checkpoints: reduce ban time to 300s

vtnerd · nahuhh · commit 59751a4ae972 · 2025-09-10T19:42:57.000Z
diff --git a/src/cryptonote_basic/verification_context.h b/src/cryptonote_basic/verification_context.h
@@ -71,5 +71,6 @@ namespace cryptonote
     bool m_partial_block_reward;
     bool m_bad_pow; // if bad pow, ban peer outright for DoS protection
     bool m_missing_txs; // set if, during verif, we don't have all the necessary txs available
+    bool m_failed_checkpoint;
   };
 }
diff --git a/src/cryptonote_config.h b/src/cryptonote_config.h
@@ -154,6 +154,7 @@
 
 #define P2P_FAILED_ADDR_FORGET_SECONDS                  (60*60)     //1 hour
 #define P2P_IP_BLOCKTIME                                (60*60*24)  //24 hour
+#define P2P_IP_BLOCKTIME_LIGHT                          (60*5)      // 5 mins
 #define P2P_IP_FAILS_BEFORE_BLOCK                       10
 #define P2P_IDLE_CONNECTION_KILL_INTERVAL               (5*60) //5 minutes
 
diff --git a/src/cryptonote_core/blockchain.cpp b/src/cryptonote_core/blockchain.cpp
@@ -1885,6 +1885,7 @@ bool Blockchain::handle_alternative_block(const block& b, const crypto::hash& id
   {
     MERROR_VER("Block with id: " << id << std::endl << " can't be accepted for alternative chain, block height: " << block_height << std::endl << " blockchain height: " << get_current_blockchain_height());
     bvc.m_verifivation_failed = true;
+    bvc.m_failed_checkpoint = true;
     return false;
   }
 
diff --git a/src/cryptonote_protocol/cryptonote_protocol_handler.h b/src/cryptonote_protocol/cryptonote_protocol_handler.h
@@ -159,7 +159,7 @@ namespace cryptonote
     void drop_connection(cryptonote_connection_context &context, bool add_fail, bool flush_all_spans);
     void drop_connection_with_score(cryptonote_connection_context &context, unsigned int score, bool flush_all_spans);
     void drop_connection(const boost::uuids::uuid&);
-    void drop_connections(const epee::net_utils::network_address address);
+    void drop_connections(const epee::net_utils::network_address address, unsigned score = 5, bool block_light = false);
     bool kick_idle_peers();
     bool check_standby_peers();
     bool update_sync_search();
diff --git a/src/cryptonote_protocol/cryptonote_protocol_handler.inl b/src/cryptonote_protocol/cryptonote_protocol_handler.inl
@@ -1527,7 +1527,7 @@ namespace cryptonote
 
             if(bvc.m_verifivation_failed)
             {
-              drop_connections(span_origin);
+              drop_connections(span_origin, 5, bvc.m_failed_checkpoint);
               if (!m_p2p->for_connection(span_connection_id, [&](cryptonote_connection_context& context, nodetool::peerid_type peer_id, uint32_t f)->bool{
                 LOG_PRINT_CCONTEXT_L1("Block verification failed, dropping connection");
                 drop_connection_with_score(context, bvc.m_bad_pow ? P2P_IP_FAILS_BEFORE_BLOCK : 1, true);
@@ -2821,11 +2821,11 @@ skip:
   }
   //------------------------------------------------------------------------------------------------------------------------
   template<class t_core>
-  void t_cryptonote_protocol_handler<t_core>::drop_connections(const epee::net_utils::network_address address)
+  void t_cryptonote_protocol_handler<t_core>::drop_connections(const epee::net_utils::network_address address, unsigned score, bool block_light)
   {
     MWARNING("dropping connections to " << address.str());
 
