From 0d64b8f709b4655d8702f810d4876cd8d96ded82 Mon Sep 17 00:00:00 2001 From: Pieter Wuille Date: Wed, 30 Jun 2021 11:52:40 -0700 Subject: Rate limit the processing of incoming addr messages While limitations on the influence of attackers on addrman already exist (affected buckets are restricted to a subset based on incoming IP / network group), there is no reason to permit them to let them feed us addresses at more than a multiple of the normal network rate. This commit introduces a "token bucket" rate limiter for the processing of addresses in incoming ADDR and ADDRV2 messages. Every connection gets an associated token bucket. Processing an address in an ADDR or ADDRV2 message from non-whitelisted peers consumes a token from the bucket. If the bucket is empty, the address is ignored (it is not forwarded or processed). The token counter increases at a rate of 0.1 tokens per second, and will accrue up to a maximum of 1000 tokens (the maximum we accept in a single ADDR or ADDRV2). When a GETADDR is sent to a peer, it immediately gets 1000 additional tokens, as we actively desire many addresses from such peers (this may temporarily cause the token count to exceed 1000). The rate limit of 0.1 addr/s was chosen based on observation of honest nodes on the network. Activity in general from most nodes is either 0, or up to a maximum around 0.025 addr/s for recent Bitcoin Core nodes. A few (self-identified, through subver) crawler nodes occasionally exceed 0.1 addr/s. --- test/functional/p2p_addr_relay.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'test/functional/p2p_addr_relay.py') diff --git a/test/functional/p2p_addr_relay.py b/test/functional/p2p_addr_relay.py index 1a414959b9..cd668dc315 100755 --- a/test/functional/p2p_addr_relay.py +++ b/test/functional/p2p_addr_relay.py @@ -53,6 +53,7 @@ class AddrTest(BitcoinTestFramework): def set_test_params(self): self.num_nodes = 1 + self.extra_args = [["-whitelist=addr@127.0.0.1"]] def run_test(self): self.oversized_addr_test() @@ -191,7 +192,7 @@ class AddrTest(BitcoinTestFramework): def blocksonly_mode_tests(self): self.log.info('Test addr relay in -blocksonly mode') - self.restart_node(0, ["-blocksonly"]) + self.restart_node(0, ["-blocksonly", "-whitelist=addr@127.0.0.1"]) self.mocktime = int(time.time()) self.log.info('Check that we send getaddr messages') -- cgit v1.2.3 From b4ece8a1cda69cc268d39d21bba59c51fa2fb9ed Mon Sep 17 00:00:00 2001 From: Pieter Wuille Date: Thu, 1 Jul 2021 16:02:05 -0700 Subject: Functional tests for addr rate limiting --- test/functional/p2p_addr_relay.py | 80 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 80 insertions(+) (limited to 'test/functional/p2p_addr_relay.py') diff --git a/test/functional/p2p_addr_relay.py b/test/functional/p2p_addr_relay.py index cd668dc315..b53231b6df 100755 --- a/test/functional/p2p_addr_relay.py +++ b/test/functional/p2p_addr_relay.py @@ -17,7 +17,10 @@ from test_framework.p2p import P2PInterface from test_framework.test_framework import BitcoinTestFramework from test_framework.util import ( assert_equal, + assert_greater_than_or_equal, ) +import os +import random import time @@ -60,6 +63,7 @@ class AddrTest(BitcoinTestFramework): self.relay_tests() self.getaddr_tests() self.blocksonly_mode_tests() + self.rate_limit_tests() def setup_addr_msg(self, num): addrs = [] @@ -76,6 +80,19 @@ class AddrTest(BitcoinTestFramework): msg.addrs = addrs return msg + def setup_rand_addr_msg(self, num): + addrs = [] + for i in range(num): + addr = CAddress() + addr.time = self.mocktime + i + addr.nServices = NODE_NETWORK | NODE_WITNESS + addr.ip = f"{random.randrange(128,169)}.