Skip to content

Commit bf376ea

Browse files
committed
Return early in IsBanned.
I am not aware of any reason that we'd try to stop a ban-list timing side-channel and the prior code wouldn't be enough if we were.
1 parent 29f80cd commit bf376ea

File tree

1 file changed

+14
-18
lines changed

1 file changed

+14
-18
lines changed

src/net.cpp

Lines changed: 14 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -469,35 +469,31 @@ void CConnman::ClearBanned()
469469

470470
bool CConnman::IsBanned(CNetAddr ip)
471471
{
472-
bool fResult = false;
472+
LOCK(cs_setBanned);
473+
for (banmap_t::iterator it = setBanned.begin(); it != setBanned.end(); it++)
473474
{
474-
LOCK(cs_setBanned);
475-
for (banmap_t::iterator it = setBanned.begin(); it != setBanned.end(); it++)
476-
{
477-
CSubNet subNet = (*it).first;
478-
CBanEntry banEntry = (*it).second;
475+
CSubNet subNet = (*it).first;
476+
CBanEntry banEntry = (*it).second;
479477

480-
if(subNet.Match(ip) && GetTime() < banEntry.nBanUntil)
481-
fResult = true;
478+
if (subNet.Match(ip) && GetTime() < banEntry.nBanUntil) {
479+
return true;
482480
}
483481
}
484-
return fResult;
482+
return false;
485483
}
486484

487485
bool CConnman::IsBanned(CSubNet subnet)
488486
{
489-
bool fResult = false;
487+
LOCK(cs_setBanned);
488+
banmap_t::iterator i = setBanned.find(subnet);
489+
if (i != setBanned.end())
490490
{
491-
LOCK(cs_setBanned);
492-
banmap_t::iterator i = setBanned.find(subnet);
493-
if (i != setBanned.end())
494-
{
495-
CBanEntry banEntry = (*i).second;
496-
if (GetTime() < banEntry.nBanUntil)
497-
fResult = true;
491+
CBanEntry banEntry = (*i).second;
492+
if (GetTime() < banEntry.nBanUntil) {
493+
return true;
498494
}
499495
}
500-
return fResult;
496+
return false;
501497
}
502498

503499
void CConnman::Ban(const CNetAddr& addr, const BanReason &banReason, int64_t bantimeoffset, bool sinceUnixEpoch) {

0 commit comments

Comments
 (0)