p2p: bound learned addresses and outbound dials; manual peers outside the automatic cap

[bkeroack]

Problem

Core references are to src/ at current master.

Addresses a peer announces. satd took every entry of every addr / addrv2 message (#939 caps a message at 1000 entries; ProcessAddrs, net_processing.cpp:5625-5704). Each entry went to the address book and, whether the book kept it or not, onto the reconnect loop's dial list, a Vec searched end to end on every insert, with no cap. getpeerinfo reported addr_processed and addr_rate_limited as 0.

Core meters the addresses each peer announces with a token bucket (net_processing.cpp:5640-5698): one token to start (m_addr_token_bucket{1.0}, :380), MAX_ADDR_RATE_PER_SECOND = 0.1 more a second up to MAX_ADDR_PROCESSING_TOKEN_BUCKET = 1000 (:193-197), and MAX_ADDR_TO_SEND more, past that limit, when it sends the peer getaddr (:3767). Entries are shuffled first; one that finds no token is dropped unless the peer has the addr permission; a banned address is not counted as processed. Core dials only from its address book.

Outbound dials. One limit, check_outbound_limit, covered automatic and manual dials alike. It counted connected outbound peers only, manual ones included, against the automatic target (8, or 64 during IBD):

• Dials in flight were not counted, so each 10-second reconnect tick started a dial for every eligible learned address at once.
• With the automatic peers connected, addnode … onetry failed with "max outbound connections reached", and the dial from addnode add / -addnode failed silently.
• The redial pass ran only while that count was below the target, so on such a node an added node that dropped, or whose first dial failed, was not dialled again.
• onetry to a connected peer failed with "already connected to …".
• Backoff grew to 300 s for manual peers too, and every address's backoff was cleared whenever the tip moved, which during IBD is every tick.
• The redial pass skipped a banned manual peer, and never looked at the ban of an onion host: automatic dials to a banned .onion (setban, or a ban for misbehaviour from p2p: don't ban local, inbound-onion or manual peers for misbehaviour (Core parity) #944) went on, and gossip naming one was kept.
• setban <host>.onion did not disconnect a connected peer at that host: the disconnect matched bans against peers' IPs, and an onion peer's is the shared 0.0.0.0 placeholder (BanTarget::contains_addr is false for an onion target). Core's setban disconnects the peers the ban covers.

Core gives each kind its own limit, taken as a semaphore grant before the dial (net.cpp): automatic connections take semOutbound (ThreadOpenConnections); added nodes take semAddnode, MAX_ADDNODE_CONNECTIONS = 8 (net.h:71), in ThreadOpenAddedConnections, which tries again every 60 s whatever the automatic count (net.cpp:2972-3000); -connect (:2539-2556) and addnode onetry (rpc/net.cpp:352-357) take no grant, and onetry answers null, also for a host already connected (OpenNetworkConnection, net.cpp:3023-3030). OpenNetworkConnection checks bans and discouragement only for an automatic connection (no pszDest); a manual one is opened by the operator's name, banned or not.

