Skip to content

p2p: Rate limit outgoing signaling discovery requests #2192

@iostat

Description

@iostat

discovery_actions.rs, lines 215-227, has a TODO:

// TODO(binier): constrain interval between these requests
// to handle malicious peers.
P2pChannelsSignalingDiscoveryAction::DiscoveryRequestSend { peer_id, .. } => {
    !state.already_has_min_peers()
        && state.get_ready_peer(peer_id).is_some_and(|p| { ... })
}

A malicious relay peer can flood a target with discovery requests without any
rate limiting. The 60-second cooldown on RequestSend (line 139) only limits
outgoing requests we initiate, not incoming requests from peers.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

Projects

Status

Todo

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions