Security: Prevent inv and AddressBook message denial of service

[teor2345]

Motivation

If peers send a lot of messages, they can overload the InventoryRegistry or AddressBook.

This is a memory or CPU denial of service risk.

Scheduling

This risk is acceptable for the stable release, but it probably needs to be fixed to support lightwalletd users.

Suggested Solutions

AddressBook:

• make the sender task yield after sending each update on the channel
• to reduce the volume of messages from honest peers, only send message timestamps for ping and pong messages
• to avoid peers flushing or delaying other peers' updates, choose one or more of these alternatives:
  • rate-limit the number of messages per peer, and disconnect peers that go over the limit
  • use one channel per peer for timestamp updates, or for all updates
  • combine all ready timestamp updates for the same peer before sending them

InventoryRegistry:

• make the sender task yield after sending each update on the channel
• limit the number of inv entries per peer, and disconnect peers that go over the limit
• also limit the number of peers?
• to avoid peers flushing or delaying other peers' updates, choose one or more of these alternatives:
  • rate-limit the number of messages per peer, and disconnect peers that go over the limit
  • use one channel per peer for inventory updates, or for all updates
  • combine all ready inventory updates for the same peer before sending them
  • split notfound and inv updates into separate channels:
    • inv are a low priority and can be dropped if there are excess
    • notfound are a higher priority, but can still be faked by peers, so they should be dropped if there are a lot
    • synthesised notfound should never be dropped, because they represent failed requests that Zebra does not want to retry

Related Work

[mpguerra]

Hey team! Please add your planning poker estimate with ZenHub @conradoplg @dconnolly @jvff @oxarbitrage @teor2345 @upbqdn

[teor2345]

I think our current broadcast channel implementation does this well enough for now.