Fix

• net/addr_rate.rs (new): Core's token bucket, kept on PeerInfo with its counters. The addr and addrv2 arms shuffle the entries and keep those that find a token (or all of them for a peer with the addr permission); sending getaddr (addr-fetch peers, and outbound peers under a proxy) credits 1000. getpeerinfo reports addr_processed and addr_rate_limited.
• A gossiped address goes on the dial list only if the address book holds it (not one past the book's per-group or total cap). The list is a set in arrival order, capped at the book's size (16,384).
• reserve_dial checks a dial's limit and takes its place under one lock, counting dials in flight along with the peers (connected or in the handshake): automatic dials against the automatic target, manual connections apart from it; added nodes at most 8 at once; -connect, -seednode and onetry with no limit. The place is held until the peer is in the peer map.
• The reconnect tick is two passes, as in Core: every manual peer that is not connected, whatever the automatic count, then learned addresses into the free automatic slots. Automatic dials (clearnet, onion and seeds) skip banned addresses; manual ones do not. Gossip naming a banned onion host is not kept.
• With nothing leaving it, a full address book (or a full network group) would now have shut every new address out for good, so the book makes room by dropping a terrible entry (Core's AddrInfo::IsTerrible, addrman.cpp:49-72: unseen 30 days, three failed attempts and never reached, or ten failures in a week), new entries of the group first, then new, then tried ones; the dropped address leaves the dial list and its backoff state goes too. Failed redials now count as attempts in the book (Core's Attempt), which nothing recorded before.
• Manual backoff stops at 60 s (Core's added-node retry); automatic stays at 300 s. Backoff is cleared only by a dial that connects.
• setban disconnects an onion peer by its onion host; an IP-range ban no longer reaches onion peers through their placeholder address.
• addnode onetry (connect_peer_addr_onetry) is outside every limit and succeeds for a peer already connected or being dialled. A dial that fails is still reported, as satd always has.

#895: counting dials in flight removes the part of the overshoot that came from one tick starting more dials than there were free slots: the automatic count can no longer pass the target in force when a dial starts. It does not close connections opened while the IBD target (64) applied, which is #895 itself. #894 is unchanged (the dial order is the list order, as before).

Tests

Unit tests, net::addr_rate::tests (new file) and net::manager::addrdials_tests (new file node/src/net/manager_addrdials_tests.rs):

• addr_rate::tests: one address to start, ten after 100 s, the refill limit of 1000, the getaddr credit past it, the addr exemption, a clock that goes backwards.
• a_peers_addresses_are_rate_limited_unless_it_has_the_addr_permission, addrv2_is_rate_limited_too, the_answer_to_a_getaddr_is_taken_whole (through handle_message).
• an_address_the_book_has_no_room_for_is_not_dialled (100 addresses in one /16: 64 in the book, 64 on the list), the_dial_list_stops_at_its_cap.
• a_reconnect_tick_starts_no_more_automatic_dials_than_free_slots (20 learned listeners, 3 automatic peers, target 8: 5 dials, then none).
• an_added_node_is_dialled_with_the_automatic_slots_full (and an automatic dial is still refused), added_nodes_stop_at_eight_and_other_manual_peers_do_not, onetry_is_outside_the_limits_and_succeeds_for_a_connected_peer (a failed dial is still an error).
• a_manual_peers_backoff_stops_at_a_minute, a_failed_manual_redial_backs_off_by_the_manual_cap, a_new_tip_leaves_reconnect_backoff_alone (drives the run loop), a_dial_that_connects_clears_its_backoff.
• a_banned_manual_peer_is_dialled_and_a_banned_learned_one_is_not (reconnect loop and seed dial), a_banned_onion_host_is_neither_learned_nor_dialled_automatically (a banned onion host the operator named is still dialled), setban_of_an_onion_host_disconnects_that_peer_only.
• a_full_book_replaces_a_terrible_entry, a_full_group_replaces_a_terrible_entry_and_its_backoff, a_book_full_of_stale_tried_entries_takes_a_new_address, a_failed_redial_counts_as_an_attempt (each fails with its guard reverted).

Integration tests, satd/tests/p2p_addr_dials.rs (new target, live regtest node):

• a_peers_addresses_are_rate_limited_unless_it_has_the_addr_permission: 1000 addresses from an inbound peer → getpeerinfo addr_processed 1, addr_rate_limited 999; setmocktime +100 s → 10 more; a peer on a -whitebind=addr@… listener → all 1000 (Core's p2p_addr_relay.py steps).
• an_addr_fetch_peers_answer_is_taken_whole: an addr-fetch peer's 600-address answer to getaddr is learned whole.
• manual_connections_are_outside_the_automatic_outbound_target: -maxconnections=3, out of IBD, three automatic peers; addnode onetry connects and answers null, again null for the connected peer; addnode add to a port not yet listening is dialled again once it listens.