-    m_p2p->add_host_fail(address, 5);
+    m_p2p->add_host_fail(address, score, block_light);
 
     std::vector<boost::uuids::uuid> drop;
     m_p2p->for_each_connection([&](const connection_context& cntxt, nodetool::peerid_type peer_id, uint32_t support_flags) {
diff --git a/src/p2p/net_node.h b/src/p2p/net_node.h
@@ -350,7 +350,7 @@ namespace nodetool
     virtual void request_callback(const epee::net_utils::connection_context_base& context);
     virtual void for_each_connection(std::function<bool(typename t_payload_net_handler::connection_context&, peerid_type, uint32_t)> f);
     virtual bool for_connection(const boost::uuids::uuid&, std::function<bool(typename t_payload_net_handler::connection_context&, peerid_type, uint32_t)> f);
-    virtual bool add_host_fail(const epee::net_utils::network_address &address, unsigned int score = 1);
+    virtual bool add_host_fail(const epee::net_utils::network_address &address, unsigned int score = 1, bool block_light = false);
     //----------------- i_connection_filter  --------------------------------------------------------
     virtual bool is_remote_host_allowed(const epee::net_utils::network_address &address, time_t *t = NULL);
     //----------------- i_connection_limit  ---------------------------------------------------------
@@ -509,6 +509,7 @@ namespace nodetool
 
     epee::critical_section m_host_fails_score_lock;
     std::map<std::string, uint64_t> m_host_fails_score;
+    std::map<std::string, uint64_t> m_host_fails_score_light;
 
     boost::mutex m_used_stripe_peers_mutex;
     std::array<std::list<epee::net_utils::network_address>, 1 << CRYPTONOTE_PRUNING_LOG_STRIPES> m_used_stripe_peers;
diff --git a/src/p2p/net_node.inl b/src/p2p/net_node.inl
@@ -403,20 +403,21 @@ namespace nodetool
   }
   //-----------------------------------------------------------------------------------
   template<class t_payload_net_handler>
-  bool node_server<t_payload_net_handler>::add_host_fail(const epee::net_utils::network_address &address, unsigned int score)
+  bool node_server<t_payload_net_handler>::add_host_fail(const epee::net_utils::network_address &address, unsigned int score, bool block_light)
   {
     if(!address.is_blockable())
       return false;
 
     CRITICAL_REGION_LOCAL(m_host_fails_score_lock);
-    uint64_t fails = m_host_fails_score[address.host_str()] += score;
+    auto& host_fails_score = block_light ? m_host_fails_score_light : m_host_fails_score;
+    uint64_t fails = host_fails_score[address.host_str()] += score;
     MDEBUG("Host " << address.host_str() << " fail score=" << fails);
     if(fails > P2P_IP_FAILS_BEFORE_BLOCK)
     {
-      auto it = m_host_fails_score.find(address.host_str());
-      CHECK_AND_ASSERT_MES(it != m_host_fails_score.end(), false, "internal error");
+      auto it = host_fails_score.find(address.host_str());
+      CHECK_AND_ASSERT_MES(it != host_fails_score.end(), false, "internal error");
       it->second = P2P_IP_FAILS_BEFORE_BLOCK/2;
-      block_host(address);
+      block_host(address, block_light ? P2P_IP_BLOCKTIME_LIGHT : P2P_IP_BLOCKTIME);
     }
     return true;
   }
diff --git a/src/p2p/net_node_common.h b/src/p2p/net_node_common.h
@@ -64,7 +64,7 @@ namespace nodetool
     virtual bool unblock_host(const epee::net_utils::network_address &address)=0;
     virtual std::map<std::string, time_t> get_blocked_hosts()=0;
     virtual std::map<epee::net_utils::ipv4_network_subnet, time_t> get_blocked_subnets()=0;
-    virtual bool add_host_fail(const epee::net_utils::network_address &address, unsigned int score = 1)=0;
+    virtual bool add_host_fail(const epee::net_utils::network_address &address, unsigned int score = 1, bool block_light = false)=0;
     virtual void add_used_stripe_peer(const t_connection_context &context)=0;
     virtual void remove_used_stripe_peer(const t_connection_context &context)=0;
     virtual void clear_used_stripe_peers()=0;
@@ -122,7 +122,7 @@ namespace nodetool
     {
       return std::map<epee::net_utils::ipv4_network_subnet, time_t>();
     }
-    virtual bool add_host_fail(const epee::net_utils::network_address &address, unsigned int score)
+    virtual bool add_host_fail(const epee::net_utils::network_address &address, unsigned int score, bool block_light)
     {
       return true;
     }
diff --git a/tests/unit_tests/node_server.cpp b/tests/unit_tests/node_server.cpp
@@ -608,7 +608,7 @@ TEST(cryptonote_protocol_handler, race_condition)
         core_protocol->on_connection_close(context);
     }
     virtual ~net_node_t() override {}
-    virtual bool add_host_fail(const address_t&, unsigned int = {}) override {
+    virtual bool add_host_fail(const address_t&, unsigned int = {}, bool = {}) override {
       return {};
     }
     virtual bool block_host(address_t address, time_t = {}, bool = {}) override {