{random.randrange(1,255)}.{random.randrange(1,255)}.{random.randrange(1,255)}" + addr.port = 8333 + addrs.append(addr) + msg = msg_addr() + msg.addrs = addrs + return msg + def send_addr_msg(self, source, msg, receivers): source.send_and_ping(msg) # pop m_next_addr_send timer @@ -208,6 +225,69 @@ class AddrTest(BitcoinTestFramework): self.nodes[0].disconnect_p2ps() + def rate_limit_tests(self): + + for contype, tokens, no_relay in [("outbound-full-relay", 1001, False), ("block-relay-only", 0, True), ("inbound", 1, False)]: + self.log.info(f'Test rate limiting of addr processing for {contype} peers') + self.stop_node(0) + os.remove(os.path.join(self.nodes[0].datadir, "regtest", "peers.dat")) + self.start_node(0, []) + self.mocktime = int(time.time()) + self.nodes[0].setmocktime(self.mocktime) + if contype == "inbound": + peer = self.nodes[0].add_p2p_connection(AddrReceiver()) + else: + peer = self.nodes[0].add_outbound_p2p_connection(AddrReceiver(), p2p_idx=0, connection_type=contype) + + # Check that we start off with empty addrman + addr_count_0 = len(self.nodes[0].getnodeaddresses(0)) + assert_equal(addr_count_0, 0) + + # Send 600 addresses. For all but the block-relay-only peer this should result in at least 1 address. + peer.send_and_ping(self.setup_rand_addr_msg(600)) + addr_count_1 = len(self.nodes[0].getnodeaddresses(0)) + assert_greater_than_or_equal(tokens, addr_count_1) + assert_greater_than_or_equal(addr_count_0 + 600, addr_count_1) + assert_equal(addr_count_1 > addr_count_0, tokens > 0) + + # Send 600 more addresses. For the outbound-full-relay peer (which we send a GETADDR, and thus will + # process up to 1001 incoming addresses), this means more entries will appear. + peer.send_and_ping(self.setup_rand_addr_msg(600)) + addr_count_2 = len(self.nodes[0].getnodeaddresses(0)) + assert_greater_than_or_equal(tokens, addr_count_2) + assert_greater_than_or_equal(addr_count_1 + 600, addr_count_2) + assert_equal(addr_count_2 > addr_count_1, tokens > 600) + + # Send 10 more. As we reached the processing limit for all nodes, this should have no effect. + peer.send_and_ping(self.setup_rand_addr_msg(10)) + addr_count_3 = len(self.nodes[0].getnodeaddresses(0)) + assert_greater_than_or_equal(tokens, addr_count_3) + assert_equal(addr_count_2, addr_count_3) + + # Advance the time by 100 seconds, permitting the processing of 10 more addresses. Send 200, + # but verify that no more than 10 are processed. + self.mocktime += 100 + self.nodes[0].setmocktime(self.mocktime) + new_tokens = 0 if no_relay else 10 + tokens += new_tokens + peer.send_and_ping(self.setup_rand_addr_msg(200)) + addr_count_4 = len(self.nodes[0].getnodeaddresses(0)) + assert_greater_than_or_equal(tokens, addr_count_4) + assert_greater_than_or_equal(addr_count_3 + new_tokens, addr_count_4) + + # Advance the time by 1000 seconds, permitting the processing of 100 more addresses. Send 200, + # but verify that no more than 100 are processed (and at least some). + self.mocktime += 1000 + self.nodes[0].setmocktime(self.mocktime) + new_tokens = 0 if no_relay else 100 + tokens += new_tokens + peer.send_and_ping(self.setup_rand_addr_msg(200)) + addr_count_5 = len(self.nodes[0].getnodeaddresses(0)) + assert_greater_than_or_equal(tokens, addr_count_5) + assert_greater_than_or_equal(addr_count_4 + new_tokens, addr_count_5) + assert_equal(addr_count_5 > addr_count_4, not