Skip to content

Commit c588f5f

Browse files
committed
network: drop duplicated peer connections by server nonce
On dockerized private network with non-default ext/int ports mapping there's no way to distinguish connections by underlying connecion address prior to handshake. Even after handshake, if the peer doesn't declare announced address/port the same way as it is declared in the node's local peer record, there's still no other way than server nonce to distinguish duplicating connections. For example, on privnet with configuration from #3915, node will maintain two connection to every seed: ``` // Start the node, wait for some connections to be established. ... // Try to connect to seed nodes, in particular, with the seed 172.17.0.1:20334: 2025-05-22T10:44:55.779Z INFO choosing peer from seeds {"addr": "172.17.0.1:20334", "requested": 1} ... 2025-05-22T10:44:55.779Z INFO dealing address {"addr": "172.17.0.1:20334"} ... // New peer is connected (incoming connection), it's the seed node // 172.17.0.1:20334 in fact, start protocol with this node: 2025-05-22T10:44:55.908Z INFO new peer connected {"peer addr": "172.200.0.254:42654", "fake conn addr": "172.200.0.254:42654", "conn addr": "172.200.0.254:42654", "peerCount": 1} 2025-05-22T10:44:55.909Z INFO started protocol {"addr": "172.200.0.254:42654", "userAgent": "/NEO-GO:0.109.2-pre-16-g953c3580/", "startHeight": 0, "id": 2422991527} ... // Outgoing seed connection succeeds, there's no way to distinguish this // connection from incoming one based on any available address: 2025-05-22T10:44:55.994Z INFO updating seed address {"seed": "172.17.0.1:20334", "old": "", "new": "172.17.0.1:20334"} 2025-05-22T10:44:55.994Z INFO register connected {"addr": "172.17.0.1:20334"} 2025-05-22T10:44:55.994Z INFO new peer connected {"peer addr": "172.17.0.1:20334", "fake conn addr": "172.17.0.1:20334", "conn addr": "172.17.0.1:20334", "peerCount": 2} ... // Start protocol with the same seed based on outgoing connection: 2025-05-22T10:44:55.996Z INFO started protocol {"addr": "172.17.0.1:20334", "userAgent": "/NEO-GO:0.109.2-pre-16-g953c3580/", "startHeight": 0, "id": 2422991527} ``` That's it, addresses can't tell us anything in this case. So we either live with duplicating connections or filter out connections by server ID. The latter is not the best option sice an invironment is untrusted and peer may intentionally fake its ID, but we don't have more reliable information. Close #3915. Signed-off-by: Anna Shaleva <[email protected]>
1 parent b66e25b commit c588f5f

File tree

1 file changed

+1
-2
lines changed

1 file changed

+1
-2
lines changed

pkg/network/server.go

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -851,15 +851,14 @@ func (s *Server) handleVersionCmd(p Peer, version *payload.Version) error {
851851
if s.Net != version.Magic {
852852
return errInvalidNetwork
853853
}
854-
peerAddr := p.PeerAddr().String()
855854
s.lock.RLock()
856855
for peer := range s.peers {
857856
if p == peer {
858857
continue
859858
}
860859
ver := peer.Version()
861860
// Already connected, drop this connection.
862-
if ver != nil && ver.Nonce == version.Nonce && peer.PeerAddr().String() == peerAddr {
861+
if ver != nil && ver.Nonce == version.Nonce {
863862
s.lock.RUnlock()
864863
return errAlreadyConnected
865864
}

0 commit comments

Comments
 (0)