Zebra should limit the number of addresses it sends to peers, to avoid address book discovery

[teor2345]

Motivation

Currently, Zebra sends up to 1000 addresses to any peer that asks for addresses. But there are only a few hundred active peers on mainnet.

This large list of peer addresses, combined with Zebra's connectivity to many nodes, makes it easier for malicious nodes to use a Zebra instance to pollute the peer addresses of other nodes.

Solution

Limit the number of peer addresses that Zebra sends to:

• maximum 1000: protocol constant
• maximum 1/3 of the available addresses - this is a security parameter
• minimum 1: handle an edge case where the number of eligible addresses is 1 or 2

The relevant code is at:

zebra/zebrad/src/components/inbound.rs

Line 237 in cc7d5bd

peers.truncate(MAX_ADDR);

This change has the following benefits:

• it's harder to use Zebra to attack other peers
• Zebra doesn't ever reveal its entire peer set to honest peers (but repeated malicious requests could discover it easily)
• other peers get a variety of addresses from Zebra, improving network diversity and reducing the risk of flooding

Related Issues

#1867 Zebra should stop gossiping unreachable addresses to other nodes

Context

zcashd and Zebra both resist address book pollution, so this issue is not critical.

[teor2345]

zcashd and Zebra both resist address book pollution, so this issue is not critical.