Existing tests edited in place: gossiped_addresses_keep_their_services_and_source (manager.rs, two addresses from one peer: the peer now has addr); an_address_that_names_no_host_is_neither_learned_nor_dialled and off_regtest_a_gossiped_private_address_is_neither_learned_nor_dialled (satd/tests/regtest.rs) announce several addresses from one inbound peer and expect all of them to be looked at; their nodes now run with -whitelist=addr@127.0.0.1, as Core's own address tests do.

Fails without the fix: yes. Each guard was reverted on its own and the named test failed on its assertion:

• dial limit counting connected peers only → a_reconnect_tick_starts_no_more_automatic_dials_than_free_slots "left: 20, right: 5";
• manual redial only below the automatic target → an_added_node_is_dialled_with_the_automatic_slots_full times out;
• onetry taking the automatic limit / erroring for a connected peer → onetry_is_outside_the_limits_and_succeeds_for_a_connected_peer (expect fails both ways);
• no added-node limit → added_nodes_stop_at_eight_and_other_manual_peers_do_not "left: 10, right: 8";
• 300 s manual cap → a_manual_peers_backoff_stops_at_a_minute "left: 300s, right: 60s";
• backoff reset on a new tip → a_new_tip_leaves_reconnect_backoff_alone "left: Some(0), right: Some(3)";
• pushing what the book refused → an_address_the_book_has_no_room_for_is_not_dialled "left: 100, right: 64";
• no list cap → the_dial_list_stops_at_its_cap;
• no rate limit → the two rate-limit tests "left: (1000, 0), right: (1, 999)", "(500, 0) vs (1, 499)";
• no getaddr credit → the_answer_to_a_getaddr_is_taken_whole "(1, 999) vs (1000, 0)" and the bucket test;
• manual redial skipping bans → both ban tests time out; automatic onion dials or onion gossip ignoring bans → the onion ban test; automatic clearnet or seed dials ignoring bans → a_banned_manual_peer_is_dialled_and_a_banned_learned_one_is_not ("left: 1, right: 0", and the seed expect_err);
• the onion setban test failed on the unfixed code: "left: {1, 2, 3}, right: {2, 3}".

Notes

• Ordinary peers are still banned for -bantime rather than discouraged (unchanged, as in p2p: don't ban local, inbound-onion or manual peers for misbehaviour (Core parity) #944); the ban checks above use satd's ban list.
• The automatic target is unchanged (8, 64 during IBD, the IBD figure not capped by -maxconnections). -seednode peers stay manual connections (CORE_DIFFERENCES.md), so they are now redialled like other manual peers whatever the automatic count.
• satd still sends getaddr only to addr-fetch peers and, under a proxy, to outbound peers (Core sends it to every outbound full-relay peer); unsolicited addr traffic is metered exactly as Core meters it.
• Found, not fixed: under a proxy satd also sends getaddr to a block-relay-only outbound peer, which Core never does (manager.rs, the proxy getaddr in the peer setup).

Release notes

RELEASE_- Ordinary peers are still banned for -bantime rather than discouraged (unchanged, as in #944); the ban checks above use satd's ban list.

• The automatic target is unchanged (8, 64 during IBD, the IBD figure not capped by -maxconnections). -seednode peers stay manual connections (CORE_DIFFERENCES.md), so they are now redialled like other manual peers whatever the automatic count.
• satd still sends getaddr only to addr-fetch peers and, under a proxy, to outbound peers (Core sends it to every outbound full-relay peer); unsolicited addr traffic is metered exactly as Core meters it.
• Found, not fixed: under a proxy satd also sends getaddr to a block-relay-only outbound peer, which Core never does (manager.rs, the proxy getaddr in the peer setup).

🤖 Generated with Claude Code