diff --git a/prdoc/pr_7158.prdoc b/prdoc/pr_7158.prdoc new file mode 100644 index 000000000000..e113a7fdcd1c --- /dev/null +++ b/prdoc/pr_7158.prdoc @@ -0,0 +1,12 @@ +title: Reject litep2p inbound requests from banned peers + +doc: + - audience: Node Dev + description: | + This PR rejects inbound requests from banned peers (reputation is below the banned threshold). + This mirrors the request-response implementation from the libp2p side. + While at it, have registered a new inbound failure metric to have visibility into this. + +crates: +- name: sc-network + bump: patch diff --git a/substrate/client/network/src/litep2p/shim/request_response/mod.rs b/substrate/client/network/src/litep2p/shim/request_response/mod.rs index 00ec425c9b76..e7598debde15 100644 --- a/substrate/client/network/src/litep2p/shim/request_response/mod.rs +++ b/substrate/client/network/src/litep2p/shim/request_response/mod.rs @@ -271,6 +271,13 @@ impl RequestResponseProtocol { request_id: RequestId, request: Vec, ) { + log::trace!( + target: LOG_TARGET, + "{}: request received from {peer:?} ({fallback:?} {request_id:?}), request size {:?}", + self.protocol, + request.len(), + ); + let Some(inbound_queue) = &self.inbound_queue else { log::trace!( target: LOG_TARGET, @@ -282,12 +289,18 @@ impl RequestResponseProtocol { return; }; - log::trace!( - target: LOG_TARGET, - "{}: request received from {peer:?} ({fallback:?} {request_id:?}), request size {:?}", - self.protocol, - request.len(), - ); + if self.peerstore_handle.is_banned(&peer.into()) { + log::trace!( + target: LOG_TARGET, + "{}: rejecting inbound request from banned {peer:?} ({request_id:?})", + self.protocol, + ); + + self.handle.reject_request(request_id); + self.metrics.register_inbound_request_failure("banned-peer"); + return; + } + let (tx, rx) = oneshot::channel(); match inbound_queue.try_send(IncomingRequest {