feat: enforce idontwant - #3595
Draft
matthewkeil wants to merge 6 commits into
Draft
Conversation
Adds an ordered ladder of gossipsub protocol IDs and a protocolSupportsFeature() predicate so version-dependent behavior can be gated on "supports feature X" instead of comparing protocol IDs for equality. Future protocol versions appended to the ladder automatically inherit all lower-version features.
sendIDontWants compared the negotiated protocol to /meshsub/1.2.0 with exact equality, so peers negotiating any future gossipsub version would silently stop receiving IDONTWANT. Gate on the IDontWant feature instead, which any version at or above v1.2 on the version ladder supports.
makePrune returned a bare prune only for peers negotiated at exactly /meshsub/1.0.0. Gate on the Backoff feature (v1.1+) instead so the check stays correct as versions are added. Peers with no live outbound stream now also get the conservative bare prune - moot in practice, as a prune cannot be delivered without a stream.
The v1.2 spec requires that peers found in the per-peer dont_send_message_ids set MUST be skipped when relaying a message (gossipsub-v1.2.md line 62). Received IDONTWANTs were tracked in the idontwants map but never consulted on the send path, so duplicates were still forwarded to peers that explicitly refused them. Skip those peers in forwardMessage and count skipped sends in a new gossipsub_idontwant_skipped_sends_total metric.
With content-derived message ids a peer may send IDONTWANT for a message id before we publish a message with that same id. Skip those peers in publish, after the zero-peers check so error semantics are unchanged, and report only peers actually sent to in the publish result.
Verifies the idontwantMaxMessages cap bounds attacker-controlled suppression (ids beyond the cap are still forwarded) and that tracked idontwants are dropped when the peer disconnects.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements the gossipsub v1.2 MUST (gossipsub-v1.2.md line 62): peers found in the per-peer dont_send_message_ids set are now skipped when relaying.
Previously received IDONTWANTs were tracked, pruned, and metered but never consulted on any send path, so duplicates were still sent to peers that refused them. Enforcement covers both forwardMessage and publish (content-derived message ids make pre-publish IDONTWANT possible), with a new gossipsub_idontwant_skipped_sends_total metric.
Also fixes a latent version gate:
sendIDontWantsmatched/meshsub/1.2.0by exact equality, which would silently stop IDONTWANT to peers on any future protocol version. Version-dependent behavior is now gated by a feature-test predicate over an ordered version ladder (the go-libp2p-pubsub pattern), so future versions inherit lower-version features automatically.