Limit new peer connection rate #1847
Labels
A-rust
Area: Updates to Rust code
C-bug
Category: This is a bug
C-security
Category: Security issues
I-heavy
Problems with excessive memory, disk, or CPU usage
I-slow
Problems with performance or responsiveness
I-unbounded-growth
Zebra keeps using resources, without any limit
NU-5
Network Upgrade: NU5 specific tasks
Milestone
Is your feature request related to a problem? Please describe.
Zebra doesn't limit its outbound connection rate. This is a distributed denial of service risk.
Describe the solution you'd like
CandidateSet.next()
into an async function0.1
secondsnew_peer_interval
so it's clear that it's the crawl interval, not the peer connection rate limitDescribe alternatives you've considered
This is a critical security issue, so we must do something.
We could limit the connection rate in
crawl_and_dial
, but that risks a DDoS in any other future users ofCandidateSet
.Similarly, we could attempt to limit the connection rate in other parts of the network stack, but that risks future refactors or bugs causing a DDoS.
Additional context
zcashd
does not have this issue.The text was updated successfully, but these errors were encountered: