1  // Copyright (c) 2009-2010 Satoshi Nakamoto
  2  // Copyright (c) 2009-present The Bitcoin Core developers
  3  // Distributed under the MIT software license, see the accompanying
  4  // file COPYING or http://www.opensource.org/licenses/mit-license.php.
  5  #ifndef BITCOIN_BANMAN_H
  6  #define BITCOIN_BANMAN_H
  7  
  8  #include <addrdb.h>
  9  #include <common/bloom.h>
 10  #include <net_types.h>
 11  #include <sync.h>
 12  #include <util/fs.h>
 13  
 14  #include <chrono>
 15  #include <cstdint>
 16  #include <memory>
 17  
 18  // NOTE: When adjusting this, update rpcnet:setban's help ("24h")
 19  static constexpr unsigned int DEFAULT_MISBEHAVING_BANTIME = 60 * 60 * 24; // Default 24-hour ban
 20  
 21  /// How often to dump banned addresses/subnets to disk.
 22  static constexpr std::chrono::minutes DUMP_BANS_INTERVAL{15};
 23  
 24  class CClientUIInterface;
 25  class CNetAddr;
 26  class CSubNet;
 27  
 28  // Banman manages two related but distinct concepts:
 29  //
 30  // 1. Banning. This is configured manually by the user, through the setban RPC.
 31  // If an address or subnet is banned, we never accept incoming connections from
 32  // it and never create outgoing connections to it. We won't gossip its address
 33  // to other peers in addr messages. Banned addresses and subnets are stored to
 34  // disk on shutdown and reloaded on startup. Banning can be used to
 35  // prevent connections with spy nodes or other griefers.
 36  //
 37  // 2. Discouragement. If a peer misbehaves (see Misbehaving() in
 38  // net_processing.cpp), we'll mark that address as discouraged. We still allow
 39  // incoming connections from them, but they're preferred for eviction when
 40  // we receive new incoming connections. We never make outgoing connections to
 41  // them, and do not gossip their address to other peers. This is implemented as
 42  // a bloom filter. We can (probabilistically) test for membership, but can't
 43  // list all discouraged addresses or unmark them as discouraged. Discouragement
 44  // can prevent our limited connection slots being used up by incompatible
 45  // or broken peers.
 46  //
 47  // Neither banning nor discouragement are protections against denial-of-service
 48  // attacks, since if an attacker has a way to waste our resources and we
 49  // disconnect from them and ban that address, it's trivial for them to
 50  // reconnect from another IP address.
 51  //
 52  // Attempting to automatically disconnect or ban any class of peer carries the
 53  // risk of splitting the network. For example, if we banned/disconnected for a
 54  // transaction that fails a policy check and a future version changes the
 55  // policy check so the transaction is accepted, then that transaction could
 56  // cause the network to split between old nodes and new nodes.
 57  //
 58  // NOTE: previously a misbehaving peer would get banned instead of discouraged.
 59  // This meant a peer could unboundedly grow our in-memory map of banned ips. When
 60  // receiving an ADDR message we would also compare every address received to every
 61  // item in the map. See https://bitcoincore.org/en/2024/07/03/disclose-unbounded-banlist.
 62  
 63  class BanMan
 64  {
 65  public:
 66      ~BanMan();
 67      BanMan(fs::path ban_file, CClientUIInterface* client_interface, int64_t default_ban_time);
 68      void Ban(const CNetAddr& net_addr, int64_t ban_time_offset = 0, bool since_unix_epoch = false) EXCLUSIVE_LOCKS_REQUIRED(!m_banned_mutex);
 69      void Ban(const CSubNet& sub_net, int64_t ban_time_offset = 0, bool since_unix_epoch = false) EXCLUSIVE_LOCKS_REQUIRED(!m_banned_mutex);
 70      void Discourage(const CNetAddr& net_addr) EXCLUSIVE_LOCKS_REQUIRED(!m_banned_mutex);
 71      void ClearBanned() EXCLUSIVE_LOCKS_REQUIRED(!m_banned_mutex);
 72  
 73      //! Return whether net_addr is banned
 74      bool IsBanned(const CNetAddr& net_addr) EXCLUSIVE_LOCKS_REQUIRED(!m_banned_mutex);
 75  
 76      //! Return whether sub_net is exactly banned
 77      bool IsBanned(const CSubNet& sub_net) EXCLUSIVE_LOCKS_REQUIRED(!m_banned_mutex);
 78  
 79      //! Return whether net_addr is discouraged.
 80      bool IsDiscouraged(const CNetAddr& net_addr) EXCLUSIVE_LOCKS_REQUIRED(!m_banned_mutex);
 81  
 82      bool Unban(const CNetAddr& net_addr) EXCLUSIVE_LOCKS_REQUIRED(!m_banned_mutex);
 83      bool Unban(const CSubNet& sub_net) EXCLUSIVE_LOCKS_REQUIRED(!m_banned_mutex);
 84      void GetBanned(banmap_t& banmap) EXCLUSIVE_LOCKS_REQUIRED(!m_banned_mutex);
 85      void DumpBanlist() EXCLUSIVE_LOCKS_REQUIRED(!m_banned_mutex);
 86  
 87  private:
 88      void LoadBanlist() EXCLUSIVE_LOCKS_REQUIRED(!m_banned_mutex);
 89      //!clean unused entries (if bantime has expired)
 90      void SweepBanned() EXCLUSIVE_LOCKS_REQUIRED(m_banned_mutex);
 91  
 92      Mutex m_banned_mutex;
 93      banmap_t m_banned GUARDED_BY(m_banned_mutex);
 94      bool m_is_dirty GUARDED_BY(m_banned_mutex){false};
 95      CClientUIInterface* m_client_interface = nullptr;
 96      CBanDB m_ban_db;
 97      const int64_t m_default_ban_time;
 98      CRollingBloomFilter m_discouraged GUARDED_BY(m_banned_mutex) {50000, 0.000001};
 99  };
100  
101  #endif // BITCOIN_BANMAN_H