P2P: fix address book panic when banning a peer - #668
Open
thomasbuilds wants to merge 1 commit into
Open
Conversation
`handle_new_connection` inserted into `connected_peers_ban_id` before `update_white_list_peer_entry`, which fails when a peer already in the white list connects advertising a different pruning seed. The index then kept an entry for a connection never added to `connected_peers`, and eviction only walks `connected_peers`, so it stayed. `ban_peer` looked those entries back up in `connected_peers` and `expect`ed them to be there, so banning any peer sharing that ban ID ended the process, as the workspace sets `panic = "abort"`. Remove `connected_peers_ban_id` rather than reorder the insert: it only answered which connected peers share a ban ID, which is a filter over `connected_peers` that cannot disagree with it. This also drops the two lookups in the disconnect handling that assumed they agreed. Anchor removal was wrong in three ways. `ban_peer` bound the iterated address inside a closure, so the removal in the loop body used the banned address instead of each closed peer's. Both it and the disconnect path keyed off the connection address, while the anchor list is keyed by the address the peer is reachable on, which differs for inbound peers. And the disconnect path dropped the entry even when another connection to that address was still open. Both now key off the reachable address, and the disconnect path waits for the last connection to close.
thomasbuilds
force-pushed
the
fix-address-book-ban-id
branch
from
August 8, 2026 16:00
64ae5fc to
8c7a456
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
handle_new_connectioninserted intoconnected_peers_ban_idbeforeupdate_white_list_peer_entry, which fails when a peer already in the white list connects advertising a different pruning seed. The index then kept an entry for a connection never added toconnected_peers, and eviction only walksconnected_peers, so it stayed.ban_peerlooked those entries back up inconnected_peersandexpected them to be there, so banning any peer sharing that ban ID ended the process, as the workspace setspanic = "abort".Remove
connected_peers_ban_idrather than reorder the insert: it only answered which connected peers share a ban ID, which is a filter overconnected_peersthat cannot disagree with it. This also drops the two lookups in the disconnect handling that assumed they agreed.Anchor removal was wrong in three ways.
ban_peerbound the iterated address inside a closure, so the removal in the loop body used the banned address instead of each closed peer's. Both it and the disconnect path keyed off the connection address, while the anchor list is keyed by the address the peer is reachable on, which differs for inbound peers. And the disconnect path dropped the entry even when another connection to that address was still open. Both now key off the reachable address, and the disconnect path waits for the last connection to close.