Repository navigation
Conversation
jxs
marked this pull request as draft
November 9, 2026 19:45
jxs
force-pushed
the
feat-quic-retry
branch
5 times, most recently
from
November 10, 2026 17:58
614db41 to
c3066f4
Compare
jxs
marked this pull request as ready for review
November 10, 2026 18:00
Contributor
|
This pull request has merge conflicts. Could you please resolve them @jxs? 🙏 |
Contributor
|
Tick the box to add this pull request to the merge queue (same as
|
jxs
force-pushed
the
feat-quic-retry
branch
2 times, most recently
from
November 10, 2026 18:04
5c75e8f to
a45c48c
Compare
Inbound connections from an unvalidated source address now have to pass a stateless QUIC Retry round trip (RFC 9000 §8.1.2) before the TLS handshake starts, once that source's budget of free attempts is spent. Without it, a peer can trivially burn CPU by repeatedly sending fresh connection ClientHellos, each of which immediately starts a handshake. Budgets are tracked per source address (IPv4 exactly, IPv6 per /58 prefix, matching libp2p-connection-limits; loopback exempt) in an LRU cache of 4096 token buckets, defaulting to burst 4 and 6 attempts/minute, following go-libp2p's resource manager. Configurable via `Config::inbound_address_validation` (`Disabled`/`Always`/`RateLimited`), enabled by default. test(quic): assert the inbound Retry is sent before the handshake
Member
|
I think go-libp2p applies the limit to all peers, not per source address: We should do the same, otherwise an attacker can just spoof src IP addresses and circumvent the rate limiter I think? |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Inbound connections from an unvalidated source address now have to pass a stateless QUIC Retry round trip (RFC 9000 §8.1.2) before the TLS handshake starts, once that source's budget of free attempts is spent.
Without this, a peer can trivially burn CPU by repeatedly sending fresh connection
ClientHellos, each of which immediately starts a handshake.Budgets are tracked per source address (IPv4 exactly, IPv6 per /58 prefix, matching libp2p-connection-limits; loopback exempt) in an LRU cache of 4096 token buckets, defaulting to burst 4 and 6 attempts/minute, following go-libp2p's resource manager. Configurable via
Config::inbound_address_validation(Disabled/Always/RateLimited), enabled by default.This matches libp2p/go-libp2p#3283