no_relay) + + self.nodes[0].disconnect_p2ps() if __name__ == '__main__': AddrTest().main() -- cgit v1.2.3 From a4bcd687c934d47aa3922334e97e579caf5f8124 Mon Sep 17 00:00:00 2001 From: John Newbery Date: Wed, 14 Jul 2021 11:58:50 -0700 Subject: Improve tests using statistics --- test/functional/p2p_addr_relay.py | 114 ++++++++++++++++++++------------------ 1 file changed, 61 insertions(+), 53 deletions(-) (limited to 'test/functional/p2p_addr_relay.py') diff --git a/test/functional/p2p_addr_relay.py b/test/functional/p2p_addr_relay.py index b53231b6df..ff1d85a9be 100755 --- a/test/functional/p2p_addr_relay.py +++ b/test/functional/p2p_addr_relay.py @@ -13,13 +13,12 @@ from test_framework.messages import ( msg_addr, msg_getaddr ) -from test_framework.p2p import P2PInterface -from test_framework.test_framework import BitcoinTestFramework -from test_framework.util import ( - assert_equal, - assert_greater_than_or_equal, +from test_framework.p2p import ( + P2PInterface, + p2p_lock, ) -import os +from test_framework.test_framework import BitcoinTestFramework +from test_framework.util import assert_equal import random import time @@ -27,6 +26,7 @@ import time class AddrReceiver(P2PInterface): num_ipv4_received = 0 test_addr_contents = False + _tokens = 1 def __init__(self, test_addr_contents=False): super().__init__() @@ -43,6 +43,20 @@ class AddrReceiver(P2PInterface): raise AssertionError("Invalid addr.port of {} (8333-8342 expected)".format(addr.port)) assert addr.ip.startswith('123.123.123.') + def on_getaddr(self, message): + # When the node sends us a getaddr, it increments the addr relay tokens for the connection by 1000 + self._tokens += 1000 + + @property + def tokens(self): + with p2p_lock: + return self._tokens + + def increment_tokens(self, n): + # When we move mocktime forward, the node increments the addr relay tokens for its peers + with p2p_lock: + self._tokens += n + def addr_received(self): return self.num_ipv4_received != 0 @@ -225,67 +239,61 @@ class AddrTest(BitcoinTestFramework): self.nodes[0].disconnect_p2ps() + def send_addrs_and_test_rate_limiting(self, peer, no_relay, new_addrs, total_addrs): + """Send an addr message and check that the number of addresses processed and rate-limited is as expected""" + + peer.send_and_ping(self.setup_rand_addr_msg(new_addrs)) + + peerinfo = self.nodes[0].getpeerinfo()[0] + addrs_processed = peerinfo['addr_processed'] + addrs_rate_limited = peerinfo['addr_rate_limited'] + self.log.debug(f"addrs_processed = {addrs_processed}, addrs_rate_limited = {addrs_rate_limited}") + + if no_relay: + assert_equal(addrs_processed, 0) + assert_equal(addrs_rate_limited, 0) + else: + assert_equal(addrs_processed, min(total_addrs, peer.tokens)) + assert_equal(addrs_rate_limited, max(0, total_addrs - peer.tokens)) + def rate_limit_tests(self): - for contype, tokens, no_relay in [("outbound-full-relay", 1001, False), ("block-relay-only", 0, True), ("inbound", 1, False)]: + self.mocktime = int(time.time()) + self.restart_node(0, []) + self.nodes[0].setmocktime(self.mocktime) + + for contype, no_relay in [("outbound-full-relay", False), ("block-relay-only", True), ("inbound", False)]: self.log.info(f'Test rate limiting of addr processing for {contype} peers') - self.stop_node(0) - os.remove(os.path.join(self.nodes[0].datadir, "regtest", "peers.dat")) - self.start_node(0, []) - self.mocktime = int(time.time()) - self.nodes[0].setmocktime(self.mocktime) if contype == "inbound": peer = self.nodes[0].add_p2p_connection(AddrReceiver()) else: peer = self.nodes[0].add_outbound_p2p_connection(AddrReceiver(), p2p_idx=0, connection_type=contype) - # Check that we start off with empty addrman - addr_count_0 = len(self.nodes[0].getnodeaddresses(0)) - assert_equal(addr_count_0, 0) - - # Send 600 addresses. For all but the block-relay-only peer this should result in at least 1 address. - peer.send_and_ping(self.setup_rand_addr_msg(600)) - addr_count_1 = len(self.nodes[0].getnodeaddresses(0)) - assert_greater_than_or_equal(tokens, addr_count_1) - assert_greater_than_or_equal(addr_count_0 + 600, addr_count_1) - assert_equal(addr_count_1 > addr_count_0, tokens > 0) + # Send 600 addresses. For all but the block-relay-only peer this should result in addresses being processed. + self.send_addrs_and_test_rate_limiting(peer, no_relay, 600, 600) # Send 600 more addresses. For the outbound-full-relay peer (which we send a GETADDR, and thus will - # process up to 1001 incoming addresses), this means more entries will appear. - peer.send_and_ping(self.setup_rand_addr_msg(600)) - addr_count_2 = len(self.nodes[0].getnodeaddresses(0)) - assert_greater_than_or_equal(tokens, addr_count_2) - assert_greater_than_or_equal(addr_count_1 + 600, addr_count_2) - assert_equal(addr_count_2 > addr_count_1, tokens > 600) - - # Send 10 more. As we reached the processing limit for all nodes, this should have no effect. - peer.send_and_ping(self.setup_rand_addr_msg(10)) - addr_count_3 = len(self.nodes[0].getnodeaddresses(0)) - assert_greater_than_or_equal(tokens, addr_count_3) - assert_equal(addr_count_2, addr_count_3) - - # Advance the time by 100 seconds, permitting the processing of 10 more addresses. Send 200, - # but verify that no more than 10 are processed. + # process up to 1001 incoming addresses), this means more addresses will be processed. + self.send_addrs_and_test_rate_limiting(peer, no_relay, 600, 1200) + + # Send 10 more. As we reached the processing limit for all nodes, no more addresses should be procesesd. + self.send_addrs_and_test_rate_limiting(peer, no_relay, 10, 1210) + + # Advance the time by 100 seconds, permitting the processing of 10 more addresses. + # Send 200 and verify that 10 are processed. self.mocktime += 100 self.nodes[0].setmocktime(self.mocktime) - new_tokens = 0 if no_relay else 10 - tokens += new_tokens - peer.send_and_ping(self.setup_rand_addr_msg(200)) - addr_count_4 = len(self.nodes[0].getnodeaddresses(0)) - assert_greater_than_or_equal(tokens, addr_count_4) - assert_greater_than_or_equal(addr_count_3 + new_tokens, addr_count_4) - - # Advance the time by 1000 seconds, permitting the processing of 100 more addresses. Send 200, - # but verify that no more than 100 are processed (and at least some). + peer.increment_tokens(10) + + self.send_addrs_and_test_rate_limiting(peer, no_relay, 200, 1410) + + # Advance the time by 1000 seconds, permitting the processing of 100 more addresses. + # Send 200 and verify that 100 are processed. self.mocktime += 1000 self.nodes[0].setmocktime(self.mocktime) - new_tokens = 0 if no_relay else 100 - tokens += new_tokens - peer.send_and_ping(self.setup_rand_addr_msg(200)) - addr_count_5 = len(self.nodes[0].getnodeaddresses(0)) - assert_greater_than_or_equal(tokens, addr_count_5) - assert_greater_than_or_equal(addr_count_4 + new_tokens, addr_count_5) - assert_equal(addr_count_5 > addr_count_4, not no_relay) + peer.increment_tokens(100) + + self.send_addrs_and_test_rate_limiting(peer, no_relay, 200, 1610) self.nodes[0].disconnect_p2ps() -- cgit v1.2.3