Original file line number	Diff line number	Diff line change
`@@ -71,5 +71,6 @@ namespace cryptonote`
`71`	`71`	`bool m_partial_block_reward;`
`72`	`72`	`bool m_bad_pow; // if bad pow, ban peer outright for DoS protection`
`73`	`73`	`bool m_missing_txs; // set if, during verif, we don't have all the necessary txs available`
	`74`	`+ bool m_failed_checkpoint;`
`74`	`75`	`};`
`75`	`76`	`}`
Original file line number	Diff line number	Diff line change
`@@ -1885,6 +1885,7 @@ bool Blockchain::handle_alternative_block(const block& b, const crypto::hash& id`
`1885`	`1885`	`{`
`1886`	`1886`	`MERROR_VER("Block with id: " << id << std::endl << " can't be accepted for alternative chain, block height: " << block_height << std::endl << " blockchain height: " << get_current_blockchain_height());`
`1887`	`1887`	`bvc.m_verifivation_failed = true;`
	`1888`	`+ bvc.m_failed_checkpoint = true;`
`1888`	`1889`	`return false;`
`1889`	`1890`	`}`
`1890`	`1891`
Original file line number	Diff line number	Diff line change
`@@ -1527,7 +1527,7 @@ namespace cryptonote`
`1527`	`1527`
`1528`	`1528`	`if(bvc.m_verifivation_failed)`
`1529`	`1529`	`{`
`1530`		`- drop_connections(span_origin);`
	`1530`	`+ drop_connections(span_origin, 5, bvc.m_failed_checkpoint);`
`1531`	`1531`	`if (!m_p2p->for_connection(span_connection_id, [&](cryptonote_connection_context& context, nodetool::peerid_type peer_id, uint32_t f)->bool{`
`1532`	`1532`	`LOG_PRINT_CCONTEXT_L1("Block verification failed, dropping connection");`
`1533`	`1533`	`drop_connection_with_score(context, bvc.m_bad_pow ? P2P_IP_FAILS_BEFORE_BLOCK : 1, true);`
`@@ -2821,11 +2821,11 @@ skip:`
`2821`	`2821`	`}`
`2822`	`2822`	`//------------------------------------------------------------------------------------------------------------------------`
`2823`	`2823`	`template<class t_core>`
`2824`		`- void t_cryptonote_protocol_handler<t_core>::drop_connections(const epee::net_utils::network_address address)`
	`2824`	`+ void t_cryptonote_protocol_handler<t_core>::drop_connections(const epee::net_utils::network_address address, unsigned score, bool block_light)`
`2825`	`2825`	`{`
`2826`	`2826`	`MWARNING("dropping connections to " << address.str());`
`2827`	`2827`
`2828`		`- m_p2p->add_host_fail(address, 5);`
	`2828`	`+ m_p2p->add_host_fail(address, score, block_light);`
`2829`	`2829`
`2830`	`2830`	`std::vector<boost::uuids::uuid> drop;`
`2831`	`2831`	`m_p2p->for_each_connection([&](const connection_context& cntxt, nodetool::peerid_type peer_id, uint32_t support_flags) {`
Original file line number	Diff line number	Diff line change
`@@ -403,20 +403,21 @@ namespace nodetool`
`403`	`403`	`}`
`404`	`404`	`//-----------------------------------------------------------------------------------`
`405`	`405`	`template<class t_payload_net_handler>`
`406`		`- bool node_server<t_payload_net_handler>::add_host_fail(const epee::net_utils::network_address &address, unsigned int score)`
	`406`	`+ bool node_server<t_payload_net_handler>::add_host_fail(const epee::net_utils::network_address &address, unsigned int score, bool block_light)`
`407`	`407`	`{`
`408`	`408`	`if(!address.is_blockable())`
`409`	`409`	`return false;`
`410`	`410`
`411`	`411`	`CRITICAL_REGION_LOCAL(m_host_fails_score_lock);`
`412`		`- uint64_t fails = m_host_fails_score[address.host_str()] += score;`
	`412`	`+ auto& host_fails_score = block_light ? m_host_fails_score_light : m_host_fails_score;`
	`413`	`+ uint64_t fails = host_fails_score[address.host_str()] += score;`
`413`	`414`	`MDEBUG("Host " << address.host_str() << " fail score=" << fails);`
`414`	`415`	`if(fails > P2P_IP_FAILS_BEFORE_BLOCK)`
`415`	`416`	`{`
`416`		`- auto it = m_host_fails_score.find(address.host_str());`
`417`		`- CHECK_AND_ASSERT_MES(it != m_host_fails_score.end(), false, "internal error");`
	`417`	`+ auto it = host_fails_score.find(address.host_str());`
	`418`	`+ CHECK_AND_ASSERT_MES(it != host_fails_score.end(), false, "internal error");`
`418`	`419`	`it->second = P2P_IP_FAILS_BEFORE_BLOCK/2;`
`419`		`- block_host(address);`
	`420`	`+ block_host(address, block_light ? P2P_IP_BLOCKTIME_LIGHT : P2P_IP_BLOCKTIME);`
`420`	`421`	`}`
`421`	`422`	`return true;`
`422`	`423`	`}`
Original file line number	Diff line number	Diff line change
`@@ -64,7 +64,7 @@ namespace nodetool`
`64`	`64`	`virtual bool unblock_host(const epee::net_utils::network_address &address)=0;`
`65`	`65`	`virtual std::map<std::string, time_t> get_blocked_hosts()=0;`
`66`	`66`	`virtual std::map<epee::net_utils::ipv4_network_subnet, time_t> get_blocked_subnets()=0;`
`67`		`- virtual bool add_host_fail(const epee::net_utils::network_address &address, unsigned int score = 1)=0;`
	`67`	`+ virtual bool add_host_fail(const epee::net_utils::network_address &address, unsigned int score = 1, bool block_light = false)=0;`
`68`	`68`	`virtual void add_used_stripe_peer(const t_connection_context &context)=0;`
`69`	`69`	`virtual void remove_used_stripe_peer(const t_connection_context &context)=0;`
`70`	`70`	`virtual void clear_used_stripe_peers()=0;`
`@@ -122,7 +122,7 @@ namespace nodetool`
`122`	`122`	`{`
`123`	`123`	`return std::map<epee::net_utils::ipv4_network_subnet, time_t>();`
`124`	`124`	`}`
`125`		`- virtual bool add_host_fail(const epee::net_utils::network_address &address, unsigned int score)`
	`125`	`+ virtual bool add_host_fail(const epee::net_utils::network_address &address, unsigned int score, bool block_light)`
`126`	`126`	`{`
`127`	`127`	`return true;`
`128`	`128`	`}`
Original file line number	Diff line number	Diff line change
`@@ -608,7 +608,7 @@ TEST(cryptonote_protocol_handler, race_condition)`
`608`	`608`	`core_protocol->on_connection_close(context);`
`609`	`609`	`}`
`610`	`610`	`virtual ~net_node_t() override {}`
`611`		`- virtual bool add_host_fail(const address_t&, unsigned int = {}) override {`
	`611`	`+ virtual bool add_host_fail(const address_t&, unsigned int = {}, bool = {}) override {`
`612`	`612`	`return {};`
`613`	`613`	`}`
`614`	`614`	`virtual bool block_host(address_t address, time_t = {}, bool = {}) override {`