both addrman and connman. #22791 made the data const and private (so that it can't be updated by other components), but it is still passed out of addrman as a reference to const, and used by `CNetAddress` to calculate the group and AS of the net address.

  This RFC PR proposes to move all asmap data and logic into a new `NetGroupManager` component. This is initialized at startup, and the client components addrman and connman simply call `NetGroupManager::GetGroup(const CAddress&)` and `NetGroupManager::GetMappedAS(const CAddress&)` to get the net group and AS of an address.

ACKs for top commit:
  mzumsande:
    Code Review ACK 36f814c0e84d009c0e0aa26981a20ac4cf338a85
  jnewbery:
    CI failure seems spurious. I rebased onto latest master to trigger a new CI run, but whilst I was doing that, mzumsande ACKed https://github.com/bitcoin/bitcoin/commit/36f814c0e84d009c0e0aa26981a20ac4cf338a85, so I've reverted to that.
  dergoegge:
    Code review ACK 36f814c0e84d009c0e0aa26981a20ac4cf338a85

Tree-SHA512: 244a89cdfd720d8cce679eae5b7951e1b46b37835fccb6bdfa362856761bb110e79e263a6eeee8246140890f3bee2850e9baa7bc14a388a588e0e29b9d275175

1 files changed, 66 insertions, 0 deletions

diff --git a/src/netgroup.h b/src/netgroup.h
new file mode 100644
index 0000000000..2dd63ec66b
--- /dev/null
+++ b/src/netgroup.h
@@ -0,0 +1,66 @@
+// Copyright (c) 2021 The Bitcoin Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#ifndef BITCOIN_NETGROUP_H
+#define BITCOIN_NETGROUP_H
+
+#include <netaddress.h>
+#include <uint256.h>
+
+#include <vector>
+
+/**
+ * Netgroup manager
+ */
+class NetGroupManager {
+public:
+    explicit NetGroupManager(std::vector<bool> asmap)
+        : m_asmap{std::move(asmap)}
+    {}
+
+    /** Get a checksum identifying the asmap being used. */
+    uint256 GetAsmapChecksum() const;
+
+    /**
+     * Get the canonical identifier of the network group for address.
+     *
+     * The groups are assigned in a way where it should be costly for an attacker to
+     * obtain addresses with many different group identifiers, even if it is cheap
+     * to obtain addresses with the same identifier.
+     *
+     * @note No two connections will be attempted to addresses with the same network
+     *       group.
+     */
+    std::vector<unsigned char> GetGroup(const CNetAddr& address) const;
+
+    /**
+     *  Get the autonomous system on the BGP path to address.
+     *
+     *  The ip->AS mapping depends on how asmap is constructed.
+     */
+    uint32_t GetMappedAS(const CNetAddr& address) const;
+
+private:
+    /** Compressed IP->ASN mapping, loaded from a file when a node starts.
+     *
+     * This mapping is then used for bucketing nodes in Addrman and for
+     * ensuring we connect to a diverse set of peers in Connman. The map is
+     * empty if no file was provided.
+     *
+     * If asmap is provided, nodes will be bucketed by AS they belong to, in
+     * order to make impossible for a node to connect to several nodes hosted
+     * in a single AS. This is done in response to Erebus attack, but also to
+     * generally diversify the connections every node creates, especially
+     * useful when a large fraction of nodes operate under a couple of cloud
+     * providers.
+     *
+     * If a new asmap is provided, the existing addrman records are
+     * re-bucketed.
+     *
+     * This is initialized in the constructor, const, and therefore is
+     * thread-safe. */
+    const std::vector<bool> m_asmap;
+};
+
+#endif // BITCOIN_NETGROUP_H