Add optional rate-limit on incoming pre-auth connections - #3356
Open
t-bast wants to merge 1 commit into
Open
Conversation
pm47
reviewed
Aug 21, 2026
|
|
||
| when(AUTHENTICATING) { | ||
| case Event(TransportHandler.HandshakeCompleted(remoteNodeId), d: AuthenticatingData) => | ||
| cancelTimer(AUTH_TIMER) |
Member
There was a problem hiding this comment.
What prompted the moving of this to BEFORE_INIT?
Member
Author
There was a problem hiding this comment.
Because we may otherwise stay stuck in BEFORE_INIT indefinitely! We need to timeout the connection if we don't move out of BEFORE_INIT as well, the AUTH_TIMER must cover both AUTHENTICATION and BEFORE_INIT.
Peers that open a connection but never complete the BOLT 8 handshake consume resources on our node (memory, file descriptors and CPU). We now bound how many of those we're willing to keep around, with an eviction mechanism that lets honest peers eventually get connected. Note that this only affects incoming connections: outgoing connections are not rate-limited, which means that peers with whom we have channels cannot be negatively affected by this mechanism since we'll actively reconnect to them. This isn't a foolproof DDoS protection at all however: attackers that spam connection attempts can still severely delay or prevent honest new peers from connecting. It should be coupled with a DDoS protection layer at the cloud provider layer, where it is easier to do correctly and more efficient.
t-bast
force-pushed
the
incoming-connection-rate-limit
branch
from
August 21, 2026 11:25
53125a9 to
f7c5a2a
Compare
Member
Author
|
Trivial rebase to fix the merge conflict (on release notes). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Peers that open a connection but never complete the BOLT 8 handshake consume resources on our node (memory, file descriptors and CPU).
We now bound how many of those we're willing to keep around, with an eviction mechanism that lets honest peers eventually get connected.
Note that this only affects incoming connections: outgoing connections are not rate-limited, which means that peers with whom we have channels cannot be negatively affected by this mechanism since we'll actively reconnect to them.
This isn't a foolproof DDoS protection at all however: attackers that spam connection attempts can still severely delay or prevent honest new peers from connecting. It should be coupled with a DDoS protection layer at the cloud provider layer, where it is easier to do correctly and more efficient.
This mechanism can be disabled entirely by setting
eclair.peer-connection.max-pending-incoming-connections = 0ineclair.conf. The default values are high enough to have no impact on most deployments.Disclaimer: this code was created with the help of Claude Opus 5, which was a very good rubber duck, reviewer and wrote most of the unit tests.